mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 02:26:12 +02:00
Devin Foley
c734e0ebb5
A codex_local agent is pinned by the server isolation guard to a per-agent managed CODEX_HOME with OPENAI_API_KEY="" and no provisioned credentials. The adapter previously skipped auth seeding whenever env.CODEX_HOME was set, so managed homes launched with zero credentials and the provider returned "401 Missing bearer". - Detect when a configured CODEX_HOME is a Paperclip-managed path (under the instance company tree) vs a genuine external override. - Seed ChatGPT-subscription (or per-agent API-key) auth.json into managed homes even when env.CODEX_HOME is set; leave real external overrides untouched. - Fail fast with a clear adapter error when a managed home ends up with no usable auth.json and no API key, instead of emitting unauthenticated calls. - Document the seeding contract in the codex-local adapter docs. Adds unit tests for managed-vs-external detection, auth seeding, the auth-check helper, and the no-credentials fail-fast error path.
