mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-24 10:13:11 +02:00
Dotta
9d7d9ea724
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Codex executes commands inside the runner workspace > - The provider process must not inherit host credentials or broad file access > - Planning mode also needs a read-only workspace boundary > - This pull request defines the isolated launch and thread configuration > - A later pull request will use it from the Codex driver > - The benefit is an independently reviewed security boundary ## Linked Issues or Issue Description **Subsystem affected** `packages/paperclip-runner` Codex launch security. **Problem or motivation** A provider process can inherit host paths, environment secrets, network access, or write permissions unless the runner constructs a closed configuration. **Proposed solution** Build explicit app-server arguments and thread parameters. Deny host roots and network access, allow only a small environment list, and use a read-only profile for plan mode. **Alternatives considered** Relying on ambient Codex defaults would make runner safety depend on each host installation. **Roadmap alignment** This supports the Codex-first experimental runner. It does not enable the runner adapter. ## What Changed - Added deny-by-default filesystem rules. - Added separate execution and planning permission profiles. - Added network denial. - Added an explicit environment allowlist. - Disabled host apps, plugins, memories, multi-agent behavior, and image generation. - Added security configuration tests. ## Verification - `pnpm --filter @paperclipai/paperclip-runner test:typescript` - `pnpm -r typecheck` - `pnpm build` - The focused security configuration test has 3 passing cases. ## Risks The risk is an overly broad provider launch. Tests verify denied host roots, read-only context roots, workspace permissions, network denial, and secret exclusion. ## Model Used OpenAI Codex with GPT-5.6 and repository tool use. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge