mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-04 19:28:46 +01:00
DottaandPaperclip
fbb7055b90
## Thinking Path > - Paperclip manages agents and their work. > - Runner owns each provider process and its activity channel. > - Codex Plan mode uses a restricted filesystem policy. > - Runner adds its activity FIFO as a writable filesystem root. > - Codex adds protected metadata paths beneath each writable root. > - A FIFO cannot contain those paths, so the Linux helper fails before useful work starts. > - This pull request grants access through the private activity directory and keeps discovery files read-only. ## Linked Issues or Issue Description Refs #18050. The activity channel came from that change. No existing FIFO-mount repair was found. #18853 repairs interrupted preparation recovery; it does not change this provider filesystem policy. **What happened?** A native Codex Plan session can fail while loading AGENTS.md instructions. The filesystem helper tries to inspect `activity.fifo/.aws` and fails with `Not a directory`. This happens before the provider can produce the requested plan. **Expected behavior** The sandbox must load permitted instructions and allow activity-channel writes. Plan mode must still reject workspace writes and private state access. **Steps to reproduce** Use the ignored `read_only_codex_opens_with_runtime_activity` regression in the Runner Rust suite with the source-pinned Linux Codex executable and its matching bubblewrap resource. The fixture calls the actual activity channel producer and policy projection. On the original producer it exits 101 with the FIFO metadata-mount panic. With this change it exits 0. **Paperclip version or commit** Original producer reproduced at208bda1a0e. The local native artifact is official Codex 0.160.0 for Linux arm64, which matches the source pin. The failing hosted executable version was not independently available from its normal run records. **Deployment mode** Native Runner with Linux Codex. Verification used an isolated local Linux container with no network, credentials, or model call. ## What Changed - Grant writes to the Runner-created private activity-channel directory instead of using its FIFO as a filesystem root. - Keep the lock, descriptor, and helper read-only. Keep the existing network, workspace, environment, and active-run authority policies. - Add actual channel isolation coverage and a pinned executable regression. The latter also checks FIFO bytes, instruction reads, workspace write denial, private-state and synthetic credential-home denial, descriptor and lock write denial, lock removal denial, and ambient-variable filtering. - Document the native sandbox check and the separate fixture-export path. Export alone does not verify the sandbox. ## Verification - Actual producer plus official Linux Codex 0.160.0 and matching bubblewrap: original producer exits 101 with the FIFO `.aws` panic; changed producer exits 0 with all permission checks and exact FIFO output verified. - `cargo test --manifest-path packages/paperclip-runner/runner/Cargo.toml runtime_notification --lib --offline`: 8 passed, 2 manual sandbox fixtures ignored. - `cargo test --manifest-path packages/paperclip-runner/runner/Cargo.toml codex_provider::tests --lib --offline`: 30 passed. - `cargo build --manifest-path packages/paperclip-runner/runner/Cargo.toml --bin paperclip-runnerd --offline`: passed. - Cargo format and diff checks passed. - A broader optional local Rust library sweep did not pass in the restricted macOS host. Three filesystem-monitor tests failed and another did not finish; the owned sweep was bounded and stopped. A socket-identity fixture also failed with EPERM. A representative monitor failure and the socket failure were repeated with the unchanged original producer. Their failures are retained and are not claimed fixed by this PR. - The existing ignored `publisher_crosses_real_codex_tool_boundary_without_runner_state_access` fixture was not executed successfully on the final head. Its stale channel-directory denial was corrected after Greptile review. The separate actual-producer Linux sandbox fixture verifies exact FIFO bytes and permission denials; it does not call `record-activity`. - Full local pnpm typecheck/test/build was not run for this Rust-only change. Required technical CI passes onfd4da0bf5e. Greptile is 5/5. The automatic Paperclip Review remains queued; merge is held for that review. No hosted task recovery or provider turn is claimed. ## Risks The writable grant now covers the process-private channel directory. The descriptor remains outside that grant. The lock has an explicit read-only mount inside it. Native sandbox checks verify the lock cannot be written or removed. Existing tests retain authority rotation, stale-context rejection, malformed input bounds, and fixed-path cleanup after endpoint replacement. The retained startup error also mentions a loopback permission error. This change fixes the independently reproduced FIFO-root defect. It does not prove that every hosted namespace capability is healthy. Preconfigured-home and custom policies retain their existing explicit deny rules. ## Model Used OpenAI GPT-6.1 Sol (`gpt-6.1-sol`) in Codex, with source editing, terminal execution, and tool use. The host did not report its context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>