fix(deps): update npm production dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@paperclipai/plugin-sdk (source)	^2026.626.0 → ^2026.831.1
react (source)	^19.2.7 → ^19.2.8

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

paperclipai/paperclip (@​paperclipai/plugin-sdk)

v2026.831.1

Compare Source

Paperclip v2026.831.1

Released: 2026-09-02

A patch on top of 2026.831.0 that fixes first-run onboarding. It carries a single targeted change; everything else in 2026.831.0 is unchanged.

Fixes

• Onboarding no longer gets stuck on the organization step. On the first onboarding screen ("What is the name of your organization?"), clicking Continue created the organization on the server but could leave the wizard sitting on the same step — so the page appeared to just refresh, and repeated clicks silently created duplicate organizations. The company-created list refresh can make the surrounding app adopt the just-created organization before the create request's continuation runs; the wizard now recognizes that as the same successful transition and advances to the first-agent step, while a genuine switch to a different organization still stops with a clear message. (#​12667)

Upgrade Guide

• No migrations, no configuration changes, no API changes. Upgrade in place.

v2026.831.0

Compare Source

Paperclip v2026.831.0

Released: 2026-08-31

Paperclip v2026.831.0 soaked as 2026.828.0-beta.0 and carries 175 commits. The company skill library now actually reaches your agents at run time, Kimi Code joins the adapter lineup, operators hosting Paperclip for others get real control over which settings surfaces their users see, the sandbox callback bridge is rebuilt on a bounded HTTP/2 transport, and onboarding sheds its mission step for a shorter arc with the agent front and center. It also raises the Node.js floor to 24 — read the Upgrade Guide before updating a source install.

Breaking Changes

• Node.js 24.11.0 or newer is required. Every package manifest declares the new floor and the Docker images ship Node 24. Only managed installs (paperclipai install) refuse outright on an older Node; npm installs and a directly started server on Node 22/23 print an unsupported-version warning and continue. A warning is not support — upgrade Node before taking this release. (#​11792, #​11890)
• Invalid agent credentials are rejected instead of downgraded. A bearer token that fails verification now returns a 401 naming the cause (expired, unverifiable, terminated agent, wrong company, …) instead of silently falling through to the anonymous local-user actor. Any integration that depended on that fall-through will start seeing 401s — that fall-through was the bug. (#​11589)
• The company brand color and per-company attachment size limit are gone. The fields are removed from the company General page, the create/update APIs, and the portability manifest; migration 0229 drops the columns. Export bundles that carry the old fields still import — the values are ignored. (#​12291)
• Silent-run detection no longer takes action on its own. Output silence still surfaces as a suspicious/critical level on active-run summaries in the UI, but it no longer creates evaluation issues, recovery actions, comments, or wake requests. Stranded-task recovery similarly stops automatic takeovers: exhausted and unsafe recovery now routes to a board-owned action instead of reassigning work by itself. (#​12242, #​11961)
• Agent thought text stays out of automatic issue comments. ACPX run summaries are limited to the final output segment, and the legacy full-summary setting is deliberately ignored so configuration cannot bypass the containment. (#​11801, @​nearfolk)
• Grok no longer defaults --permission-mode to dontAsk. The adapter passes no permission-mode flag unless one is explicitly configured; --always-approve remains the unattended policy. (#​11898)

Highlights

• Your skill library now reaches your agents — Skills used to be something you installed and hoped for. Now every agent run carries a deterministic manifest of the company's skill library in its instructions, agents can list skills over MCP, newly hired CEOs get the five core Paperclip skills by default, and installing a skill offers an "Enable for agents" step that pre-selects every skills-capable agent. When a skill fails to materialize, the failure is surfaced in the run output with its cause instead of the skill silently vanishing — and legacy runners are pinned back to the canonical operational skill. (#​12147, #​12138, #​12136, #​12146, #​12225)
• Kimi Code is a first-class adapter — kimi_local runs Moonshot's Kimi Code CLI on the shared ACP engine by default — live streaming transcripts, tool-call lifecycle, the same machinery as Claude, Codex, and Gemini — with an automatic headless-CLI fallback when ACP prerequisites are missing. (#​9967, @​hawikk)
• Operators can shape what their users see — For anyone hosting Paperclip for others: PAPERCLIP_HIDDEN_SETTINGS hides settings surfaces by key — instance pages, individual experimental flags, company pages like Members, Invites, Secrets, Export, and Import, and even individual tabs like Provider vaults and Proposals. Hiding company.import floors the API too, and cloud-managed instances floor imports unconditionally. PAPERCLIP_SETTING_DEFAULTS overrides the schema default of selected instance settings without persisting anything, and a managed-sandbox-only mode hides host-path and execution-engine surfaces entirely. (#​11823, #​12199, #​12284, #​12285, #​12293)
• The sandbox callback bridge, rebuilt to not fall over — The bridge that lets sandboxed agents call back into Paperclip now prefers a bounded Node HTTP/2 duplex transport, demoting the file-polling relay to a soft-deprecated fallback: bytes stay binary end to end, every resource dimension is budgeted by a process-owned byte ledger (route data, broker forwards, decoder buffers, pending writes), the in-sandbox gateway survives faults after readiness and fails loudly before it, and a duplex channel dying mid-run fails the run closed instead of letting it end "successfully" with lost writes. The retired v1 transport is deleted outright. (#​12120, #​11769, #​12003, #​12060, #​11966, #​12171)
• Onboarding gets to the point — The mission step is gone; the wizard opens on creating your agent, which asks for a name and nothing else (every onboarding hire starts in the general role). The steps are rebuilt on a single card with the brand pill held across them — dormant while you set up, alive when you review — and the auth page wears the new brand lockup. The idle "test your environment" card is gone too; the probe still runs on Connect and still blocks a failing hire. (#​11935, #​11905, #​12274, #​12074)

Improvements

• Opt-in error monitoring with Sentry — Set SENTRY_DSN and install the optional @sentry/node peer to get server-side error capture; the DSN rides the authenticated session response so the browser reports too, behind a React error boundary. Everything is fail-open: no DSN, no package, no Sentry, no problem. (#​12190, #​12249, #​12270)
• Company imports land better — Last release made big imports resumable; this release makes arriving pleasant. Imported companies get de-duplicated names, an already-imported bundle names the company it landed as, every import outcome ends with a dashboard CTA, agents paused by an import carry a dedicated pause reason with visible notices and a Resume button in the thread, and the dashboard shows a banner with "Resume all" while imported agents sit paused. (#​12145, #​12144, #​12143, #​12140, #​12142)
• Settings, unified — Company and instance settings share one navigation; instance general controls live on the company General page; invites moved into a tab of the Members page; the separate instance Heartbeats page is gone; and user-facing copy now says "organization" where it used to say "company". Hosted tenants also get issue prefixes derived from the organization name, following renames. (#​11789, #​12289, #​12282, #​12243, #​12292)
• Environments you can actually manage — Deleting an environment now walks you through it: agents are reassigned in the same action, lease holders are listed, and destroying reusable sandboxes is a separate consent-labeled choice. Custom-image templates report boot-relevant drift with attribution and can be relinked in one click, and the managed default environment shows up by its name ("Paperclip Computer"), not its driver key. (#​12053, #​11751, #​11641, #​11838)
• Faster sandbox file movement — Inbound workspace, asset, and referenced-project syncs run in parallel where the provider opts in, and Daytona file uploads are transparently zstd-compressed with a raw fallback. Referenced projects finally honor .gitignore during staging, and reported transfer byte counts are the real ones. (#​11736, #​12271, #​12184, #​12180)
• Managed workspaces hold up across restarts — A shared port registry with lease heartbeats and identity checks keeps runtimes reliable across control-plane restarts, degraded embedded databases are detected and replaced with bounded restart supervision, cloned worktrees quarantine their copied services instead of fighting the originals, deferred database seeds are first-class operations with verified evidence, and the workspace login handoff is a signed, single-use ticket gated on real readiness. macOS worktrees can adopt their port owners now too. (#​11740, #​11651, #​11653, #​11706, #​11671, #​11763, @​tf00185077)
• Wakes and recovery got more precise — Question answers are delivered durably through a dedicated delivery ledger, blockers-resolved wakes are level-triggered and cycle-aware so a terminal reset can't strand a dependent, recovery retries survive restarts with bounded lineages, routine runs that failed transiently clear themselves when work resumes, and agent resume is authorized through direct grants. (#​12307, #​11732, #​11979, @​zach-hermes, #​11817, #​9689, #​12047)
• Quality of life — "Agent mode" is now "Auto mode" with full labels on the mode chips, every inbox item can be archived, parked browser tabs pick up new releases within the hour instead of serving a stale UI until a hard refresh, and the development runner honors --data-dir isolation. (#​11866, #​11636, #​12198, #​12193)
• Groundwork, deliberately off — A native Codex execution runner (adapter paperclip_runner) landed behind the default-off enableNativeRunner instance flag, along with its persistence contracts and transport. It refuses hires and runs while the flag is off; nothing changes for existing adapters. (#​12188, #​12169, #​12176)

Fixes

• Sign-up and sign-in work on Better Auth 1.7 — the upgrade needed an issuer column Better Auth expects; migration 0230 adds and backfills it. (#​11886, #​12396)
• The rich text editor renders again — a second Lexical copy from a stale override broke node identity; the tree is back to one pinned copy, and prose containing angle brackets no longer kicks you out of the rich editor. (#​12317, #​12290)
• Docker orphans get reaped — tini is PID 1 in the server image, so processes adopted after their parent exits are cleaned up instead of accumulating as zombies; a behavioral probe in CI keeps it that way. (#​12137, @​zannis)
• Adapters — Hermes surfaces the real reasoning text from reasoning.available events instead of a placeholder (#​9237, @​harjothkhara); Grok stops warning when the default model sentinel isn't in the discovered list (#​12062); the Claude/Codex/Gemini ACP adapters share one workspace-restore teardown (#​12196); and the adapter Test lane verifies auth for every Claude ACP target with a deny-by-default probe environment. (#​11810)
• Plugins — errored plugins retry at boot instead of staying dead, plugin detail-tab deep links survive a reload, and plugin bundles get the host's real JSX runtime. (#​12054, #​11826)
• Task chat — the composer clears the moment you send (and restores the draft on failure), the live tail shows the run's actual status instead of "Waiting for transcript...", and carets line up. (#​11772, #​11802)
• Git workspace sync — imported histories with no common ancestor are grafted instead of failing the run, sync-created merge commits carry a deterministic identity, and PR preparation can attach to an existing branch without touching it. (#​11638, #​11637, #​11703)
• Server correctness — image-upload namespaces accept identity-provider characters with traversal rejected cleanly, the setup-token start guard is pinned to the served adapter, sandbox-driver environments skip the host provision command, rendered markdown code blocks follow the active theme, and the workspace reaper gained a configurable cooldown before it collects a terminal workspace's worktree. (#​12288, #​12179, #​11626, #​11591, #​11642)

The onboarding-service fixes from this range (npx onboard leaving a crash-looping background service, the duplicate foreground-start prompt, onboarding ending without opening the dashboard) already shipped to stable users as v2026.824.1.

Upgrade Guide

• Node.js: the minimum is now 24.11.0. Docker users get Node 24 with the image. Source installs and custom base images must upgrade first. Managed installs refuse with an error on an older Node; npm installs and direct server startup on Node 22/23 warn and continue, which is easy to miss in service logs — check node --version before upgrading rather than relying on the warning.
• Migrations: this release adds 8 database migrations (0223 through 0230): a secret-proposal → interaction link (0223), unified adapter auth sessions replacing the Claude-specific table (0224, 0225), a disposition-repair dedup index (0226), the native-runner contract tables — inert while the flag is off (0227), durable question-answer deliveries (0228), dropping the company brand-color and attachment-limit columns (0229), and the Better Auth issuer column with backfill (0230). They run automatically on startup. Only 0229 discards data, and only those two removed fields.
• New optional environment variables (defaults preserve current behavior):
  • PAPERCLIP_HIDDEN_SETTINGS — comma-separated settings surfaces to hide, for operators hosting Paperclip for others; hiding company.import also floors the import API. (#​11823, #​12199)
  • PAPERCLIP_SETTING_DEFAULTS — JSON object overriding the schema default of selected instance settings. (#​12285)
  • SENTRY_DSN — opt in to error monitoring; also install the @sentry/node@10.71.0 optional peer for server-side capture. (#​12190)
  • PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS — days a terminal workspace is left alone before its worktree is reaped (default 7, 0 disables the cooldown). (#​11642)
• Removed API fields: brandColor and attachmentMaxBytes are gone from the company create/update/branding APIs and the portability manifest. Clients still sending them get validation errors; exported bundles carrying them import fine.
• Behavior changes to note: bad agent bearer tokens now 401 (see Breaking Changes), silent runs and stranded tasks no longer trigger automatic recovery actions, and Grok's implicit --permission-mode dontAsk is gone.

Contributors

This release has 175 commits from 13 contributors. Thank you to everyone who contributed to this release!

@​aaymeloglu, @​harjothkhara, @​hawikk, @​nearfolk, @​tf00185077, @​zach-hermes, @​zannis

v2026.824.1

Compare Source

Paperclip v2026.824.1

Released: 2026-08-25

Paperclip v2026.824.1 is a patch release on v2026.824.0 that repairs the background-service leg of onboarding end to end: the service now actually starts from an npx onboard, onboarding no longer steers you into a safety-check error afterward, and it finishes by handing you the dashboard in your browser.

Fixes

• Accepting the background-service prompt during an npx onboard no longer installs a broken service. The service definition targets the managed command shim, but an ephemeral run never installs it — the service crash-looped on a missing binary while onboarding, believing the service was handling things, skipped its own foreground start: a first run that ended with nothing serving. The service step now materializes the managed install (payload and command shim, pinned to the version being onboarded) before registering the service, and when it cannot — a custom PAPERCLIP_SHIM_PATH, or a failed install — it declines with the repair commands instead. (#​12148)
• Onboarding no longer offers a foreground start the service already covers. After a successful service install, interactive onboarding still asked "Start Paperclip now?" — accepting ran a second server into the already-running instance guard, ending a successful onboard with an error. The prompt is skipped once the service is running. (#​12153)
• Onboarding ends at the dashboard instead of a dead stop. After the service starts, onboarding now waits for it to report the endpoint it actually bound (including a fallback port when the configured one is busy), prints the dashboard URL, and opens it in the browser on interactive terminals. Headless runs print the URL; PAPERCLIP_NO_BROWSER=1 disables the browser open. If the service does not become ready, onboarding says so and points at paperclipai service logs instead of claiming success. (#​12164)
• paperclipai doctor diagnoses a missing service binary as exactly that. The service-runtime check no longer suggests stopping a nonexistent conflicting process when the service's binary is missing (it names the missing path and points at paperclipai install), and the health check attributes a healthy responder that is not the managed service instead of reporting a plain "Healthy". (#​12148)

Upgrade Guide

• No migrations and no configuration changes.
• If a previous onboard left a crash-looping background service behind: run paperclipai install, then paperclipai service start. The dead service definition is reused once its binary exists.

Contributors

This release has 3 commits from the core team.

v2026.824.0

Compare Source

Paperclip v2026.824.0

Released: 2026-08-24

Paperclip v2026.824.0 is a fast follow to 2026.817.0 — and the first stable to walk the full canary → nightly → beta → stable happy path end to end, soaking as 2026.818.0-beta.1 before promotion. It carries 172 commits: chat-style tasks graduate from experiment to the default experience, managed runtime previews become reachable over Tailscale HTTPS, sandbox execution gains a verified provider capability contract, you can sign in to Claude and Codex from inside the product, large company imports survive dropped connections, and a large batch of long-standing community fixes lands.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Chat-style tasks are the default. The "Chat-Style Tasks" experiment toggle is gone; the task detail page is now the conversation view for everyone. A new "Classic Task Interface" preference (enableClassicTaskInterface, replacing enableTaskChatRedesign in instance settings) restores the pre-chat page — page-level header, plain comment thread, fixed Properties sidebar — but chat-only features are unavailable there. (#​11101)
• Sandbox session-output streaming is now capability-driven, and three operator flags are gone. The server's streamAgentSessionOutput setting and the Daytona plugin's useSessions and useLogStream keys no longer exist; the verified provider capability snapshot is the only streaming decision, with an automatic poll fallback. Saved configurations that still carry the removed keys load fine — the keys are simply inert. (#​11463, #​11557)
• Managed dev runtimes now default to Tailscale HTTPS previews. When the host broker is available, eligible Paperclip-managed worktree runtimes are exposed as tailscale_https instead of loopback HTTP. Set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off to keep the old behavior, or force to fail closed when the broker is missing. Managed runtime control routes also gained two new 409 responses (workspace_runtime_control_in_progress, workspace_runtime_lease_conflict) — callers that assumed a control always starts must handle a conflict. (#​11524, #​11525)
• Interaction resolver policy defaults to anyone for new interactions. Every interaction kind now goes through one resolver-policy evaluator with recorded provenance, instead of per-route rules that blocked valid agents. Migration 0218 deliberately does not widen anything already pending: existing rows keep their old restrictions under new names (board_or_agents → not_creator, board_only → human_only). (#​11376)
• The decision-training surfaces are removed from the Decisions desk — the training library route, row actions, and drawer. The backend snapshot contract is unchanged and no data migration runs. (#​11225)

Highlights

• Chat-style tasks, now the default experience — Last release's experimental conversation view is now how every task works, and it grew up on the way: cleaner message spacing and agent bubbles, searchable assignment and the sub-task tree in the properties pane, document comments docked in a side gutter, and a chat sidebar that surfaces every issue document and agent artifact. Blocked tasks show their blockers as links with live, ordered blocker work right in the thread, and an issue with a live run shows a calm in-flight notice instead of a false alarm. Onboarding is chat-first too: finishing the wizard drops you straight into your first task's conversation, where the agent greets you, asks clarifying questions, and proposes a plan you approve item by item. (#​11101, #​11263, #​11226, #​11456, #​11487, #​11423)
• HTTPS previews for managed runtimes, over Tailscale — A managed runtime service used to listen on plain loopback HTTP, so an agent's branch preview was unreachable from a phone or a second computer. Paperclip can now expose it at a real HTTPS URL on your tailnet, built in three deliberate layers: a separate least-privilege host broker that authorizes every mapping (peer credentials, a fixed port range, protected-port denies, append-only audit), the exposure lifecycle with durable issue-owned runtime leases and bounded control recovery so a stranded control can never block the lane forever, and a single port-pair mediator so a start can never collide with or adopt another issue's service — every mismatch fails closed and names the conflict. (#​11524, #​11525, #​11526)
• Sign in to Claude and Codex from inside Paperclip — The new-agent page now offers Claude subscription login before you create the agent, on both Test lanes, with diagnostics kept in redacted server logs and login URLs normalized to allowlisted Anthropic hosts. Under the hood, a guarded setup-token flow drives claude setup-token through a sandbox pseudo-terminal with owner-bound sessions and one-time token delivery, and the Codex adapter gets an equivalent sandbox device-login that promotes the credential only after readiness checks and then deletes the temporary sandbox. Deployments behind a TLS-terminating platform edge (Railway, Render, Fly, …) can declare CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true so the transport guard stops warning about a connection that is HTTPS to the user, and a promoted device-login credential now survives managed-home re-seeding. (#​11347, #​11286, #​11237, #​11579, #​11578)
• A real capability contract for sandbox providers — Last release introduced live output streaming and persistent sessions for Daytona; this release makes those behaviors provable instead of configured. Providers declare capabilities in their manifest, the live worker verifies them, and the server resolves the effective set fail-closed as the intersection of declared, verified, and configured — a declared capability can never grant a method the worker didn't prove. Streaming and persistent sessions now turn on wherever the verified snapshot allows, with an automatic poll fallback, and the three operator flags that used to gate them are gone (see Breaking Changes). (#​11463, #​11557)
• Chunked, resumable company imports — Last release raised the import cap to 1 GB; this release makes the transfer worthy of it. A dropped connection at 90% used to start the whole upload over — imports now move as verified ~32 MB parts spooled to disk with a durable run ledger, so an interrupted transfer resumes from the parts already uploaded (across dropped connections, page refreshes, and server restarts) and peak upload memory drops to one part. The Import page and CLI gained the resumable upload and a chunked preview, bundles now preserve task timestamps and hierarchy through export/import, imported agents keep their own adapter instead of being coerced to the destination's CEO adapter, and freshly imported tasks stay quiescent under the productivity review sweep. (#​11223, #​11224, #​11193, #​11192, #​11191)

Improvements

• Onboarding meets you where you are — A company with no agent is sent into onboarding automatically, opening at the right step: the mission step is skipped when the company already has one, an existing mission is carried into the wizard, and the step is decided once instead of jumping under a mid-flow customer. The wizard's agent and connect-model steps were reworked for the chat-first flow, no longer keep an invisible disabled adapter selected, and the decorative panel follows your theme. (#​11352, #​11416, #​11429, #​11371, #​11379)
• Paperclip Cloud onboarding seed — An instance can now receive the mission, first agent, and first task collected during Paperclip Cloud signup and apply them at activation, so a seeded stack opens ready to work instead of asking again. (#​11098)
• Managed sandbox deployments — Tenants can edit environment variables on a platform-managed sandbox environment (and only that), and a managed-sandbox-only mode hides local execution entirely with run selection failing closed. Bundled providers' documented credential env vars (e.g. DAYTONA_API_KEY) now reach their plugin workers, and the synthetic "Local" default option respects the mode. (#​11200, #​11244)
• Archived work reopens in place — An archived isolated execution workspace can be reopened where it was, including archived git worktrees for managed-checkout projects. Cold arrivals on an archived company's URL are bounced to a clear page with a one-click Unarchive. (#​11322, #​11395, #​11302)
• Review governance — Review-policy verdicts are serialized and transactional, a verdict can no longer bypass a policy by downgrading, the requester is persisted atomically, and the UI badges the review policy when it is what constrains approval. (#​11405, #​10938)
• Agents can look up secrets by name — A read-only /secrets/catalog endpoint maps secret names to ids for agents wiring env bindings — no values, no provider config. Issue-document annotations are also included in agent review context, so feedback left on a document reaches the agent that acts on it. (#​9530, #​11332)
• Search that scales — The parent-issue picker searches on the server instead of the loaded page, and the issues list API gained an updatedSince filter. (#​11334, #​9050)
• Observability — Host-side stage.sync steps are instrumented and the agent process span is homed correctly, continuing last release's sandbox-startup tracing work. (#​11301)
• See your channel with paperclipai channels — the new command shows every release lane (stable, beta, nightly, canary), the version each currently resolves to, and which one your install follows. (#​11210)

Fixes

• Deployments behind an authenticating proxy work end to end — The live-events WebSocket now authenticates cloud-proxied browsers (previously it could never connect through an auth-terminating proxy), the service worker's fetch fallback always answers with a real Response instead of a blank page, the web app manifest is fetched with credentials, and the UI survives first load against a cold backend. The archived-company selection ping-pong that could trap a session in a redirect loop is gone. (#​11290, #​11292, #​11245, #​11246, #​11300)
• Everything is scoped to the signed-in account — Invite membership checks, company selection, and query caches are all keyed to the account that is actually signed in, caches clear on sign-out, and the stored company survives a failed company request instead of being dropped. Onboarding drafts verify ownership against a list fetched this session and never restore wizard state for a company the user does not own. (#​11417, #​11430, #​11380, #​11477, #​11382, #​11370)
• Security hardening — Tool-access routes no longer leak cross-tenant ID oracles, routine webhooks reject HMAC replays, routine detail responses exclude assignee configuration, page-publish uploader credentials are scoped to the publish helper, execution workspace summaries are isolated, only accessible workspace file links are highlighted, the heartbeat-fallback comment can never publish a raw transcript, and CLI guidance shown to users goes through the safe npx form. (#​9589, #​9994, #​9818, #​10894, #​10790, #​11090, #​10143, #​11343, #​11400)
• Runs keep their context — Agent sessions are reused across execution handoffs and kept across issue comments, comment-wake decisions read post-insert issue state, stale closure-comment wakeups on done issues stop, successful-run handoff recovery skips recovery-action-driven and plugin-managed runs, and ACP run lifecycle corrections settle failures, sync workspaces back, and clean up leases properly. (#​9917, #​10111, #​10068, #​8656, #​9010, #​9047, #​11454)
• Sandbox plumbing resilience — The sandbox stdin file race is closed with atomic writes and a fault-tolerant poller, stdin writes are ordered in the process-session bridge, the callback bridge poll loop has a per-iteration timeout and watchdog, bridge traffic forwards to the local listen origin, the agent-hire skill's routes pass the callback bridge, runs that hit a provider worker restart window retry instead of failing setup, Daytona liveness calls are bounded per call, and syncOut accepts bsdtar tarball listings. (#​11235, #​11406, #​11341, #​10017, #​8978, #​10212, #​11408, #​11289)
• Adapter reliability — Claude local pipes the print prompt via stdin and no longer fails root-only permission skips; Codex local skips benign stderr warnings when deriving a fallback error; OpenCode retries its models preflight under transient contention and treats the availability probe as non-fatal; Grok reports real token usage and cost instead of hardcoded zeros; Cursor cloud drops an unreachable API callback; hiring onto an adapter the instance cannot run is refused; and adapters load on Windows (pathToFileURL before dynamic import). (#​9500, #​9463, #​10003, #​9225, #​10294, #​10433, #​8546, #​10256, #​4287)
• Server correctness — DELETE /api/issues/:id succeeds for issues with dependents (comments and read-state cascade; cost and finance records are kept with their issue reference cleared), non-UUID company refs return 404 instead of 500, cross-package Zod errors are recognized, wiring blockers in a PATCH no longer implicitly reopens a blocked issue, unsigned ask-first requests stay out of the review queue without being cancelled, the terminal workspace reaper stops starving on its oldest candidates, the agent run JWT default TTL is aligned to the documented 48h so suspended-laptop runs stop waking with an expired credential, an explicit PAPERCLIP_API_URL overrides the derived runtime URL in run env, base-URL ports are only rewritten for loopback hosts, and silent nonzero exits in the Hermes flow surface as failures. (#​11331, #​9959, #​10168, #​10269, #​11338, #​11238, #​10176, #​10339, #​10258, #​10107)
• Workspace Git scans are bounded — One bounded scheduler now coalesces and caps every expensive workspace Git scan (a request storm once produced ~270 concurrent git status processes and starved health checks), and the browser only starts scans when the file panel is open and visible. (#​11572)
• UI paper cuts — The queued-message interrupt action is back, agent secret access moved to a searchable secrets tab, slash autocomplete scrolls inside dialogs, inbox archive gained an undo toast and folded subtasks are remembered, inbox routing honors the saved policy for explicit targets, board approval prose renders as markdown, create-dialog badges use the real issue prefix, issue-document deep links route correctly, truncated issue descriptions are flagged, generated invite links prefer the public base URL, selected run lifecycle and logs stay current, and the mobile task chat gained blocker actions, a composer aligned with the thread, and a new-task dialog that stays above the keyboard. (#​11374, #​11283, #​11222, #​11220, #​11069, #​11221, #​9817, #​8550, #​11551, #​4771, #​7619, #​10169, #​11282, #​11296, #​11281)
• Odds and ends — Skill sync refreshes project folders in place instead of replacing them, issue writes through board keys work regardless of assignee, environment-secret bindings resolve their company context on first save, and worktree-mode dev instances warn when the embedded-Postgres data directory sits in the OS temp dir. (#​11066, #​9025, #​11291, #​8283)

Upgrade Guide

• Migrations: this release adds 11 database migrations (0212 through 0222), covering the one-per-company onboarding first task (0212), resumable company transfer runs (0213), adapter device-login sessions (0214, 0215), Cloud onboarding seeds (0216), issue-deletion foreign-key policies (0217), interaction resolver-policy defaults and provenance (0218), runtime exposure state (0219), execution-workspace runtime leases (0220), Claude setup-token sessions (0221), and environment-lease references that survive environment deletion (0222). Migrations run automatically on startup — no manual action required. Nothing drops a table or deletes data; note that 0218 rewrites resolver-policy values on existing pending interactions (conservatively — see Breaking Changes) and 0217/0222 change what happens to dependent rows on delete.
• New optional environment variables (all have sensible defaults; set only if you need them):
  • PAPERCLIP_MANAGED_RUNTIME_HTTPS — auto (default), off, or force; controls the Tailscale HTTPS default for managed runtime previews (see Breaking Changes). PAPERCLIP_TAILSCALE_BROKER_SOCKET and PAPERCLIP_TAILSCALE_DNS_NAME override the broker socket path and the tailnet DNS name; PAPERCLIP_VITE_HMR_PROTOCOL (ws/wss) pins the dev-preview HMR protocol. (#​11524, #​11525)
  • CLAUDE_LOGIN_TRUSTED_PROXIES — allowlisted proxy peers for the Claude login transport guard; CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true — declare platform-edge TLS termination on managed platforms where the proxy addresses aren't knowable. (#​11286, #​11579)
  • PAPERCLIP_ONBOARDING_SEED_ADAPTER_TYPE — adapter type for the agent created by a Cloud onboarding seed. (#​11098)
  • SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR — where durable sandbox cleanup records are spooled; PAPERCLIP_PROCESS_SESSION_STDIN_MAX_RETRIES — retry ceiling for the sandbox stdin poller. (#​11347, #​11235)
• Removed configuration keys: streamAgentSessionOutput (server) and useSessions / useLogStream (Daytona plugin) no longer do anything — remove them from saved configs at your leisure; they load but are inert. (#​11557)
• Agent run JWT TTL: the server default now matches the documented 48h (PAPERCLIP_AGENT_JWT_TTL_SECONDS=172800). If you relied on the old implicit 1h expiry, set the variable explicitly. (#​10176)
• HTTPS previews: to use them, install Tailscale on the host and run the new broker (see the @paperclipai/tailscale-https-broker README); to opt out, set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off. Nothing else changes for unmanaged or custom services.

Contributors

This release has 172 commits from 32 contributors. Thank you to everyone who contributed to this release!

@​0xopaque, @​adamteale, @​ApolinarioRatio, @​austinpilz, @​christianlappin, @​cucurigoo, @​dmndbrp-oss, @​dylanroy, @​edgardfrz, @​fronc, @​futhgar, @​panbanda, @​raviy06, @​samrusani, @​santastabber, @​sauerdaniel, @​seb-veto, @​Sergio-LPA, @​stubbi, @​ulisavo, @​vmarchaud, @​webdevdot

v2026.817.0

Compare Source

Paperclip v2026.817.0

Released: 2026-08-17

Paperclip v2026.817.0 is the first stable release since 2026.722.0 — and the first stable ever published through the new canary → nightly → beta → stable rel

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.