paperclip

Paperclip v2026.831.1

Released: 2026-09-02

A patch on top of 2026.831.0 that fixes first-run onboarding. It carries a single targeted change; everything else in 2026.831.0 is unchanged.

Fixes

• Onboarding no longer gets stuck on the organization step. On the first onboarding screen ("What is the name of your organization?"), clicking Continue created the organization on the server but could leave the wizard sitting on the same step — so the page appeared to just refresh, and repeated clicks silently created duplicate organizations. The company-created list refresh can make the surrounding app adopt the just-created organization before the create request's continuation runs; the wizard now recognizes that as the same successful transition and advances to the first-agent step, while a genuine switch to a different organization still stops with a clear message. (#12667)

Upgrade Guide

• No migrations, no configuration changes, no API changes. Upgrade in place.

Paperclip v2026.831.0

Released: 2026-08-31

Paperclip v2026.831.0 soaked as 2026.828.0-beta.0 and carries 175 commits. The company skill library now actually reaches your agents at run time, Kimi Code joins the adapter lineup, operators hosting Paperclip for others get real control over which settings surfaces their users see, the sandbox callback bridge is rebuilt on a bounded HTTP/2 transport, and onboarding sheds its mission step for a shorter arc with the agent front and center. It also raises the Node.js floor to 24 — read the Upgrade Guide before updating a source install.

Breaking Changes

• Node.js 24.11.0 or newer is required. Every package manifest declares the new floor and the Docker images ship Node 24. Only managed installs (paperclipai install) refuse outright on an older Node; npm installs and a directly started server on Node 22/23 print an unsupported-version warning and continue. A warning is not support — upgrade Node before taking this release. (#11792, #11890)
• Invalid agent credentials are rejected instead of downgraded. A bearer token that fails verification now returns a 401 naming the cause (expired, unverifiable, terminated agent, wrong company, …) instead of silently falling through to the anonymous local-user actor. Any integration that depended on that fall-through will start seeing 401s — that fall-through was the bug. (#11589)
• The company brand color and per-company attachment size limit are gone. The fields are removed from the company General page, the create/update APIs, and the portability manifest; migration 0229 drops the columns. Export bundles that carry the old fields still import — the values are ignored. (#12291)
• Silent-run detection no longer takes action on its own. Output silence still surfaces as a suspicious/critical level on active-run summaries in the UI, but it no longer creates evaluation issues, recovery actions, comments, or wake requests. Stranded-task recovery similarly stops automatic takeovers: exhausted and unsafe recovery now routes to a board-owned action instead of reassigning work by itself. (#12242, #11961)
• Agent thought text stays out of automatic issue comments. ACPX run summaries are limited to the final output segment, and the legacy full-summary setting is deliberately ignored so configuration cannot bypass the containment. (#11801, @nearfolk)
• Grok no longer defaults --permission-mode to dontAsk. The adapter passes no permission-mode flag unless one is explicitly configured; --always-approve remains the unattended policy. (#11898)

Highlights

• Your skill library now reaches your agents — Skills used to be something you installed and hoped for. Now every agent run carries a deterministic manifest of the company's skill library in its instructions, agents can list skills over MCP, newly hired CEOs get the five core Paperclip skills by default, and installing a skill offers an "Enable for agents" step that pre-selects every skills-capable agent. When a skill fails to materialize, the failure is surfaced in the run output with its cause instead of the skill silently vanishing — and legacy runners are pinned back to the canonical operational skill. (#12147, #12138, #12136, #12146, #12225)
• Kimi Code is a first-class adapter — kimi_local runs Moonshot's Kimi Code CLI on the shared ACP engine by default — live streaming transcripts, tool-call lifecycle, the same machinery as Claude, Codex, and Gemini — with an automatic headless-CLI fallback when ACP prerequisites are missing. (#9967, @hawikk)
• Operators can shape what their users see — For anyone hosting Paperclip for others: PAPERCLIP_HIDDEN_SETTINGS hides settings surfaces by key — instance pages, individual experimental flags, company pages like Members, Invites, Secrets, Export, and Import, and even individual tabs like Provider vaults and Proposals. Hiding company.import floors the API too, and cloud-managed instances floor imports unconditionally. PAPERCLIP_SETTING_DEFAULTS overrides the schema default of selected instance settings without persisting anything, and a managed-sandbox-only mode hides host-path and execution-engine surfaces entirely. (#11823, #12199, #12284, #12285, #12293)
• The sandbox callback bridge, rebuilt to not fall over — The bridge that lets sandboxed agents call back into Paperclip now prefers a bounded Node HTTP/2 duplex transport, demoting the file-polling relay to a soft-deprecated fallback: bytes stay binary end to end, every resource dimension is budgeted by a process-owned byte ledger (route data, broker forwards, decoder buffers, pending writes), the in-sandbox gateway survives faults after readiness and fails loudly before it, and a duplex channel dying mid-run fails the run closed instead of letting it end "successfully" with lost writes. The retired v1 transport is deleted outright. (#12120, #11769, #12003, #12060, #11966, #12171)
• Onboarding gets to the point — The mission step is gone; the wizard opens on creating your agent, which asks for a name and nothing else (every onboarding hire starts in the general role). The steps are rebuilt on a single card with the brand pill held across them — dormant while you set up, alive when you review — and the auth page wears the new brand lockup. The idle "test your environment" card is gone too; the probe still runs on Connect and still blocks a failing hire. (#11935, #11905, #12274, #12074)

Improvements

• Opt-in error monitoring with Sentry — Set SENTRY_DSN and install the optional @sentry/node peer to get server-side error capture; the DSN rides the authenticated session response so the browser reports too, behind a React error boundary. Everything is fail-open: no DSN, no package, no Sentry, no problem. (#12190, #12249, #12270)
• Company imports land better — Last release made big imports resumable; this release makes arriving pleasant. Imported companies get de-duplicated names, an already-imported bundle names the company it landed as, every import outcome ends with a dashboard CTA, agents paused by an import carry a dedicated pause reason with visible notices and a Resume button in the thread, and the dashboard shows a banner with "Resume all" while imported agents sit paused. (#12145, #12144, #12143, #12140, #12142)
• Settings, unified — Company and instance settings share one navigation; instance general controls live on the company General page; invites moved into a tab of the Members page; the separate instance Heartbeats page is gone; and user-facing copy now says "organization" where it used to say "company". Hosted tenants also get issue prefixes derived from the organization name, following renames. (#11789, #12289, #12282, #12243, #12292)
• Environments you can actually manage — Deleting an environment now walks you through it: agents are reassigned in the same action, lease holders are listed, and destroying reusable sandboxes is a separate consent-labeled choice. Custom-image templates report boot-relevant drift with attribution and can be relinked in one click, and the managed default environment shows up by its name ("Paperclip Computer"), not its driver key. (#12053, #11751, #11641, #11838)
• Faster sandbox file movement — Inbound workspace, asset, and referenced-project syncs run in parallel where the provider opts in, and Daytona file uploads are transparently zstd-compressed with a raw fallback. Referenced projects finally honor .gitignore during staging, and reported transfer byte counts are the real ones. (#11736, #12271, #12184, #12180)
• Managed workspaces hold up across restarts — A shared port registry with lease heartbeats and identity checks keeps runtimes reliable across control-plane restarts, degraded embedded databases are detected and replaced with bounded restart supervision, cloned worktrees quarantine their copied services instead of fighting the originals, deferred database seeds are first-class operations with verified evidence, and the workspace login handoff is a signed, single-use ticket gated on real readiness. macOS worktrees can adopt their port owners now too. (#11740, #11651, #11653, #11706, #11671, #11763, @tf00185077)
• Wakes and recovery got more precise — Question answers are delivered durably through a dedicated delivery ledger, blockers-resolved wakes are level-triggered and cycle-aware so a terminal reset can't strand a dependent, recovery retries survive restarts with bounded lineages, routine runs that failed transiently clear themselves when work resumes, and agent resume is authorized through direct grants. (#12307, #11732, #11979, @zach-hermes, #11817, #9689, #12047)
• Quality of life — "Agent mode" is now "Auto mode" with full labels on the mode chips, every inbox item can be archived, parked browser tabs pick up new releases within the hour instead of serving a stale UI until a hard refresh, and the development runner honors --data-dir isolation. (#11866, #11636, #12198, #12193)
• Groundwork, deliberately off — A native Codex execution runner (adapter paperclip_runner) landed behind the default-off enableNativeRunner instance flag, along with its persistence contracts and transport. It refuses hires and runs while the flag is off; nothing changes for existing adapters. (#12188, #12169, #12176)

Fixes

• Sign-up and sign-in work on Better Auth 1.7 — the upgrade needed an issuer column Better Auth expects; migration 0230 adds and backfills it. (#11886, #12396)
• The rich text editor renders again — a second Lexical copy from a stale override broke node identity; the tree is back to one pinned copy, and prose containing angle brackets no longer kicks you out of the rich editor. (#12317, #12290)
• Docker orphans get reaped — tini is PID 1 in the server image, so processes adopted after their parent exits are cleaned up instead of accumulating as zombies; a behavioral probe in CI keeps it that way. (#12137, @zannis)
• Adapters — Hermes surfaces the real reasoning text from reasoning.available events instead of a placeholder (#9237, @harjothkhara); Grok stops warning when the default model sentinel isn't in the discovered list (#12062); the Claude/Codex/Gemini ACP adapters share one workspace-restore teardown (#12196); and the adapter Test lane verifies auth for every Claude ACP target with a deny-by-default probe environment. (#11810)
• Plugins — errored plugins retry at boot instead of staying dead, plugin detail-tab deep links survive a reload, and plugin bundles get the host's real JSX runtime. (#12054, #11826)
• Task chat — the composer clears the moment you send (and restores the draft on failure), the live tail shows the run's actual status instead of "Waiting for transcript...", and carets line up. (#11772, #11802)
• Git workspace sync — imported histories with no common ancestor are grafted instead of failing the run, sync-created merge commits carry a deterministic identity, and PR preparation can attach to an existing branch without touching it. (#11638, #11637, #11703)
• Server correctness — image-upload namespaces accept identity-provider characters with traversal rejected cleanly, the setup-token start guard is pinned to the served adapter, sandbox-driver environments skip the host provision command, rendered markdown code blocks follow the active theme, and the workspace reaper gained a configurable cooldown before it collects a terminal workspace's worktree. (#12288, #12179, #11626, #11591, #11642)

The onboarding-service fixes from this range (npx onboard leaving a crash-looping background service, the duplicate foreground-start prompt, onboarding ending without opening the dashboard) already shipped to stable users as v2026.824.1.

Upgrade Guide

• Node.js: the minimum is now 24.11.0. Docker users get Node 24 with the image. Source installs and custom base images must upgrade first. Managed installs refuse with an error on an older Node; npm installs and direct server startup on Node 22/23 warn and continue, which is easy to miss in service logs — check node --version before upgrading rather than relying on the warning.
• Migrations: this release adds 8 database migrations (0223 through 0230): a secret-proposal → interaction link (0223), unified adapter auth sessions replacing the Claude-specific table (0224, 0225), a disposition-repair dedup index (0226), the native-runner contract tables — inert while the flag is off (0227), durable question-answer deliveries (0228), dropping the company brand-color and attachment-limit columns (0229), and the Better Auth issuer column with backfill (0230). They run automatically on startup. Only 0229 discards data, and only those two removed fields.
• New optional environment variables (defaults preserve current behavior):
  • PAPERCLIP_HIDDEN_SETTINGS — comma-separated settings surfaces to hide, for operators hosting Paperclip for others; hiding company.import also floors the import API. (#11823, #12199)
  • PAPERCLIP_SETTING_DEFAULTS — JSON object overriding the schema default of selected instance settings. (#12285)
  • SENTRY_DSN — opt in to error monitoring; also install the @sentry/node@10.71.0 optional peer for server-side capture. (#12190)
  • PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS — days a terminal workspace is left alone before its worktree is reaped (default 7, 0 disables the cooldown). (#11642)
• Removed API fields: brandColor and attachmentMaxBytes are gone from the company create/update/branding APIs and the portability manifest. Clients still sending them get validation errors; exported bundles carrying them import fine.
• Behavior changes to note: bad agent bearer tokens now 401 (see Breaking Changes), silent runs and stranded tasks no longer trigger automatic recovery actions, and Grok's implicit --permission-mode dontAsk is gone.

Contributors

This release has 175 commits from 13 contributors. Thank you to everyone who contributed to this release!

@aaymeloglu, @harjothkhara, @hawikk, @nearfolk, @tf00185077, @zach-hermes, @zannis

Paperclip v2026.824.1

Released: 2026-08-25

Paperclip v2026.824.1 is a patch release on v2026.824.0 that repairs the background-service leg of onboarding end to end: the service now actually starts from an npx onboard, onboarding no longer steers you into a safety-check error afterward, and it finishes by handing you the dashboard in your browser.

Fixes

• Accepting the background-service prompt during an npx onboard no longer installs a broken service. The service definition targets the managed command shim, but an ephemeral run never installs it — the service crash-looped on a missing binary while onboarding, believing the service was handling things, skipped its own foreground start: a first run that ended with nothing serving. The service step now materializes the managed install (payload and command shim, pinned to the version being onboarded) before registering the service, and when it cannot — a custom PAPERCLIP_SHIM_PATH, or a failed install — it declines with the repair commands instead. (#12148)
• Onboarding no longer offers a foreground start the service already covers. After a successful service install, interactive onboarding still asked "Start Paperclip now?" — accepting ran a second server into the already-running instance guard, ending a successful onboard with an error. The prompt is skipped once the service is running. (#12153)
• Onboarding ends at the dashboard instead of a dead stop. After the service starts, onboarding now waits for it to report the endpoint it actually bound (including a fallback port when the configured one is busy), prints the dashboard URL, and opens it in the browser on interactive terminals. Headless runs print the URL; PAPERCLIP_NO_BROWSER=1 disables the browser open. If the service does not become ready, onboarding says so and points at paperclipai service logs instead of claiming success. (#12164)
• paperclipai doctor diagnoses a missing service binary as exactly that. The service-runtime check no longer suggests stopping a nonexistent conflicting process when the service's binary is missing (it names the missing path and points at paperclipai install), and the health check attributes a healthy responder that is not the managed service instead of reporting a plain "Healthy". (#12148)

Upgrade Guide

• No migrations and no configuration changes.
• If a previous onboard left a crash-looping background service behind: run paperclipai install, then paperclipai service start. The dead service definition is reused once its binary exists.

Contributors

This release has 3 commits from the core team.

Paperclip v2026.824.0

Released: 2026-08-24

Paperclip v2026.824.0 is a fast follow to 2026.817.0 — and the first stable to walk the full canary → nightly → beta → stable happy path end to end, soaking as 2026.818.0-beta.1 before promotion. It carries 172 commits: chat-style tasks graduate from experiment to the default experience, managed runtime previews become reachable over Tailscale HTTPS, sandbox execution gains a verified provider capability contract, you can sign in to Claude and Codex from inside the product, large company imports survive dropped connections, and a large batch of long-standing community fixes lands.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Chat-style tasks are the default. The "Chat-Style Tasks" experiment toggle is gone; the task detail page is now the conversation view for everyone. A new "Classic Task Interface" preference (enableClassicTaskInterface, replacing enableTaskChatRedesign in instance settings) restores the pre-chat page — page-level header, plain comment thread, fixed Properties sidebar — but chat-only features are unavailable there. (#11101)
• Sandbox session-output streaming is now capability-driven, and three operator flags are gone. The server's streamAgentSessionOutput setting and the Daytona plugin's useSessions and useLogStream keys no longer exist; the verified provider capability snapshot is the only streaming decision, with an automatic poll fallback. Saved configurations that still carry the removed keys load fine — the keys are simply inert. (#11463, #11557)
• Managed dev runtimes now default to Tailscale HTTPS previews. When the host broker is available, eligible Paperclip-managed worktree runtimes are exposed as tailscale_https instead of loopback HTTP. Set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off to keep the old behavior, or force to fail closed when the broker is missing. Managed runtime control routes also gained two new 409 responses (workspace_runtime_control_in_progress, workspace_runtime_lease_conflict) — callers that assumed a control always starts must handle a conflict. (#11524, #11525)
• Interaction resolver policy defaults to anyone for new interactions. Every interaction kind now goes through one resolver-policy evaluator with recorded provenance, instead of per-route rules that blocked valid agents. Migration 0218 deliberately does not widen anything already pending: existing rows keep their old restrictions under new names (board_or_agents → not_creator, board_only → human_only). (#11376)
• The decision-training surfaces are removed from the Decisions desk — the training library route, row actions, and drawer. The backend snapshot contract is unchanged and no data migration runs. (#11225)

Highlights

• Chat-style tasks, now the default experience — Last release's experimental conversation view is now how every task works, and it grew up on the way: cleaner message spacing and agent bubbles, searchable assignment and the sub-task tree in the properties pane, document comments docked in a side gutter, and a chat sidebar that surfaces every issue document and agent artifact. Blocked tasks show their blockers as links with live, ordered blocker work right in the thread, and an issue with a live run shows a calm in-flight notice instead of a false alarm. Onboarding is chat-first too: finishing the wizard drops you straight into your first task's conversation, where the agent greets you, asks clarifying questions, and proposes a plan you approve item by item. (#11101, #11263, #11226, #11456, #11487, #11423)
• HTTPS previews for managed runtimes, over Tailscale — A managed runtime service used to listen on plain loopback HTTP, so an agent's branch preview was unreachable from a phone or a second computer. Paperclip can now expose it at a real HTTPS URL on your tailnet, built in three deliberate layers: a separate least-privilege host broker that authorizes every mapping (peer credentials, a fixed port range, protected-port denies, append-only audit), the exposure lifecycle with durable issue-owned runtime leases and bounded control recovery so a stranded control can never block the lane forever, and a single port-pair mediator so a start can never collide with or adopt another issue's service — every mismatch fails closed and names the conflict. (#11524, #11525, #11526)
• Sign in to Claude and Codex from inside Paperclip — The new-agent page now offers Claude subscription login before you create the agent, on both Test lanes, with diagnostics kept in redacted server logs and login URLs normalized to allowlisted Anthropic hosts. Under the hood, a guarded setup-token flow drives claude setup-token through a sandbox pseudo-terminal with owner-bound sessions and one-time token delivery, and the Codex adapter gets an equivalent sandbox device-login that promotes the credential only after readiness checks and then deletes the temporary sandbox. Deployments behind a TLS-terminating platform edge (Railway, Render, Fly, …) can declare CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true so the transport guard stops warning about a connection that is HTTPS to the user, and a promoted device-login credential now survives managed-home re-seeding. (#11347, #11286, #11237, #11579, #11578)
• A real capability contract for sandbox providers — Last release introduced live output streaming and persistent sessions for Daytona; this release makes those behaviors provable instead of configured. Providers declare capabilities in their manifest, the live worker verifies them, and the server resolves the effective set fail-closed as the intersection of declared, verified, and configured — a declared capability can never grant a method the worker didn't prove. Streaming and persistent sessions now turn on wherever the verified snapshot allows, with an automatic poll fallback, and the three operator flags that used to gate them are gone (see Breaking Changes). (#11463, #11557)
• Chunked, resumable company imports — Last release raised the import cap to 1 GB; this release makes the transfer worthy of it. A dropped connection at 90% used to start the whole upload over — imports now move as verified ~32 MB parts spooled to disk with a durable run ledger, so an interrupted transfer resumes from the parts already uploaded (across dropped connections, page refreshes, and server restarts) and peak upload memory drops to one part. The Import page and CLI gained the resumable upload and a chunked preview, bundles now preserve task timestamps and hierarchy through export/import, imported agents keep their own adapter instead of being coerced to the destination's CEO adapter, and freshly imported tasks stay quiescent under the productivity review sweep. (#11223, #11224, #11193, #11192, #11191)

Improvements

• Onboarding meets you where you are — A company with no agent is sent into onboarding automatically, opening at the right step: the mission step is skipped when the company already has one, an existing mission is carried into the wizard, and the step is decided once instead of jumping under a mid-flow customer. The wizard's agent and connect-model steps were reworked for the chat-first flow, no longer keep an invisible disabled adapter selected, and the decorative panel follows your theme. (#11352, #11416, #11429, #11371, #11379)
• Paperclip Cloud onboarding seed — An instance can now receive the mission, first agent, and first task collected during Paperclip Cloud signup and apply them at activation, so a seeded stack opens ready to work instead of asking again. (#11098)
• Managed sandbox deployments — Tenants can edit environment variables on a platform-managed sandbox environment (and only that), and a managed-sandbox-only mode hides local execution entirely with run selection failing closed. Bundled providers' documented credential env vars (e.g. DAYTONA_API_KEY) now reach their plugin workers, and the synthetic "Local" default option respects the mode. (#11200, #11244)
• Archived work reopens in place — An archived isolated execution workspace can be reopened where it was, including archived git worktrees for managed-checkout projects. Cold arrivals on an archived company's URL are bounced to a clear page with a one-click Unarchive. (#11322, #11395, #11302)
• Review governance — Review-policy verdicts are serialized and transactional, a verdict can no longer bypass a policy by downgrading, the requester is persisted atomically, and the UI badges the review policy when it is what constrains approval. (#11405, #10938)
• Agents can look up secrets by name — A read-only /secrets/catalog endpoint maps secret names to ids for agents wiring env bindings — no values, no provider config. Issue-document annotations are also included in agent review context, so feedback left on a document reaches the agent that acts on it. (#9530, #11332)
• Search that scales — The parent-issue picker searches on the server instead of the loaded page, and the issues list API gained an updatedSince filter. (#11334, #9050)
• Observability — Host-side stage.sync steps are instrumented and the agent process span is homed correctly, continuing last release's sandbox-startup tracing work. (#11301)
• See your channel with paperclipai channels — the new command shows every release lane (stable, beta, nightly, canary), the version each currently resolves to, and which one your install follows. (#11210)

Fixes

• Deployments behind an authenticating proxy work end to end — The live-events WebSocket now authenticates cloud-proxied browsers (previously it could never connect through an auth-terminating proxy), the service worker's fetch fallback always answers with a real Response instead of a blank page, the web app manifest is fetched with credentials, and the UI survives first load against a cold backend. The archived-company selection ping-pong that could trap a session in a redirect loop is gone. (#11290, #11292, #11245, #11246, #11300)
• Everything is scoped to the signed-in account — Invite membership checks, company selection, and query caches are all keyed to the account that is actually signed in, caches clear on sign-out, and the stored company survives a failed company request instead of being dropped. Onboarding drafts verify ownership against a list fetched this session and never restore wizard state for a company the user does not own. (#11417, #11430, #11380, #11477, #11382, #11370)
• Security hardening — Tool-access routes no longer leak cross-tenant ID oracles, routine webhooks reject HMAC replays, routine detail responses exclude assignee configuration, page-publish uploader credentials are scoped to the publish helper, execution workspace summaries are isolated, only accessible workspace file links are highlighted, the heartbeat-fallback comment can never publish a raw transcript, and CLI guidance shown to users goes through the safe npx form. (#9589, #9994, #9818, #10894, #10790, #11090, #10143, #11343, #11400)
• Runs keep their context — Agent sessions are reused across execution handoffs and kept across issue comments, comment-wake decisions read post-insert issue state, stale closure-comment wakeups on done issues stop, successful-run handoff recovery skips recovery-action-driven and plugin-managed runs, and ACP run lifecycle corrections settle failures, sync workspaces back, and clean up leases properly. (#9917, #10111, #10068, #8656, #9010, #9047, #11454)
• Sandbox plumbing resilience — The sandbox stdin file race is closed with atomic writes and a fault-tolerant poller, stdin writes are ordered in the process-session bridge, the callback bridge poll loop has a per-iteration timeout and watchdog, bridge traffic forwards to the local listen origin, the agent-hire skill's routes pass the callback bridge, runs that hit a provider worker restart window retry instead of failing setup, Daytona liveness calls are bounded per call, and syncOut accepts bsdtar tarball listings. (#11235, #11406, #11341, #10017, #8978, #10212, #11408, #11289)
• Adapter reliability — Claude local pipes the print prompt via stdin and no longer fails root-only permission skips; Codex local skips benign stderr warnings when deriving a fallback error; OpenCode retries its models preflight under transient contention and treats the availability probe as non-fatal; Grok reports real token usage and cost instead of hardcoded zeros; Cursor cloud drops an unreachable API callback; hiring onto an adapter the instance cannot run is refused; and adapters load on Windows (pathToFileURL before dynamic import). (#9500, #9463, #10003, #9225, #10294, #10433, #8546, #10256, #4287)
• Server correctness — DELETE /api/issues/:id succeeds for issues with dependents (comments and read-state cascade; cost and finance records are kept with their issue reference cleared), non-UUID company refs return 404 instead of 500, cross-package Zod errors are recognized, wiring blockers in a PATCH no longer implicitly reopens a blocked issue, unsigned ask-first requests stay out of the review queue without being cancelled, the terminal workspace reaper stops starving on its oldest candidates, the agent run JWT default TTL is aligned to the documented 48h so suspended-laptop runs stop waking with an expired credential, an explicit PAPERCLIP_API_URL overrides the derived runtime URL in run env, base-URL ports are only rewritten for loopback hosts, and silent nonzero exits in the Hermes flow surface as failures. (#11331, #9959, #10168, #10269, #11338, #11238, #10176, #10339, #10258, #10107)
• Workspace Git scans are bounded — One bounded scheduler now coalesces and caps every expensive workspace Git scan (a request storm once produced ~270 concurrent git status processes and starved health checks), and the browser only starts scans when the file panel is open and visible. (#11572)
• UI paper cuts — The queued-message interrupt action is back, agent secret access moved to a searchable secrets tab, slash autocomplete scrolls inside dialogs, inbox archive gained an undo toast and folded subtasks are remembered, inbox routing honors the saved policy for explicit targets, board approval prose renders as markdown, create-dialog badges use the real issue prefix, issue-document deep links route correctly, truncated issue descriptions are flagged, generated invite links prefer the public base URL, selected run lifecycle and logs stay current, and the mobile task chat gained blocker actions, a composer aligned with the thread, and a new-task dialog that stays above the keyboard. (#11374, #11283, #11222, #11220, #11069, #11221, #9817, #8550, #11551, #4771, #7619, #10169, #11282, #11296, #11281)
• Odds and ends — Skill sync refreshes project folders in place instead of replacing them, issue writes through board keys work regardless of assignee, environment-secret bindings resolve their company context on first save, and worktree-mode dev instances warn when the embedded-Postgres data directory sits in the OS temp dir. (#11066, #9025, #11291, #8283)

Upgrade Guide

• Migrations: this release adds 11 database migrations (0212 through 0222), covering the one-per-company onboarding first task (0212), resumable company transfer runs (0213), adapter device-login sessions (0214, 0215), Cloud onboarding seeds (0216), issue-deletion foreign-key policies (0217), interaction resolver-policy defaults and provenance (0218), runtime exposure state (0219), execution-workspace runtime leases (0220), Claude setup-token sessions (0221), and environment-lease references that survive environment deletion (0222). Migrations run automatically on startup — no manual action required. Nothing drops a table or deletes data; note that 0218 rewrites resolver-policy values on existing pending interactions (conservatively — see Breaking Changes) and 0217/0222 change what happens to dependent rows on delete.
• New optional environment variables (all have sensible defaults; set only if you need them):
  • PAPERCLIP_MANAGED_RUNTIME_HTTPS — auto (default), off, or force; controls the Tailscale HTTPS default for managed runtime previews (see Breaking Changes). PAPERCLIP_TAILSCALE_BROKER_SOCKET and PAPERCLIP_TAILSCALE_DNS_NAME override the broker socket path and the tailnet DNS name; PAPERCLIP_VITE_HMR_PROTOCOL (ws/wss) pins the dev-preview HMR protocol. (#11524, #11525)
  • CLAUDE_LOGIN_TRUSTED_PROXIES — allowlisted proxy peers for the Claude login transport guard; CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true — declare platform-edge TLS termination on managed platforms where the proxy addresses aren't knowable. (#11286, #11579)
  • PAPERCLIP_ONBOARDING_SEED_ADAPTER_TYPE — adapter type for the agent created by a Cloud onboarding seed. (#11098)
  • SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR — where durable sandbox cleanup records are spooled; PAPERCLIP_PROCESS_SESSION_STDIN_MAX_RETRIES — retry ceiling for the sandbox stdin poller. (#11347, #11235)
• Removed configuration keys: streamAgentSessionOutput (server) and useSessions / useLogStream (Daytona plugin) no longer do anything — remove them from saved configs at your leisure; they load but are inert. (#11557)
• Agent run JWT TTL: the server default now matches the documented 48h (PAPERCLIP_AGENT_JWT_TTL_SECONDS=172800). If you relied on the old implicit 1h expiry, set the variable explicitly. (#10176)
• HTTPS previews: to use them, install Tailscale on the host and run the new broker (see the @paperclipai/tailscale-https-broker README); to opt out, set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off. Nothing else changes for unmanaged or custom services.

Contributors

This release has 172 commits from 32 contributors. Thank you to everyone who contributed to this release!

@0xopaque, @adamteale, @ApolinarioRatio, @austinpilz, @christianlappin, @cucurigoo, @dmndbrp-oss, @dylanroy, @edgardfrz, @fronc, @futhgar, @panbanda, @raviy06, @samrusani, @santastabber, @sauerdaniel, @seb-veto, @Sergio-LPA, @stubbi, @ulisavo, @vmarchaud, @webdevdot

Paperclip v2026.817.0

Released: 2026-08-17

Paperclip v2026.817.0 is the first stable release since 2026.722.0 — and the first stable ever published through the new canary → nightly → beta → stable release channels. This exact build shipped as a canary, was smoke-tested and promoted to nightly, soaked as 2026.811.0-beta.0, and only then was promoted to stable. It carries 311 commits spanning a first-class Decisions workflow, full-fidelity company Import/Export, a managed CLI install lifecycle, a chat-style task view, and a long list of fixes and performance work.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Docker :latest now means stable. Previously :latest tracked every master merge. If you relied on that behavior, switch to :canary (or :nightly for a smoke-gated daily). Stable images also get :YYYY.MDD.P version tags and every image gets :sha-<short-sha> for exact pinning. (#11006)
• Experimental Cloud Sync is removed. The host-to-host sync transport (previously flag-gated) is gone; company Import/Export is the single supported data-movement path. Migration 0196 drops the old sync-state tables. Your company data is untouched — only the experimental transport's own bookkeeping is removed. (#10507)
• Standard-trust agents can write to company-visible issues. Comments, issue updates, child-task creation, and assignment now follow one default-open rule based on issue visibility, instead of per-channel ownership grants. Company, user, trust-scope, and run-lifecycle controls still apply, and cross-issue side effects are contained and attributed. (#10804, #10837)
• Archived projects are excluded from the default project list route. Pass the explicit filter to include them. (#10146)

Highlights

• Release channels: canary → nightly → beta → stable — Paperclip now ships on four channels. canary publishes on every merge to master; nightly republishes the newest green canary once a night, but only after the full release smoke suite (real Docker container, browser-driven onboarding) passes against the exact published artifact; beta is a maintainer-promoted nightly behind an approval gate, re-smoked after publish; and every stable must first soak as a beta for at least 3 days. Install with npx paperclipai@latest (stable), @beta, @nightly, or @canary, or pull ghcr.io/paperclipai/paperclip:latest / :beta / :nightly / :canary. Docker :latest now means stable — see Breaking Changes above. Full details in doc/CHANNELS.md. (#11006, #11008)
• Decisions: a first-class propose/decide workflow — Agents can now propose multi-option actions instead of performing them, and humans decide from a governed, auditable surface. Decisions v1 adds the propose mode itself (typed options and inputs, stale-target detection, audited effect execution), durable decision queues with a prioritized, decide-now-ranked attention feed, and a Decisions desk with triage controls, an aging shelf, and reversible retention. Completed-target decisions retire automatically and link back to their targets. (#10010, #10651, #10672, #10785, #10474, #10892)
• Full-fidelity company Import/Export replaces Cloud Sync — The experimental host-to-host Cloud Sync transport is gone; Import/Export is now the single way to move a company between instances (self-hosted ↔ cloud, or plain backups), with no reachability or cross-instance auth requirements. Bundles (schemaVersion 6) now carry labels, blockers, issue documents, work products, monitors, and every attachment as content-addressed sha256 blobs verified before a single row is written. Imports run as durable async jobs with batched inserts and an integrity guard, packages upload as compressed zips, and the upload cap is now 1 GB and operator-configurable via PAPERCLIP_IMPORT_ZIP_MAX_BYTES. (#10507, #10523, #10531, #10538, #11184)
• Managed install, update, and service lifecycle in the CLI — The paperclipai CLI can now install Paperclip as a durable, self-updating service instead of an ephemeral npx process: managed install with a per-user payload store and stable command shim, side-by-side updates with pre-update backups and retained rollback state, plus service, uninstall, doctor, and bootstrap-installer support across Linux, macOS, containers, and WSL. Managed updates preserve your env files and extensions. (#10045, #10980, #11005)
• One Activity page for "who changed what" — The basic Activity list and the separate Audit page merged into a single rich Activity page built on the audit feed: full history, filters, a scope toggle for all actors vs. agent actions only, and a per-agent audit tab on agent detail. Privileged controls are hidden from members without the audit permission, and cross-task agent writes now come with attribution, audit receipts, and actionable denial messages. (#10838, #10831, #9744, #10843)

Improvements

• Multi-project workspace sync, on by default — Runs that reference multiple projects now sync every referenced project into the workspace by default, with per-project authorization resolved at run prep and partial-sync warnings surfaced on the run. @-mentioned projects are also staged into remote sandboxes over the confined transport. (#10473, #10469, #10380, #10564)
• Shared workspace concurrency controls — Issue runs on a shared workspace are serialized with bounded busy deferrals, and the concurrency limit is configurable from the workspace policy editor. (#10699, #10759, #10771)
• Human-approved secret proposals — Agents that encounter credentials during work can hand them into Paperclip as inert proposals; nothing becomes a live secret or binding until an authorized human reviews and approves. Secret details also gained write-through editing of external values and deep links. (#9934, #10196)
• Agent-to-agent governance surfaces — Issue-thread interactions support governed agent addressees, so one agent can explicitly address another for a response, with server-side authorization, withdrawal, and terminal-issue expiry. Agents can resolve review confirmations under explicit review verdict policies, review rounds are capped with exhausted reviews escalated to the responsible human, delegation cycles back to an open ancestor's creator are refused, and assignment to paused agents is refused (with warnings when an escalation path routes to a paused manager). (#10252, #10251, #10939, #10931, #10650, #10658, #10648, #10657)
• Task-scoped egress grants for confined runs — On Kubernetes confinement, tasks that legitimately need GitHub or package registries can request narrow, issue-scoped egress grants that become run-label-selected network policies, instead of the operator enabling broad namespace-wide egress. Denied requests explain the governing policy and how to request a grant. (#10155)
• Cache-adjusted run cost — Adapters can report the provider-billed cost after prompt-cache discounts, so cache-heavy runs stop being priced wrong in the cost ledger. (#10349)
• Routines: activity-gated run policy — Routines can gate advanced runs on recent activity, exposed through both the editor and the API, and the routines list groups by folder name. (#10225, #9438, #10201)
• Model catalog updates — Claude Opus 5 and Claude Sonnet 5 join the Claude adapter's static model fallback, and GPT-5.6 model metadata is resolved at source for Codex. Cheap model profiles are now disabled by default for new agents: an adapter's cheap profile requires an explicit operator opt-in at agent creation, and Codex's cheap profile no longer defaults to a hardcoded model (existing agents are unchanged). (#10327, #10280, #9780, #10019)
• Daytona sandbox improvements — Agent output streams live from Daytona sandboxes (no more host output polling), sessions are persistent with plain command dispatch, and an advisory bwrap wrapper with capability probes hardens execution; app-home ownership is ensured before the privilege drop. (#11049, #10941, #10541, #10554, #10805, #10530)
• Quieter, clearer system messaging — Recovery notices are structured and humanized into compact rows with evidence on demand, recovery updates are quieter overall, recovery and blocked-notice copy is rewritten in plain language, and workspace-ready comments render as compact system notices. (#11075, #10542, #10065, #10636)
• UI quality of life — Task chat composer drafts persist across navigation, task lists gained recency separators, copy and feedback actions returned to the agent bubble footer, the task identifier shows in the task-detail breadcrumb, and page loads got animated paperclip loaders. Task priority controls are hidden from the UI (the data model, API, and search DSL are fully intact). (#11076, #10454, #11025, #10933, #10456, #11024)
• Per-user document stars — Star documents for yourself without affecting anyone else. (#9952)
• Faster steady-state server — Steady-state DB hot paths in the dashboard, attention, and productivity sweeps were cut down, attention feed queries run in parallel instead of strictly sequential (a big win when Postgres is network-attached), and new indexes cover the recovery-sweep lookups. (#10992, #10795, #10969)
• Faster sandbox startup — Sandbox run startup sheds round trips across the board: git-workspace staging coalesces into one confined sync, dead start round trips are folded, the two bridge setups run in parallel, the started sandbox handle is cached per lease, remote script writes skip on content-hash match, staging happens once per remote session, and exec wrappers drop nvm sourcing with an opt-in no-profile fast path. (#10488, #10485, #10334, #10335, #10377, #10089, #10443, #10352)
• Snappier UI navigation — Issue detail navigation is warmed ahead of the click. (#10416)
• Observability — Sandbox startup and execution now emit granular OpenTelemetry spans (provider round trips, pack/transfer, cache-hit flags, per-step timing attribution), and manual spans export correctly. (#10758, #10764, #10999, #10204, #10565)

Experimental

These ship behind experimental settings toggles.

• Chat-style task view — An opt-in "Chat-Style Tasks" experiment turns the issue detail page into a conversation: the thread leads, the composer stays at the bottom, live tool activity folds into compact summaries, and properties/plan/artifacts move into header tabs. A second iteration added a rich-text composer with attachment chips, live-turn narration, and a mobile layout. (#10606, #10707)
• Apps and Connections — Notion connects through MCP OAuth with PKCE and dynamic client registration — no manual OAuth credential setup — and companies can hold multiple connections to the same provider, with explicit review decisions for quarantined actions. (#11009, #11060, #11040)
• Status cards — An experimental status card view compiles a single-prompt, agent-generated status update, joining summary-mentioned issues to the watched set. (#10101, #10202, #10205)
• Simplified English interactions — An experimental flag renders agent interactions in Simplified English, with an optional /simplified-english skill in the catalog. (#10934, #10410)

Fixes

• Real version numbers everywhere — Published Docker images now stamp the real build version instead of the package.json placeholder, bake in the build commit, and expose the running commit on the unauthenticated health response — so --version, the UI, and /health finally agree on what you're running. (#10257, #10566, #10563)
• Config preservation — Managed config repair preserves extensions and guards invalid repairs, managed environment drift survives boot, and skill sync / package import no longer silently replace an operator's skill selections — replacement now requires an explicit merge mode. (#11005, #10979, #10978)
• Inbox correctness — Tasks completed by human users archive properly, passive issue views stay out of Mine, archived-by-you items stay archived, inbox re-sorts defer to attention boundaries so items stop jumping mid-read, empty search sections hide, and external object summaries no longer leak into the inbox. (#10668, #10581, #10623, #10700, #10020)
• Workspace resilience — Execution workspaces whose recorded branch no longer exists self-heal, isolated workspace provisioning self-heals when the base CLI is broken, sandbox git copy-back bundles against the merge-base so diverged or reset workspaces still import, delivered workspaces are recognized and terminal worktrees reaped, and isolated setup defers until runtime start. (#10578, #10574, #10601, #10908, #10653)
• Codex adapter reliability — Mid-turn harness crashes are classified structurally as retriable infrastructure errors, silent active builds are preserved, control-plane access is preserved in sandbox runs, sandbox runs can use the sandbox image's own Codex login, and a duplicate --skip-git-repo-check flag injection is gone. (#10210, #10153, #10152, #10582, #10595)
• Plugin runtime fixes — Plugin agent session turns and replies deliver reliably, freshly-started plugin workers receive their stored config, and proactive worker-to-host calls resolve a company scope. (#10137, #10092, #10103)
• Backup retention respects calendar months — Monthly backup pruning now uses calendar-month boundaries instead of a fixed 30-day approximation, so it no longer deletes valid month-end backups early. Isolated worktree dev instances also stop scheduling their own redundant backup streams. (#3718, #10520)
• Server hardening — Company-export YAML renders iteratively to stop a stack overflow on large companies, PAPERCLIP_DECISION_SIGNING_SECRET is no longer required at startup (a secure persisted instance key is used when absent), duplicate built-in agents are prevented and self-healed, routine checkout conflicts return 409, and due timer intervals are claimed atomically. (#10854, #10594, #10223, #3790, #10584)
• UI paper cuts — White-on-white text on light-mode chat bubbles, the Live badge and Working shimmer surviving task teardown, blockquotes the markdown editor escaped as \>, clipboard copy over plain HTTP, plans not showing in the Plan pane, agent detail lingering after termination, and the full selected timeline window not loading are all fixed. (#10952, #10985, #10466, #10875, #10930, #10451, #9576)

Upgrade Guide

• Migrations: this release adds 28 database migrations (0184 through 0211) covering Decisions, status cards, document memberships, interaction governance, and new indexes. Migrations run automatically on startup — no manual action required. Note that 0196 drops the tables belonging to the removed experimental Cloud Sync transport (see Breaking Changes).
• New optional environment variables (all have sensible defaults; set only if you need them):
  • PAPERCLIP_IMPORT_ZIP_MAX_BYTES — company import zip upload cap (default 1 GB). (#11184)
  • DATABASE_PREPARED_STATEMENTS, DATABASE_POOL_MAX, DATABASE_IDLE_TIMEOUT_SECONDS, DATABASE_CONNECT_TIMEOUT_SECONDS — DB client tuning; set DATABASE_PREPARED_STATEMENTS=false when connecting through a transaction-mode pooler (pgbouncer, Supavisor, Neon pooled hosts). (#10795)
  • RUN_LOG_S3_INFLIGHT_MIRROR_SECONDS — opt-in throttled mirroring of in-flight run logs to S3 with a graceful-shutdown flush; unset means no change. (#10512)
  • PAPERCLIP_DECISION_SIGNING_SECRET — optional override for decision signing; when absent, a secure persisted instance key is used automatically. (#10594)
• Docker users: decide which channel you want. If you tracked :latest for master builds, that lane is now :canary; :latest only moves on stable releases from here on.
• Downgrading across channels (e.g. nightly back to stable) can mean running an older schema than your data was created with — treat a downgrade like a restore and back up your data directory first.

Contributors

This release has 311 commits from 17 contributors. Thank you to everyone who contributed to this release!

@bluzername, @LeonSGP43, @myaji35, @noahrasheta, @samrusani, @santhiprakash, @scokeepa, @sparkeros

Paperclip v2026.722.0

Released: 2026-07-22

Highlights

• Run-bound agent secret access — Agents can now fetch the secrets they've been granted on demand through a run-bound API, instead of relying only on ambient environment injection. A new access.* delivery mode exposes API-only secrets, GET /api/agents/me/secrets lists just the aliases an agent is granted, and POST /api/agents/me/secrets/:key/value returns a value with Cache-Control: no-store. Every value read is written to both the security audit trail and the operator activity log, low-trust review/skill-test tokens stay denied, and a new Secret access editor lets you manage per-agent grants from agent settings. (#9921)
• Local agents run on Windows — The embedded ACPX engine no longer wraps local agent commands in a generated Bash script, so Claude, Codex, Gemini, and custom ACP adapters now spawn natively on Windows as well as Linux. Environment variables are injected through ACPX session options, child stderr is captured in-process, .cmd npm/pnpm shims are preferred on Windows, and symlink EPERM failures fall back to copies. A real Node ACP spawn smoke now runs on both Ubuntu and Windows. (#9980)

Improvements

• User-named PAPERCLIP_* bindings now reach your agents — The heartbeat previously stripped every PAPERCLIP_-prefixed env binding before resolution, so a secret you deliberately named something like PAPERCLIP_CLOUD_PROD_PROVIDER_RAILWAY_TOKEN was silently dropped. Now only PAPERCLIP_API_KEY is categorically rejected, harness-assigned runtime vars always win, and every other PAPERCLIP_* binding flows through to the run environment. (#9974)
• Sturdier telemetry client — The telemetry client now matches the wire contract: payloads are chunked, batch IDs are deterministic, retries are batched with backoff, and the local store is bounded. A silent-drop baseline is pinned and caps/backoff are now a configurable surface. Telemetry remains anonymized and can be disabled with DO_NOT_TRACK=1 or PAPERCLIP_TELEMETRY_DISABLED=1. (#9946, #9906, @nickyleach)
• Slash-named secrets browse as folders — Secrets whose names contain slashes now navigate as nested folders in the UI. (#9913)
• Searchable agent picker for secret access — Granting per-agent secret access now uses a searchable agent picker instead of a long flat list. (#9918)
• Cleaner external object labels and star controls — External object labels and the star controls that sit next to them were simplified for less visual noise. (#9929)
• Safer sandbox CODEX_HOME sync — The codex-local adapter now stages an explicit allowlist when syncing CODEX_HOME into the sandbox, rather than copying the whole home directory. (#9972, @nickyleach)

Experimental

These features ship gated behind experimental settings — enable Apps under experimental settings to try them out.

• Connections v3 foundation — The groundwork for one-click Connected Apps landed: a v3 schema core adds a stable company-scoped connection UID, explicit ownership/auth/transport fields, a subject-aware connection_grants table, and multi-key credentials (with the legacy remote_http transport renamed to mcp_remote). On top of that, a generated AppDefinition Wave 1 catalog gives browse and setup a single typed contract, and a runtime layer adds subject-aware authorization state, scoped key handling, and OpenAPI-registered grant routes that fail closed for unknown scopes. (#9958, #9981, #9982)

Fixes

• Archived inbox items stay archived — Items you've archived no longer resurface in the inbox. (#9931)
• Execution-policy final approval finishes cleanly — Approving the final stage of an execution policy now terminates the policy instead of rewinding it back to stage 1. (#7936, @HKTITAN)
• Accept Office issue attachments — Office document attachments (Word, Excel, PowerPoint) are now accepted on issues. (#8562, @samrusani)
• Redact HTTP cookies from server logs — Cookie headers are now redacted from server logs so session material doesn't leak into log output. (#7977, @nosolosoft)
• No more 500s from run-authored comments — createdByRunId is sanitized on comment insert, fixing a class of 500 errors. (#9489, @digitalflanker-ux)
• Preserve terminal status on issue release — Releasing an issue no longer clobbers a terminal (done/cancelled) status. (#7524, @harshkotak)
• Fail loudly on invalid config files — An invalid config file now surfaces a clear error instead of being silently ignored. (#9041, @lesbass)
• Non-clickable pending-approval guidance — The pending-approval admin guidance on the invite screen is no longer a misleading clickable element. (#6786, @le-czs)
• Cron validity settles with radix-ui 1.6.4 — Cron validity handling and a settle-branch test were synced for radix-ui 1.6.4. (#9966, @nickyleach)
• CLI import selection fixes — Cleared import selections no longer drop the extension file, and missing company-manifest fields were added to the import-selection test fixture. (#2379, @kevinmanase, #9978, @aaymeloglu)
• Cloud-managed instances pass the health gate — Cloud-managed instances are now treated as bootstrapped in the health gate so they don't stall on startup. (#9912)

Upgrade Guide

• This release adds two additive database migrations for the Connections v3 foundation (0182_connections_v3_schema_core, 0183_connection_user_authorization_state), which backfill stable connection UIDs, create default workspace grants, and rename the remote_http transport to mcp_remote. Migrations run automatically on startup — no manual action is required.
• If you previously set a static PAPERCLIP_API_KEY in adapter/config env to override the run token, that override no longer applies — the harness-minted run token is now the only source of the run API key. All other PAPERCLIP_*-named bindings now flow through to the run environment as expected.
• Connections/Apps remain gated behind experimental settings. Enable Apps under experimental settings to try the Connections v3 surfaces.

Contributors

This release has 44 commits from 13 contributors. Thank you to everyone who contributed to this release!

@aaymeloglu, @digitalflanker-ux, @harshkotak, @HKTITAN, @kevinmanase, @le-czs, @lesbass, @MindSyncHub, @nickyleach, @nosolosoft, @samrusani

Paperclip v2026.720.0

Released: 2026-07-20

Highlights

• Skill Studio & skill organization — A three-pane skill IDE with sandboxed test runs, so you can author, edit, and try out skills without leaving Paperclip. Skills now organize into nested folders with a dedicated "My Skills" view, you can import skills straight from a project, and company skill policy is open-by-default with core UX for tightening it. Company skill forks run prechecks before they land, and markdown edits get proper dirty-tracking and save. (#9241, #9235, #9356, #9633, #9620, #9564)
• Attention queue & Decisions — A new attention queue and Decisions surface bring everything that needs your input into one place, with faster scrolling and readable, mobile-friendly decision rows. (#9380, #9468, #9472)
• Better search — Search gains filters, sorting, and operators, with command-palette parity so you can find issues and entities the same way everywhere, plus a new bulk extract endpoint. (#9327, #9507)
• Tougher, self-healing runs — Run restart recovery, workspace self-heal, quota-aware retries, and failed-run metrics mean your instance tries harder before it involves you. Recovery is now routed by failure cause, waits for provider quota resets, throttles serial repeats, and reports observability metrics with a rate alert. Plan-approval continuations and external-wait liveness are durable across failed wakes, and resolved blockers reliably wake the tasks that depend on them. (#9183, #9331, #9373, #9229, #9634, #9635, #9651, #9644)

Improvements

• Sandbox execution — ACP sessions can now run in sandbox execution targets, with sandbox support for the Grok local adapter, custom-image snapshots applied across config tests and saves, and a sandbox wall-clock backstop raised to four hours for long-running work. (#9390, #9338, #9385, #9232)
• Issue monitors are visible everywhere — External-service and issue monitors now surface across task surfaces and in issue properties, so you can see what a task is waiting on at a glance. (#9783)
• Reworked secrets dialog with in-sheet agent access — The secrets dialog was reworked and you can now grant per-agent secret access directly in the sheet. (#9797)
• Agents can safely tidy inboxes — Agents can now archive and tidy user inboxes under a governed inbox-archive access policy. (#9724, #9658, #9654)
• Active PR gardening workflow — A new PR-gardening workflow keeps open pull requests moving. (#9510)
• Stable workspace service controls — The workspace service control bar was stabilized so start/stop/restart controls behave predictably. (#9705)
• Responsible-user attribution on activity logs — Activity logs now stamp the responsible user, and issue attribution is explicit. (#9731)
• Clearer blocked-issue messaging — When a message won't reopen a blocked issue, the UI now explains why (Rule C). (#9417)
• Interruptible queued runs — You can now interrupt queued issue runs instead of waiting them out. (#9725)
• Clearer task-level model overrides — Issue properties now clarify task-level model overrides. (#9710)
• Design-system convergence — Single-source design tokens, a visual regression suite, and a retuned theme, plus broad Card/Badge adoption, a multiplicative radius ladder, and unified list surfaces. Task status glyphs now use Lucide icons. (#9134, #9240, #9395)
• Activity-gated routines — Scheduled runs can be gated on external activity, so routines only fire when there's real work to do. (#9436)
• ACP is the default engine for local adapters — Local coding adapters now run through ACP by default, with local coding processes confined for safety, and the Claude ACP client was updated. (#9238, #9504, #9484)
• Spend & cost telemetry — ACP-lane usage and cost now flow into spend telemetry, unpriced CLI usage is recorded, and credential-health retention is documented. (#9471, #9505, #9248, @nickyleach)
• Durable run logs — Run logs are now mirrored to a durable object-storage-backed store. (#8984, @stubbi)
• Codex & model updates — Updated Codex adapter GPT-5.6 defaults and added gpt-5.4-mini to Codex/OpenCode selection (plus openai/gpt-5.5 to OpenCode). (#9352, #4357, @supertaz)
• Ship ripgrep in the agent runtime image — rg is now available out of the box in the base agent image. (#8976, @stubbi)
• Fewer redundant wakes — Redundant issue re-wakes are throttled and the execution contract is injected once per fresh heartbeat, cutting duplicate token spend. (#9470, #9469)
• Show source SHA for unreleased builds — Builds that aren't on a formal release now surface their source SHA, preserved even without Git metadata. (#9508, #9638)
• Prose editor for agent instructions — Markdown agent instructions now use the prose editor. (#9332)
• Health-gated dev services — Paperclip dev services now require health readiness before they're considered up. (#9269)
• Harder environment deletion — Environment deletion is hardened and now shows its delete blast radius. (#9250, @nickyleach)
• Faster release verification — The release verify workflow is parallelized and npm registry version queries are batched. (#9168, #9202)

Experimental

These features ship gated behind experimental settings — enable them under experimental settings to try them out.

• MCP Tool Gateway & Apps — A first-class, governed way to connect Model Context Protocol tools. A named MCP gateway brokers every tool call, governed access contracts and a tool-access policy decide which agents and profiles may use which tools, and the new Tools, Profiles, and Apps surfaces let you wire up, install, and smoke-test connections from the UI. (#9556, #9557, #9558, #9559, #9560, #9561, #9562, #9563)
• Built-in Summarizer & summary slots — A built-in summarizer agent and summary slots surface concise, always-current summaries right in the UI. (#9713)
• Decision Training — A new decision-training library and inspector let you capture decision snapshots and review how your agents decide over time, backed by a snapshot foundation and image galleries for decisions with visual context. (#9702, #9779, #9532)
• Cases — A new first-class Case object gives you a structured, document-backed record for things like releases and social threads. (#9198)

Fixes

• Cross-tenant existence oracle closed — The API now returns 404 instead of 403 so it no longer leaks whether another tenant's resource exists. (#3967, @stubbi)
• Stronger public invites — Invite-token entropy is widened and public invite endpoints are rate-limited. (#8979, @stubbi)
• apiCompression no longer corrupts auth — Fixed gzip clients getting corrupted or dropped Better Auth responses. (#9381)
• React performance-track memory leak — Reaped React 19.2 performance-track measures that were leaking memory in long-lived tabs. (#9827)
• No more duplicate tasks or recovery loops — Duplicate task creation and recovery loops are prevented, repeated creates are deduplicated, and cancelled productivity-review loops are stopped. (#9648, #9650, #5210, @YanisThePie)
• Reliable hot restart — Hot-restart run adoption is restored and a hot-restart shutdown deadlock is fixed. (#9647, #9670)
• Durable continuations — Accepted-interaction continuation recovery is bounded, stranded recovery continuations are restored, and stale handoff alarms are suppressed during live continuation. (#9656, #9630, #9695)
• Codex auth hardening — Refresh auth failures are classified, a host-unusable Codex auth merge fails closed, Codex models are configured at startup, the output-inactivity timeout is raised to 30 minutes, raw child output counts as activity, and shadowed sandbox auth is flagged. Codex auth-merge scripts moved into the adapter with an outbound copy-back home-asset restore path. (#9598, #9276, #9700, #9699, #9632, #9259, #9785, #9787, #9788, @nickyleach)
• Explain AWS secret failures — AWS secret creation failures are now explained in the UI instead of failing silently. (#9645)
• Routine catch-up coalescing — Sub-hourly catch-up runs are coalesced so a backlog doesn't stampede. (#9649)
• Worktree port conflicts — Recurring worktree port conflicts are prevented, and adapter env is forwarded to local agents while runtime env stays authoritative. (#9642, #9617)
• Search & PR-gardening hardening — Extract match limits are honored and PR-gardening candidate discovery is hardened. (#9652)
• Company skills honor responsible-user grants — Company skill access now honors responsible-user grants. (#9571)
• Decision cards survive machine comments — Machine-authored comments no longer supersede decision cards. (#9015, @nsollazzo)
• PID persistence for adapters — onSpawn is forwarded to the Hermes and process adapters so PIDs persist. (#8722, @machjesusmoto)
• Reliable process teardown — runChildProcess now escalates to SIGKILL on liveness rather than trusting child.killed. (#8598, @justinltodd)
• System comments show as "You" — System-authored comments now display as "You" instead of "Paperclip". (#6330, @BorClaw)
• Correct heartbeat activity attribution — Heartbeat invoke/resume now uses run.id for the activity log. (#3424, @tmartin2113)
• Prefix-aware export/import links — Company export/import links are prefix-aware again behind a path prefix. (#6648, @qbamca)
• Tolerate empty profile names — Empty-string user names in profile/session parsing no longer break. (#8986, @stubbi)
• Worktree repair — Dirty and foreign-branch execution worktrees are repaired, target attestation is required before repair, and worktree execution only starts after activation. (#9297, #9414, #9374)
• Workspace branch reconciliation — Added auto-forward execution-workspace branch reconciliation and its route, and avoided freezing an accepted-plan workspace branch before child realization. (#9172, #9170, #9233, @nickyleach)
• Request-storm and polling fixes — Fixed a request-storm polling loop, issue-list coalescing, bounded the shared polling cache, event-sourced the company live-runs list, and cut live-update churn that inflated tab memory. (#9190, #9406, #9627, #9701, #9624)
• Live-run readability & memory — Live run streaming text is more readable, live agent-run transcript buffers are capped to bound tab memory, and markdown mention observers are no longer recreated on every render. (#9330, #9569, #3809, @LeonSGP43)
• Threads stay put — Issue threads no longer jump to the latest comment while you're reading. (#9354)
• Markdown rendering fixes — Rendered markdown list markers stay visible and numbered lists are no longer cut off on the left. (#9359)
• Inbox & list polish — The inbox unread badge no longer indents the row, unread badge alignment is fixed, and inbox hover stays in sync with j/k keyboard selection across list reshapes. Agent names stay visible on the mobile agents index and inbox/task list nesting, hover perf, and routine detail were tidied. (#9767, #9685, #9680, #9236, #9317, #9383)
• Environment edit is a routed page — Editing an environment is now its own route, with a detailed unsaved-changes banner that guards against draft loss. (#9386, #9391)
• Experiments auto-recovery dialog — Enabling an experiment no longer leaves the UI dimmed and locked. (#9513)
• Custom image setup — Custom-image setup gets proper company context, and custom-image snapshots stay applied to probes and saves. (#9028, #9385)
• Reflection Coach & built-in assets — Startup no longer crashes when Reflection Coach assets are missing, and built-in agent assets are preserved in server builds. (#9351, #9339)
• Skip user-secret resolution for skills routes — Skills routes no longer attempt to resolve user secrets.
• Timeouts self-describe — acpx_local timeouts are now self-describing. (#9232)
• Sandbox network resilience — Stalled Daytona Git network commands now fail fast.

Upgrade Guide

• This release adds a large batch of additive database migrations for the new MCP Tool Gateway, tool access policy, OAuth state, connection installs, Smoke Lab, decision-training snapshots, summary slots, inbox-archive policies, and audit/activity attribution. Migrations run automatically on startup — no manual action is required.
• The MCP Tool Gateway, Cases, Decision Training, the built-in Summarizer, and Sandbox execution are gated behind experimental settings. Enable them under experimental settings to try them out.

Contributors

This release has 195 commits from 16 contributors. Thank you to everyone who contributed to this release!

@bluzername, @BorClaw, @justinltodd, @LeonSGP43, @machjesusmoto, @nickyleach, @nsollazzo, @qbamca, @RobinALG87, @stubbi, @supertaz, @tmartin2113, @YanisThePie

Paperclip v2026.707.0

Released: 2026-07-07

This release lands 89 commits from 8 contributors.

Highlights

• User-specific runtime secrets - Secrets can now be scoped to the individual human operator, not just the company. Define user-specific secret definitions, store per-user values, bind them to environments, and — thanks to new responsible-user run attribution — have Paperclip deterministically check that the human behind a run has actually supplied the value a run needs before it dispatches. This is a real prerequisite for safe multi-user and cloud execution. (#8825, @cryppadotta)
• Work Timeline - A new company-scoped Work Timeline page renders a compact, Gantt-style SVG view of when your agents worked, how handoffs happened, and where work overlapped — so you can scan multi-agent execution across the whole company at a glance instead of opening runs one by one. The timeline is backed by a dedicated company endpoint with hardened security filters. (#8938, #8880, #8875, #8923, @cryppadotta)
• Custom sandbox images with a built-in SSH terminal - Build reusable custom sandbox images and set them up without ever leaving the browser: an embedded SSH terminal lets you install packages and prep the image directly from the environment configuration flow, and custom images are now scoped to their instance environments. No more copying an SSH command into an external terminal. (#8911, #8794, #8850, @devinfoley)
• Redesigned environment variables editor - The legacy env-var editor is replaced with a single reusable editor used everywhere environment variables are configured (agents, projects, routines, company environments). It handles text values, secret references, draft rows, and sensitive-value warnings consistently, with clearer affordances for converting a plain value into a secret reference. (#8930, @cryppadotta)
• One-click recovery for diverged work - The recovery card now diagnoses when a task's branch has diverged from its base and offers a one-click isolated re-issue, so you can recover stuck or conflicted work without hand-untangling git state. (#9136, @nickyleach)
• Starred resources in the sidebar - Pin the projects, agents, and tasks you touch most to a dedicated starred section in the sidebar for one-click access. (#9085, @cryppadotta)

Improvements

• Optional Ramp skill - A new optional catalog skill wires agents into Ramp's finance setup playbooks — account onboarding, cards, and spend controls — while keeping every action subordinate to Paperclip's approval gates and fail-closed host allowlist. Companies can opt in, and reviewers can see the source model and safety rules in one shipped catalog entry. (#9157, @cryppadotta)
• Faster issue detail loading - Issue detail and activity-ledger responses are trimmed to the fields those views actually need, dropping large embedded project, workspace, and runtime-metadata payloads. Active issues with workspaces now load noticeably faster without changing the underlying persistence model. (#9125, @cryppadotta)
• Project typeahead in the ⌘K command palette - Matching projects now rank above tasks in the command palette, so typing a project name jumps straight to it instead of burying it under tasks, and the project name is always visible in the row. (#8773, @scotttong)
• Gemini 3.1 Pro models - The gemini-local adapter adds Gemini 3.1 Pro models. (#1602, @woosal1337)
• Live heartbeat progress in run logs - The live agent run viewer now renders heartbeat progress events as system log lines, so useful progress text shows up during long operations instead of staying invisible until another event arrives. (#8965, @devinfoley)
• Better live feedback during sandboxed runs - Sandboxed runs surface clearer live agent feedback while they execute. (#8915, @devinfoley)
• Live descendant status in inbox rows - Inbox rows now show the live status of descendant work, so a parent task reflects what its children are actually doing. (#8876, @cryppadotta)
• Operator issue workflow polish - The operator-facing issue workflow UI got a cleanup pass for clearer status and next-step affordances. (#9091, @cryppadotta)
• Cleaner issue properties pane - The issue properties pane got a cleanup pass, and the issue media attachment gallery is now unified across surfaces. (#8941, #8785, @cryppadotta)
• Pipeline automation title templates - Pipeline automations support title templates, so generated issues get consistent, templated titles. (#8787, @cryppadotta)
• Deduplicated pipeline automation health warnings - Pipeline automation health warnings are deduplicated, so the same issue isn't reported multiple times. (#9090, @cryppadotta)
• Deduplicated watchdog review wakes - Open watchdog review wakes are deduplicated so a single review doesn't trigger repeated wakes. (#9148, @cryppadotta)
• Bundled UI webfonts - The app now bundles its UI webfonts instead of fetching them at runtime, so the interface renders with consistent typography even offline or in locked-down networks. (#9020, @cryppadotta)
• Read-only diagnostics endpoints - New read-only diagnostics endpoints expose issue-subtree, issue-blocker, and workspace branch-ancestry state, making it easier to inspect why work is stuck without mutating anything. (#9135, #9114, #9117, @nickyleach)
• Branch incoherence containment - Managed workspaces now contain branch-incoherence situations instead of letting them cascade, so a single bad branch state doesn't strand downstream runs. (#9131, @nickyleach)
• Faster upgrades - The slow issue-comment attribution backfill was relocated to a fast, idempotent migration, so upgrading is quicker and safer to re-run. (#9108, @nickyleach)
• Checkbox selections carried into continuation wakes - Checkbox selections are now included in continuation wakes, so an agent resuming a task keeps the choices you made. (#8893, @cryppadotta)
• Plan review context preserved across wakes - Plan review context is preserved when an agent is woken, so long-running planning work doesn't lose its thread. (#8649, @cryppadotta)
• Dependency wake reconciliation backstop - A reconciliation backstop makes dependency-driven wakes more reliable, so blocked tasks don't get stranded when a blocker resolves. (#8943, @nickyleach)
• Ask-user questions expire when superseded - Pending ask-user questions are expired once a later comment supersedes them, so stale prompts don't linger. (#8799, @cryppadotta)
• Normalized adapter display labels - Adapter display labels are normalized for a consistent look across the UI. (#8913, @devinfoley)
• Telemetry data contract - This release adds a documented telemetry data contract, generated client telemetry types, and an interaction-resolved telemetry signal — groundwork for more reliable, well-typed anonymized usage insights. (#8886, #8818, #8824, @nickyleach)
• Accessibility improvements - The issues view toggle and goal-tree expand buttons get proper ARIA attributes and tooltips, and date preset and day-of-week toggle buttons now expose aria-pressed. (#1937, #1939, #1913, @bluzername)

Fixes

• Work Timeline actor avatars - Actor avatars now render correctly on the Work Timeline instead of showing missing or wrong images. (#9152, @cryppadotta)
• iOS inbox archive gestures - The inbox swipe-to-archive control no longer shares one pending-state gate across rows, so archiving one item on mobile no longer makes the other inbox archive gestures feel stuck. (#9154, @cryppadotta)
• Deduplicated adapter-agnostic config keys - Adapter-agnostic config keys are no longer duplicated, so agent configuration stays clean when switching adapters. (#9058, @nickyleach)
• Skill selection preserved when switching adapter type - Changing an agent's adapter type no longer drops the skill selection you'd already made. (#8975, @fengwuqingchen)
• Responsible-user migration hardening - A batch of fixes to the responsible-user migration path: the inbox-resurface backfill is corrected in place, migration timestamps are repaired, and heartbeat-run identifier references are migrated correctly — so inboxes don't resurface stale work after upgrade. (#9111, #9146, #9107, @cryppadotta, @nickyleach)
• DB backup health alerts - Database backup health alerts fire correctly again instead of misreporting healthy backups. (#9147, @cryppadotta)
• Projectless worktree workspaces fail fast - Git-worktree workspaces without a project now fail during heartbeat setup instead of starting a run that can't succeed. (#9118, @nickyleach)
• Wake diagnostics redaction - Wake diagnostics now redact low-trust identifier references, preventing untrusted identifiers from leaking into diagnostic output. (#9133, @nickyleach)
• Source-install version reporting - Source installs now report their version from git metadata, so the running version is accurate outside of tagged builds. (#9103, @nickyleach)
• OpenClaw gateway protocol version - The OpenClaw gateway adapter bumps PROTOCOL_VERSION to 4 to match the gateway, fixing version-mismatch handshakes. (#5984, @sparkeros)
• Clean terminal output in the UI - Hermes terminal output is stripped of ANSI escape codes in the UI parsers, so logs render cleanly instead of showing raw escape sequences. (#8731, @neerajdad123-byte)
• Agent-authored comments attributed correctly - Agent-authored comments are now attributed to the agent instead of being rendered as "Board". (#8833, @scotttong)
• Markdown contrast on accent bubbles - Fixed low-contrast markdown text rendered on accent-colored chat bubbles. (#8689, @aronprins)
• Workspace reuse & branch coherence - A batch of managed-workspace fixes: inherited workspace reuse falls back correctly, clean branch drift is restored on finalize, branch coherence recovery is fixed, and run config is refreshed before a workspace is reused so runs don't start from stale settings. (#8963, #8914, #8826, #8797, @devinfoley)
• Sandbox reliability - Sandbox bridge credentials and stalled review recovery are fixed, sandbox restore failures now emit better diagnostics, and sandboxed Claude and Codex probe behavior is corrected. (#8844, #8903, #8775, @devinfoley)
• Active heartbeat run reaping - Active heartbeat runs are no longer incorrectly reaped. (#8776, @devinfoley)
• Issue create response relation summaries - Creating an issue now returns correct relation summaries in the response. (#8901, @nickyleach)
• Watchdog properties pane cache - Fixed a stale cache in the watchdog properties pane. (#8786, @cryppadotta)
• Stale server info debug metadata - Cleared stale server-info debug metadata. (#8753, @devinfoley)

Contributors

Thank you to everyone who contributed to this release!

@aronprins, @bluzername, @fengwuqingchen, @ms-moar, @neerajdad123-byte, @nickyleach, @sparkeros, @woosal1337

Paperclip v2026.626.0

Released: 2026-06-26

This release lands 122 commits from 17 contributors.

Highlights

• Hermes, now built in (local & remote gateway) - Hermes is a first-class adapter in this release. Hire hermes_local agents that run on your own machine, or hermes_gateway agents that run Hermes remotely through a gateway — no manual plugin install required, with secure onboarding defaults for the gateway URL and API key. External Hermes packages can still override or shadow the built-ins through Adapter manager. (#8543, @cryppadotta)
• Task watchdogs - A first-class watchdog control plane lets you attach automated checks to a task and have Paperclip watch it for you — surfacing watchdog state, outcomes, and outstanding work right in the issue thread instead of leaving you to babysit a long-running agent. (#8339, @cryppadotta)
• Ask work mode - Issues can now run in an "ask" work mode for question-and-answer tasks, so you can point an agent at a question and get an answer back without it spinning up a full execution workflow. (#8334, @cryppadotta)
• Sandbox runtime status, live in your threads - Ephemeral sandbox runtimes now report their status directly in issue threads, and Daytona sandbox leases are reused across runs — so cloud/sandboxed execution is both more visible and faster to spin up. (#8594, #8593, @devinfoley; #8513, @devinfoley)
• Workspace file downloads & external object references - Get work products out of Paperclip: download the files your agents produced straight from the workspace, and reference external objects (links, assets) across issue surfaces so the right context travels with the task. (#8512, #8229, @cryppadotta)

Improvements

• Refreshed onboarding - The onboarding flow has been reworked and the older classic wizard retired, alongside a batch of UI style fixes — so getting a new instance set up is cleaner and the default task UI (work-mode labels, status colors, team-creation copy) is consistent out of the box. (#8628, @cryppadotta)
• Task status icons & colors - Task status now reads at a glance with dedicated icons and colors across the board and issue lists. (#8580, @scotttong; #8376, @tonio-alucema)
• Routine date variables - Routines gain date variable controls, so a recurring routine can parameterize on the run date without hand-editing the prompt each time. (#8655, @cryppadotta)
• Skill category editing - You can now edit skill categories in settings, making it easier to organize an installed skill catalog. (#8615, @cryppadotta)
• Publish Paperclip pages & capsules - A bundled page-publishing skill lets agents publish static HTML pages and asset folders to an approved host, and a bundled capsules skill ships the Paperclip capsule identicon toolkit. (#8664, #8669, @cryppadotta)
• Bounded workspace overview - The workspace overview endpoint is now bounded, dramatically cutting the payload and latency for instances with large workspaces. (#8627, @cryppadotta)
• Streamlined sidebar by default - The streamlined sidebar is now the default layout. (#8496, @devinfoley)
• Sorted workspace routines - Workspace routines are now sorted by name, so the routine list stays predictable. (#8666, @cryppadotta)
• Plugin install targeting - The CLI surfaces the plugin install target host and adds a plugin target command, so you always know which instance a plugin is being installed into. (#8575, @cryppadotta)
• Better workspace selector search - The reusable workspace selector gets improved search, making it quicker to pick the right workspace. (#8597, @cryppadotta)
• Instance-scoped execution environments - Execution environments are now instance-scoped and edited through a dialog, with cleaner copy and a tidier driver dropdown on the Company Environments screen. (#8375, #8391, #8400, #8398, #8329, @cryppadotta)
• Heartbeat preflight budget caps - Heartbeats now respect preflight budget caps, giving you a hard ceiling on what a single wake can spend. (#8347, @levineam)
• Skill mutations gated by permission - Skill create/edit/delete is now gated behind a dedicated skills:create permission, so lower-privileged principals can browse skills without being able to change them. (#8616, @cryppadotta)
• Observable sandbox sync progress - Adapter utilities can now report sandbox sync progress, so long file syncs into a sandbox are no longer a black box. (#8395, @cryppadotta)
• Codex local inherits host login - codex_local agents inherit the host Codex login by default and seed managed auth into isolated homes, so they work without re-authenticating. (#8425, #8403, @cryppadotta)
• Codex local inactivity monitor - The codex_local adapter now monitors output inactivity and prefers the loopback runtime API URL for local agents, improving reliability of long local runs. (#5017, #5102, @neerazz)
• Claude refusal signal - The claude_local adapter emits an errorCode of claude_refusal on a stop_reason refusal, so refusals are handled as a first-class outcome. (#8314, @uky333)
• Claude 4.5 model aliases - claude_local now uses direct 4.5 model aliases. (#3800, @LeonSGP43)
• Agent id header for claude_local - claude_local stamps the agent id via an X-Anthropic-Agent-Id header. (#8322, @zenprocess)
• Cleaner agent config & company copy - The agent config environment selector is cleaner, the company creation copy is refreshed, and the adapter test button only tests (no accidental saves). (#8504, #8653, #8405, @cryppadotta)
• Cheap-model agent config check - Agent configuration checks now test with a cheap model, so validating a config doesn't burn premium tokens. (#8632, @cryppadotta)

Fixes

• Mobile issue chat - Fixed issue-chat spacing on mobile, the mention warning spacing, and horizontal viewport scroll on small screens. (#8493, #8486, #8370, @cryppadotta)
• Scroll position on back/forward - The main content area now restores its scroll position on browser back/forward navigation. (#8636, @devinfoley)
• UI detail regressions - A batch of issue-detail and rich-object regressions are fixed, including generic URL rich-object labels. (#8613, #8662, @cryppadotta)
• Secret ref binding sync - Top-level secret reference binding now stays in sync, and agent secret bindings are enforced across lifecycle flows so a reassigned or re-run agent always sees the right secrets. (#8630, #8307, @cryppadotta)
• Sandbox restore & publishing - Fixed sandbox restore index drift, sandbox git publishing, large workspace uploads, and excluded transient Codex home dirs from sandbox sync. (#8595, #8422, #8581, @cryppadotta)
• Daytona disk & resources - Daytona sandboxes default to auto-archive so they leave the disk quota, resource overrides work for image-backed sandboxes, and the env config form accepts valid memory input with size presets. (#8561, #8564, #8389, @cryppadotta)
• Smarter recovery - Stranded-issue recovery converts review-parked continuations into dependency waits and exempts routine-parent issues from missing-disposition handoff, so agents aren't yanked off legitimately-waiting work. (#8371, @cryppadotta; #8157, @BuyWhere)
• Cancelled child blockers ignored - Attention calculations now ignore cancelled child blockers, so a cancelled subtask no longer keeps its parent stuck. (#7577, @MrBlackTongue)
• Issue read authorization - Single-issue comments and issue-thread lists now enforce read authorization, and mention-granted closed-issue comments respect resume intent. (#8346, #8331, #8350, @nickyleach)
• CEO authorization hardening - Same-company CEO authorization is hardened against cross-company access. (#8276, @cryppadotta)
• Isolated remote Claude config - Remote Claude config is isolated from local credentials, so a sandboxed Claude run can't pick up your host login. (#7676, @lennies)
• Live events socket hardening - Live-events upgrade sockets are hardened against malformed upgrades. (#8383, @cryppadotta)
• Gemini headless stalls - Fixed headless Gemini invocation stalls. (#8368, @chekos)
• Cursor streamed text - The cursor adapter coalesces streamed assistant text into clean prose blocks. (#8544, @seb-veto)
• OpenClaw Gateway root params - The OpenClaw Gateway no longer forwards root Paperclip params. (#4416, @serenakeyitan)
• Agent creation & hire UI - Fixed the blank page when creating an agent, and inbox hire approvals now clear when approving or terminating from the detail page. (#8336, #8340, @cryppadotta)
• Routine schedule editor - The routine schedule editor is stabilized, including interrupted-run labels. (#8333, @cryppadotta)
• Copy buttons over HTTP - Issue copy buttons work again when served over plain HTTP. (#8212, @joegalbert-ai)
• Fresh worktrees track origin/master - New worktrees are based on origin/master and unstarted reuses are refreshed, so execution workspaces don't start from stale code. (#8412, @cryppadotta)
• Durable agent pause - Agent pause now stays durable at execution-start. (#8317, @Tattoofamily)
• CLI board auth - The CLI handles a headless browser-open failure during board auth instead of hanging. (#8328, @AayushThakur1999)
• Pipelines plumbing - Internal groundwork for multi-stage pipeline cases landed under the hood (stages, case transitions, drift detection); it's not a user-facing surface yet. (#7903, @cryppadotta)

Contributors

Thank you to everyone who contributed to this release!

@AayushThakur1999, @aronprins, @BuyWhere, @chekos, @dmndbrp-oss, @joegalbert-ai, @lennies, @LeonSGP43, @levineam, @MrBlackTongue, @neerazz, @seb-veto, @serenakeyitan, @Tattoofamily, @tonio-alucema, @uky333, @zenprocess

Paperclip v2026.618.0

Released: 2026-06-18

Highlights

• Skills Store - Browse, install, and manage agent skills from a dedicated in-app store, so you can give your agents new capabilities without hand-wiring files. Skills are now a first-class, installable unit with install counts and a company-scoped catalog. (#7990, @cryppadotta)
• Self-hostable sandbox execution - Cloud/sandboxed agent execution matures: a self-hostable Kubernetes sandbox provider plugin lands alongside server-side Kubernetes execution integration and hardened agent-runtime images, plus a new Novita sandbox provider. Run your agents in an isolated sandbox on your own infrastructure or a cloud provider. (#5790, #7938, #7934, @stubbi; #7595, @Alex-yang00)
• Per-company multi-tenant isolation - A major security foundation for shared and cloud deployments: each company now gets its own JWT signing keys, cloud tenants are strictly company-scoped (never instance-admin), and plugin tables carry a company_id foreign key so plugin data is isolated per tenant. (#5864, #7525, #5865, @stubbi)
• Workspace file viewer and artifact links - Inspect the files your agents produced directly from the issue — a built-in workspace file viewer plus artifact links mean you can open work products without leaving the thread. (#7681, @cryppadotta)
• Env-driven gateway routing for local adapters - The codex, pi, opencode, and gemini local adapters can now route through custom providers and gateways via environment configuration (custom providers, small/cheap model selection, remote allow-all) — a key prerequisite for running your own model gateways. (#7919, #7920, #7837, #7918, @stubbi)

Improvements

• Harder-working agents - A large batch of heartbeat, recovery, and execution-lock fixes makes your instance more resilient: execution locks release on cross-agent reassignment, stale executionRunId/checkoutRunId are cleared on release, reassignment, checkout, and run finalization (with a backstop sweeper), orphan execution locks are cleared when a run finalizes, and stale checkout run ownership is safely adopted. (#5110, @vbalko-claimate; #2482, @alcylu; #6008, @nicorodrigues; #4318, @AyeletMorris-ShieldFC; #5413, @ivasuy)
• Smarter recovery - Stranded-issue recovery now skips issues with a pending wake interaction and exempts escalation when the assignee shows recent visible progress, so agents aren't yanked off work they're actively doing. (#4854, @ming0627; #5213, @sunghere)
• Routine detail page - The routine detail page gets a redesigned sub-sidebar layout plus follow-up polish, making it easier to read and tune a recurring routine. (#7848, #7858, @cryppadotta)
• Follow your system theme - First-time visitors now default to their OS prefers-color-scheme, and there's a theme toggle right on the unauthenticated auth page. (#5873, #5874, @stubbi)
• OpenTelemetry auto-instrumentation - The server supports opt-in OpenTelemetry auto-instrumentation, so you can wire Paperclip into your existing observability stack. (#3735, @stubbi)
• Proxy-aware trust config - TRUST_PROXY now accepts a CIDR list and named subnets, making correct client-IP handling behind load balancers and reverse proxies much easier to configure. (#5872, @stubbi)
• GPT-5.5 for Codex local - GPT-5.5 is now available in the codex_local adapter's model options. (#5575, @Buywatermelon)
• Auto-built bundled plugins - Bundled plugins are now built automatically on install, so they work out of the box without a manual build step. (#8254, @devinfoley)
• Read-only agent config without elevated grants - Read-only agent config and skill endpoints no longer require the agents:create permission, so lower-privileged principals can inspect configuration. (#3725, @stubbi)
• Auto-complete approved review comments - Review comments that are approved now auto-complete, removing a manual step from the review loop. (#5839, @tommypoltev)
• Secrets stay out of the logs - HTTP error log lines now redact passwords and tokens so credentials don't leak into your logs. (#8013, @devinfoley)
• Account menu Feedback shortcut - There's now a Feedback item in the account flyout menu for quick, in-context feedback. (#7854, @scotttong)
• Hermes custom providers - The Hermes adapter now passes custom providers through as args, so your provider configuration is respected. (#8231, @cryppadotta)

Fixes

• Agent config save toast - Saving an agent configuration now shows a success toast so you get clear confirmation the change landed. (#1931, @bluzername)
• Extra args field no longer mangles commas - The extra-args field stops corrupting comma-separated values while you type. (#2125, @tvskart)
• Desktop shell stays put - The desktop shell no longer window-scrolls when scrollIntoView walks past the body, and stays pinned on comment submit. (#8071, @devinfoley; #8041, @dosthcpp)
• Routine variable detection - Routine variables are now detected even when their underscores are markdown-escaped. (#8056, @devinfoley)
• Railway compatibility - The VOLUME keyword was removed from the image for Railway compatibility. (#2619, @br-creative)
• Skip gosu when already correct user - Startup skips gosu when the process is already running as the target user. (#2908, @stubbi)
• OpenClaw Gateway - The OpenClaw Gateway integration is now complete and stabilized. (#2322, @DissidentAI)
• Watchdog noise - The watchdog now suppresses repeat alerts when the source issue is blocked or the evaluation is board-closed. (#5942, @dbezar)
• Session continuity across adapter/model swaps - Heartbeats no longer reuse a stale runtime sessionId across an adapter swap or when the agent's model changes, and session IDs are validated as UUIDs before --resume. (#4109, @kengraversen; #4195, @nirarazi; #1742, @nydamon)
• Adapter session self-healing - Local adapters recover more gracefully: gemini_local treats token-overflow as a fresh-session signal, claude_local recovers from a poisoned previous_message_id 400, and runs auto-retry on Claude "Could not process image" 400s during resume. (#4932, @sherifkozman; #5972, @redmutex; #3276, @nullEFFORT)
• Codex local auth handling - codex_local replaces a stale auth.json copy with a symlink on prepare, omits the default model so the CLI picks per auth mode, and there's added test coverage for the EEXIST symlink race. (#5240, @HKTITAN; #7971, @devinfoley; #5269, @abhishekgahlot2)
• No more zombie runs - Zombie run coalescing is prevented and the startup reap completes before the heartbeat timer ticks. (#1731, @carmandale)
• Self-comment reopen guards - Same-run self-comments are skipped and terminal issues are guarded against an assignee's self-comment reopening them. (#4973, @roy493; #4346, @NiViGaHo)
• Defer fresh-session wakes - Same-issue force-fresh-session wakes are deferred into follow-up runs instead of disrupting the current one. (#4080, @xidui)
• Status filter accepts arrays - The issues list endpoint now accepts an array-form ?status= filter and no longer crashes on repeated keys. (#4890, @Lempkey)
• Board member visibility actions - Board members can now perform the null-mapped visibility actions that agents already had. (#7935, @HKTITAN)
• Cron minute-stepper performance - Intl.DateTimeFormat is now cached per timezone in the cron minute-stepper, reducing per-tick overhead. (#8034, @aronprins)
• Managed sandbox dedup - A partial unique index now dedups managed sandbox rows, and the Kubernetes provider resolves sandbox pods by exact name; sandbox workspaces are tarred by entry to avoid EPERM on unowned target dirs. (#8247, @devinfoley; #7982, #7836, @stubbi)
• Orphan-sweep regression - Fixed an orphan-sweep null-assignee filter regression so the sweeper targets the right issues. (#8018, @devinfoley)

Contributors

Thank you to everyone who contributed to this release!

@abhishekgahlot2, @alcylu, @Alex-yang00, @aronprins, @AyeletMorris-ShieldFC, @bluzername, @br-creative, @Buywatermelon, @carmandale, @dbezar, @DissidentAI, @dosthcpp, @HKTITAN, @ivasuy, @kengraversen, @Lempkey, @ming0627, @nicorodrigues, @nirarazi, @nullEFFORT, @nydamon, @redmutex, @roy493, @sherifkozman, @stubbi, @sunghere, @tommypoltev, @tvskart, @vbalko-claimate, @xidui

Released: 2026-06-09

Highlights

• Company Artifacts - Files, media, and documents your agents produce are now first-class. A new company-scoped Artifacts page indexes every work product across issues and runs, groups them by task stack by default, and supports upload and rich playback — including video artifact thumbnails — so you can inspect what your agents made without opening each issue one by one. (#7621, #7654, #7667, #7248, @cryppadotta)
• Collapsible sidebar rail and takeover panes - The primary navigation can now collapse to a persisted rail with hover/focus peek, giving contextual pages — especially company settings and plugin routes — far more horizontal room while keeping global navigation one click away. (#7824, @cryppadotta)
• Rich issue attachments with video - Issues now accept video attachments and render rich inline previews, including standalone PWA browser controls and inline video playback, so screen recordings and media land directly in the thread instead of as opaque downloads. (#7361, #7360, @cryppadotta)
• Checkbox confirmation interactions - Issue-thread interactions can now ask the board or user to confirm one or more options via a structured checkbox payload, with consistent validation across the API, CLI, plugin helpers, and UI — and free-text "other" answers now render as proper links. (#7649, @cryppadotta)
• Information Architecture refresh (experimental) - An opt-in visual refresh of the project and agent surfaces makes high-frequency workflows easier to scan, and instance settings now live under company settings so configuration is discoverable from one place. (#7543, @scotttong; #7680, @cryppadotta)
• Automated PR quality and security gates - commitperclip now runs automated quality and security gates on incoming PRs — checking for a linked issue, test coverage, a complete template, and a clean lockfile, plus a dedup-search check — so contributors get fast, consistent feedback and maintainers spend review time where it counts. Paired with new low-trust review containment that gives reviewers of untrusted content a narrowly-scoped, prompt-injection-resistant authority preset. (#6469, @brandonburr; #7632, #7530, @cryppadotta)

Improvements

• Harder-working agents - Operators get a direct, audited recovery path with a new clear-error agent action and live-run stop finalization actions, while invalid agents (terminated, paused, pending-approval) are centrally prevented from receiving new assignments or runs — so your instance stays consistent and tries harder before involving you. (#7695, #7679, #7663, @cryppadotta)
• Sharper wake boundaries - Document-scoped comments are now treated as review context instead of firing the same wake path as top-level issue comments, and issue comment wake handoffs were refined — so agents wake on the activity that actually needs them. (#7766, #7678, @cryppadotta)
• External adapter overrides for built-ins - External adapter plugins can now hot-install over a built-in adapter type (for example a newer hermes implementation) while keeping the built-in available as a fallback, matching the registry's existing override behavior. (#7394, @HenkDz)
• Gemini CLI bundled in the image - The production Docker image now bakes in the Gemini CLI so the gemini_local adapter works out of the box alongside claude, codex, and opencode. (#7693, @davison)
• New Claude models in the selector - Claude Fable 5 and Mythos 5 are now offered in the claude_local adapter's model selector (Opus 4.8 stays the default). (#7826, @cryppadotta)
• Routines respect paused projects - Scheduled routine ticks are now suppressed while a project is paused, archived routines are hidden from the routines page, and the routines view now defaults to grouping by project. (#7502, @dosthcpp)
• Deleted comments are redacted - Deleted issue comments are now redacted atomically, with regression coverage, so removed content doesn't linger in the thread. (#7554, @cryppadotta)
• Stronger CLI and API parity - The CLI now sends X-Paperclip-Run-Id so agents can mutate their own issues via the CLI, plus broader OpenAPI spec coverage, auth metadata, and CLI/API parity tests. (#7642, #4579, #6626, @aronprins)
• Login accessibility - The login screen now ships proper accessibility and password-manager metadata for a smoother sign-in. (#7660, @cryppadotta)
• Safer workspaces - Git-sensitive adapter workspaces are now guarded, archived companies no longer wake agents, and experimental settings survive across retired feature flags. (#7644, #7478, @cryppadotta)

Fixes

• Foreign tracker keys no longer link as Paperclip issues - Keys from other trackers in your text are no longer mistakenly turned into Paperclip issue links. (#7511, @pmn4)
• Agents can use plugin tools - Agent-issued JWTs are now accepted by the plugin tool endpoints (GET/POST /api/plugins/tools), so agents can actually call the plugin capabilities built for them. (#7480, @devinfoley)
• Plugin worker resolution - The plugin tool dispatcher now propagates pluginDbId so worker.isRunning resolves correctly. (#5671, @Ramon-nassa)
• Issue anchor binding - anchor.createdAt is now coerced to a Date before the postgres binding, fixing an insert failure on annotation anchors. (#5220, @aperim-agent)
• Hermes resume state - Hermes resume session state is now guarded during heartbeats so resumed runs pick up cleanly. (#7516, @andrewylies)
• Dev runner snapshot race - Fixed a dev-runner snapshot race and the document comment panel layering, with regression coverage. (#7362, @cryppadotta)

Contributors

Thank you to everyone who contributed to this release!

@andrewylies, @aperim-agent, @aronprins, @brandonburr, @davison, @dosthcpp, @HenkDz, @pmn4, @Ramon-nassa

Released: 2026-05-29

Highlights

• Inline document annotations and comments - Issue documents now support inline, revision-aware annotation threads with comments and stable anchor snapshots, so agents and operators can discuss a specific passage instead of leaving detached issue comments or editing the whole document. (#6733, @cryppadotta)
• Company skills CLI and catalog management - Skills are now first-class: install, reset, audit, export, and assign company skills with a new CLI and a board UI, backed by a packaged skills catalog and a clear provenance model across bundled, catalog, runtime, and adapter-provided skills. (#6782, @cryppadotta)
• Hide projects and agents from your sidebar - User-scoped resource membership lets each user leave projects and agents they don't want cluttering their sidebar while keeping every resource accessible, backed by company-scoped membership APIs and a cleaner, easier-to-scan project list. (#6677, @cryppadotta)
• First-admin claim flow for fresh self-hosted deployments - Private, unclaimed deployments (such as Umbrel installs on a LAN) now get a one-time browser claim so operators can create the first admin before any invite exists, while public deployments and installs with active invites keep the existing invite-only model. (#6755, @cryppadotta)
• Live Claude model discovery - The Claude Local adapter can now refresh its Anthropic model catalog from the UI, so newly released Claude models show up without waiting for a code release — with the static fallback list kept current as a safety net. (#6953, @cryppadotta)

Improvements

• Bundled plugins now appear in the plugin manager - Instance Settings → plugin manager lists built-in bundled plugins alongside installed external plugins, so the full set of available plugins is visible in one place. (#6734, @cryppadotta)
• Tighter workspace lifecycle guarantees - Workspace finalize gates and no-remote-git enforcement close holes in the worktree contract — no more silent env reuse across assignees, dependent issue wakes no longer fire before finalize lands, and issue.interaction.accept waits for finalize — so dependent issues reliably see a consistent worktree. (#6969, @devinfoley)

Fixes

• Accepted plans decompose exactly once - Accepted plan revisions are now guarded so they can't be decomposed more than once across overlapping runs, fixing the duplicate-subtask fan-out that could occur when agents woke from review decisions and reused isolated workspaces, plus clearer plan-decomposition UI state. (#6831, @devinfoley)

Released: 2026-05-25

Highlights

• Modal sandbox provider is now a first-party plugin - Paperclip ships a Modal sandbox-provider plugin so companies can run agents on Modal's managed sandboxes alongside E2B, Cloudflare, and Daytona, with CI publishing and cold-start-friendly probe timeouts wired in. (#6245, #6289, #6290, @devinfoley)
• Workspace diffs are a first-class viewer plugin - The new workspace diff plugin renders staged, unstaged, head, renamed, binary, oversized, and untracked changes through host services and plugin slots, with split/unified panes, sticky headers, and reliable default base refs. (#6071, #6383, @cryppadotta)
• Routines can carry their own secrets - Routine env now flows through the runtime contract with persisted revisions, agent < project < routine precedence, and safe secret metadata in routine UI/history — without exposing secret values in logs or access events. (#6212, @cryppadotta)
• Local Cloud Upstream sync is in - A new Cloud Upstream flow ships with shared types, server routes, persisted run schema, CLI sync helpers, a board UI, and settings entry points so operators can preview, resolve conflicts, and activate local-to-cloud syncs. (#6548, @cryppadotta)
• ACPX-Claude adapter works seamlessly out of the box - The acpx_local adapter now resolves bare Claude model IDs, surfaces real diagnostic detail instead of opaque "Internal error" logs, and respects user ~/.claude/settings.json permissions so first-run Claude Local ACPX agents don't strand. (#6590, @devinfoley)

Improvements

• Scoped agent permissions and assignment controls - Issue and agent assignment mutations now run through a real authorization service with protected-assignment enforcement, plugin SDK/host APIs for company settings slots and policy/grant management, retry-now affordances on blocked issues, and an incremental principal-access compatibility backfill. (#6386, @cryppadotta)
• AWS provider vault setup is operator-friendly - The Secrets page now offers AWS provider vault discovery with prefill, removal flows, and Storybook coverage so external vault configuration no longer requires hand-typed metadata. (#6381, @cryppadotta)
• SecretBindingPicker is wired into plugin config forms - JSON-schema secret-ref fields (E2B, Modal, Cloudflare, Daytona, …) now render the canonical secret picker instead of a plain password input, so binding stored secrets no longer requires copy-pasting UUIDs. (#6339, @devinfoley)
• External agent invites moved into the add-agent modal - Bring-your-own-agent onboarding now lives next to local/managed agent creation with an agent-oriented prompt result view and Back navigation, instead of hiding behind OpenClaw-specific company invite settings. (#6183, @aronprins)
• Mobile board flows feel smoother - Mobile new-issue dialog height, priority overflow, company settings nav, plugin-route sidebar selection, browser controls in home-screen app mode, and small touch-target/menu scroll bugs are all polished. (#6550, #6384, @cryppadotta)
• Plugin runtime is scoped tighter to its company - Plugin worker-to-host calls now propagate host-owned invocation context, performAction carries authenticated actor context, company invocation scope is enforced on bridge calls, and plugin operation issues stay out of normal issue surfaces. (#6547, @cryppadotta)
• Runtime and tenant import paths are more reliable - Embedded Postgres now bootstraps native runtime before CLI/server/test startup, async tenant import jobs have deferred validation, and trusted Cloud tenant imports no longer fail the browser-origin guard for legitimate server-to-server traffic. (#6549, #6378, @cryppadotta)
• Control-plane state transitions are tighter - Pagination sorts cleanly on updated issue lists, scheduled retry comments behave, pending plugin migrations re-apply on hot reload, plugin-schema worktree seeds restore safely, stale request confirmations expire after user comments, and feedback export shutdown drains without database-unavailable loops. (#6380, @cryppadotta)
• Cheap recovery model is fenced off from real work - Status-only recovery now carries explicit guard context, route guards block deliverable mutations during cheap runs, and cheap-profile hints no longer leak into normal source-work retries. (#6371, @cryppadotta)
• Invite flow, projects, and workspace polish from the May 17 branch land - Invite landing reuses the shared companies query helper, existing-member invite behavior and copy fallback are restored, reusable workspace selection picks correctly, worktree auth and static SPA fallback are fixed, markdown wrapping and plugin slot registration are firmed up, and projects page sorting lands. (#6604, #6210, @cryppadotta)
• Sandbox-provider plugins no longer clutter Instance Settings - Driver-only plugins (E2B, exe.dev, Modal) are hidden from the per-plugin sidebar group since they have no own settings page and already redirect to Environments. (#6341, @devinfoley)
• Inbox rows are cleaner - The amber "Planning" pill is removed from IssueRow; planning mode itself, the composer toggle, and the work-mode contract are untouched. (#6269, @cryppadotta)
• Plugin authoring guide reflects managed resources - The plugin authoring docs are updated for the current managed-capabilities model so plugin authors aren't writing against stale guidance. (#6261, @cryppadotta)

Fixes

• E2B heartbeats stop failing at 5/11 minutes - The workspace tar upload now strips macOS LIBARCHIVE.xattr.* PAX headers that GNU tar rejected on Linux, and timeoutMs/sleepAfter are refreshed per execute so E2B and Cloudflare sandboxes don't expire between heartbeats. (#6560, @devinfoley)
• Invite page no longer goes blank after sign-in - CompanyProvider and the invite landing page now share a single companies query shape, fixing the companiesQuery.data?.some is not a function crash from the React Query key-key collision. (#6433, @aronprins)
• Company creation survives wrapped prefix collisions - The retry detector now walks the Drizzle 0.45.x error cause chain for the companies_issue_prefix_idx unique constraint, so generated-prefix collisions retry instead of 500-ing. (#6423, @aronprins)
• Autocomplete works inside the new-issue dialog - Floating autocomplete menus rendered through body-level portals are now marked as allowed dialog-external UI, so completion items are selectable inside Radix Dialog without pointer events being eaten. (#6311, @cryppadotta)
• paperclip worktree init --force no longer wipes <repo>/.paperclip/worktrees/ - The init path stopped recursively removing the whole <repo>/.paperclip/ directory and now only rewrites config.json and .env. (#6240, @devinfoley)
• New secret form stays usable with long values - The shared Textarea primitive now applies min-w-0 max-w-full, so a long unbreakable secret no longer pushes the Create/Cancel buttons off-screen. (#6222, @devinfoley)
• Cold-start sandbox probes no longer time out - environmentProbe worker RPC timeout is raised to 120s so Modal (and other cold-start providers) finish booting before the probe fails. (#6289, @devinfoley)
• Docker builds find link-plugin-dev-sdk.mjs - The Dockerfile deps stage now copies the script before pnpm install, so the plugin-workspace-diff postinstall hook doesn't fail with Cannot find module. (#6338, @devinfoley)

Contributors

Thank you to everyone who contributed to this release!

@aronprins

Released: 2026-05-17

Highlights

• Grok Build is now a first-class local runtime - Paperclip can configure and run grok_local through the built-in adapter registry, with server, UI, CLI, transcript parsing, session handling, diagnostics, and focused adapter coverage. (#6087, @devinfoley)
• Issue documents can be locked for safer handoffs - Board-managed document locks preserve approved snapshots, route agent writes to derived documents, expose lock state in the UI and API, and record lock activity. (#6009, @cryppadotta)
• The Issues board scales better with large columns - High-volume Kanban columns now support compact cards, collapsed cold lanes, per-column reveal limits, persisted density controls, and matching UI coverage. (#5309, @eibrahim)
• Internationalization groundwork is in place - The board UI now has an i18next foundation, locale validation, runtime package declarations, and a validated catalog of supported locale resources for future translated surfaces. (#6058, #5943, #6070, @cryppadotta)

Improvements

• Live issue document updates refresh open boards - Document create, update, restore, and delete activity now invalidates the relevant list, active-document, and revision caches without forcing operators to reload the issue page. (#6005, @cryppadotta)
• Cloudflare sandbox execution is more reliable - The Cloudflare bridge now has larger execution capacity, SSE keepalives, safer stdout handling, sandbox-aware probe budgets, and a corrected Pi sandbox install path. (#5967, @devinfoley)
• LLM Wiki packaging and plugin migrations are safer - The packaged plugin now includes required assets, uses a visible bootstrap template, and validates and applies spaces migrations through explicit namespace-safe SQL. (#6010, @cryppadotta)
• PR verification runs faster - The GitHub PR workflow now fans out typecheck, release-registry checks, grouped general tests, and build work instead of serializing them behind one monolithic verify job. (#6137, @devinfoley)
• Multilingual issue flows have regression coverage - Board issue creation, server issue/comment/document round trips, and scoped wake payload rendering now cover Chinese, Japanese, and Hindi text preservation. (#6069, @cryppadotta)

Fixes

• Grok reasoning streams regain readable turn boundaries - Paperclip now restores missing line breaks between streamed Grok reasoning chunks so the live Working panel no longer merges separate thoughts into run-on text. (#6142, @devinfoley)
• Identifier-based wakeups bind to the right project workspace - Heartbeat wakeup context now carries the resolved projectId and canonicalizes identifier-style issue references before workspace resolution. (#6026, @devinfoley)
• Company export tolerates missing local run logs - Optional comment attribution metadata now degrades gracefully when historical heartbeat run log files are missing, preserving exportable issue comments. (#5960, @cryppadotta)

Contributors

Thank you to everyone who contributed to this release!

@eibrahim

Released: 2026-05-13

Highlights

• Source-scoped recovery actions — Stalled or missing-disposition recovery now creates first-class recovery actions on the source issue itself, with owner, evidence, wake policy, and resolution outcome (restored, blocked, cancelled, or false_positive). Recovery indicators surface on issue rows, detail surfaces, active run panels, and blocker notices, and blocked resolutions require a real first-class blocker instead of a comment. (#5599)
• Blocked Inbox attention view — A new Blocked Inbox tab surfaces blocked work alongside active assignments, with blocked-reason chips, filtering and search, deterministic urgency sorting, responsive layouts, and a backend blocker-attention contract so operators have a clear triage path for stalled tasks. (#5603)
• Local plugin development workflow — paperclipai plugin init scaffolding now ships with a CLI-first authoring loop covering local-path installs, plugin key routing, dashboard capabilities, dev watcher startup and reload, and SDK worker entrypoint validation for symlinked package layouts. A new local plugin development guide and refreshed paperclip-create-plugin skill instructions document the full happy path. (#5821)

Improvements

• Ordered sub-issue navigation — Issue detail footers now expose previous/next ordered navigation that walks siblings and continues into a parent's first ordered child, with hidden-issue filtering and dependency-aware ordering preserved. The quicklook blur/click race is also fixed so portaled link clicks complete reliably. (#5938)

Fixes

• Comment date binding regression — Issue comment listing no longer fails with ERR_INVALID_ARG_TYPE when the derived-attribution heartbeat scan binds a Date into postgres-js. Window bounds are now bound as ISO timestamp strings with explicit ::timestamptz casts so comments load on issues such as PAP-9284 without weakening the conservative attribution recovery. (#5919)
• Remote sandbox host workspace resumes — claude_local sessions now persist the host workspace cwd (not the remote sandbox cwd), reject saved cwds that point at system roots before falling back to the agent home workspace, skip sockets, FIFOs, devices, and other non-file entries during workspace restore snapshot capture, and pass only a small model-provider API-key allowlist to plugins that declare environment.drivers.register. (#5922)

Upgrade Guide

One new database migration runs automatically on startup:

• 0084_issue_recovery_actions — adds the issue_recovery_actions table and supporting indexes for source-scoped recovery. The migration is idempotent so it is safe for anyone who previously applied an earlier branch-local recovery-action migration. Existing child recovery issue paths remain guarded; new source-scoped flows will surface recovery indicators in additional places on the board UI.

No application configuration changes are required to take this release.