Files

T

Devin Foley 20aea356cc refactor(deps-dev): bump vitest from 3.2.4 to 4.1.8 (#7581 )

## Thinking Path

> - Paperclip orchestrates AI agents for zero-human companies
> - Test infrastructure across server, ui, packages/* runs on Vitest
> - Dependabot opened a narrow bump (3.2.4 → 3.2.6), but the wider
workspace is on 3.2.4 and the major-version bridge to v4 needs a
coordinated change set across configs and tests
> - Staying on 3.x indefinitely leaves us behind on Vitest 4 (perf,
pool, and config improvements) and forces repeated patch-only dependabot
churn
> - This pull request upgrades Vitest to 4.1.8 across the workspace,
updates `server/vitest.config.ts` and `scripts/run-vitest-stable.mjs`
for the new API, and adjusts two UI tests for the new assertion
semantics
> - The benefit is a single, coherent Vitest 4 upgrade that supersedes
#7570 and gets us on the supported major line

## What Changed

- Bump `vitest` from `3.2.4` to `4.1.8` across root, `server`, `ui`, and
all `packages/*` (including plugin examples and sandbox providers)
- Update `server/vitest.config.ts` for Vitest 4 config surface
- Update `scripts/run-vitest-stable.mjs` to match the new runner
behavior
- Adjust `ui/src/components/CommentThread.test.tsx` and
`ui/src/components/MarkdownEditor.test.tsx` for Vitest 4 matcher/timing
semantics
- Refresh `pnpm-lock.yaml`

## Verification

- `pnpm install` resolves cleanly with the new lockfile
- `pnpm -w -r test` (server, ui, packages) runs under Vitest 4.1.8

## Risks

- Major-version Vitest bump: behavioral changes in pools, fake timers,
and matcher strictness can surface flake. Test config and the two UI
tests were updated to match v4 semantics; broader test runs should be
watched on CI before merge.
- Supersedes dependabot PR #7570 (3.2.4 → 3.2.6); that PR should be
closed.

## Model Used

- Claude (Anthropic) — `claude-opus-4-7`, extended thinking, tool use
enabled

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [ ] I have run tests locally and they pass
- [ ] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [ ] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge

Closes #7570

2026-06-05 21:11:32 -07:00

bridge-template

refactor(deps-dev): bump vitest from 3.2.4 to 4.1.8 (#7581 )

2026-06-05 21:11:32 -07:00

src

fix(sandbox): prevent E2B workspace upload + lease idle failures (PAPA-382) (#6560 )

2026-05-22 13:34:11 -07:00

package.json

refactor(deps-dev): bump vitest from 3.2.4 to 4.1.8 (#7581 )

2026-06-05 21:11:32 -07:00

README.md

Add Cloudflare sandbox provider plugin (#5687 )

2026-05-11 07:33:13 -07:00

tsconfig.json

Add Cloudflare sandbox provider plugin (#5687 )

2026-05-11 07:33:13 -07:00

vitest.config.ts

Add Cloudflare sandbox provider plugin (#5687 )

2026-05-11 07:33:13 -07:00

README.md

`@paperclipai/plugin-cloudflare-sandbox`

Published Cloudflare sandbox provider plugin for Paperclip.

This package lives in the Paperclip monorepo, but it is intentionally excluded from the root pnpm workspace and shaped to publish and install like a standalone npm package. Operators can install it from the Plugins page by package name, and the host will fetch its dependencies at install time without adding lockfile churn to the Paperclip repo.

Install

From a Paperclip instance, install:

@paperclipai/plugin-cloudflare-sandbox

Configure Cloudflare from Company Settings -> Environments, not from the plugin's instance settings page.

Configuration

The environment uses core driver: "sandbox" with provider: "cloudflare".

Required fields:

bridgeBaseUrl
bridgeAuthToken

Important validation rules:

reuseLease: true requires keepAlive: true
non-local bridgeBaseUrl values must be https://
sessionId is required when sessionStrategy is named

Pasted auth tokens are stored by Paperclip as company secrets because the manifest marks bridgeAuthToken as a secret-ref field.

Bridge template

The package includes an operator-facing Cloudflare Worker scaffold under bridge-template. That template uses @cloudflare/sandbox, a Sandbox Durable Object binding, and a small JSON HTTP surface under /api/paperclip-sandbox/v1.

Local development

cd packages/plugins/sandbox-providers/cloudflare
pnpm install --ignore-workspace --no-lockfile
pnpm build
pnpm test
pnpm typecheck

These commands assume the repo root has already been installed once so the local @paperclipai/plugin-sdk workspace package is available to the compiler during development.