## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Cloud and sandbox agents need less round-trip overhead at workspace
start
> - The workspace start path now uploads the git history and the working
tree overlay in two separate sync operations
> - That adds extra mkdir, guard, upload, and rename work for the same
workspace bytes
> - This pull request merges those two uploads into one guarded sync
operation
> - The benefit is one sync round trip for the workspace bytes with the
same guard and login-shell contract
## Linked Issues or Issue Description
No public GitHub issue exists for this change.
### Problem
A git-backed workspace start uploads the git-history clone and the
working-tree overlay as two separate host-to-sandbox sync operations.
### Proposed Solution
Merge the two uploads into one sync operation. Keep both tar mappings
under the same confinement guard. Run the git-history extract first,
then the overlay extract, then optional cleanup.
### Alternatives Considered
Keep two sync operations. That keeps the current round-trip cost and
duplicates the guard, upload, and rename work.
### Roadmap Alignment
This change supports the roadmap work on cloud and sandbox agents by
reducing workspace start overhead.
## What Changed
- Merge the git-history tar and the working-tree overlay tar into one
sync operation.
- Run the git-history extract first, then the overlay extract, then
optional remove-deleted-paths cleanup.
- Keep both temporary tar targets under the runtime directory so the
first extract cannot delete the second tar before use.
- Keep the symlink-escape guard, login-shell contract, and file-mapping
checks on the merged file set.
## Verification
- `tsc --noEmit` on `@paperclipai/adapter-utils`
- `@paperclipai/adapter-utils` full project test suite: 354 pass / 4
skipped
- Orchestrator proof: one merged operation with both tars and two
ordered extract commands
- Orchestrator proof: the confinement guard covers both tar mappings
- Daytona plugin `plugin.test.ts`: 94 pass
## Risks
- Any regression in the extract order could change workspace start
behavior.
- Any regression in the merged guard could block valid uploads or miss
an escape attempt.
## Model Used
OpenAI GPT-5, tool use enabled, current Codex session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
d5b9f6c8c9