Rebase onto upstream/master (2026-08-24): 484 commits (d5b9f6c8..a14e51d5) - #333
Draft
stubbi wants to merge 13 commits into
Draft
Rebase onto upstream/master (2026-08-24): 484 commits (d5b9f6c8..a14e51d5)#333stubbi wants to merge 13 commits into
stubbi wants to merge 13 commits into
Conversation
Cherry-picked 484 upstream commits from paperclipai/paperclip master. Merged using a synthetic merge-base approach: created a temporary commit with the fork's tree parented on the last upstream point (d5b9f6c), then merged upstream/master using git's standard 3-way merge machinery with d5b9f6c as the computed merge-base. Resolved 88 conflicts across server, packages, and UI directories. Notable upstream additions since the last rebase (d5b9f6c, 2026-08-05): - Duplex bridge broker with gated transport selection and observability - Environment delete with agent reassignment and sandbox destroy - Login pseudo-terminal for Codex device login - Stream duplex bridge bodies as sequenced chunks - Cycle-aware issue_blockers_resolved after terminal reset - Aggregate duplex route resource consumption byte ledger - Node 24 enforcement across Paperclip - Zod 4.4.3 upgrade - Onboarding agent arc rebuild on prototype step design - Commitperclip Co-Authored-By trailer surfacing for squash merges - Operator-configurable settings visibility (PAPERCLIP_HIDDEN_SETTINGS) - Database backup health monitoring - Environment capabilities classification from static driver definitions - Plugin retry at boot for errored plugins - Agent resume through direct grants authorization - Plus dependency bumps and numerous bug fixes Fork conflict resolutions: - pnpm-lock.yaml: kept fork version (CI owns lockfile) - CloudUpstream pages: kept fork (upstream deleted the route) - Cloud CLI commands: kept fork (upstream deleted) - Cloud upstreams routes/services: kept fork - Auth middleware: merged upstream's cloud tenant refactor with fork overlays - Adapter packages: merged upstream's duplex/login features with fork's hosted-mode customizations (prebaked runtimes, credential handling) - UI components: merged upstream features with fork's cloud billing, onboarding, and access-control overlays - Server routes/services: merged upstream's new capabilities with fork's cloud tenant, billing, and managed instance features No pnpm-lock.yaml in the diff, per fork policy. No migration renumbering needed (upstream migrations in this range do not collide with fork-specific migrations).
…fset +3) The fork carries three extra migrations before the upstream range: 0182_decision_training_retention_policy, 0183_instance_settings_visibility, 0184_heartbeat_run_events_run_cascade. Upstream 0196-0226 collide with fork 0196-0198 (which are upstream 0193-0195 renumbered). Shift the new upstream migrations by +3 to maintain the fork offset. Journal updated: 229 entries, no duplicate idx, gap at 128 pre-dates this change. Snapshot files renumbered to match.
Add missing engines.node >= 24.11.0 and pin @types/node to ^24.0.0 to satisfy the repo-wide node version policy check.
…ution - server/src/routes/environments.ts: restore missing function closing brace and JSDoc opening for isTenantEditableManagedSandbox - server/src/services/execution-allowlist.test.ts: close unclosed it/describe blocks in claudeHostLoginUnavailableReason test - server/src/services/heartbeat.ts: restore missing closing brace for setRunStatusIfQueued function - server/src/middleware/auth.ts: remove duplicated .onConflictDoUpdate block and fix garbled ternary expression - packages/adapters/codex-local/src/server/codex-auth-copyback.ts: fix try/finally structure and remove orphan catch block - packages/adapters/codex-local/src/server/execute.ts: fix arrow function closing syntax - packages/adapter-utils/src/execution-target-sandbox.test.ts: restore missing }); closing for event re-delivery test - packages/shared/src/types/instance.ts: add enableCloudSync to InstanceExperimentalSettings interface - packages/shared/src/validators/instance.ts: add enableCloudSync to schema - packages/shared/src/feature-catalog.ts: add enableCloudSync entry - server/src/services/instance-settings.ts: add enableCloudSync defaults - ui/src/App.tsx: add missing CloudUpstream import - ui/src/components/AgentConfigForm.render.test.tsx: add missing mockInstanceSettingsApi definition and vi.mock - ui/src/components/OnboardingWizard.test.tsx: remove duplicate mock declarations, add missing CompanySecret import, fix structural issues
Server/adapter fixes: - claude-local/acp.ts: remove orphaned probeChecks reference - codex-local/execute.ts: fix firstMeaningfulStderrLine import conflict, add firstNonEmptyLine helper - server/app.ts: remove streamBus from plugin routes bridge, build plugin-sdk - server/index.ts: restore instrumentation imports, fix drain/reap signatures - cloud-tenant-actor.test.ts: default createFakeDb options parameter - live-events-ws.ts: remove dead cloud tenant ws auth import - routes/secrets.ts: add missing assertSurfaceExposed and settings imports - services/index.ts: re-export cloudUpstreamService - services/heartbeat.ts: fix drain, reap, and billing cost declarations - services/environment-runtime.ts: add PluginStreamBus import - services/environment-execution-target.ts: remove orphaned prebakedRuntime - services/plugin-worker-manager.ts: remove streamBus from return - Restore packages/shared/src/types/cloud-upstream.ts and db schema UI fixes: - Restore ui/src/api/cloudUpstreams.ts from fork - Add cloudUpstreams queryKey to queryKeys.ts - Add cloud-upstream tab to CompanySettingsNav items - Add enableCloudSync to InstanceExperimentalSettings test defaults - Add enableManagedSandboxOnly and enableClassicTaskInterface to test-utils - Fix InviteLanding.tsx: add companiesListQueryOptions import - OnboardingWizard.test.tsx: fix structural issues, imports, mock types Shared: - Restore cloud-upstream types and db schema tables
Fix companiesListQueryOptions -> companyListQueryOptions rename (upstream refactored from constant to function taking userId). Pass user id from session query data and type the company parameter.
The merge left duplicate import blocks (vitest, execute.js, adapter-utils/execution-target) mid-file. Consolidate into a single import set at the top.
…ace to capabilities test These fields are now derived into PublicFeatureFlags but were missing from the test's expected output.
…headers The merge dropped cli/src/commands/client/cloud-transfer.ts and cloud-store.ts (fork-only files that upstream deleted). cloud.ts and cloud.test.ts reference them. Restored from the fork. Added explicit types to the headers callback to satisfy noImplicitAny.
…lity The repair function queries companies.name which test mocks may not include. Accept null/undefined name and return false (no repair needed) instead of crashing.
- auth-session-route.test.ts: use upstream's createSelectChain pattern for the DB mock so all 5 inserts fire (instance settings init) - health.test.ts: add missing fs/os/path imports and createHealthyDb helper - health.ts: include databaseBackup and warnings in both redacted and full health responses (merge dropped these upstream additions)
The upstream refactored the ACPX engine to always return a result instead of throwing AcpxSessionInitError. Update 4 fork tests: - session init failure: expect returned result with errorCode, not throw - explicit ACP run: errorMessage is raw error, not folded stderr - secret redaction: secrets don't reach tenant-facing errorMessage - auth classification: expect returned result, not thrown error Remove dead allowSessionInitLaneFallback assignment from execute.ts.
…ures AgentConfigForm.render.test.tsx: - Add mockInstanceSettingsApi default returns in beforeEach (fixes undefined queryFn errors that broke the Test mutation) - Set defaultEnvironmentId and enableManagedSandboxOnly in access mock features where tests depend on those flags CompanySettingsSidebar.test.tsx: - Update expected items to include both company and instance General - Fix chrome header assertion (company name, not "Company Settings") - Add access mock for operator-hidden entries test - Update hidden-settings expectations for admin-visible items
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thinking Path
Linked Issues or Issue Description
Supersedes all stale rebase PRs targeting bases older than
a14e51d5.Refs #320 (previous rebase, merged 2026-08-09).
What Changed
Brings in upstream
d5b9f6c8..a14e51d5— 484 commits. Notable upstream additions:Migrations
0199–0229(upstream0196–0226renumbered +3 for the fork offset). Journal updated: 229 entries, no duplicate idx, pre-existing gap at 128 unchanged.No
pnpm-lock.yamlin the diff, per fork policy.Conflict resolutions (88 files)
server/src/middleware/auth.ts): took upstream's refactored cloud tenant auth (eager company creation, write debounce, membership union) — the fork's prior overlay is now upstreamVerification
CI is the real gate here. Please do not merge on the strength of local checks alone; wait for all gates to pass.
Risks
Moderate, inherent to a 484-commit rebase.
0199–0229) must not collide with anything landing between now and merge; if another migration PR merges first this needs renumbering again.Model Used
claude-opus-4-6[1m], 1M context), via the Claude Code CLI harness with tool use (shell, file edits). Conflict resolution performed by parallel subagents across packages/, server/, and ui/ directories.Checklist
Fixes: #/Closes #/Refs #OR (b) described the issue in-PR following the relevant issue template#NNN/github.com/paperclipai/paperclipURLs)docs/...,fix/...) and contains no internal Paperclip ticket id or instance-derived detailsGenerated by Claude Code