Paperclip merges CreateOS sandbox support, with publishing still gated

Paperclip merged the CreateOS sandbox-provider contribution shortly after midnight UTC on September 16. The operational attraction is workspace continuity without keeping the same compute session active between runs. The revised contribution also narrows an easy availability overstatement: this optional provider can be installed from a local path or explicitly included in an image, while automatic npm publication remains disabled until maintainers bootstrap it. A merge establishes source availability; it does not erase the packaging and live-account qualification boundaries documented by the authors.

The facts

- PR #13434 merged at 00:09 UTC on September 16 and continues the earlier CreateOS contribution tracked in #13203. - The provider calls the CreateOS HTTP API directly without adding a vendor SDK. - It implements sandbox lifecycle hooks, incremental process output and binary workspace synchronization, including pause and resume by ID. - Trusted host credential fallback is limited to the official API origin; custom endpoints require an explicit key. - The release manifest keeps publishFromCi false until initial npm publication is bootstrapped, and the provider is not installed by default. - The source reports a skipped live provider smoke and warns that an ambiguous create response may leave a resource requiring account inspection.

Why it matters

Agent work often alternates between bursts of execution and waiting. Preserving the workspace while pausing a sandbox can be more useful than repeatedly recreating an environment or paying to keep it running. But pause support is not the same as guaranteed expiry or durable recovery. The contribution explicitly does not promise snapshots, ingress, duplex channels or guaranteed expiry, and process tracking remains in memory. Those omissions are part of the product contract, not fine print to be filled in with assumptions from another sandbox vendor.

Current

Inspected on 2026-09-16. The Paperclip stable-channel baseline is v2026.831.1 published 2026-09-02T04:56:26Z. The primary source was merged 2026-09-16T00:09:43Z when captured. Mainline merges, open proposals and packaged releases are distinct availability states; the release baseline does not establish that a proposal has shipped.

Evidence

Primary evidence: paperclipai/paperclip PR #13434 (https://github.com/paperclipai/paperclip/pull/13434). Supporting context: paperclipai/paperclip PR #13203 (https://github.com/paperclipai/paperclip/pull/13203); Paperclip — official product README (https://raw.githubusercontent.com/paperclipai/paperclip/master/README.md). The source bodies and linked context were inspected. Test results quoted from contributors remain attributed reports, not independently reproduced experiments.

Operator take

Evaluate this as a new opt-in execution backend with a specific reuse model. Before assigning production work, test a pause/resume cycle, binary file round trip, cancellation and the handling of an ambiguous creation response on a disposable account resource. Verify cleanup in the provider console instead of assuming a failed client call means nothing was created. Keep the earlier contribution's zero-idle-cost motivation separate from actual account billing terms; this report does not measure cost. The merged source is useful for inspection now, while distribution readiness and live native-runner qualification still need their own receipts.

Caveat

The PR reports all 25 jobs green in a named CI run but also documents limits in the local full-suite attempt and an unrun credentialed live smoke. These are attributed results, not tests reproduced here. The older proposal supplies motivation and lineage; the merged revision controls the current availability and capability claims.