Paperclip v2026.1012.0

Released: 2026-10-12

Paperclip v2026.1012.0 carries 130 commits, promoted from 2026.1006.0-beta.0. The headline is that outside assistants can now join your team: Claude Code, Codex, OpenCode, and any MCP client can connect to Paperclip as a signed-in person, review work, and delegate tasks, all behind an experimental setting. Around that: Chat leads the navigation with each agent's tasks and artifacts beside the conversation, the Connections catalog pulls in accounts you already linked in Composio and Arcade, connections carry usage instructions that reach your agents automatically, Claude Sonnet 5.5 and GPT-6.1 Sol arrive with refreshed harnesses, and agents can safely update company skills. Underneath, Codex runs survive server restarts and model-capacity errors, workspace restore locks move to crash-safe SQLite file locks, and default agent instructions shrink to a fraction of their former size.

Breaking Changes

• Workspace restore locks change protocol; stop every old process before upgrading. Restore and agent-file collection locks are now OS-backed SQLite file locks under <instance root>/locks/directory-merge/, released by the kernel when a process crashes. Old and new versions must not write to the same instance root at once: drain and stop all old server and worker processes (including other hosts or containers) before upgrading or rolling back, then move any leftover legacy <hash>.lock/ directories to a scratch location. Never delete or move the new .lock.sqlite files. See doc/workspace-restore-locks.md. (#14869)
• Stored tool grants are enforced as written. A grant whose scope.allow list does not match a tool, connection, or application no longer falls through to a broader policy; grants with unknown selectors or malformed restrictions now deny access. Review custom grants after upgrading if an agent loses a tool it previously used. (#14915)

Highlights

• Assistants join your team over MCP — A new "Assistant Connection (MCP)" card in Connections lets Claude Code, Codex, OpenCode, and generic MCP clients connect to Paperclip through browser OAuth or device-code consent and act as the signed-in user: read and search tasks, create and delegate work, leave human comments, read documents and deliverables, and follow results through signed event webhooks (#14846). Consent shows the client and organization, write access can be opted out, requests can be pinned to one company, and a paperclip mcp CLI device login bridges local stdio clients; it is off by default behind Settings → Experimental → "Assistant connections (MCP)" and requires an HTTPS PAPERCLIP_PUBLIC_URL (#14933).
• Chat leads the way — With Agent Chat enabled in the streamlined UI (the default shell), Chat is the first row in the Work navigation, the chat rail lists every eligible agent, and the side panel shows that agent's recent tasks and artifacts; a new experimental "Combined Inbox + Task List" setting folds Inbox into Tasks as views (#15100). Instances that switched "Streamlined UI" off keep the legacy navigation and do not see these changes. The Chat entry reopens the last conversation you visited (#14848), and the chat header shows the agent's avatar (#14726).
• One catalog for every account — The Connections Apps catalog discovers accounts already connected upstream in Composio, Arcade, and supported Executor gateways and groups them with native accounts under one app card, with source chips, search, and pagination (#15254). AgentMail is a default connection with inline setup cards in Agent Chat (#14772), Neon joins the catalog with OAuth or API-key sign-in (#14980), Asana works again with a default "Sign in with Asana" (#14756), and AI accounts gain a "Check usage" action that reads current provider limits for Codex, Claude, Grok, and OpenRouter (#14936).
• Connections carry instructions for agents — A connection can hold editable usage instructions that are delivered to every authorized agent turn across the native runner, legacy adapters, and HTTP/process contracts. Honcho, Mem0, Zep, Supermemory, and Cognee ship defaults, the editor appears in setup and the Permissions panel, and agent Instructions show a read-only "From connections" section (#15216).
• New models, refreshed harnesses — Claude Sonnet 5.5 is selectable for Claude Code agents with Low through Max effort, and the qualified Claude runtime moves to Claude Code 2.1.286 (#14993); GPT-6.1 Sol joins the Codex adapter with Fast mode and Ultra effort, Bedrock gains Sonnet 5.5, and the shared pins move to Codex 0.160.0 and OpenCode 1.18.34 (#14942). Claude and Codex model menus now list models in the same order as the Claude and ChatGPT apps (#14917, #14918).
• Agents maintain company skills — Native-runner agents get an update_skill tool that rewrites a company skill with version checking and safe retries, recorded in version history and the audit log; the skill file API gains optional expectedVersionId and idempotencyKey fields (#15049). Newly created agents receive a default set of configuration grants so they can finish agent, tool, skill, and task setup without manual permission work (#15283).
• Codex runs that survive restarts and capacity limits — A native Codex turn killed by a server restart resumes in the same conversation once the old process is proven gone (#15297); a model at capacity shows a "Model at capacity" card and retries automatically after one and then two minutes (#15347); a model the ChatGPT account cannot use shows "Model unavailable" with guidance instead of generic recovery (#15299, #15304); and Codex keeps its stock base prompt, receiving Paperclip's context as additive developer instructions (#14920).
• A rebuilt New task dialog — The dialog is built on the shared task composer with a Project and Worktrees bar, remembered assignee, project, and effort, and task mentions in suggestions; the status, reviewer, approver, and watchdog controls move out of the dialog into task properties, and new tasks default to the last assignee used (#15091). Tasks created without a title get a clean plain-text provisional title (#15047).
• Far shorter default instructions — New companies and hires get role descriptions instead of procedural manuals: the default CEO instructions drop from roughly 1,900 words to 20 (#14985), new non-CEO hires receive a one-sentence default manual (#14948), and the bundled planning skills shrink to about 400 words combined and no longer force a child-task matrix (#15296). Existing saved manuals and custom bundles are unchanged.

Fixes

• Native runner and sessions — A run whose final answer was saved but whose shutdown failed reaches its correct final status, and the agent list_projects tool returns paged summaries instead of overflowing the command limit (#15217); tasks stopped during native preparation on an older build regain Retry and accept new messages (#15020, #15022); a continuation cancelled by the queued-run review gate is treated as a review wait instead of an unknown-execution hold (#15024); Retry and saved-message recovery work on SQL_ASCII databases (#15033); a user-continued legacy run that times out can be retried automatically (#14987); a completed run no longer reports "Run failed" when instruction-file cleanup times out afterward (#14945) and that cleanup no longer blocks lease release (#14866); write_document and other semantic tool calls no longer fail when a document merely discusses credentials (#14937) or contains credential-looking text (#15301); long connected MCP tool names are aliased to fit provider limits and the recovery notice explains why a run was cancelled with a Continue option (#14951); agents keep their task context when a tool connection changes mid-task (#14963); native MCP gateways reject run tokens from any agent other than their owner (#14914); and the Codex runner's "ignored unrelated provider information" warnings stay in the run log instead of the chat (#14929).
• Sandboxes and workspaces — Sandbox runs no longer fail with workspace_restore_failed after an agent rebases or amends its branch (#15268); the Daytona driver recovers output from a log socket that goes silent (#14889); bridge control commands are capped at 30 seconds and active runs are flagged as suspicious after 5 minutes of silence and critical after 15 (#14979); multi-repository projects round-trip commits on SSH execution environments (#14782); isolated-worktree tasks on the Paperclip repository itself set up without a local seed config (#14810); and the standard Docker image bundles the remote provider pack so remote OpenCode and ACPX runs no longer fail with runner_remote_provider_artifact_incompatible (#14854).
• Chat and task UI — Steer and Interrupt show your message immediately and deliver to the active run even after a model or effort change, and a stopped native startup offers Retry (#15015); a message sent after a failed native run no longer hangs and is delivered exactly once (#14857); stale "Run failed", "Stopped", and "Waiting to resume" markers disappear once a later attempt supersedes them (#14874); dismissed agent questions stay in the task feed and remain answerable (#15229); confirmation cards show "Preparing approval…" until the source workspace is ready instead of erroring on click (#14893); an unsaved Agent Chat no longer polls the browser panel with a draft id every three seconds (#15298); the thread no longer calls a stale send or cancel action (#14863); mobile task pages get an opaque footer, steadier scrolling, a full-height document panel, and in-place document links (#15228) with new output staying above the composer (#15282); the completed-work caret sits beside its label (#15048), composer labels use the available width (#15050), branch artifacts without a remote link say so (#15051), the Dashboard shows each task once (#14847), and a selected saved subscription can be used without clicking the provider tile (#14996).
• Connections and access — Agent settings can reconnect an unavailable personal AI account in place, and a newly connected account becomes the user's default (#14916); generic MCP OAuth requests offline_access when offered so access survives token expiry (#14950); MCP tool discovery uses a fraction of the memory and queries on large catalogs, bounds concurrent listings with a tool_discovery_busy 503 under load, and answers GET on stateless endpoints with 405 (#14864); low-trust agents can create self-assigned work inside their permitted scope and update their own managed AGENTS.md from the owner's chat (#14870) and accept their owner's direct messages and human-assigned tasks outside an intake boundary (#14775); company skill imports from a server-managed project checkout no longer fail with skill_workspace_boundary_denied (#10329); and the managed git/gh launcher retries a failed credential broker request before continuing without managed credentials (#14856).
• Server resilience — Dashboard reads (#14873), scoped read queries (#15248), and the task run list (#15300) retry transient PostgreSQL disconnects instead of failing the request, and routine routes return 404 for malformed ids instead of a database error (#15313).

Improvements

• Experimental AI connection pools rotate new tasks across saved AI accounts while each task stays pinned to its account, behind the default-off enableAiConnectionRouters setting and a router plugin (#14967); the exe.dev sandbox provider can clone a prepared "Source VM" instead of creating a bare one (#14975); the native runner daemon accepts any --listen-port so several listening runners can share a host (#15353); the server keeps a durable lifecycle journal of agent hire, pause, resume, and terminate events and project create and update events as groundwork for plugin hooks (#15280, #15306); Slack, GitHub, MCP, invitation, routine, and handoff prompts share one animated "copy prompt" control (#14862) and the Slack setup prompt matches the current flow (#14965); the per-action Test dialog renders MCP results as readable tables and cards (#14859); agents can create question cards from a single canonical question set (#14946) and receive identical completion-tool guidance across Codex, Claude, and OpenCode (#14961) with less repeated procedure text and a canonical link from write_document (#15151); and failed restores and Stop timeouts record which stage failed and why in run results and Sentry context (#15005, #15291, #14990, #14986).

Upgrade Guide

• Migrations 0294–0305 run on upgrade: 0294 adds a tool_mcp_gateway_tokens expiry index; 0295 and 0296 add aggregator account snapshot and sync tables; 0297 adds resource_lifecycle_events and 0300 rewrites its action check constraint; 0298 adds tool_connections.agent_instructions and backfills default instructions for existing Honcho, Mem0, Zep, Supermemory, and Cognee connections; 0299 adds AI connection pool, router cursor, and task pin tables plus company_secrets.ai_session_epoch; 0301–0305 add the public MCP OAuth client, grant, token, receipt, event subscription, device-flow, and admission tables. All are additive; 0298 is the only one that updates existing rows.
• Stop all old processes before upgrading (#14869): the new SQLite restore-lock protocol cannot coexist with the old directory locks. Drain every server and worker that writes to the instance root, move leftover legacy <hash>.lock/ directories out of <instance root>/locks/directory-merge/, then start the new version. The same applies to rollback.
• Review custom tool grants (#14915): grants with unknown scope selectors or malformed restrictions now deny instead of falling through.
• New experimental settings, all off by default: "Assistant connections (MCP)" (enablePublicMcp) exposes the public MCP endpoint and requires PAPERCLIP_PUBLIC_URL to be an HTTPS origin (#14933); "Combined Inbox + Task List" (enableCombinedInboxTasks) folds Inbox into Tasks and takes effect only while "Streamlined UI" is on (#15100); enableAiConnectionRouters turns on connection pools and has no UI toggle (#14967).
• Connection instructions for custom adapters (#15216): HTTP adapters receive a top-level connectionInstructions field in the request body, either a { text, digest } object or null when no instructions apply; process adapters receive PAPERCLIP_CONNECTION_INSTRUCTIONS_FILE, the path to a private JSON file holding the same { text, digest } object, and the variable is set to an empty string (not a path) when no instructions apply. Adapters should append the object's text to the model prompt rather than passing the object through. Built-in harnesses need no change.
• Harness pins moved to Codex 0.160.0, Claude Agent SDK 0.3.286 (Claude Code 2.1.286), and OpenCode 1.18.34 (#14942, #14993). Custom sandbox images built with Claude Code older than 2.1.284 must be rebuilt before Sonnet 5.5 works on the CLI path, and the controller and runner should be deployed before promoting a sandbox image with the new pins; remote Codex now accepts 0.149.0 up to but excluding 0.161.0.
• New defaults: newly created standard agents receive default configuration grants, while existing agents are unchanged (#15283); the runner's --listen-port still defaults to 43127 (#15353); silent active runs are flagged after 5 and 15 minutes instead of 1 and 4 hours, with no automatic cancellation (#14979).
• No other configuration or API changes require action.

Contributors

This release has 130 commits from 9 contributors. Thank you to everyone who contributed to this release!

@baozdemir, @valentinpalkovic, @abderbejaoui