0 Fork 0

mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-26 10:26:26 +01:00

Files

T

Priya RamanandPaperclip 65a8cecf31 fix(sandbox): make the pre-READY duplex newline scan incremental

The pre-READY readiness gate searched the full accumulated buffer with
buffer.indexOf("\\n") for every chunk. String#indexOf is linear in the
searched string, so many small newline-less chunks made the cumulative
scan work quadratic in the bytes received before the cap fired. An
untrusted provider could monopolize a host worker CPU.

Record the buffer length before each append and search from that offset
with buffer.indexOf("\\n", from). A newline can only be inside the new
chunk, so the search is correct and the total scan work is linear. Reset
the offset to 0 after the blank-line skip consumes a line.

Add a regression test that counts the scan work through a test-only seam
and asserts it stays proportional to the bytes received. The O(1) buffer
cap, the protocol_contamination result, the settled byte-drop guard, the
nonce check, and the file-bridge fallback stay unchanged.

Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-08-20 19:30:16 +00:00

src

fix(sandbox): make the pre-READY duplex newline scan incremental

2026-08-20 19:30:16 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572 )

2026-08-17 22:11:30 -05:00

package.json

build(deps-dev): bump @types/node from 22.19.21 to 22.20.1 (#10304 )

2026-07-28 10:48:45 -07:00

README.md

PAPA-430: workspace finalize gates + no-remote-git enforcement (#6969 )

2026-05-29 08:25:29 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

README.md

@paperclipai/adapter-utils

Shared utilities for Paperclip adapters: process spawning, environment injection, sandbox/SSH transport, workspace sync, and the round-trip helpers that move code between the local execution-workspace cwd and wherever the agent actually runs.

For the adapter-author guide see docs/adapters/creating-an-adapter.md and the in-repo notes at packages/adapters/AUTHORING.md.

No-remote-git contract

The local execution-workspace cwd is the only persistence boundary across runs. No adapter may depend on a git remote for cross-run state.

Adapters that run the agent on a different host should use the SSH round-trip helpers in src/ssh.ts:

prepareWorkspaceForSshExecution({ spec, localDir, remoteDir }) — bundles the local cwd (tracked files, dirty edits, untracked additions, and the git history needed to reconstruct it) to remoteDir before the run starts. Runs with no git remote configured.
restoreWorkspaceFromSshExecution({ spec, localDir, remoteDir, ... }) — syncs the remote cwd back into localDir after the run, including any new commits the agent created. Also runs with no git remote configured.

prepareRemoteManagedRuntime in src/remote-managed-runtime.ts wraps both calls for adapters that want a per-run remote workspace and an automatic restoreWorkspace() finally hook.

The invariant is pinned by the no-remote-git contract case in src/ssh-fixture.test.ts, which asserts that a remote-only commit propagates to the local worktree through the prepare → restore round-trip with no git remote configured at any point. Do not regress that test.