privilegedescalation/org
12
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix env var directive: provide localhost fallback instead of exit-on-401

Browse Source 
The previous directive told agents to exit on 401, causing them to bail
on the first failed curl. PAPERCLIP_API_URL is injected by the adapter
but may not expand in all shell contexts. Fall back to localhost:3100.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Chris Farhood
2026-03-18 14:55:22 -04:00
parent d8d9d23a55
commit 436292b9f3
7 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ceo/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 1. Load your operating context
cmo/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub
cto/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub
engineering/gandalf/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub
engineering/hugh/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub
engineering/regina/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub
marketing/samuel/HEARTBEAT.md
+1 -1
View File
@@ -4,7 +4,7 @@
Do these steps in order. Do not skip any. Do not ask for input.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected into your process environment. **Do NOT base64-decode, JWT-parse, or manually verify tokens** — just use them directly in commands. If `PAPERCLIP_API_URL` appears empty in a shell command, use `http://localhost:3100` as the API base URL.
### 0. Authenticate with GitHub