{"record":{"id":"91b5dc1b1595bde0","repo":"paperclipai/paperclip","slug":"codex-acp-must-share-the-image-s-codex-installatio","errorCode":null,"errorMessage":"Codex ACP must share the image's Codex installation","messagePattern":"Codex ACP must share the image's Codex installation","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/paperclip-runner/scripts/build-provider-pack.mjs","lineNumber":138,"sourceCode":"      \"--filter\",\n      \"@paperclipai/paperclip-runner\",\n      \"deploy\",\n      \"--prod\",\n      temporaryRoot,\n    ],\n    { cwd: workspaceRoot, encoding: \"utf8\", stdio: \"inherit\" },\n  );\n  if (deployed.status !== 0) {\n    throw new Error(`pnpm deploy failed with exit code ${deployed.status}`);\n  }\n\n  // Fail the image build if a bridge silently brings back an older/private\n  // provider CLI. A direct dependency alone does not deduplicate pnpm's graph.\n  const packRequire = createRequire(join(temporaryRoot, \"package.json\"));\n  const codexAcpRequire = createRequire(packRequire.resolve(\"@agentclientprotocol/codex-acp/package.json\"));\n  if (realpathSync(codexAcpRequire.resolve(\"@openai/codex/package.json\")) !==\n      realpathSync(packRequire.resolve(\"@openai/codex/package.json\"))) {\n    throw new Error(\"Codex ACP must share the image's Codex installation\");\n  }\n\n  // Reuse the already-qualified build interpreter instead of introducing a\n  // package-manager lifecycle hook or a second binary supply chain. The pack\n  // manifest binds the copied bytes, platform, architecture, and minimum\n  // version before any provider is launched.\n  const minimumNodeVersion = [24, 11, 0];\n  const actualNodeVersion = process.versions.node.split(\".\").map(Number);\n  if (\n    actualNodeVersion[0] < minimumNodeVersion[0] ||\n    (actualNodeVersion[0] === minimumNodeVersion[0] &&\n      (actualNodeVersion[1] < minimumNodeVersion[1] ||\n        (actualNodeVersion[1] === minimumNodeVersion[1] &&\n          actualNodeVersion[2] < minimumNodeVersion[2])))\n  ) {\n    throw new Error(\"Provider pack build Node is older than 24.11.0\");\n  }\n  const stableNodeRoot = join(temporaryRoot, \"node_modules\", \"node\");","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/paperclip-runner/scripts/build-provider-pack.mjs#L120-L156","documentation":"Supply-chain guard in build-provider-pack.mjs: after pnpm deploy, the @agentclient Codex ACP bridge resolves @openai/codex to a different real path than the runner pack's own @openai/codex dependency. The build fails because a duplicate/deduplicated older or private Codex CLI slipped into the pack via the bridge instead of sharing the image's pinned installation.","triggerScenarios":"Thrown at packages/paperclip-runner/scripts/build-provider-pack.mjs:138 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pin the bridge's @openai/codex to the same version as the runner dependency so pnpm deduplicates to one instance","Add a pnpm override for @openai/codex at the workspace root","Update @agentclient/* bridge to a version compatible with the image's Codex version"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}