67ca8287e8
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - The `codex_local` adapter isolates local Codex runs by assigning managed `CODEX_HOME` state per company and per agent > - PR #8272 tightened that isolation, but it left a gap: once `CODEX_HOME` became explicit, the adapter treated it like a user-managed override and skipped auth seeding > - That meant newly isolated agents could launch with no usable `auth.json`, hit OpenAI unauthenticated, and fail with `401 Missing bearer` > - Users who had already persisted one of those broken managed homes could remain stranded even after config changes unless Paperclip repaired the home itself > - This pull request teaches Paperclip to seed managed homes correctly, backfill already-stranded managed homes on startup, and reject credential-less managed homes before they reach the provider > - The benefit is that affected managed `codex_local` agents recover automatically after upgrade and restart, without manual `CODEX_HOME` surgery ## Linked Issues or Issue Description - Fixes #497 - Refs #5028 - Related PR: #8272 - Related PR: #8399 ## What Changed - Distinguished Paperclip-managed `CODEX_HOME` paths from genuine external overrides and always seeded auth into managed homes, even when `CODEX_HOME` is explicit in config. - Wrote API-key-backed `auth.json` files for managed homes when `OPENAI_API_KEY` is configured, otherwise symlinked the shared Codex auth for subscription/OAuth flows. - Added a startup reconciliation pass that backfills already-isolated managed homes created by the broken release so upgrade plus restart repairs stranded agents automatically. - Preserved previously resolved API-key auth when the stored `OPENAI_API_KEY` binding is secret-backed and startup cannot resolve the secret value directly. - Hardened the managed-home preflight to require a credential-bearing `auth.json`, not just file presence, and documented the recovery behavior. - Added regression tests covering managed-home seeding, fail-fast behavior, and server-side startup reconciliation. ## Verification ```bash pnpm exec vitest run packages/adapters/codex-local/src/server/codex-home.test.ts packages/adapters/codex-local/src/server/execute.auth.test.ts server/src/__tests__/codex-auth-reconciliation.test.ts server/src/__tests__/codex-local-execute.test.ts server/src/__tests__/server-startup-feedback-export.test.ts pnpm --filter @paperclipai/adapter-codex-local typecheck pnpm --filter @paperclipai/server typecheck pnpm check:tokens pnpm exec vitest run server/src/__tests__/server-startup-feedback-export.test.ts ``` GitHub Actions `PR` workflow is green on latest head `e5b1e08d4`, including policy, typecheck, test shards, build, e2e, serialized server suites, and canary dry run. Greptile Review is green on latest head with 0 comments added. No UI changes. ## Risks - Startup reconciliation now mutates persisted managed Codex homes at boot. Risk is low because it only touches Paperclip-managed company/agent home paths and no-ops when a home already has usable auth. - Genuine external `CODEX_HOME` overrides remain intentionally self-managed, so those users still own repair steps inside their custom home. - Hosts with neither shared Codex auth nor an explicit per-agent API key now fail earlier with a clearer adapter error instead of surfacing a downstream `401`, which changes timing but not capability. ## Model Used - OpenAI Codex, GPT-5-based coding agent in a local Codex session; exact served model ID/context window were not exposed to the session. Tool use and code execution were enabled. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
89 lines
4.3 KiB
TypeScript
89 lines
4.3 KiB
TypeScript
export { companyService } from "./companies.js";
|
|
export { companyArtifactsService } from "./company-artifacts.js";
|
|
export { companySearchService } from "./company-search.js";
|
|
export { feedbackService } from "./feedback.js";
|
|
export { companySkillService } from "./company-skills.js";
|
|
export { agentService, deduplicateAgentName } from "./agents.js";
|
|
export { agentInstructionsService, syncInstructionsBundleConfigFromFilePath } from "./agent-instructions.js";
|
|
export { assetService } from "./assets.js";
|
|
export { documentService, extractLegacyPlanBody } from "./documents.js";
|
|
export { documentAnnotationService } from "./document-annotations.js";
|
|
export {
|
|
ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY,
|
|
buildContinuationSummaryMarkdown,
|
|
getIssueContinuationSummaryDocument,
|
|
refreshIssueContinuationSummary,
|
|
} from "./issue-continuation-summary.js";
|
|
export { projectService } from "./projects.js";
|
|
export {
|
|
clampIssueListLimit,
|
|
ISSUE_LIST_DEFAULT_LIMIT,
|
|
ISSUE_LIST_MAX_LIMIT,
|
|
issueService,
|
|
type IssueFilters,
|
|
} from "./issues.js";
|
|
export { issueThreadInteractionService } from "./issue-thread-interactions.js";
|
|
export { issueTreeControlService } from "./issue-tree-control.js";
|
|
export { issueApprovalService } from "./issue-approvals.js";
|
|
export { issueReferenceService } from "./issue-references.js";
|
|
export { issueRecoveryActionService } from "./issue-recovery-actions.js";
|
|
export { taskWatchdogService } from "./task-watchdogs.js";
|
|
export {
|
|
issueIsInTaskWatchdogSubtree,
|
|
resolveTaskWatchdogMutationScope,
|
|
taskWatchdogScopeAllowsIssueMutation,
|
|
} from "./task-watchdog-scope.js";
|
|
export { goalService } from "./goals.js";
|
|
export { activityService, type ActivityFilters } from "./activity.js";
|
|
export { approvalService } from "./approvals.js";
|
|
export { budgetService } from "./budgets.js";
|
|
export { secretService } from "./secrets.js";
|
|
export { routineService } from "./routines.js";
|
|
export { costService } from "./costs.js";
|
|
export { financeService } from "./finance.js";
|
|
export { heartbeatService } from "./heartbeat.js";
|
|
export {
|
|
productivityReviewService,
|
|
PRODUCTIVITY_REVIEW_ORIGIN_KIND,
|
|
} from "./productivity-review.js";
|
|
export { classifyIssueGraphLiveness, type IssueLivenessFinding } from "./recovery/index.js";
|
|
export { dashboardService } from "./dashboard.js";
|
|
export { sidebarBadgeService } from "./sidebar-badges.js";
|
|
export { sidebarPreferenceService } from "./sidebar-preferences.js";
|
|
export { resourceMembershipService, type ResourceMembershipPolicyHook } from "./resource-memberships.js";
|
|
export { inboxDismissalService } from "./inbox-dismissals.js";
|
|
export { accessService } from "./access.js";
|
|
export {
|
|
backfillPrincipalAccessCompatibility,
|
|
ensureHumanRoleDefaultGrants,
|
|
insertMissingPrincipalGrants,
|
|
type PrincipalAccessCompatibilityBackfillStats,
|
|
} from "./principal-access-compatibility.js";
|
|
export { authorizationService } from "./authorization.js";
|
|
export type {
|
|
AuthorizationAction,
|
|
AuthorizationActor,
|
|
AuthorizationDecision,
|
|
AuthorizationResource,
|
|
} from "./authorization.js";
|
|
export { boardAuthService } from "./board-auth.js";
|
|
export { instanceSettingsService } from "./instance-settings.js";
|
|
export { bootstrapExecutionPolicyFromEnv } from "./execution-policy-bootstrap.js";
|
|
export { cloudUpstreamService, reconcileCloudUpstreamRunsOnStartup } from "./cloud-upstreams.js";
|
|
export { companyPortabilityService } from "./company-portability.js";
|
|
export { teamsCatalogService } from "./teams-catalog.js";
|
|
export { environmentService } from "./environments.js";
|
|
export { executionWorkspaceService } from "./execution-workspaces.js";
|
|
export { workspaceOperationService } from "./workspace-operations.js";
|
|
export { workspaceFileResourceService } from "./workspace-file-resources.js";
|
|
export { workProductService } from "./work-products.js";
|
|
export { logActivity, type LogActivityInput } from "./activity-log.js";
|
|
export { notifyHireApproved, type NotifyHireApprovedInput } from "./hire-hook.js";
|
|
export { publishLiveEvent, subscribeCompanyLiveEvents } from "./live-events.js";
|
|
export {
|
|
reconcileCodexLocalManagedHomesOnStartup,
|
|
type CodexAuthReconciliationSummary,
|
|
} from "./codex-auth-reconciliation.js";
|
|
export { reconcilePersistedRuntimeServicesOnStartup, restartDesiredRuntimeServicesOnStartup } from "./workspace-runtime.js";
|
|
export { createStorageServiceFromConfig, getStorageService } from "../storage/index.js";
|