Paperclip
Paperclip finds Codex state escaping its local isolation boundary
A Paperclip report says CODEX_HOME isolation can still leave state_5.sqlite in the shared ~/.codex directory; a proposed fix sets CODEX_SQLITE_HOME too. Related work stops unreadable instruction files from silently degrading agent behavior.
paperclipai/paperclip issue #11398 is the inspected primary source: “codex_local: CODEX_HOME isolation silently ignored — state_5.sqlite falls back to shared ~/.codex home.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- paperclipai/paperclip issue #11398 was created 2026-08-14T23:41:40Z and was open at inspection; its title is “codex_local: CODEX_HOME isolation silently ignored — state_5.sqlite falls back to shared ~/.codex home.” - paperclipai/paperclip PR #11399 was created 2026-08-14T23:47:11Z and was open at inspection; its title is “fix(codex-local): set CODEX_SQLITE_HOME alongside CODEX_HOME.” - paperclipai/paperclip PR #11396 was created 2026-08-14T22:35:49Z and was open at inspection; its title is “fix(adapters): surface instructions-file read failures instead of degrading silently.” - The repository reported 78152 stars, 5075 open issues, default branch master, and last push 2026-08-15T00:54:15Z. - The latest tagged-release baseline checked was v2026.722.0 published 2026-07-22T23:05:41Z.
What changed
paperclipai/paperclip issue #11398 reports: Pre-submission checklist [x] I have searched existing open and closed issues and this is not a duplicate. (Searched codex_local, codex-home sqlite, CODEX_SQLITE_HOME, failed to initialize sqlite state runtime — found related-but-distinct codex_local issues, e.g. the open per-agent auth-home seeding PR, but nothing about this specific env-var gap.) [x] I am on the latest released version of Paperclip (or can reproduce on master). (2026.722.0, matches the current releases/v2026.722.0.md.) [x] I have confirmed the error originates in Paperclip itself — not in my agent adapter, API provider, or local configuration. (Confirmed by direct manual repro below, isolated from Paperclip's own process entirely.) What happened? codex_local sets env.CODEX_HOME to each agent's Paperclip-managed per-agent home (execute.ts:946, env.CODEX_HOME = remoteCodexHome?? effectiveCodexHome;) but never sets CODEX_SQLITE_HOME. On Codex CLI 0.147.0, the runtime SQLite state (state_5.sqlite, logs_2.sqlite, goals_1.sqlite, etc.) is controlled by CODEX_SQLITE_HOME, which is separate from CODEX_HOME. Without it set, every codex_local agent on a host silently shares one SQLite state home (~/.codex/) instead of its own isolated managed one — even though CODEX_HOME is correctly per-agent for config/auth/sessions. Two codex_local agents on the same host (different agent IDs, different per-agent codex-home paths) collided on that one shared SQLite state home and both failed within 11 seconds of each other with: Both agents were marked
paperclipai/paperclip PR #11399 reports: Thinking Path Paperclip's codex_local adapter is meant to give each agent an isolated managed CODEX_HOME for config/auth/sessions. Codex CLI 0.147.0 also has a separate CODEX_SQLITE_HOME that controls where its runtime SQLite state (state_5.sqlite, logs_2.sqlite, goals_1.sqlite) actually lives. execute.ts only ever set CODEX_HOME, never CODEX_SQLITE_HOME, so that isolation silently didn't apply to SQLite state. Every codex_local agent on a host therefore shared one SQLite state home, and concurrent agents collided on it with failed to initialize sqlite state runtime. Confirmed this manually (isolated from Paperclip): setting CODEX_HOME alone does not relocate state_5.sqlite; setting both env vars to the same path does. The fix mirrors the existing CODEX_HOME assignment into CODEX_SQLITE_HOME at the same call site. What Changed One line added at packages/adapters/codex-local/src/server/execute.ts:886 (immediately after the existing env.CODEX_HOME assignment): Same value already computed and used on the line above — no new logic, no new inputs. Linked Issues or Issue Description Fixes #11398. Full repro, evidence ruling out corruption/checksum-drift, and the manual before/after test are there. Verification Confirmed manually, isolated from Paperclip entirely: Not done:** I have not run Paperclip's own test/CI suite or set up its dev environment — no pnpm/dev deps installed where I made this change. This is a minimal, single-line, same-value-reused change, but please treat CI as the
paperclipai/paperclip PR #11396 reports: Thinking Path - Paperclip is the open source app people use to manage AI agents for work - The adapter layer builds each run's prompt. It injects the agent's configured instructions file (adapterConfig.instructionsFilePath) into the system prompt. - Every local adapter read that file inline, caught the error, wrote one warning line to the run log, and used the generic prompt template instead. - The failure never reached the run result or the agent record. An agent with a moved or mistyped instructions path kept heartbeating and billing forever with no role instructions, and the board saw a healthy agent. - This pull request moves the read into one helper in adapter-utils, returns a structured failure, and reports that failure on AdapterExecutionResult. - The server now counts consecutive failures for the same path, writes the reason to agents.errorReason, and pauses the agent after two failures in a row. - The benefit is that a broken instructions config is visible on the board in at most two heartbeats, and it stops burning tokens instead of degrading silently. Linked Issues or Issue Description Refs #11391 (part 1 of that report; part 2, the stale absolute instructions root, is not addressed here) What Changed Add readAdapterInstructionsFile() and instructionsReadFailureCommandNote() in packages/adapter-utils/src/agent-instructions-file.ts. The helper does
Why it matters
A local adapter is not isolated if one state database still follows the user-wide default, and instructions are not trustworthy if read failures become invisible fallback behavior. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.
Current
The primary record was open when captured on 2026-08-15. The tagged-release baseline was v2026.722.0 published 2026-07-22T23:05:41Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/paperclipai/paperclip/issues/11398. Supporting records are https://github.com/paperclipai/paperclip/pull/11399 and https://github.com/paperclipai/paperclip/pull/11396. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Launch two isolated runs with distinct state roots, prove their databases never cross, and fail closed with a visible error when managed instructions cannot be read. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.