@tickernelz/paperclip-pro-adapter-utils 2026.929.2 → 2026.929.4

package/dist/acpx-engine/execute.test.js

@@ -1365,6 +1365,49 @@ describe("shared ACPX engine runtime behavior", () => {
         expect(authStat.isSymbolicLink()).toBe(true);
         expect(path.resolve(path.dirname(managedAuth), await fs.readlink(managedAuth))).toBe(sourceAuth);
     });
+    it.each(["OPENAI_API_KEY", "CODEX_API_KEY"])("uses isolated API-key auth instead of the host ChatGPT login for %s", async (keyName) => {
+        const root = await makeTempRoot();
+        const sourceCodexHome = path.join(root, "source-codex-home");
+        const paperclipHome = path.join(root, "paperclip-home");
+        await fs.mkdir(sourceCodexHome, { recursive: true });
+        const sourceAuth = path.join(sourceCodexHome, "auth.json");
+        await fs.writeFile(sourceAuth, JSON.stringify({ tokens: "host-login" }), "utf8");
+        const managedHome = path.join(paperclipHome, "instances", "test-instance", "companies", "company-1", "acp-engine", "agents", "agent-1", "codex-home");
+        await fs.mkdir(managedHome, { recursive: true });
+        const managedAuth = path.join(managedHome, "auth.json");
+        if (process.platform === "win32") {
+            await fs.writeFile(managedAuth, JSON.stringify({ tokens: "stale-login" }), "utf8");
+        }
+        else {
+            await fs.symlink(sourceAuth, managedAuth);
+        }
+        vi.stubEnv("CODEX_HOME", sourceCodexHome);
+        vi.stubEnv("PAPERCLIP_HOME", paperclipHome);
+        vi.stubEnv("PAPERCLIP_INSTANCE_ID", "test-instance");
+        vi.stubEnv("OPENAI_API_KEY", "");
+        vi.stubEnv("CODEX_API_KEY", "");
+        try {
+            const { sessionInputs } = await runExecutor({
+                agent: "codex",
+                stateDir: path.join(root, "state"),
+                env: { [keyName]: "sk-acp-test-key" },
+                paperclipRuntimeSkills: [],
+                paperclipSkillSync: { desiredSkills: [] },
+            });
+            const sessionEnv = sessionInputs[0].sessionOptions.env;
+            expect(sessionEnv.CODEX_HOME).toBe(managedHome);
+            expect(sessionEnv.DEFAULT_AUTH_REQUEST).toBe(JSON.stringify({ methodId: "api-key" }));
+            expect((await fs.lstat(managedAuth)).isSymbolicLink()).toBe(false);
+            expect(JSON.parse(await fs.readFile(managedAuth, "utf8"))).toEqual({ OPENAI_API_KEY: "sk-acp-test-key" });
+            expect(await fs.readFile(sourceAuth, "utf8")).toBe(JSON.stringify({ tokens: "host-login" }));
+            if (process.platform !== "win32") {
+                expect((await fs.stat(managedAuth)).mode & 0o777).toBe(0o600);
+            }
+        }
+        finally {
+            vi.unstubAllEnvs();
+        }
+    });
     it("sets GROK_HOME for a Grok run from the company Grok home, and leaves CODEX_HOME unchanged for a Codex run", async () => {
         const root = await makeTempRoot();
         const paperclipHome = path.join(root, "paperclip-home");
@@ -2636,6 +2679,35 @@ describe("ACPX engine remote sandbox staging seam (PR 1: workspace + cwd)", () =
         // And session/new is created on the in-sandbox workspace cwd.
         expect(sessionInputs[0]?.cwd).toBe(remoteCwd);
     });
+    it.skipIf(process.platform === "win32")("never seeds a remote Codex run from a host API key", async () => {
+        const { root, stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+        const sourceCodexHome = path.join(root, "source-codex-home");
+        const paperclipHome = path.join(root, "paperclip-home");
+        await fs.mkdir(sourceCodexHome, { recursive: true });
+        const sourceAuth = path.join(sourceCodexHome, "auth.json");
+        await fs.writeFile(sourceAuth, JSON.stringify({ tokens: "host-login" }), "utf8");
+        vi.stubEnv("CODEX_HOME", sourceCodexHome);
+        vi.stubEnv("PAPERCLIP_HOME", paperclipHome);
+        vi.stubEnv("PAPERCLIP_INSTANCE_ID", "test-instance");
+        vi.stubEnv("OPENAI_API_KEY", "sk-host-only-key");
+        try {
+            await runExecutor({
+                agent: "codex",
+                stateDir,
+                cwd: localCwd,
+                paperclipRuntimeSkills: [],
+                paperclipSkillSync: { desiredSkills: [] },
+            }, { authToken: "real-run-jwt", executionTarget });
+        }
+        finally {
+            vi.unstubAllEnvs();
+        }
+        const instanceRoot = path.join(paperclipHome, "instances", "test-instance", "companies", "company-1");
+        const subscriptionAuth = path.join(instanceRoot, "codex-home", "auth.json");
+        expect((await fs.lstat(subscriptionAuth)).isSymbolicLink()).toBe(true);
+        await expect(fs.readFile(path.join(instanceRoot, "acp-engine", "agents", "agent-1", "codex-home", "auth.json"), "utf8")).rejects.toMatchObject({ code: "ENOENT" });
+        expect(await fs.readFile(sourceAuth, "utf8")).toBe(JSON.stringify({ tokens: "host-login" }));
+    });
     it("hands the merged paperclip env to the process-session launch when the setups overlap", async () => {
         const { stateDir, localCwd, remoteCwd, executionTarget } = await setupRemoteSandbox();
         // Decode the process-session LAUNCH payload (the base64 command blob) — the