## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Codex executes commands inside the runner workspace
> - The provider process must not inherit host credentials or broad file
access
> - Planning mode also needs a read-only workspace boundary
> - This pull request defines the isolated launch and thread
configuration
> - A later pull request will use it from the Codex driver
> - The benefit is an independently reviewed security boundary
## Linked Issues or Issue Description
**Subsystem affected**
`packages/paperclip-runner` Codex launch security.
**Problem or motivation**
A provider process can inherit host paths, environment secrets, network
access, or write permissions unless the runner constructs a closed
configuration.
**Proposed solution**
Build explicit app-server arguments and thread parameters. Deny host
roots and network access, allow only a small environment list, and use a
read-only profile for plan mode.
**Alternatives considered**
Relying on ambient Codex defaults would make runner safety depend on
each host installation.
**Roadmap alignment**
This supports the Codex-first experimental runner. It does not enable
the runner adapter.
## What Changed
- Added deny-by-default filesystem rules.
- Added separate execution and planning permission profiles.
- Added network denial.
- Added an explicit environment allowlist.
- Disabled host apps, plugins, memories, multi-agent behavior, and image
generation.
- Added security configuration tests.
## Verification
- `pnpm --filter @paperclipai/paperclip-runner test:typescript`
- `pnpm -r typecheck`
- `pnpm build`
- The focused security configuration test has 3 passing cases.
## Risks
The risk is an overly broad provider launch. Tests verify denied host
roots, read-only context roots, workspace permissions, network denial,
and secret exclusion.
## Model Used
OpenAI Codex with GPT-5.6 and repository tool use.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
9d7d9ea724