mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 09:41:04 +01:00
Harold KimandPaperclip
d8bc224137
When executionTargetIsRemote, Codex runs with CODEX_HOME set to the remote sandbox home. Any token rotation that occurs inside the sandbox updates only the remote copy, so the prior post-run snapshot read from the local effectiveCodexHome would always report rotationsDetected:false. - Add readPostRunCodexCredentialTelemetrySnapshot: for remote targets, shell-cats the remote auth.json via runAdapterExecutionTargetShellCommand so the post-run fingerprint reflects the actual remote token state - Add parseCodexCredentialTelemetrySnapshot as an exported function so the remote reader can parse the raw JSON without touching the local fs - Add shellQuote and missingCodexCredentialTelemetrySnapshot helpers - Tighten CODEX_REFRESH_TOKEN_INVALIDATED_RE (remove broad 401/unauthorized to avoid false positives) and add CODEX_OAUTH_INVALID_GRANT_RE plus CODEX_CONTEXTUAL_REFRESH_AUTH_INVALIDATED_RE for more precise matching - Add execute.remote.test coverage: reads post-run telemetry from remote CODEX_HOME and verifies rotationsDetected:true + no token material leaked Co-Authored-By: Paperclip <noreply@paperclip.ing>