RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
paperclip/packages/adapter-utils
History
Michel Tomas 176f888ac9
fix(adapter-utils): accept the bridge token in X-API-Key 
The in-sandbox callback gateway read the bridge token only from
"Authorization: Bearer <token>". The public Paperclip API documents the
"X-API-Key: <token>" header, so an agent that follows those docs sends
that header first and gets a 401 with "Invalid bridge token." The agent
then retries with a bearer header and the same token.

Both gateways now read the token through one helper. The helper prefers a
bearer token in the Authorization header. It falls back to the X-API-Key
header. The token still goes to the same constant-time comparison, and the
closed header allowlist still strips both headers before either gateway
forwards a request.

Claude-Session: https://claude.ai/code/session_01U9PF3d9SASC9tomDRjyeVt
 		2026-09-03 20:11:27 +02:00
..
src fix(adapter-utils): accept the bridge token in X-API-Key 2026-09-03 20:11:27 +02:00
CHANGELOG.md fix: bound workspace Git scans (#11572) 2026-08-17 22:11:30 -05:00
README.md PAPA-430: workspace finalize gates + no-remote-git enforcement (#6969) 2026-05-29 08:25:29 -07:00
package.json feat(connections): add self-serve intent runtime (#12345) 2026-08-29 12:08:34 -05:00
tsconfig.json Fix root TypeScript solution config 2026-03-09 14:09:30 -05:00

README.md

@paperclipai/adapter-utils

Shared utilities for Paperclip adapters: process spawning, environment injection, sandbox/SSH transport, workspace sync, and the round-trip helpers that move code between the local execution-workspace cwd and wherever the agent actually runs.

For the adapter-author guide see docs/adapters/creating-an-adapter.md and the in-repo notes at packages/adapters/AUTHORING.md.

No-remote-git contract

The local execution-workspace cwd is the only persistence boundary across runs. No adapter may depend on a git remote for cross-run state.

Adapters that run the agent on a different host should use the SSH round-trip helpers in src/ssh.ts:

  • prepareWorkspaceForSshExecution({ spec, localDir, remoteDir }) — bundles the local cwd (tracked files, dirty edits, untracked additions, and the git history needed to reconstruct it) to remoteDir before the run starts. Runs with no git remote configured.
  • restoreWorkspaceFromSshExecution({ spec, localDir, remoteDir, ... }) — syncs the remote cwd back into localDir after the run, including any new commits the agent created. Also runs with no git remote configured.

prepareRemoteManagedRuntime in src/remote-managed-runtime.ts wraps both calls for adapters that want a per-run remote workspace and an automatic restoreWorkspace() finally hook.

The invariant is pinned by the no-remote-git contract case in src/ssh-fixture.test.ts, which asserts that a remote-only commit propagates to the local worktree through the prepare → restore round-trip with no git remote configured at any point. Do not regress that test.