Files

T

Devin Foley 20aea356cc refactor(deps-dev): bump vitest from 3.2.4 to 4.1.8 (#7581 )

## Thinking Path

> - Paperclip orchestrates AI agents for zero-human companies
> - Test infrastructure across server, ui, packages/* runs on Vitest
> - Dependabot opened a narrow bump (3.2.4 → 3.2.6), but the wider
workspace is on 3.2.4 and the major-version bridge to v4 needs a
coordinated change set across configs and tests
> - Staying on 3.x indefinitely leaves us behind on Vitest 4 (perf,
pool, and config improvements) and forces repeated patch-only dependabot
churn
> - This pull request upgrades Vitest to 4.1.8 across the workspace,
updates `server/vitest.config.ts` and `scripts/run-vitest-stable.mjs`
for the new API, and adjusts two UI tests for the new assertion
semantics
> - The benefit is a single, coherent Vitest 4 upgrade that supersedes
#7570 and gets us on the supported major line

## What Changed

- Bump `vitest` from `3.2.4` to `4.1.8` across root, `server`, `ui`, and
all `packages/*` (including plugin examples and sandbox providers)
- Update `server/vitest.config.ts` for Vitest 4 config surface
- Update `scripts/run-vitest-stable.mjs` to match the new runner
behavior
- Adjust `ui/src/components/CommentThread.test.tsx` and
`ui/src/components/MarkdownEditor.test.tsx` for Vitest 4 matcher/timing
semantics
- Refresh `pnpm-lock.yaml`

## Verification

- `pnpm install` resolves cleanly with the new lockfile
- `pnpm -w -r test` (server, ui, packages) runs under Vitest 4.1.8

## Risks

- Major-version Vitest bump: behavioral changes in pools, fake timers,
and matcher strictness can surface flake. Test config and the two UI
tests were updated to match v4 semantics; broader test runs should be
watched on CI before merge.
- Supersedes dependabot PR #7570 (3.2.4 → 3.2.6); that PR should be
closed.

## Model Used

- Claude (Anthropic) — `claude-opus-4-7`, extended thinking, tool use
enabled

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [ ] I have run tests locally and they pass
- [ ] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [ ] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

Closes #7570

2026-06-05 21:11:32 -07:00

src

Harden Cloudflare sandbox execution (#5967 )

2026-05-13 22:00:10 -07:00

Dockerfile

…

package.json

refactor(deps-dev): bump vitest from 3.2.4 to 4.1.8 (#7581 )

2026-06-05 21:11:32 -07:00

README.md

…

tsconfig.json

…

vitest.config.ts

…

wrangler.jsonc

Harden Cloudflare sandbox execution (#5967 )

2026-05-13 22:00:10 -07:00

README.md

Cloudflare Sandbox Bridge Template

This Worker is the operator-facing bridge used by @paperclipai/plugin-cloudflare-sandbox.

It exposes a small authenticated JSON API under /api/paperclip-sandbox/v1 and translates Paperclip lease and command requests into Cloudflare Sandbox SDK calls.

What it does

health and probe
acquire, resume, release, and destroy leases
execute commands in a sandbox session
clean up timed-out sessions so Paperclip does not inherit wedged background processes

Prerequisites

Cloudflare account with Sandbox / Containers access
wrangler configured for that account
Docker running locally for wrangler deploy
A bridge auth token set as a Worker secret:

npx wrangler secret put BRIDGE_AUTH_TOKEN

Local development

cd bridge-template
pnpm install --ignore-workspace --no-lockfile
pnpm test
pnpm typecheck
pnpm dev

Deploy

pnpm deploy

After deploy, configure Paperclip with:

bridgeBaseUrl: your Worker URL
bridgeAuthToken: the same bearer token value stored in BRIDGE_AUTH_TOKEN

Notes

reuseLease: true should only be used together with keepAlive: true
.workers.dev is fine for bridge HTTP traffic, but preview/wildcard host flows are intentionally out of scope here
keep the Docker image aligned with the installed @cloudflare/sandbox version