mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-28 20:21:50 +01:00
nickyleachandPaperclip
a2d014d2ef
The generated Paperclip API access note taught agents to put the run bearer on a curl command line, which any process running as the same user can read. Every run now gets a paperclip-api helper staged onto PATH; the helper reads the token from its own environment and sets the Authorization header itself, so the token never becomes a command-line argument. The helper rejects an absolute URL, a scheme-relative path, and a path containing a backslash, and it verifies the built request resolves to the configured API origin before sending it. Staging now runs for every run, not only a managed-GitHub run, so a host-GitHub run still gets the helper. The note renders only when the helper was actually staged, checked through the one env field the staging step itself sets, so the note and the staging step cannot drift apart. Co-authored-by: Paperclip <noreply@paperclip.ing>