mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-27 11:20:42 +01:00
Priya RamanandPaperclip
aa55a49370
Select the duplex transport only when the experimental setting enableSandboxDuplexBridge is exactly true and the resolved capability duplexCommandStream is exactly true. Any other value of either gate selects the file bridge. The host assigns the loopback port and one random per-open nonce, and passes both to the gateway only through the launch environment. The host builds the sandbox-facing origin http://127.0.0.1:<assigned port> from its own stored port. No field of any channel frame contributes to the endpoint. Change the READY frame from an address string to a strict version-plus-nonce schema in the host codec, the embedded gateway codec, and the shared fixture; the gateway echoes the nonce and sends READY only after it binds the assigned port. The gateway binds exactly that port or writes a diagnostic and exits nonzero. Readiness fails closed. On a mismatched nonce, an address-bearing or incomplete READY frame, protocol contamination before READY, a bind failure, or a timeout, the host closes the partial channel inside a bounded budget and selects the file bridge, and leaves no live provider session. The broker starts only after readiness passes, so no request that carries the bridge token reaches a rejected endpoint. Teardown closes the channel before lease release. Co-authored-by: Paperclip <noreply@paperclip.ing>