@paperclipai/server 2026.830.0-canary.13 → 2026.830.0-canary.14

package/dist/build-info.json

@@ -1,3 +1,3 @@
 {
-  "commit": "e13856eb3"
+  "commit": "0834a0c1f"
 }

package/dist/vendor/paperclip-runner/drivers/acpx/environment.d.ts

@@ -0,0 +1,20 @@
+import type { QualifiedAcpxAgent } from "./qualified-profiles.js";
+declare const sanitizedAcpxSpawnInputBrand: unique symbol;
+/**
+ * Opaque child-process input produced only after the host environment crosses
+ * the ACPX credential allowlist. Future ACPX launchers accept this boundary
+ * object rather than an arbitrary `process.env`-shaped value.
+ */
+export interface SanitizedAcpxSpawnInput {
+    readonly env: Readonly<NodeJS.ProcessEnv>;
+    readonly [sanitizedAcpxSpawnInputBrand]: true;
+}
+/**
+ * Build the only host-environment input that may cross an ACPX child-process
+ * launch boundary. Agent-specific homes are added by the later runtime sandbox;
+ * Paperclip transport and native MCP credentials are never inherited from the
+ * host process.
+ */
+export declare function createSanitizedAcpxSpawnInput(environment: NodeJS.ProcessEnv | undefined, agent: QualifiedAcpxAgent): SanitizedAcpxSpawnInput;
+export {};
+//# sourceMappingURL=environment.d.ts.map

package/dist/vendor/paperclip-runner/drivers/acpx/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/drivers/acpx/environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,CAAC,MAAM,4BAA4B,EAAE,OAAO,MAAM,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,QAAQ,CAAC,CAAC,4BAA4B,CAAC,EAAE,IAAI,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,EAC1C,KAAK,EAAE,kBAAkB,GACxB,uBAAuB,CAqDzB"}

package/dist/vendor/paperclip-runner/drivers/acpx/environment.js

@@ -0,0 +1,62 @@
+/**
+ * Build the only host-environment input that may cross an ACPX child-process
+ * launch boundary. Agent-specific homes are added by the later runtime sandbox;
+ * Paperclip transport and native MCP credentials are never inherited from the
+ * host process.
+ */
+export function createSanitizedAcpxSpawnInput(environment, agent) {
+    const source = environment ?? process.env;
+    const result = {};
+    const credentialNames = agent === "pi"
+        ? ["OPENROUTER_API_KEY"]
+        : agent === "claude"
+            ? ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"]
+            : [
+                "OPENAI_API_KEY",
+                "CODEX_API_KEY",
+            ];
+    const allowed = new Set([
+        "PATH",
+        "LANG",
+        "LANGUAGE",
+        "TZ",
+        "TMPDIR",
+        "TEMP",
+        "TMP",
+        "SSL_CERT_FILE",
+        "SSL_CERT_DIR",
+        "NODE_EXTRA_CA_CERTS",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "NO_PROXY",
+        "ALL_PROXY",
+        "http_proxy",
+        "https_proxy",
+        "no_proxy",
+        "all_proxy",
+        "RUST_BACKTRACE",
+        "PAPERCLIP_NATIVE_MCP_NAME",
+        "PAPERCLIP_NATIVE_MCP_URL",
+        ...credentialNames,
+    ]);
+    let retainedBytes = 0;
+    for (const [key, value] of Object.entries(source)) {
+        if (typeof value !== "string")
+            continue;
+        if (!allowed.has(key) && !/^LC_[A-Z0-9_]{1,32}$/.test(key))
+            continue;
+        if (key.includes("\0") || value.includes("\0")) {
+            throw new Error("ACPX environment contains a null byte");
+        }
+        const entryBytes = Buffer.byteLength(key) + Buffer.byteLength(value);
+        if (entryBytes > 64 * 1024 || retainedBytes + entryBytes > 256 * 1024) {
+            throw new Error("ACPX environment exceeds its bounded launch size");
+        }
+        retainedBytes += entryBytes;
+        result[key] = value;
+    }
+    return Object.freeze({
+        env: Object.freeze(result),
+    });
+}
+//# sourceMappingURL=environment.js.map

package/dist/vendor/paperclip-runner/drivers/acpx/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/drivers/acpx/environment.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAA0C,EAC1C,KAAyB;IAEzB,MAAM,MAAM,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC1C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,eAAe,GACnB,KAAK,KAAK,IAAI;QACZ,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACxB,CAAC,CAAC,KAAK,KAAK,QAAQ;YAClB,CAAC,CAAC,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;YAClD,CAAC,CAAC;gBACE,gBAAgB;gBAChB,eAAe;aAChB,CAAC;IACV,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,MAAM;QACN,MAAM;QACN,UAAU;QACV,IAAI;QACJ,QAAQ;QACR,MAAM;QACN,KAAK;QACL,eAAe;QACf,cAAc;QACd,qBAAqB;QACrB,YAAY;QACZ,aAAa;QACb,UAAU;QACV,WAAW;QACX,YAAY;QACZ,aAAa;QACb,UAAU;QACV,WAAW;QACX,gBAAgB;QAChB,2BAA2B;QAC3B,0BAA0B;QAC1B,GAAG,eAAe;KACnB,CAAC,CAAC;IACH,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,UAAU,GAAG,EAAE,GAAG,IAAI,IAAI,aAAa,GAAG,UAAU,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,aAAa,IAAI,UAAU,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC3B,CAA4B,CAAC;AAChC,CAAC"}

package/dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.d.ts

@@ -0,0 +1,36 @@
+export declare const QUALIFIED_ACPX_VERSION: "0.13.1";
+export declare const ACPX_DRIVER_KIND: "acpx_runtime";
+export declare const ACPX_DRIVER_PROTOCOL_VERSION: 1;
+import type { NativeAcpxAgent } from "../../contracts/native-execution.js";
+export type QualifiedAcpxAgent = NativeAcpxAgent;
+export interface QualifiedAcpxProfile {
+    readonly driverKind: typeof ACPX_DRIVER_KIND;
+    readonly protocolVersion: typeof ACPX_DRIVER_PROTOCOL_VERSION;
+    readonly acpxVersion: typeof QUALIFIED_ACPX_VERSION;
+    readonly agent: QualifiedAcpxAgent;
+    readonly agentProfileVersion: 1;
+    readonly agentServerPackage: string;
+    readonly agentServerVersion: string;
+    readonly agentRuntimePackage: string | null;
+    readonly agentRuntimeVersion: string | null;
+    readonly commandDigest: string;
+    readonly qualificationModel: string;
+    /**
+     * Model identifier the pinned ACP server reports after accepting the exact
+     * qualification model. Most agents echo the requested model. Claude's ACP
+     * server deliberately exposes its stable SDK selector (`sonnet`) while the
+     * SDK resolves that selector to the canonical wire model
+     * (`claude-sonnet-5`). Paperclip verifies the exact request was accepted
+     * before treating this identifier as the qualified effective model.
+     */
+    readonly reportedModelId: string;
+    readonly permissionPolicy: "interactive";
+}
+/**
+ * Digests bind the closed profile declaration (package, version, runtime and
+ * model), not a caller-controlled executable. The environment probe separately
+ * verifies the resolved package files before a billable prompt is admitted.
+ */
+export declare const QUALIFIED_ACPX_PROFILES: Readonly<Record<QualifiedAcpxAgent, QualifiedAcpxProfile>>;
+export declare function resolveQualifiedAcpxProfile(agent: QualifiedAcpxAgent, requestedModel: string): QualifiedAcpxProfile;
+//# sourceMappingURL=qualified-profiles.d.ts.map

package/dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qualified-profiles.d.ts","sourceRoot":"","sources":["../../../src/drivers/acpx/qualified-profiles.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,EAAG,QAAiB,CAAC;AACxD,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,4BAA4B,EAAG,CAAU,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3E,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,4BAA4B,CAAC;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,sBAAsB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAkDhD,CAAC;AAEH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,kBAAkB,EACzB,cAAc,EAAE,MAAM,GACrB,oBAAoB,CAQtB"}

package/dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.js

@@ -0,0 +1,71 @@
+export const QUALIFIED_ACPX_VERSION = "0.13.1";
+export const ACPX_DRIVER_KIND = "acpx_runtime";
+export const ACPX_DRIVER_PROTOCOL_VERSION = 1;
+/**
+ * Digests bind the closed profile declaration (package, version, runtime and
+ * model), not a caller-controlled executable. The environment probe separately
+ * verifies the resolved package files before a billable prompt is admitted.
+ */
+export const QUALIFIED_ACPX_PROFILES = deepFreeze({
+    pi: {
+        driverKind: ACPX_DRIVER_KIND,
+        protocolVersion: ACPX_DRIVER_PROTOCOL_VERSION,
+        acpxVersion: QUALIFIED_ACPX_VERSION,
+        agent: "pi",
+        agentProfileVersion: 1,
+        agentServerPackage: "pi-acp",
+        agentServerVersion: "0.0.33",
+        agentRuntimePackage: "@earendil-works/pi-coding-agent",
+        agentRuntimeVersion: "0.84.2",
+        commandDigest: "sha256:8c696f38296d53d0061fa11534570c5ddd951b63532aed30e0f1fcc676dc169f",
+        qualificationModel: "openrouter/deepseek/deepseek-v4-flash-0731",
+        reportedModelId: "openrouter/deepseek/deepseek-v4-flash-0731",
+        permissionPolicy: "interactive",
+    },
+    claude: {
+        driverKind: ACPX_DRIVER_KIND,
+        protocolVersion: ACPX_DRIVER_PROTOCOL_VERSION,
+        acpxVersion: QUALIFIED_ACPX_VERSION,
+        agent: "claude",
+        agentProfileVersion: 1,
+        agentServerPackage: "@agentclientprotocol/claude-agent-acp",
+        agentServerVersion: "0.70.0",
+        agentRuntimePackage: null,
+        agentRuntimeVersion: null,
+        commandDigest: "sha256:9d73d1f0f121fb96cc8badb28c22d5bff02d8582eb2e40360a81c189e1b9422a",
+        qualificationModel: "claude-sonnet-5",
+        reportedModelId: "sonnet",
+        permissionPolicy: "interactive",
+    },
+    codex: {
+        driverKind: ACPX_DRIVER_KIND,
+        protocolVersion: ACPX_DRIVER_PROTOCOL_VERSION,
+        acpxVersion: QUALIFIED_ACPX_VERSION,
+        agent: "codex",
+        agentProfileVersion: 1,
+        agentServerPackage: "@agentclientprotocol/codex-acp",
+        agentServerVersion: "1.6.2",
+        agentRuntimePackage: null,
+        agentRuntimeVersion: null,
+        commandDigest: "sha256:94049b3e3c3aee87de62703786e4fa81d031d7bd979f99bdf516d84f28791a79",
+        qualificationModel: "gpt-5.6-sol",
+        reportedModelId: "gpt-5.6-sol",
+        permissionPolicy: "interactive",
+    },
+});
+export function resolveQualifiedAcpxProfile(agent, requestedModel) {
+    const profile = QUALIFIED_ACPX_PROFILES[agent];
+    if (requestedModel !== profile.qualificationModel) {
+        throw new Error(`ACPX ${agent} profile requires exact model ${profile.qualificationModel}; received ${requestedModel}`);
+    }
+    return structuredClone(profile);
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return value;
+}
+//# sourceMappingURL=qualified-profiles.js.map

package/dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qualified-profiles.js","sourceRoot":"","sources":["../../../src/drivers/acpx/qualified-profiles.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAiB,CAAC;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAuB,CAAC;AACxD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAU,CAAC;AA8BvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAEhC,UAAU,CAAC;IACb,EAAE,EAAE;QACF,UAAU,EAAE,gBAAgB;QAC5B,eAAe,EAAE,4BAA4B;QAC7C,WAAW,EAAE,sBAAsB;QACnC,KAAK,EAAE,IAAI;QACX,mBAAmB,EAAE,CAAC;QACtB,kBAAkB,EAAE,QAAQ;QAC5B,kBAAkB,EAAE,QAAQ;QAC5B,mBAAmB,EAAE,iCAAiC;QACtD,mBAAmB,EAAE,QAAQ;QAC7B,aAAa,EACX,yEAAyE;QAC3E,kBAAkB,EAAE,4CAA4C;QAChE,eAAe,EAAE,4CAA4C;QAC7D,gBAAgB,EAAE,aAAa;KAChC;IACD,MAAM,EAAE;QACN,UAAU,EAAE,gBAAgB;QAC5B,eAAe,EAAE,4BAA4B;QAC7C,WAAW,EAAE,sBAAsB;QACnC,KAAK,EAAE,QAAQ;QACf,mBAAmB,EAAE,CAAC;QACtB,kBAAkB,EAAE,uCAAuC;QAC3D,kBAAkB,EAAE,QAAQ;QAC5B,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,aAAa,EACX,yEAAyE;QAC3E,kBAAkB,EAAE,iBAAiB;QACrC,eAAe,EAAE,QAAQ;QACzB,gBAAgB,EAAE,aAAa;KAChC;IACD,KAAK,EAAE;QACL,UAAU,EAAE,gBAAgB;QAC5B,eAAe,EAAE,4BAA4B;QAC7C,WAAW,EAAE,sBAAsB;QACnC,KAAK,EAAE,OAAO;QACd,mBAAmB,EAAE,CAAC;QACtB,kBAAkB,EAAE,gCAAgC;QACpD,kBAAkB,EAAE,OAAO;QAC3B,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,aAAa,EACX,yEAAyE;QAC3E,kBAAkB,EAAE,aAAa;QACjC,eAAe,EAAE,aAAa;QAC9B,gBAAgB,EAAE,aAAa;KAChC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,CACzC,KAAyB,EACzB,cAAsB;IAEtB,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,cAAc,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,QAAQ,KAAK,iCAAiC,OAAO,CAAC,kBAAkB,cAAc,cAAc,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/vendor/paperclip-runner/drivers/acpx/sidecar-protocol.d.ts

@@ -0,0 +1,67 @@
+import type { QualifiedAcpxAgent } from "./qualified-profiles.js";
+import type { NativeRuntimeContextSnapshot } from "../../contracts/runtime-context.js";
+import type { NativeAcpxPermissionMode } from "../../contracts/native-execution.js";
+import { type GeneratedAcpxSidecarCommand, type GeneratedAcpxSidecarEventType } from "./generated-sidecar-contract.js";
+export declare const ACPX_SIDECAR_PROTOCOL_VERSION: 2;
+export declare const ACPX_SIDECAR_MAX_FRAME_BYTES: number;
+export interface AcpxSidecarRequest {
+    protocolVersion: typeof ACPX_SIDECAR_PROTOCOL_VERSION;
+    id: number;
+    command: GeneratedAcpxSidecarCommand;
+    params: Record<string, unknown>;
+}
+export interface AcpxSidecarResponse {
+    protocolVersion: typeof ACPX_SIDECAR_PROTOCOL_VERSION;
+    id: number;
+    ok: boolean;
+    result?: Record<string, unknown>;
+    error?: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+}
+export interface AcpxSidecarEvent {
+    protocolVersion: typeof ACPX_SIDECAR_PROTOCOL_VERSION;
+    sequence: number;
+    eventType: GeneratedAcpxSidecarEventType;
+    runId: string | null;
+    turnId: string | null;
+    payload: Record<string, unknown>;
+}
+export interface AcpxSidecarOpenParams {
+    runtimeDirectory: string;
+    normalizedSessionId: string;
+    workingDirectory: string;
+    agent: QualifiedAcpxAgent;
+    model: string;
+    permissionMode: NativeAcpxPermissionMode;
+    permissionModePinned: boolean;
+    systemInstructions: string;
+    runtimeContext: NativeRuntimeContextSnapshot | null;
+    tools: readonly Readonly<Record<string, unknown>>[];
+    providerSessionKey?: string;
+    expectedIdentity?: AcpxExpectedSessionIdentity;
+}
+export interface AcpxExpectedSessionIdentity {
+    kind: "acpx";
+    normalizedSessionId: string;
+    acpxRecordId: string;
+    backendSessionId: string;
+    agentSessionId: string;
+    profileDigest: string;
+    workspaceDigest: string;
+    requestedModel: string;
+    effectiveModel: string;
+    permissionMode?: NativeAcpxPermissionMode;
+}
+export declare function parseAcpxSidecarRequest(value: unknown): AcpxSidecarRequest;
+export declare function boundedSidecarValue(value: unknown, maxBytes?: number): Record<string, unknown>;
+export declare function sanitizeAcpxPlanEntries(value: unknown): Array<{
+    content: string;
+    status: "pending" | "in_progress" | "completed";
+    priority: string | null;
+}>;
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function text(value: unknown, fallback?: string): string;
+//# sourceMappingURL=sidecar-protocol.d.ts.map

package/dist/vendor/paperclip-runner/drivers/acpx/sidecar-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecar-protocol.d.ts","sourceRoot":"","sources":["../../../src/drivers/acpx/sidecar-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAGL,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EACnC,MAAM,iCAAiC,CAAC;AAEzC,eAAO,MAAM,6BAA6B,GACD,CAAC;AAC1C,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,OAAO,6BAA6B,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,2BAA2B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,OAAO,6BAA6B,CAAC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,OAAO,6BAA6B,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,6BAA6B,CAAC;IACzC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,wBAAwB,CAAC;IACzC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACpD,KAAK,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IACpD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,wBAAwB,CAAC;CAC3C;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA6C1E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,QAAQ,SAAY,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAChD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAqBD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI9D;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAK,GAAG,MAAM,CAE1D"}

package/dist/vendor/paperclip-runner/drivers/acpx/sidecar-protocol.js

@@ -0,0 +1,92 @@
+import { GENERATED_ACPX_SIDECAR_COMMANDS, GENERATED_ACPX_SIDECAR_PROTOCOL_VERSION, } from "./generated-sidecar-contract.js";
+export const ACPX_SIDECAR_PROTOCOL_VERSION = GENERATED_ACPX_SIDECAR_PROTOCOL_VERSION;
+export const ACPX_SIDECAR_MAX_FRAME_BYTES = 1024 * 1024;
+export function parseAcpxSidecarRequest(value) {
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch {
+        throw new Error("ACPX sidecar request is not JSON serializable");
+    }
+    if (!serialized ||
+        Buffer.byteLength(serialized) > ACPX_SIDECAR_MAX_FRAME_BYTES) {
+        throw new Error("ACPX sidecar request exceeds the frame limit");
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error("ACPX sidecar request must be an object");
+    }
+    const request = value;
+    if (Object.keys(request).some((key) => !["protocolVersion", "id", "command", "params"].includes(key))) {
+        throw new Error("ACPX sidecar request contains an unknown field");
+    }
+    if (request.protocolVersion !== ACPX_SIDECAR_PROTOCOL_VERSION) {
+        throw new Error("unsupported ACPX sidecar protocol version");
+    }
+    if (!Number.isSafeInteger(request.id) || Number(request.id) < 1)
+        throw new Error("sidecar request id must be a positive integer");
+    const command = text(request.command);
+    if (!GENERATED_ACPX_SIDECAR_COMMANDS.includes(command))
+        throw new Error("unsupported ACPX sidecar command");
+    if (typeof request.params !== "object" ||
+        request.params === null ||
+        Array.isArray(request.params)) {
+        throw new Error("ACPX sidecar request params must be an object");
+    }
+    return {
+        protocolVersion: ACPX_SIDECAR_PROTOCOL_VERSION,
+        id: Number(request.id),
+        command: command,
+        params: structuredClone(request.params),
+    };
+}
+export function boundedSidecarValue(value, maxBytes = 64 * 1024) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+        throw new Error("ACPX sidecar value limit must be a positive integer");
+    }
+    try {
+        const serialized = JSON.stringify(value);
+        if (!serialized || Buffer.byteLength(serialized) > maxBytes) {
+            return { omitted: true, reason: "payload_limit" };
+        }
+        const parsed = JSON.parse(serialized);
+        return typeof parsed === "object" &&
+            parsed !== null &&
+            !Array.isArray(parsed)
+            ? parsed
+            : { omitted: true, reason: "object_required" };
+    }
+    catch {
+        return { omitted: true, reason: "serialization_failed" };
+    }
+}
+export function sanitizeAcpxPlanEntries(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.slice(0, 256).flatMap((candidate) => {
+        const entry = record(candidate);
+        const content = text(entry.content).trim().slice(0, 4_000);
+        const status = text(entry.status);
+        if (!content ||
+            (status !== "pending" &&
+                status !== "in_progress" &&
+                status !== "completed"))
+            return [];
+        return [
+            {
+                content,
+                status,
+                priority: text(entry.priority).slice(0, 80) || null,
+            },
+        ];
+    });
+}
+export function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
+export function text(value, fallback = "") {
+    return typeof value === "string" ? value : fallback;
+}
+//# sourceMappingURL=sidecar-protocol.js.map

package/dist/vendor/paperclip-runner/drivers/acpx/sidecar-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecar-protocol.js","sourceRoot":"","sources":["../../../src/drivers/acpx/sidecar-protocol.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,+BAA+B,EAC/B,uCAAuC,GAGxC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,CAAC,MAAM,6BAA6B,GACxC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,GAAG,IAAI,CAAC;AAsDxD,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IACE,CAAC,UAAU;QACX,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,4BAA4B,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,KAAgC,CAAC;IACjD,IACE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACvE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,6BAA6B,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAE,+BAAqD,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,OAAO,CAAC,MAAM,KAAK,IAAI;QACvB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO;QACL,eAAe,EAAE,6BAA6B;QAC9C,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAwC;QACjD,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAiC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,QAAQ,GAAG,EAAE,GAAG,IAAI;IAEpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,OAAO,MAAM,KAAK,QAAQ;YAC/B,MAAM,KAAK,IAAI;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IAKpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IACE,CAAC,OAAO;YACR,CAAC,MAAM,KAAK,SAAS;gBACnB,MAAM,KAAK,aAAa;gBACxB,MAAM,KAAK,WAAW,CAAC;YAEzB,OAAO,EAAE,CAAC;QACZ,OAAO;YACL;gBACE,OAAO;gBACP,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI;aACpD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paperclipai/server",
-  "version": "2026.830.0-canary.13",
+  "version": "2026.830.0-canary.14",
   "license": "MIT",
   "homepage": "https://github.com/paperclipai/paperclip",
   "bugs": {
@@ -29,22 +29,22 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1115.0",
     "@opentelemetry/api": "^1.9.0",
-    "@paperclipai/adapter-claude-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-codex-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-cursor-cloud": "2026.830.0-canary.13",
-    "@paperclipai/adapter-cursor-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-gemini-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-grok-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-kimi-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-openclaw-gateway": "2026.830.0-canary.13",
-    "@paperclipai/adapter-opencode-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-pi-local": "2026.830.0-canary.13",
-    "@paperclipai/adapter-utils": "2026.830.0-canary.13",
-    "@paperclipai/db": "2026.830.0-canary.13",
-    "@paperclipai/hermes-paperclip-adapter": "2026.830.0-canary.13",
-    "@paperclipai/plugin-sdk": "2026.830.0-canary.13",
-    "@paperclipai/shared": "2026.830.0-canary.13",
-    "@paperclipai/skills-catalog": "2026.830.0-canary.13",
+    "@paperclipai/adapter-claude-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-codex-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-cursor-cloud": "2026.830.0-canary.14",
+    "@paperclipai/adapter-cursor-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-gemini-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-grok-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-kimi-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-openclaw-gateway": "2026.830.0-canary.14",
+    "@paperclipai/adapter-opencode-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-pi-local": "2026.830.0-canary.14",
+    "@paperclipai/adapter-utils": "2026.830.0-canary.14",
+    "@paperclipai/db": "2026.830.0-canary.14",
+    "@paperclipai/hermes-paperclip-adapter": "2026.830.0-canary.14",
+    "@paperclipai/plugin-sdk": "2026.830.0-canary.14",
+    "@paperclipai/shared": "2026.830.0-canary.14",
+    "@paperclipai/skills-catalog": "2026.830.0-canary.14",
     "@vercel/connect": "0.6.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
@@ -68,7 +68,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@paperclipai/paperclip-runner": "2026.830.0-canary.13",
+    "@paperclipai/paperclip-runner": "2026.830.0-canary.14",
     "@types/express": "^5.0.0",
     "@types/express-serve-static-core": "^5.1.3",
     "@types/jsdom": "^30.0.0",