v2026.1023.0

Paperclip v2026.1023.0

Released: 2026-10-23

Paperclip v2026.1023.0 carries 200 commits, promoted from 2026.1012.1-beta.0. The headline is private work: a task or project can now be marked private and shared with named people and agents; everyone else cannot open it, find it in task lists or search, read its run transcripts, or reach it through a plugin. Around that: agents can run through your own model gateway (OpenRouter, Amazon Bedrock, Google Gemini, or any OpenAI Responses, Anthropic Messages, or Chat Completions endpoint), Slack bots set themselves up through Slack's Manifest API, the GitHub review bot gets a two-screen setup and a real Paperclip Review status check, Costs becomes an exact ledger that also shows monthly subscription fees, and connected assistants can edit tasks, upload files, and configure agents over MCP. Underneath, OpenAI Dot and Pi 1.0 join the experimental Runner, native OpenCode streams as it types, each agent gets a persistent cryptographic identity, and idle instances stop polling the database every second.

Breaking Changes

• Operators can now edit the company. The Operator role preset grows from one grant (tasks:assign) to fourteen: agent creation and configuration, skills, environments, invitations, task assignment, pipelines, connections, tool management and use, and audit reads. Existing Operators pick up the missing grants through the normal startup seeding; custom grant scopes are kept. Join approval and member-permission management stay out of the preset, and inviting an Admin now requires join approval while inviting an Owner also requires member-permission management. Review your member roles if Operators were meant to be read-mostly. (#15377)
• GitHub review bots move behind their own experimental setting. The GitHub Code Review Bot catalog entry, its setup, and its management screens appear only while Settings → Experimental → GitHub review bots (enableGitHubReviewBots, off by default) is on; existing bots keep running while it is off. The old setup-method and delegated-agent screens are gone, and per-person automatic-run flags are replaced by author include/exclude filters (legacy people[].automaticReviews values are read but ignored). (#15416)
• Budgets hold on unpriced usage by default. Each budget policy gains an unpriced-usage setting that defaults to block: while a run's usage has no reliable price, the policy counts as at its limit until the charge is resolved through the audited cost adjustment flow. Set the policy to allow to keep running on unpriced usage. (#14997)

Highlights

• Private tasks and projects — Mark a task private when you create it, or make a project private with its own member list; a personal private project is created for you on first use. Private work is readable only by its responsible user, creator, current assignee, named grantees, and private-project members, and that rule applies to task lists and task counts, search, activity, run detail, transcripts, events, and logs, documents, attachments, work products, and every plugin read. Two surfaces stay company-wide on purpose: dashboard and sidebar totals may count private work without exposing a title or identifier, and the company run list shows a locked row for a private task's run with only the agent, status, timing, token, and cost fields, so budget oversight keeps working. Privacy flows down to children; sharing a child never exposes its parent or siblings. Owners and admins do not see private tasks by default and must request ?breakGlass=true, which writes an audit row and a warning notice on the task. Agents' access is intersected with the run's responsible user, so reusing an agent does not carry another person's permissions. (#14717, #10633, #14718)
• Bring your own model gateway — Connectors gains rows for OpenRouter, Amazon Bedrock, Google Gemini, and generic Responses API, Messages API, Chat Completions API, and local endpoints. URLs, protocol, region, and credentials live on the connection; the agent's Harness / Runtime page picks a compatible Connection from a dropdown and the model picker accepts manual IDs. Codex (legacy and Runner) routes to OpenRouter or custom Responses endpoints, Claude (legacy and Runner) to OpenRouter, custom Messages endpoints, or Bedrock, and OpenCode and Hermes to OpenRouter or custom Chat Completions endpoints. OpenRouter connections without an explicit model list load OpenRouter's public catalog. (#14970, #15341)
• Slack bots set themselves up — New Slack bot drafts default to automatic setup: paste a temporary App configuration token, Paperclip creates the app through Slack's Manifest API, installs it through OAuth, links your Slack account, uploads the agent's avatar, and verifies delivery in a four-screen wizard with no Slack CLI involved (#15413). A new Require at-mention setting stops thread replies from waking the agent without an explicit mention (#15612); a follow-up sent after a Slack Stop starts a fresh turn instead of stalling (#15737); and Slack agents now know the saved slash command people use to link their accounts, link every task they create, and report results and review requests back in the originating thread (#15576, #15579, #15611).
• A two-screen GitHub review bot — Setup is now Choose agent, then Connect GitHub under a personal account or organization; GitHub asks for creation and installation consent, and Paperclip stores the App secrets locally, imports repository access, and verifies delivery. Each accepted request gets one editable App-owned progress comment, and review assessments publish a Paperclip Review check for the reviewed commit with a configurable passing score (1–5) that branch protection can require. A self-hosted instance needs one Paperclip Cloud approval before its first managed GitHub connection, because Cloud hosts the fixed OAuth callback and signed webhook inbox; tokens are sealed to your instance. (#15416)
• Costs you can reconcile — Accounting is now a durable, exact ledger: usage receipts are fsynced and replayed after failures, retries settle one charge, amounts keep decimal cents, and every event is marked reported, estimated, or unpriced instead of silently zero (#14991, #14997). The Costs page reports each connected ChatGPT or Claude subscription's monthly fee once beside API spend, lets you enter the real price, and keeps ambiguous plans unpriced (#15634); quota reads are scoped to authorized company accounts (#14994); cost gaps are listed by agent with links to the affected runs, the model the runtime actually selected is recorded, and a retry appears only when saved evidence is ready (#15948); and historical pricing gaps show as a neutral note under the totals rather than a red error (#15459).
• Assistants that can do more over MCP — A connected Claude Code, Codex, or other MCP assistant can now edit tasks, finish or block them, write documents and revisions, register deliverables, upload files through expiring tickets, and, with a separately consented configuration scope, manage agent settings and instructions, projects and repositories, and skills (#15380). Connections are named by owner and client ("Dotta's Codex connection") with the authorizing person's avatar, revoked rows disappear, and the copied invitation is shorter (#15411).
• Sixteen more apps in the catalog — Gauge (#15596), Superagent (#15394), Telem.AI web search (#15379), Enterpret (#13906), Calendly, Exa, Firecrawl, GSC Wizard, Parallel Search, Tavily, and Windsor.ai (#15621), and Bitly, Context7, Hugging Face, and Resend (#15686) join as verified hosted MCP connections. Sentry sign-in discovers OAuth through its MCP resource metadata, so setup no longer asks for a client ID and secret (#15837), and OAuth grants now record whether each scope came from the provider or from Paperclip's request (#14059).
• New Runner providers — OpenAI Dot joins as a standalone experimental agent choice: pair your Dot with a one-use code, and the Runner delivers assignments over MCP Events while Dot uses its own tools and reports back (#15402, #15414, [#15581](https...

v2026.1012.0

Paperclip v2026.1012.0

Released: 2026-10-12

Paperclip v2026.1012.0 carries 130 commits, promoted from 2026.1006.0-beta.0. The headline is that outside assistants can now join your team: Claude Code, Codex, OpenCode, and any MCP client can connect to Paperclip as a signed-in person, review work, and delegate tasks, all behind an experimental setting. Around that: Chat leads the navigation with each agent's tasks and artifacts beside the conversation, the Connections catalog pulls in accounts you already linked in Composio and Arcade, connections carry usage instructions that reach your agents automatically, Claude Sonnet 5.5 and GPT-6.1 Sol arrive with refreshed harnesses, and agents can safely update company skills. Underneath, Codex runs survive server restarts and model-capacity errors, workspace restore locks move to crash-safe SQLite file locks, and default agent instructions shrink to a fraction of their former size.

Breaking Changes

• Workspace restore locks change protocol; stop every old process before upgrading. Restore and agent-file collection locks are now OS-backed SQLite file locks under <instance root>/locks/directory-merge/, released by the kernel when a process crashes. Old and new versions must not write to the same instance root at once: drain and stop all old server and worker processes (including other hosts or containers) before upgrading or rolling back, then move any leftover legacy <hash>.lock/ directories to a scratch location. Never delete or move the new .lock.sqlite files. See doc/workspace-restore-locks.md. (#14869)
• Stored tool grants are enforced as written. A grant whose scope.allow list does not match a tool, connection, or application no longer falls through to a broader policy; grants with unknown selectors or malformed restrictions now deny access. Review custom grants after upgrading if an agent loses a tool it previously used. (#14915)

Highlights

• Assistants join your team over MCP — A new "Assistant Connection (MCP)" card in Connections lets Claude Code, Codex, OpenCode, and generic MCP clients connect to Paperclip through browser OAuth or device-code consent and act as the signed-in user: read and search tasks, create and delegate work, leave human comments, read documents and deliverables, and follow results through signed event webhooks (#14846). Consent shows the client and organization, write access can be opted out, requests can be pinned to one company, and a paperclip mcp CLI device login bridges local stdio clients; it is off by default behind Settings → Experimental → "Assistant connections (MCP)" and requires an HTTPS PAPERCLIP_PUBLIC_URL (#14933).
• Chat leads the way — With Agent Chat enabled in the streamlined UI (the default shell), Chat is the first row in the Work navigation, the chat rail lists every eligible agent, and the side panel shows that agent's recent tasks and artifacts; a new experimental "Combined Inbox + Task List" setting folds Inbox into Tasks as views (#15100). Instances that switched "Streamlined UI" off keep the legacy navigation and do not see these changes. The Chat entry reopens the last conversation you visited (#14848), and the chat header shows the agent's avatar (#14726).
• One catalog for every account — The Connections Apps catalog discovers accounts already connected upstream in Composio, Arcade, and supported Executor gateways and groups them with native accounts under one app card, with source chips, search, and pagination (#15254). AgentMail is a default connection with inline setup cards in Agent Chat (#14772), Neon joins the catalog with OAuth or API-key sign-in (#14980), Asana works again with a default "Sign in with Asana" (#14756), and AI accounts gain a "Check usage" action that reads current provider limits for Codex, Claude, Grok, and OpenRouter (#14936).
• Connections carry instructions for agents — A connection can hold editable usage instructions that are delivered to every authorized agent turn across the native runner, legacy adapters, and HTTP/process contracts. Honcho, Mem0, Zep, Supermemory, and Cognee ship defaults, the editor appears in setup and the Permissions panel, and agent Instructions show a read-only "From connections" section (#15216).
• New models, refreshed harnesses — Claude Sonnet 5.5 is selectable for Claude Code agents with Low through Max effort, and the qualified Claude runtime moves to Claude Code 2.1.286 (#14993); GPT-6.1 Sol joins the Codex adapter with Fast mode and Ultra effort, Bedrock gains Sonnet 5.5, and the shared pins move to Codex 0.160.0 and OpenCode 1.18.34 (#14942). Claude and Codex model menus now list models in the same order as the Claude and ChatGPT apps (#14917, #14918).
• Agents maintain company skills — Native-runner agents get an update_skill tool that rewrites a company skill with version checking and safe retries, recorded in version history and the audit log; the skill file API gains optional expectedVersionId and idempotencyKey fields (#15049). Newly created agents receive a default set of configuration grants so they can finish agent, tool, skill, and task setup without manual permission work (#15283).
• Codex runs that survive restarts and capacity limits — A native Codex turn killed by a server restart resumes in the same conversation once the old process is proven gone (#15297); a model at capacity shows a "Model at capacity" card and retries automatically after one and then two minutes (#15347); a model the ChatGPT account cannot use shows "Model unavailable" with guidance instead of generic recovery (#15299, #15304); and Codex keeps its stock base prompt, receiving Paperclip's context as additive developer instructions (#14920).
• A rebuilt New task dialog — The dialog is built on the shared task composer with a Project and Worktrees bar, remembered assignee, project, and effort, and task mentions in suggestions; the status, reviewer, approver, and watchdog controls move out of the dialog into task properties, and new tasks default to the last assignee used (#15091). Tasks created without a title get a clean plain-text provisional title (#15047).
• Far shorter default instructions — New companies and hires get role descriptions instead of procedural manuals: the default CEO instructions drop from roughly 1,900 words to 20 (#14985), new non-CEO hires receive a one-sentence default manual (#14948), and the bundled planning skills shrink to about 400 words combined and no longer force a child-task matrix (#15296). Existing saved manuals and custom bundles are unchanged.

Fixes

• Native runner and sessions — A run whose final answer was saved but whose shutdown failed reaches its correct final status, and the agent list_projects tool returns paged summaries instead of overflowing the command limit (#15217); tasks stopped during native preparation on an older build regain Retry and accept new messages (#15020, #15022); a continuation cancelled by the queued-run review gate is treated as a review wait instead of an unknown-execution hold (#15024); Retry and saved-message recovery work on SQL_ASCII databases (#15033); a user-continued legacy run that times out can be retried automatically (#14987); a completed run no longer reports "Run failed" when instruction-file cleanup times out afterward (#14945) and that cleanup no longer blocks lease release (#14866); write_document and other semantic tool calls no longer fail when a document merely discusses credentials (#14937) or contains credential-looking text (#15301); long connected MCP tool names are aliased to fit provider limits and the recovery notice explains why a run was cancelled with a Continue option (#14951); agents keep their task context when a ...

v2026.1005.0

Paperclip v2026.1005.0

Released: 2026-10-05

Paperclip v2026.1005.0 carries 179 commits, promoted from 2026.1002.0-beta.0. The headline is agents that carry more with them: Grok Build runs on the native runner, agents keep their own files across tasks, company skills sync from GitHub repositories, and Browser Use Cloud gives agents a live browser that people can watch and take over from the task. Around those: most connectors now set up in one click with MCP aggregators on by default, Slack conversations round-trip between the board and the thread, Agent Chat gets its own navigation and hands finished work back to the conversation, and the task composer picks model and effort per message. Underneath, a long reliability pass hardens the native runner, sandbox transport, and the heartbeat scheduler, including a fix for a server crash loop caused by a permanently rejected queued run.

Breaking Changes

• Operator UI snippet injection is removed. The PAPERCLIP_CLOUD_UI_SNIPPET and PAPERCLIP_CLOUD_UI_SNIPPET_B64 settings no longer inject HTML into static or development pages. Operators who relied on them should move the integration to a plugin UI contribution before upgrading. (#13789)
• Keyboard shortcuts are always on, and their settings are gone. The instance-wide General toggle and the per-user Profile preference are both removed, along with the GET/PATCH /api/auth/preferences routes; PATCH /api/instance/settings/general no longer accepts keyboardShortcuts. Every signed-in user now has shortcuts enabled. (#14141, #14643)
• @-mentioning an agent no longer starts a run. Mentions in task comments are kept as context for the assignee; only explicit assignment and review requests start work. Workflows that used a mention to pull a second agent onto a task must assign or request review instead. (#14577)

Highlights

• Grok Build on the native runner — Grok Build joins the Paperclip Runner through ACP for both local and Daytona execution, with separate subscription-login and API-key credential paths and governed tools (#13882); it ships in public installs with sandbox-owned binaries rather than a download at install time (#14024). The shared harness runtimes move to Codex 0.156.0, Claude Agent SDK 0.3.280, and OpenCode 1.18.32 (#13838), model catalogs and reasoning controls are refreshed across the Claude, Codex, Grok, Gemini, Cursor, Kimi, and OpenCode adapters (#13829), and remote native Codex accepts compatible releases from 0.149.0 instead of one exact pin (#13853).
• Agents keep their own files — An agent's directory (AGENTS.md and its supporting files) now persists across tasks and sessions and is shared with the Instructions Editor; concurrent runs apply only the files they changed, and new saves no longer create revision history (#14420), on top of a new plain-directory sync transport with conflict preflight (#14416). Warm native Codex sessions survive managed-file collection by checkpointing only changed files after each turn (#14735).
• Skills synced from GitHub — Skills gains a Sources tab: pick a repository through an existing GitHub connection, choose which skill folders to import, and refresh on demand. Installed snapshots mean agents never fetch GitHub mid-run, and a failed refresh leaves the last good version in place (#14713).
• Browser Use Cloud, live in the task — A new Browser Use Cloud connector gives agents governed browser automation, and tasks show interactive browser tabs where people can follow along, take over the page, and keep the browser after the run finishes, with costs recorded against the run (#14627).
• Connections set up in one click — Connector setup collapses to one screen that states its defaults and tucks the rest behind "Change" and the Permissions tab (#14811). The Zapier, Arcade, Composio Connect, and Executor MCP aggregators are on by default with the experimental toggle removed (#13964), and they can be configured from inline task cards (#13879). Connection search prefers native apps, asks the user to choose an external provider before setup (#13941), and understands natural-language queries (#14725). New in the catalog: Fireflies with summary-ready routines (#13890), five experimental memory providers (Mem0, Zep, Supermemory, Cognee, Honcho) behind the default-off enableMemoryConnectors setting, plus assigned MCP tools delivered to remote native Codex (#13942), and GitHub Code Review Bot as its own card separate from GitHub tools (#14750). Personal pasted credentials are validated the same way at setup, health check, and invocation, and new connections request the write scopes their actions need (#14739).
• Slack goes both ways — Replies entered on the board reach the linked Slack thread and resume the same conversation, and assigned agents get their Slack tools during ordinary tasks and scheduled routines (#13920). Slack-origin tasks get governed tools to read the surrounding discussion, create follow-ups, and collaborate through the inviting bot (#13828), and an answered conversation settles to Idle instead of lingering In Progress (#13809).
• Agent Chat grows up — A secondary chat sidebar and landing page give conversations their own home (#14706); tasks delegated from a chat durably deliver their completion back to it (#14408); a clear approval typed in chat resolves the pending card, and unanswered questions move into history where they can be answered later (#14613); and a chat continues after its native worker is lost (#13813).
• A composer that picks the run — The task composer gains a per-message model and effort picker that follows the selected agent, keeps pending cards visible above it, and works on mobile (#14322); effort options match what each adapter actually executes, including Codex on the native runner (#14568, #14576). Tasks can be created from a prompt alone and the assigned agent names them (#14761). Artifacts get rich cards with previews (#14469), an image and video gallery with full-row links (#13825), and Markdown and text attachments open in task tabs with rendered, raw, and download views (#14297).
• Governed API tools, on by default — The native runner's search_api and call_api tools are enabled without an environment variable (#14186); large API responses stream to disk up to 1 GiB and saved text is readable in bounded pages (#14301); and when an assigned app catalog pushes the tool contract past its limit, agents still reach those tools through search and call (#14218).

Fixes

• Native runner and sessions — Tool outcomes survive shutdown and restart instead of recording a false failure (#14734); failed warm sessions are retired before their sandbox stops (#14747) and recovered cleanup honors the run's terminal outcome (#14767); switching a task to a warm lifecycle acquires a reusable lease (#14187); the OpenCode event stream stays open across turns (#14582) and delivers its shutdown settlement (#14668); Codex account notifications no longer abort a turn (#13902); Claude and Codex quota exhaustion is classified for the proper backoff (#13831, #13945); ACP terminal failures keep their redacted provider diagnostics (#14573) and identity guards name the failed c...

v2026.1001.0

Paperclip v2026.1001.0

Released: 2026-10-01

Paperclip v2026.1001.0 carries 77 commits, promoted from 2026.921.0-beta.1. The headline is reliability: a deep hardening pass over the native runner and chat recovery — approval and Stop races, session continuity, sandbox reconnection and cleanup — alongside a friendlier face: agent personas throughout the app, an animated onboarding character, and a rebuilt Slack setup. Around those: agents can review GitHub pull requests as scheduled review bots, Railway joins the connector catalog with governed deployment tools, approvals and answers queue during active runs instead of bouncing, and execution harnesses now default to full auto.

Breaking Changes

• The legacy Composio broker is retired. The API-key catalog method, broker clients, session creation, account synchronization, child lifecycle and toolkit routes, and the Services tab are all removed. Existing legacy Composio connections stop working, and there is no automated migration — the experimental MCP aggregator connectors (below) are the successor path; see the Upgrade Guide for the manual steps. Vercel provenance is untouched. (#13758)
• Execution harnesses now default to full auto. Native runs default Claude/ACPX to approve-all, OpenCode to allow, and Codex to approval-and-sandbox bypass, and the legacy adapters follow the same policy — provider tools and connected tools included. Explicitly configured restrictive modes are preserved, and Paperclip's own approval decisions still enforce controller authority; only the defaults change. Operators who relied on unconfigured agents inheriting restrictive provider gates should set an explicit mode. (#13686, #13693)

Highlights

• Agents get faces — Static persona images replace agent icons across lists, the sidebar, org charts, tasks, comments, selectors, activity, and dashboards, with one animated pointer-following character in the agent header (reduced-motion and touch fallbacks included) and persona reveal built into agent creation (#13171). Onboarding opens with the ClipLab sleepy-to-wake hero: the character dozes in gray through setup and wakes in full palette on Review (#13629). Slack setup can download the agent's avatar as a PNG for the bot identity, from both setup and settings (#13740).
• Agents review your pull requests — A guided setup turns a Paperclip agent into a GitHub review bot: a copyable Claude/Codex prompt walks through App installation, review scheduling, and optional required checks, with the instance origin baked in (#13717). The GitHub MCP connection also gains the Actions toolset — workflow discovery and dispatch — for existing and new connections (#13553).
• Approvals and answers queue during active runs — Responding to a question or approval while the agent is mid-run no longer bounces: resolved cards project into the run queue as immutable responses, an explicit click steers a response into a compatible native turn (or interrupts for a fresh session), and typed context survives interruption and cleanup (#13539).
• Slack setup, rebuilt — Onboarding splits into six clickable steps with a generated creation link and read-only manifest, credential validation, live account-link status, and a mention-based message test (#13638). Companies can attach communication guidance to a Slack connection that follows conversations into tasks without per-turn reminders (#13760), and callback health reports correctly behind Cloud proxies (#13694).
• The connector catalog grows — Railway arrives with OAuth setup and governed deployment tools: service and deployment status, bounded logs, and redeploy/restart/rollback, with workspace-verified access (#13415). Experimental MCP aggregators (Zapier, Arcade, Composio Connect, Executor) land behind the default-off enableMcpAggregators flag, reusing the existing vault, grants, and policy models (#13755). You.com search joins the self-serve catalog with sign-in, API-key, and keyless free tiers (#13555), and a CreateOS sandbox provider plugin implements the full environment lifecycle against the CreateOS HTTP API (#13434).
• Routines get safe webhooks — A production trigger wizard adds schedule and webhook choices, one-time credentials, test delivery receipts, and reversible removal (#13637), and a warning banner flags webhook URLs that may not be publicly reachable — localhost, private networks, HTTP, and Tailscale Serve vs Funnel (#13684).
• Skills from work, and for onboarding — A runner tool turns a completed task's learnings into a company skill, validated and governed by the existing skill policy (#13538); the first onboarding task runs through a dedicated skill invoked natively on Claude and Codex (#13517); and an eval guide plus skill-authoring skills join the docs (#13535).
• Plugins load image catalogs — Catalog identities, confined paths, package versions, and bundle hashes are validated before importing code; image selection applies to persisted installs with removal and rollback; and persistent application overlays mount in both UI shells (#13646).

Fixes

• Task conversation and UI — The chat composer no longer starts out disabled on desktop while the pause-status check is pending (shipped early as stable 2026.916.1; #13562). Selecting a single-choice option answers the question without auto-advancing the page (#13602), every copy button now confirms only after the clipboard write succeeds (#13603), task history stays visible while retries wait to start (#13597), the latest failed attempt is retryable even when later automatic retries were cancelled (#13765), and the connections sign-in screen stops adding a phantom step (#13601).
• Runner and native execution reliability — A broad hardening pass across the native runner: approval and Stop races settle correctly during cleanup (#13750), a pending startup is awaited before a Stop is acknowledged so a late handle can't submit a provider turn (#13741), provider sessions persist across turns with question and approval continuations completing on the same run (#13655), task replies and warm process continuity survive deduplication and helper-thread noise (#13738), and Agent Chat recovery keeps wake-comment identity and rejects stale retries (#13678). Sandbox operations got sturdier too: Daytona sessions reconnect after a controller restart with PID-reuse-proof adoption checks (#13691), termination keeps progressing after bridge loss with fenced cleanup attempts (#13287), leases stranded active by a restart are swept (#13515), inherited environments are validated and stale sandbox binaries replaced (#13677), catalog runtime and grading boundaries are repaired (#13676), completion-tool rejections name the missing fields (#13682), and native review handoffs complete with server-validated assignment facts and narrowly scoped reviewer tools (#13581). Also: plugin workers reach issue-tree resume (#13757), projects without workspace configuration honor the operator's isolation default (#13636), managed Git launchers work in sandbox projects (#13588), an empty GROK_HOME no longer masks the host login for local Grok runs (#13570), and Claude ACP quota classification and reset times survive to the adapter boundary (#13651).
• Connection and notification recovery — Authentication and browser connection failures recover: CONNECT_TIMEOUT joins the retry policy, WebSocket constructor failures ...

v2026.916.1

Paperclip v2026.916.1

Released: 2026-09-21

A patch on top of 2026.916.0 that fixes sending messages in the task conversation view. It carries one targeted fix (plus its regression tests and a small server error-classification repair that rode along in the same commit); everything else in 2026.916.0 is unchanged.

Fixes

• The chat composer's send button no longer starts out disabled on desktop. The task page disables the composer while it checks whether the task is paused, and in React Query v5 that pending state is true from mount until the first successful response — so every desktop task page loaded with the send button disabled, and it stayed disabled for good if the pause-status request stalled. Sends are now allowed while the check is pending: the server remains authoritative and rejects messages to paused tasks with a 409 before saving a comment or waking an agent, and a confirmed pause hold or a failed status check still blocks the composer as before. (#13562)
• Duplicate document inserts wrapped by the ORM are classified as retryable conflicts again, instead of surfacing as opaque database errors; unrelated database failures keep their original identity. (Part of #13562)

Upgrade Guide

• No migrations, no configuration changes, no API changes. Upgrade in place.

v2026.916.0

Paperclip v2026.916.0

Released: 2026-09-16

Paperclip v2026.916.0 carries 503 commits, promoted from 2026.916.0-beta.0 published the same day. The headline is the Connections train: AI runtime credentials — Claude and Codex subscriptions, API keys, shared accounts — now live in Connections under the same grants and permission boundaries as every other account, follow the responsible person through hiring and task execution, and can be connected or repaired inline from the task that needs them. Around it: agents get their own email addresses through AgentMail, experimental chat connectors bring Slack, Discord, Telegram, Microsoft Teams, and (via Photon) iMessage conversations into tasks, GitHub access becomes durable per-person identities instead of one shared token, announcements arrive as native in-app cards, and the experimental Paperclip Runner grew from last release's groundwork into a complete execution engine — with the gate now open by default on self-hosted installs for explicitly configured agents.

Breaking Changes

• Cheap model profiles are removed. The second execution mode that let recovery and overrides run on a cheaper model is gone from adapter metadata, agent runtime configuration, task overrides, recovery rules, the APIs, and the board UI; migration 0236 strips stored modelProfiles blocks from agent configurations. There is now one model-selection path for normal work and recovery work. (#12683)
• Agent APIs no longer return plaintext credentials. Every endpoint that serializes an agent — detail reads, the company agent list, and create/update/lifecycle routes — used to echo adapterConfig.env as stored, so plain bindings (API keys, tokens) came back verbatim to any caller able to read the agent, including the agent itself via GET /api/agents/me. All three response families now route through one redacting presenter. Integrations that scraped live credentials out of those responses will stop working — that was the leak. (#9860, @glovario)
• Automatic productivity reviews are retired. The detector that turned run counts, comment counts, and elapsed time into management-review tasks is deleted along with its continuation holds — infrastructure failures could satisfy its rules and manufacture work. Bounded recovery, budgets, explicit blockers, and the normal review stages all remain; existing task records stay readable and unchanged. (#13263)
• X-Forwarded-Host is only honored from a trusted proxy. The same-origin guard used to accept a forwarded host from any direct client, letting a caller promote its own header into the trusted-origin set. The forwarded host now counts only when the immediate peer passes the operator's TRUST_PROXY setting — deployments behind a reverse proxy should confirm TRUST_PROXY is configured, or the proxy's forwarded host is ignored in favor of the raw Host header. (#12832)
• Anthropic's legacy REST connection option is gone, and REST tool connections are validated as REST. The obsolete REST setup path is removed in favor of the supported AI-account flow, and stdio validation no longer lets an unsupported REST connection pass (or fail with a misleading templateId error) — existing unsupported connections now receive an accurate rejection. (#13346)

Highlights

• AI credentials live in Connections now — Provider sign-ins stop being per-agent configuration and become managed accounts with the ownership, grants, and access permissions Connections already enforces: agents reuse the responsible user's account or a permitted shared one, and model/harness selection stays independent from credential selection, with legacy agents keeping their existing authentication until they explicitly adopt a managed connection (#13247). The same sign-in components are reused across onboarding, agent configuration, and the Connectors page instead of a second login wizard (#13248). Hired agents inherit the hiring agent's provider credential references so a delegated teammate can authenticate from its first run (#13268), and connections follow hires across legacy and native runners — a missing account pauses the task and offers the connection form inline instead of failing (#13438). Each responsible user gets a per-provider default, so the same agent can run on one person's subscription and another's API key (#13351). The train also hardened as it landed: subscription sign-in works on authenticated self-hosted instances without exposing the server operator's CLI account (#13344), credential leases survive transaction pooling instead of reporting a phantom "connection busy" (#13347), one Anthropic subscription connection supports concurrent runs — only file-backed credentials still serialize (#13445), and connection probes, saved-account reuse, and task handoffs got reliability passes (#13404, #13161).
• Agents get their own email — AgentMail connections (experimental) give an agent a dedicated inbox: incoming email becomes assigned work in a task, sends are explicit agent actions authenticated through Paperclip, and internal task comments can never leak out as outgoing mail by accident. The provider key stays in the server vault, and the board follows each conversation from a task email card. (#13256)
• Reach your agents from your chat tools — Experimental native chat connectors bind a Slack, Discord, Telegram, Microsoft Teams, or GitHub bot identity to one agent and each admitted external conversation to one task, with durable per-conversation queues, questions, progress, files, and delivery receipts — board comments stay internal unless explicitly sent to the channel, and raw reasoning, logs, and credentials are never sent at all (#13100, #13038). iMessage joins through the experimental Photon channel: shared Pro DMs or dedicated numbers, photos included, with Paperclip keeping task ownership and approval authority (#13299). In the app itself, experimental Agent Chat gives every person a persistent conversation with each agent — backed by real tasks and normal governance, not a parallel chat store — and every company agent is reachable from the Chats sidebar through a searchable picker (#13284, #13420).
• GitHub access becomes identities, not a shared token — GitHub App-backed identities with durable refresh, repository-access checks, and webhook delivery replace ad-hoc tokens, built on the existing managed connections and encrypted grants (#12843). When several people steer one agent, managed Git, gh, and GitHub tools resolve to the responsible person's credentials per accepted instruction — with durable continuation rules and no fallback to a teammate's access (#13005), and that identity projects into sandbox runners too (#12907). Around the core: browse repository access across organizations (#12998), select multiple source repositories per project (#13010), duplicate connections to the same GitHub account resolve cleanly (#13022), and sign-in state and connected-repository access are visible and simplified in the UI (#12993, #13047, #12893).
• Announcements arrive in the app — A native announcement card renders a validated JSON feed with native components (the hero can be a static image or isolated HTML/CSS animation), so publishing or withdrawing a card needs no app release. Dismissals persist per account on the instance — a closed card stays closed across companies and browsers — and named staging feeds let authors test content before production. On by default against the hosted feed; the Upgrade Guide has the opt-out. (#13403)
• Onboarding walks straight to a working agent — The connect step opens as a model-source question with provider sign-in built in — one continuous sequence on a single card, API key entry included, with the pasted login code kept on screen and answered at once (#12440, #12863, #12801, #12820, #12613, #13193). Your first task now opens as a chat with a chief of staff that waits for your ...

v2026.831.1

Paperclip v2026.831.1

Released: 2026-09-02

A patch on top of 2026.831.0 that fixes first-run onboarding. It carries a single targeted change; everything else in 2026.831.0 is unchanged.

Fixes

• Onboarding no longer gets stuck on the organization step. On the first onboarding screen ("What is the name of your organization?"), clicking Continue created the organization on the server but could leave the wizard sitting on the same step — so the page appeared to just refresh, and repeated clicks silently created duplicate organizations. The company-created list refresh can make the surrounding app adopt the just-created organization before the create request's continuation runs; the wizard now recognizes that as the same successful transition and advances to the first-agent step, while a genuine switch to a different organization still stops with a clear message. (#12667)

Upgrade Guide

• No migrations, no configuration changes, no API changes. Upgrade in place.

v2026.831.0

Paperclip v2026.831.0

Released: 2026-08-31

Paperclip v2026.831.0 soaked as 2026.828.0-beta.0 and carries 175 commits. The company skill library now actually reaches your agents at run time, Kimi Code joins the adapter lineup, operators hosting Paperclip for others get real control over which settings surfaces their users see, the sandbox callback bridge is rebuilt on a bounded HTTP/2 transport, and onboarding sheds its mission step for a shorter arc with the agent front and center. It also raises the Node.js floor to 24 — read the Upgrade Guide before updating a source install.

Breaking Changes

• Node.js 24.11.0 or newer is required. Every package manifest declares the new floor and the Docker images ship Node 24. Only managed installs (paperclipai install) refuse outright on an older Node; npm installs and a directly started server on Node 22/23 print an unsupported-version warning and continue. A warning is not support — upgrade Node before taking this release. (#11792, #11890)
• Invalid agent credentials are rejected instead of downgraded. A bearer token that fails verification now returns a 401 naming the cause (expired, unverifiable, terminated agent, wrong company, …) instead of silently falling through to the anonymous local-user actor. Any integration that depended on that fall-through will start seeing 401s — that fall-through was the bug. (#11589)
• The company brand color and per-company attachment size limit are gone. The fields are removed from the company General page, the create/update APIs, and the portability manifest; migration 0229 drops the columns. Export bundles that carry the old fields still import — the values are ignored. (#12291)
• Silent-run detection no longer takes action on its own. Output silence still surfaces as a suspicious/critical level on active-run summaries in the UI, but it no longer creates evaluation issues, recovery actions, comments, or wake requests. Stranded-task recovery similarly stops automatic takeovers: exhausted and unsafe recovery now routes to a board-owned action instead of reassigning work by itself. (#12242, #11961)
• Agent thought text stays out of automatic issue comments. ACPX run summaries are limited to the final output segment, and the legacy full-summary setting is deliberately ignored so configuration cannot bypass the containment. (#11801, @nearfolk)
• Grok no longer defaults --permission-mode to dontAsk. The adapter passes no permission-mode flag unless one is explicitly configured; --always-approve remains the unattended policy. (#11898)

Highlights

• Your skill library now reaches your agents — Skills used to be something you installed and hoped for. Now every agent run carries a deterministic manifest of the company's skill library in its instructions, agents can list skills over MCP, newly hired CEOs get the five core Paperclip skills by default, and installing a skill offers an "Enable for agents" step that pre-selects every skills-capable agent. When a skill fails to materialize, the failure is surfaced in the run output with its cause instead of the skill silently vanishing — and legacy runners are pinned back to the canonical operational skill. (#12147, #12138, #12136, #12146, #12225)
• Kimi Code is a first-class adapter — kimi_local runs Moonshot's Kimi Code CLI on the shared ACP engine by default — live streaming transcripts, tool-call lifecycle, the same machinery as Claude, Codex, and Gemini — with an automatic headless-CLI fallback when ACP prerequisites are missing. (#9967, @hawikk)
• Operators can shape what their users see — For anyone hosting Paperclip for others: PAPERCLIP_HIDDEN_SETTINGS hides settings surfaces by key — instance pages, individual experimental flags, company pages like Members, Invites, Secrets, Export, and Import, and even individual tabs like Provider vaults and Proposals. Hiding company.import floors the API too, and cloud-managed instances floor imports unconditionally. PAPERCLIP_SETTING_DEFAULTS overrides the schema default of selected instance settings without persisting anything, and a managed-sandbox-only mode hides host-path and execution-engine surfaces entirely. (#11823, #12199, #12284, #12285, #12293)
• The sandbox callback bridge, rebuilt to not fall over — The bridge that lets sandboxed agents call back into Paperclip now prefers a bounded Node HTTP/2 duplex transport, demoting the file-polling relay to a soft-deprecated fallback: bytes stay binary end to end, every resource dimension is budgeted by a process-owned byte ledger (route data, broker forwards, decoder buffers, pending writes), the in-sandbox gateway survives faults after readiness and fails loudly before it, and a duplex channel dying mid-run fails the run closed instead of letting it end "successfully" with lost writes. The retired v1 transport is deleted outright. (#12120, #11769, #12003, #12060, #11966, #12171)
• Onboarding gets to the point — The mission step is gone; the wizard opens on creating your agent, which asks for a name and nothing else (every onboarding hire starts in the general role). The steps are rebuilt on a single card with the brand pill held across them — dormant while you set up, alive when you review — and the auth page wears the new brand lockup. The idle "test your environment" card is gone too; the probe still runs on Connect and still blocks a failing hire. (#11935, #11905, #12274, #12074)

Improvements

• Opt-in error monitoring with Sentry — Set SENTRY_DSN and install the optional @sentry/node peer to get server-side error capture; the DSN rides the authenticated session response so the browser reports too, behind a React error boundary. Everything is fail-open: no DSN, no package, no Sentry, no problem. (#12190, #12249, #12270)
• Company imports land better — Last release made big imports resumable; this release makes arriving pleasant. Imported companies get de-duplicated names, an already-imported bundle names the company it landed as, every import outcome ends with a dashboard CTA, agents paused by an import carry a dedicated pause reason with visible notices and a Resume button in the thread, and the dashboard shows a banner with "Resume all" while imported agents sit paused. (#12145, #12144, #12143, #12140, #12142)
• Settings, unified — Company and instance settings share one navigation; instance general controls live on the company General page; invites moved into a tab of the Members page; the separate instance Heartbeats page is gone; and user-facing copy now says "organization" where it used to say "company". Hosted tenants also get issue prefixes derived from the organization name, following renames. (#11789, #12289, #12282, #12243, #12292)
• Environments you can actually manage — Deleting an environment now walks you through it: agents are reassigned in the same action, lease holders are listed, and destroying reusable sandboxes is a separate consent-labeled choice. Custom-image templates report boot-relevant drift with attribution and can be relinked in one click, and the managed default environment shows up by its name ("Paperclip Computer"), not its driver key. (#12053, #11751, #11641, #11838)
• Faster sandbox file movement — Inbound workspace, asset, and referenced-project syncs run in parallel where the provider opts in, and Daytona file uploads are transparently zstd-compressed with a raw fallba...

v2026.824.1

Paperclip v2026.824.1

Released: 2026-08-25

Paperclip v2026.824.1 is a patch release on v2026.824.0 that repairs the background-service leg of onboarding end to end: the service now actually starts from an npx onboard, onboarding no longer steers you into a safety-check error afterward, and it finishes by handing you the dashboard in your browser.

Fixes

• Accepting the background-service prompt during an npx onboard no longer installs a broken service. The service definition targets the managed command shim, but an ephemeral run never installs it — the service crash-looped on a missing binary while onboarding, believing the service was handling things, skipped its own foreground start: a first run that ended with nothing serving. The service step now materializes the managed install (payload and command shim, pinned to the version being onboarded) before registering the service, and when it cannot — a custom PAPERCLIP_SHIM_PATH, or a failed install — it declines with the repair commands instead. (#12148)
• Onboarding no longer offers a foreground start the service already covers. After a successful service install, interactive onboarding still asked "Start Paperclip now?" — accepting ran a second server into the already-running instance guard, ending a successful onboard with an error. The prompt is skipped once the service is running. (#12153)
• Onboarding ends at the dashboard instead of a dead stop. After the service starts, onboarding now waits for it to report the endpoint it actually bound (including a fallback port when the configured one is busy), prints the dashboard URL, and opens it in the browser on interactive terminals. Headless runs print the URL; PAPERCLIP_NO_BROWSER=1 disables the browser open. If the service does not become ready, onboarding says so and points at paperclipai service logs instead of claiming success. (#12164)
• paperclipai doctor diagnoses a missing service binary as exactly that. The service-runtime check no longer suggests stopping a nonexistent conflicting process when the service's binary is missing (it names the missing path and points at paperclipai install), and the health check attributes a healthy responder that is not the managed service instead of reporting a plain "Healthy". (#12148)

Upgrade Guide

• No migrations and no configuration changes.
• If a previous onboard left a crash-looping background service behind: run paperclipai install, then paperclipai service start. The dead service definition is reused once its binary exists.

Contributors

This release has 3 commits from the core team.

v2026.824.0

Paperclip v2026.824.0

Released: 2026-08-24

Paperclip v2026.824.0 is a fast follow to 2026.817.0 — and the first stable to walk the full canary → nightly → beta → stable happy path end to end, soaking as 2026.818.0-beta.1 before promotion. It carries 172 commits: chat-style tasks graduate from experiment to the default experience, managed runtime previews become reachable over Tailscale HTTPS, sandbox execution gains a verified provider capability contract, you can sign in to Claude and Codex from inside the product, large company imports survive dropped connections, and a large batch of long-standing community fixes lands.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Chat-style tasks are the default. The "Chat-Style Tasks" experiment toggle is gone; the task detail page is now the conversation view for everyone. A new "Classic Task Interface" preference (enableClassicTaskInterface, replacing enableTaskChatRedesign in instance settings) restores the pre-chat page — page-level header, plain comment thread, fixed Properties sidebar — but chat-only features are unavailable there. (#11101)
• Sandbox session-output streaming is now capability-driven, and three operator flags are gone. The server's streamAgentSessionOutput setting and the Daytona plugin's useSessions and useLogStream keys no longer exist; the verified provider capability snapshot is the only streaming decision, with an automatic poll fallback. Saved configurations that still carry the removed keys load fine — the keys are simply inert. (#11463, #11557)
• Managed dev runtimes now default to Tailscale HTTPS previews. When the host broker is available, eligible Paperclip-managed worktree runtimes are exposed as tailscale_https instead of loopback HTTP. Set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off to keep the old behavior, or force to fail closed when the broker is missing. Managed runtime control routes also gained two new 409 responses (workspace_runtime_control_in_progress, workspace_runtime_lease_conflict) — callers that assumed a control always starts must handle a conflict. (#11524, #11525)
• Interaction resolver policy defaults to anyone for new interactions. Every interaction kind now goes through one resolver-policy evaluator with recorded provenance, instead of per-route rules that blocked valid agents. Migration 0218 deliberately does not widen anything already pending: existing rows keep their old restrictions under new names (board_or_agents → not_creator, board_only → human_only). (#11376)
• The decision-training surfaces are removed from the Decisions desk — the training library route, row actions, and drawer. The backend snapshot contract is unchanged and no data migration runs. (#11225)

Highlights

• Chat-style tasks, now the default experience — Last release's experimental conversation view is now how every task works, and it grew up on the way: cleaner message spacing and agent bubbles, searchable assignment and the sub-task tree in the properties pane, document comments docked in a side gutter, and a chat sidebar that surfaces every issue document and agent artifact. Blocked tasks show their blockers as links with live, ordered blocker work right in the thread, and an issue with a live run shows a calm in-flight notice instead of a false alarm. Onboarding is chat-first too: finishing the wizard drops you straight into your first task's conversation, where the agent greets you, asks clarifying questions, and proposes a plan you approve item by item. (#11101, #11263, #11226, #11456, #11487, #11423)
• HTTPS previews for managed runtimes, over Tailscale — A managed runtime service used to listen on plain loopback HTTP, so an agent's branch preview was unreachable from a phone or a second computer. Paperclip can now expose it at a real HTTPS URL on your tailnet, built in three deliberate layers: a separate least-privilege host broker that authorizes every mapping (peer credentials, a fixed port range, protected-port denies, append-only audit), the exposure lifecycle with durable issue-owned runtime leases and bounded control recovery so a stranded control can never block the lane forever, and a single port-pair mediator so a start can never collide with or adopt another issue's service — every mismatch fails closed and names the conflict. (#11524, #11525, #11526)
• Sign in to Claude and Codex from inside Paperclip — The new-agent page now offers Claude subscription login before you create the agent, on both Test lanes, with diagnostics kept in redacted server logs and login URLs normalized to allowlisted Anthropic hosts. Under the hood, a guarded setup-token flow drives claude setup-token through a sandbox pseudo-terminal with owner-bound sessions and one-time token delivery, and the Codex adapter gets an equivalent sandbox device-login that promotes the credential only after readiness checks and then deletes the temporary sandbox. Deployments behind a TLS-terminating platform edge (Railway, Render, Fly, …) can declare CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true so the transport guard stops warning about a connection that is HTTPS to the user, and a promoted device-login credential now survives managed-home re-seeding. (#11347, #11286, #11237, #11579, #11578)
• A real capability contract for sandbox providers — Last release introduced live output streaming and persistent sessions for Daytona; this release makes those behaviors provable instead of configured. Providers declare capabilities in their manifest, the live worker verifies them, and the server resolves the effective set fail-closed as the intersection of declared, verified, and configured — a declared capability can never grant a method the worker didn't prove. Streaming and persistent sessions now turn on wherever the verified snapshot allows, with an automatic poll fallback, and the three operator flags that used to gate them are gone (see Breaking Changes). (#11463, #11557)
• Chunked, resumable company imports — Last release raised the import cap to 1 GB; this release makes the transfer worthy of it. A dropped connection at 90% used to start the whole upload over — imports now move as verified ~32 MB parts spooled to disk with a durable run ledger, so an interrupted transfer resumes from the parts already uploaded (across dropped connections, page refreshes, and server restarts) and peak upload memory drops to one part. The Import page and CLI gained the resumable upload and a chunked preview, bundles now preserve task timestamps and hierarchy through export/import, imported agents keep their own adapter instead of being coerced to the destination's CEO adapter, and freshly imported tasks stay quiescent under the productivity review sweep. (#11223, #11224, #11193, #11192, #11191)

Improvements

• Onboarding meets you where you are — A company with no agent is sent into onboarding automatically, opening at the right step: the mission step is skipped when the company already has one, an existing mission is carried into the wizard, and the step is decided once instead of jumping under a mid-flow customer. The wizard's agent and connect-model steps were reworked for the chat-first flow, no longer keep an invisible disabled adapter selected, and the decorative panel follows your theme. (#11352, #11416, #11429, #11371, #11379)
• Paperclip Cloud onboarding seed — An instance can now receive the mission, first agent, and first task collected during Paperclip Cloud signup and apply them at activation, so a seeded stack opens ready to work instead of asking again. (#11098)
• Managed sandbox deployments — Tenants can edit environment variables on a platform-managed sandbox environment (and only that), and a managed-sandbox-only mode hides local execution entirely with run selection failing closed. Bundled providers' documented credential env vars (e.g. DAYTONA_API_KEY) now reach their plugin workers, and the synthetic "Local" default option respects the mode. ([#11200](https://github.com/...