paperclip v2026.831.0

Paperclip v2026.831.0

Released: 2026-08-31

Paperclip v2026.831.0 soaked as 2026.828.0-beta.0 and carries 175 commits. The company skill library now actually reaches your agents at run time, Kimi Code joins the adapter lineup, operators hosting Paperclip for others get real control over which settings surfaces their users see, the sandbox callback bridge is rebuilt on a bounded HTTP/2 transport, and onboarding sheds its mission step for a shorter arc with the agent front and center. It also raises the Node.js floor to 24 — read the Upgrade Guide before updating a source install.

Breaking Changes

• Node.js 24.11.0 or newer is required. Every package manifest declares the new floor and the Docker images ship Node 24. Only managed installs (paperclipai install) refuse outright on an older Node; npm installs and a directly started server on Node 22/23 print an unsupported-version warning and continue. A warning is not support — upgrade Node before taking this release. (#11792, #11890)
• Invalid agent credentials are rejected instead of downgraded. A bearer token that fails verification now returns a 401 naming the cause (expired, unverifiable, terminated agent, wrong company, …) instead of silently falling through to the anonymous local-user actor. Any integration that depended on that fall-through will start seeing 401s — that fall-through was the bug. (#11589)
• The company brand color and per-company attachment size limit are gone. The fields are removed from the company General page, the create/update APIs, and the portability manifest; migration 0229 drops the columns. Export bundles that carry the old fields still import — the values are ignored. (#12291)
• Silent-run detection no longer takes action on its own. Output silence still surfaces as a suspicious/critical level on active-run summaries in the UI, but it no longer creates evaluation issues, recovery actions, comments, or wake requests. Stranded-task recovery similarly stops automatic takeovers: exhausted and unsafe recovery now routes to a board-owned action instead of reassigning work by itself. (#12242, #11961)
• Agent thought text stays out of automatic issue comments. ACPX run summaries are limited to the final output segment, and the legacy full-summary setting is deliberately ignored so configuration cannot bypass the containment. (#11801, @nearfolk)
• Grok no longer defaults --permission-mode to dontAsk. The adapter passes no permission-mode flag unless one is explicitly configured; --always-approve remains the unattended policy. (#11898)

Highlights

• Your skill library now reaches your agents — Skills used to be something you installed and hoped for. Now every agent run carries a deterministic manifest of the company's skill library in its instructions, agents can list skills over MCP, newly hired CEOs get the five core Paperclip skills by default, and installing a skill offers an "Enable for agents" step that pre-selects every skills-capable agent. When a skill fails to materialize, the failure is surfaced in the run output with its cause instead of the skill silently vanishing — and legacy runners are pinned back to the canonical operational skill. (#12147, #12138, #12136, #12146, #12225)
• Kimi Code is a first-class adapter — kimi_local runs Moonshot's Kimi Code CLI on the shared ACP engine by default — live streaming transcripts, tool-call lifecycle, the same machinery as Claude, Codex, and Gemini — with an automatic headless-CLI fallback when ACP prerequisites are missing. (#9967, @hawikk)
• Operators can shape what their users see — For anyone hosting Paperclip for others: PAPERCLIP_HIDDEN_SETTINGS hides settings surfaces by key — instance pages, individual experimental flags, company pages like Members, Invites, Secrets, Export, and Import, and even individual tabs like Provider vaults and Proposals. Hiding company.import floors the API too, and cloud-managed instances floor imports unconditionally. PAPERCLIP_SETTING_DEFAULTS overrides the schema default of selected instance settings without persisting anything, and a managed-sandbox-only mode hides host-path and execution-engine surfaces entirely. (#11823, #12199, #12284, #12285, #12293)
• The sandbox callback bridge, rebuilt to not fall over — The bridge that lets sandboxed agents call back into Paperclip now prefers a bounded Node HTTP/2 duplex transport, demoting the file-polling relay to a soft-deprecated fallback: bytes stay binary end to end, every resource dimension is budgeted by a process-owned byte ledger (route data, broker forwards, decoder buffers, pending writes), the in-sandbox gateway survives faults after readiness and fails loudly before it, and a duplex channel dying mid-run fails the run closed instead of letting it end "successfully" with lost writes. The retired v1 transport is deleted outright. (#12120, #11769, #12003, #12060, #11966, #12171)
• Onboarding gets to the point — The mission step is gone; the wizard opens on creating your agent, which asks for a name and nothing else (every onboarding hire starts in the general role). The steps are rebuilt on a single card with the brand pill held across them — dormant while you set up, alive when you review — and the auth page wears the new brand lockup. The idle "test your environment" card is gone too; the probe still runs on Connect and still blocks a failing hire. (#11935, #11905, #12274, #12074)

Improvements

• Opt-in error monitoring with Sentry — Set SENTRY_DSN and install the optional @sentry/node peer to get server-side error capture; the DSN rides the authenticated session response so the browser reports too, behind a React error boundary. Everything is fail-open: no DSN, no package, no Sentry, no problem. (#12190, #12249, #12270)
• Company imports land better — Last release made big imports resumable; this release makes arriving pleasant. Imported companies get de-duplicated names, an already-imported bundle names the company it landed as, every import outcome ends with a dashboard CTA, agents paused by an import carry a dedicated pause reason with visible notices and a Resume button in the thread, and the dashboard shows a banner with "Resume all" while imported agents sit paused. (#12145, #12144, #12143, #12140, #12142)
• Settings, unified — Company and instance settings share one navigation; instance general controls live on the company General page; invites moved into a tab of the Members page; the separate instance Heartbeats page is gone; and user-facing copy now says "organization" where it used to say "company". Hosted tenants also get issue prefixes derived from the organization name, following renames. (#11789, #12289, #12282, #12243, #12292)
• Environments you can actually manage — Deleting an environment now walks you through it: agents are reassigned in the same action, lease holders are listed, and destroying reusable sandboxes is a separate consent-labeled choice. Custom-image templates report boot-relevant drift with attribution and can be relinked in one click, and the managed default environment shows up by its name ("Paperclip Computer"), not its driver key. (#12053, #11751, #11641, #11838)
• Faster sandbox file movement — Inbound workspace, asset, and referenced-project syncs run in parallel where the provider opts in, and Daytona file uploads are transparently zstd-compressed with a raw fallback. Referenced projects finally honor .gitignore during staging, and reported transfer byte counts are the real ones. (#11736, #12271, #12184, #12180)
• Managed workspaces hold up across restarts — A shared port registry with lease heartbeats and identity checks keeps runtimes reliable across control-plane restarts, degraded embedded databases are detected and replaced with bounded restart supervision, cloned worktrees quarantine their copied services instead of fighting the originals, deferred database seeds are first-class operations with verified evidence, and the workspace login handoff is a signed, single-use ticket gated on real readiness. macOS worktrees can adopt their port owners now too. (#11740, #11651, #11653, #11706, #11671, #11763, @tf00185077)
• Wakes and recovery got more precise — Question answers are delivered durably through a dedicated delivery ledger, blockers-resolved wakes are level-triggered and cycle-aware so a terminal reset can't strand a dependent, recovery retries survive restarts with bounded lineages, routine runs that failed transiently clear themselves when work resumes, and agent resume is authorized through direct grants. (#12307, #11732, #11979, @zach-hermes, #11817, #9689, #12047)
• Quality of life — "Agent mode" is now "Auto mode" with full labels on the mode chips, every inbox item can be archived, parked browser tabs pick up new releases within the hour instead of serving a stale UI until a hard refresh, and the development runner honors --data-dir isolation. (#11866, #11636, #12198, #12193)
• Groundwork, deliberately off — A native Codex execution runner (adapter paperclip_runner) landed behind the default-off enableNativeRunner instance flag, along with its persistence contracts and transport. It refuses hires and runs while the flag is off; nothing changes for existing adapters. (#12188, #12169, #12176)

Fixes

• Sign-up and sign-in work on Better Auth 1.7 — the upgrade needed an issuer column Better Auth expects; migration 0230 adds and backfills it. (#11886, #12396)
• The rich text editor renders again — a second Lexical copy from a stale override broke node identity; the tree is back to one pinned copy, and prose containing angle brackets no longer kicks you out of the rich editor. (#12317, #12290)
• Docker orphans get reaped — tini is PID 1 in the server image, so processes adopted after their parent exits are cleaned up instead of accumulating as zombies; a behavioral probe in CI keeps it that way. (#12137, @zannis)
• Adapters — Hermes surfaces the real reasoning text from reasoning.available events instead of a placeholder (#9237, @harjothkhara); Grok stops warning when the default model sentinel isn't in the discovered list (#12062); the Claude/Codex/Gemini ACP adapters share one workspace-restore teardown (#12196); and the adapter Test lane verifies auth for every Claude ACP target with a deny-by-default probe environment. (#11810)
• Plugins — errored plugins retry at boot instead of staying dead, plugin detail-tab deep links survive a reload, and plugin bundles get the host's real JSX runtime. (#12054, #11826)
• Task chat — the composer clears the moment you send (and restores the draft on failure), the live tail shows the run's actual status instead of "Waiting for transcript...", and carets line up. (#11772, #11802)
• Git workspace sync — imported histories with no common ancestor are grafted instead of failing the run, sync-created merge commits carry a deterministic identity, and PR preparation can attach to an existing branch without touching it. (#11638, #11637, #11703)
• Server correctness — image-upload namespaces accept identity-provider characters with traversal rejected cleanly, the setup-token start guard is pinned to the served adapter, sandbox-driver environments skip the host provision command, rendered markdown code blocks follow the active theme, and the workspace reaper gained a configurable cooldown before it collects a terminal workspace's worktree. (#12288, #12179, #11626, #11591, #11642)

The onboarding-service fixes from this range (npx onboard leaving a crash-looping background service, the duplicate foreground-start prompt, onboarding ending without opening the dashboard) already shipped to stable users as v2026.824.1.

Upgrade Guide

• Node.js: the minimum is now 24.11.0. Docker users get Node 24 with the image. Source installs and custom base images must upgrade first. Managed installs refuse with an error on an older Node; npm installs and direct server startup on Node 22/23 warn and continue, which is easy to miss in service logs — check node --version before upgrading rather than relying on the warning.
• Migrations: this release adds 8 database migrations (0223 through 0230): a secret-proposal → interaction link (0223), unified adapter auth sessions replacing the Claude-specific table (0224, 0225), a disposition-repair dedup index (0226), the native-runner contract tables — inert while the flag is off (0227), durable question-answer deliveries (0228), dropping the company brand-color and attachment-limit columns (0229), and the Better Auth issuer column with backfill (0230). They run automatically on startup. Only 0229 discards data, and only those two removed fields.
• New optional environment variables (defaults preserve current behavior):
  • PAPERCLIP_HIDDEN_SETTINGS — comma-separated settings surfaces to hide, for operators hosting Paperclip for others; hiding company.import also floors the import API. (#11823, #12199)
  • PAPERCLIP_SETTING_DEFAULTS — JSON object overriding the schema default of selected instance settings. (#12285)
  • SENTRY_DSN — opt in to error monitoring; also install the @sentry/node@10.71.0 optional peer for server-side capture. (#12190)
  • PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS — days a terminal workspace is left alone before its worktree is reaped (default 7, 0 disables the cooldown). (#11642)
• Removed API fields: brandColor and attachmentMaxBytes are gone from the company create/update/branding APIs and the portability manifest. Clients still sending them get validation errors; exported bundles carrying them import fine.
• Behavior changes to note: bad agent bearer tokens now 401 (see Breaking Changes), silent runs and stranded tasks no longer trigger automatic recovery actions, and Grok's implicit --permission-mode dontAsk is gone.

Contributors

This release has 175 commits from 13 contributors. Thank you to everyone who contributed to this release!

@aaymeloglu, @harjothkhara, @hawikk, @nearfolk, @tf00185077, @zach-hermes, @zannis