`@paperclipai/plugin-cloudflare-sandbox`

Published Cloudflare sandbox provider plugin for Paperclip.

This package lives in the Paperclip monorepo, but it is intentionally excluded from the root pnpm workspace and shaped to publish and install like a standalone npm package. Operators can install it from the Plugins page by package name, and the host will fetch its dependencies at install time without adding lockfile churn to the Paperclip repo.

Install

From a Paperclip instance, install:

text

@paperclipai/plugin-cloudflare-sandbox

Configure Cloudflare from Company Settings -> Environments, not from the plugin's instance settings page.

Configuration

The environment uses core driver: "sandbox" with provider: "cloudflare".

Required fields:

bridgeBaseUrl
bridgeAuthToken

Important validation rules:

reuseLease: true requires keepAlive: true
non-local bridgeBaseUrl values must be https://
sessionId is required when sessionStrategy is named

Pasted auth tokens are stored by Paperclip as company secrets because the manifest marks bridgeAuthToken as a secret-ref field.

Bridge template

The package includes an operator-facing Cloudflare Worker scaffold under bridge-template. That template uses @cloudflare/sandbox, a Sandbox Durable Object binding, and a small JSON HTTP surface under /api/paperclip-sandbox/v1.

Local development

bash

cd packages/plugins/sandbox-providers/cloudflare
pnpm install --ignore-workspace --no-lockfile
pnpm build
pnpm test
pnpm typecheck

These commands assume the repo root has already been installed once so the local @paperclipai/plugin-sdk workspace package is available to the compiler during development.