Paperclip v2026.916.0

Released: 2026-09-16

Paperclip v2026.916.0 carries 503 commits, promoted from 2026.916.0-beta.0 published the same day. The headline is the Connections train: AI runtime credentials — Claude and Codex subscriptions, API keys, shared accounts — now live in Connections under the same grants and permission boundaries as every other account, follow the responsible person through hiring and task execution, and can be connected or repaired inline from the task that needs them. Around it: agents get their own email addresses through AgentMail, experimental chat connectors bring Slack, Discord, Telegram, Microsoft Teams, and (via Photon) iMessage conversations into tasks, GitHub access becomes durable per-person identities instead of one shared token, announcements arrive as native in-app cards, and the experimental Paperclip Runner grew from last release's groundwork into a complete execution engine — with the gate now open by default on self-hosted installs for explicitly configured agents.

Breaking Changes

• Cheap model profiles are removed. The second execution mode that let recovery and overrides run on a cheaper model is gone from adapter metadata, agent runtime configuration, task overrides, recovery rules, the APIs, and the board UI; migration 0236 strips stored modelProfiles blocks from agent configurations. There is now one model-selection path for normal work and recovery work. (#12683)
• Agent APIs no longer return plaintext credentials. Every endpoint that serializes an agent — detail reads, the company agent list, and create/update/lifecycle routes — used to echo adapterConfig.env as stored, so plain bindings (API keys, tokens) came back verbatim to any caller able to read the agent, including the agent itself via GET /api/agents/me. All three response families now route through one redacting presenter. Integrations that scraped live credentials out of those responses will stop working — that was the leak. (#9860, @glovario)
• Automatic productivity reviews are retired. The detector that turned run counts, comment counts, and elapsed time into management-review tasks is deleted along with its continuation holds — infrastructure failures could satisfy its rules and manufacture work. Bounded recovery, budgets, explicit blockers, and the normal review stages all remain; existing task records stay readable and unchanged. (#13263)
• X-Forwarded-Host is only honored from a trusted proxy. The same-origin guard used to accept a forwarded host from any direct client, letting a caller promote its own header into the trusted-origin set. The forwarded host now counts only when the immediate peer passes the operator's TRUST_PROXY setting — deployments behind a reverse proxy should confirm TRUST_PROXY is configured, or the proxy's forwarded host is ignored in favor of the raw Host header. (#12832)
• Anthropic's legacy REST connection option is gone, and REST tool connections are validated as REST. The obsolete REST setup path is removed in favor of the supported AI-account flow, and stdio validation no longer lets an unsupported REST connection pass (or fail with a misleading templateId error) — existing unsupported connections now receive an accurate rejection. (#13346)

Highlights

• AI credentials live in Connections now — Provider sign-ins stop being per-agent configuration and become managed accounts with the ownership, grants, and access permissions Connections already enforces: agents reuse the responsible user's account or a permitted shared one, and model/harness selection stays independent from credential selection, with legacy agents keeping their existing authentication until they explicitly adopt a managed connection (#13247). The same sign-in components are reused across onboarding, agent configuration, and the Connectors page instead of a second login wizard (#13248). Hired agents inherit the hiring agent's provider credential references so a delegated teammate can authenticate from its first run (#13268), and connections follow hires across legacy and native runners — a missing account pauses the task and offers the connection form inline instead of failing (#13438). Each responsible user gets a per-provider default, so the same agent can run on one person's subscription and another's API key (#13351). The train also hardened as it landed: subscription sign-in works on authenticated self-hosted instances without exposing the server operator's CLI account (#13344), credential leases survive transaction pooling instead of reporting a phantom "connection busy" (#13347), one Anthropic subscription connection supports concurrent runs — only file-backed credentials still serialize (#13445), and connection probes, saved-account reuse, and task handoffs got reliability passes (#13404, #13161).
• Agents get their own email — AgentMail connections (experimental) give an agent a dedicated inbox: incoming email becomes assigned work in a task, sends are explicit agent actions authenticated through Paperclip, and internal task comments can never leak out as outgoing mail by accident. The provider key stays in the server vault, and the board follows each conversation from a task email card. (#13256)
• Reach your agents from your chat tools — Experimental native chat connectors bind a Slack, Discord, Telegram, Microsoft Teams, or GitHub bot identity to one agent and each admitted external conversation to one task, with durable per-conversation queues, questions, progress, files, and delivery receipts — board comments stay internal unless explicitly sent to the channel, and raw reasoning, logs, and credentials are never sent at all (#13100, #13038). iMessage joins through the experimental Photon channel: shared Pro DMs or dedicated numbers, photos included, with Paperclip keeping task ownership and approval authority (#13299). In the app itself, experimental Agent Chat gives every person a persistent conversation with each agent — backed by real tasks and normal governance, not a parallel chat store — and every company agent is reachable from the Chats sidebar through a searchable picker (#13284, #13420).
• GitHub access becomes identities, not a shared token — GitHub App-backed identities with durable refresh, repository-access checks, and webhook delivery replace ad-hoc tokens, built on the existing managed connections and encrypted grants (#12843). When several people steer one agent, managed Git, gh, and GitHub tools resolve to the responsible person's credentials per accepted instruction — with durable continuation rules and no fallback to a teammate's access (#13005), and that identity projects into sandbox runners too (#12907). Around the core: browse repository access across organizations (#12998), select multiple source repositories per project (#13010), duplicate connections to the same GitHub account resolve cleanly (#13022), and sign-in state and connected-repository access are visible and simplified in the UI (#12993, #13047, #12893).
• Announcements arrive in the app — A native announcement card renders a validated JSON feed with native components (the hero can be a static image or isolated HTML/CSS animation), so publishing or withdrawing a card needs no app release. Dismissals persist per account on the instance — a closed card stays closed across companies and browsers — and named staging feeds let authors test content before production. On by default against the hosted feed; the Upgrade Guide has the opt-out. (#13403)
• Onboarding walks straight to a working agent — The connect step opens as a model-source question with provider sign-in built in — one continuous sequence on a single card, API key entry included, with the pasted login code kept on screen and answered at once (#12440, #12863, #12801, #12820, #12613, #13193). Your first task now opens as a chat with a chief of staff that waits for your answer instead of running off on its own, and chief-of-staff hiring is reliable (#13068, #13317). Creating later agents borrows the same connection controls in a simplified wizard with reorganized configuration pages (#13011), and saved model connections are reused during setup instead of asking you to sign in again (#13161).

Improvements

• Apps and the connector catalog grew up — Apps leaves its experimental gate, connection setup is shorter, and managed Google access works on a clean self-hosted install with a safe default origin (#12728). Underneath: connection grants and delegated identities (#12341), managed external MCP connectors (#12346), secure remote MCP and PostHog setup (#12339), Composio and Gmail connectors (#12342), an expanded self-serve catalog with intent-based setup (#12344, #12347, #12345), refined Postman and Shopify flows (#12357), and consolidated connector management (#12684). Google Workspace setup was later repaired end to end: catalog and creation use the same availability rules, ownership choices survive capability changes, and Paperclip is the default Google authentication method with custom OAuth one link away (#13289, #12619, #12623). Agents can also request new service connections from native task feeds, with connection actions reviewed from the task (#13058, #13063).
• Model and provider updates — Claude Fable 5.1 is selectable in the Claude adapter with both direct Anthropic and Bedrock inference-profile IDs (#12730); Codex gains GPT-6 Astra with its model-specific controls (#12851); unset Claude models resolve to Opus 5 everywhere, with the default visible in agent configuration (#13055). Grok joins the sandbox device-login panel with a private, company-scoped credential home, curated into remote subscription runs and refreshed credentials copied back to the host (#12469, #12618, #12696). Each Codex account gets its own home and path secret, and an agent can bind to a Codex login other than the company default (#12709, #13067).
• The native Paperclip Runner now does the whole job — and self-hosted installs get the gate open by default — Last release's groundwork became a complete experimental execution engine behind the enableNativeRunner flag, which now defaults to on for self-hosted instances (cloud-managed instances keep it off) (#13068): native Codex execution and a Claude ACPX runtime plus a qualified OpenCode runtime (#12616, #12590, #12588, #12691), managed provider backends (#12699), a remote execution substrate with secure transport (#12638, #12639), administration and observability (#12641), and native turns projected into task chat (#12617). The control is one unified flag that gates every setup path (#12656, #12666). The open default only unlocks the gate: explicitly configured local Codex, OpenCode, and qualified ACPX agents can use the runner, onboarding stays on legacy adapters, nothing switches automatically, and turning enableNativeRunner off in experimental settings closes it again.
• Controls for operators — A managed experimental flag, enableIsolatedWorkspacesByDefault, makes every project without its own policy use isolated per-task git worktrees, so a fleet default no longer means editing each project by hand (#13444). New standard-trust agents can hire other agents by default — low-trust agents keep the disabled default (#12814). Sentry monitoring splits into SENTRY_DSN_FRONTEND and SENTRY_DSN_BACKEND with the old SENTRY_DSN still working as a fallback (#12678). The experimental settings page sheds dead controls and groups developer tools (#12681), and PAPERCLIP_HIDDEN_SETTINGS is honored in the production switcher menu too (#12788).
• The task surface, refreshed — A streamlined navigation foundation with refined task and workspace surfaces, consistent hover/popover/spacing behavior, and compact dashboard and Live-runs cards you can actually scan (#12746, #12747, #12748, #12854, #12793, #13269). Work products get rich cards and a run-artifact inventory on the task Artifacts tab (#12717), a viewer=full document deep link opens the maximized side pane straight from an external notification (#12812), the composer gains a Stop control with simplified task controls, status badges, and inline blocker removal (#13104, #13097), single-choice questions advance on selection (#13234), runner activity condenses into rolling per-group summaries shared across live and saved views (#13255, #13274, #13421), tasks created from a task are shown by project (#13241), long task chats stay responsive during streaming (#13229, #13228), and mobile gets real entity-picker sheets, full-width task trees, and spacing passes (#13343, #13250, #13304, #13122).
• Task search that finds the task — Full and quick search unify around PostgreSQL term coverage with explicit relevance bands and conservative typo recovery, judged against a scored corpus. (#13335)
• Try it without touching your data — A foreground-only test-drive CLI command boots an isolated instance with its own data directory and a provider-backed CEO, with reuse safeguards and restored credential inputs (#12894, #12898); server startup no longer opens a browser unless explicitly asked (#12435).
• Sandbox runs got faster and sturdier — Warm Daytona workspaces persist across turns with the host workspace staying the durability boundary (#12904, #12901), the HTTP/2 sandbox bridge carries binary bodies and attachment routes (#12923), selected skills stage into remote Claude ACP runs (#13196), and a lost sandbox control channel fails the turn fast instead of hanging it (#13158).

Fixes

• Server security and correctness — Privileged server boundaries are hardened (#12776), project goal ids are validated to exist and belong to the company (#12779), listComments no longer 500s on a non-UUID afterCommentId (#8695, @Maxxsong7), and the Docker quickstart passes PAPERCLIP_ALLOWED_HOSTNAMES through (#6846, @rsclafani).
• The database pool heals instead of wedging — Idle connections are reaped, the pool is named and ended on shutdown — closing the restart-loop that piled up backends until PostgreSQL refused every boot (#12956, @stubbi) — and a query whose socket write failed on a recycled pooled connection is replayed instead of failing the request (#13417).
• Onboarding connect step shows its work — Provider sign-in during onboarding now shows verification progress and confirms the subscription before moving on, instead of appearing to hang (#13499), and a stale or expired Claude credentials file on the machine is skipped when reading the token instead of breaking sign-in (#13505).
• More connections reliability — Personal MCP authentication discovery is unblocked (#13497), and one OpenAI or xAI subscription connection supports concurrent agent runs, matching the Anthropic fix in this release (#13452).
• Recovery and wakes — Hidden issues are excluded from stranded recovery and continuation wakes (#5648, @im0xMagnus), blocked wakes wait without spawning repeated runs (#13236), stale continuation wakes are rejected (#13173), messages you sent while a run was stopping are saved and delivered after recovery instead of vanishing (#13327, #13270, #13405), user messages can continue a stopped native task (#13239), retry-exhaustion events no longer exhaust attention-feed memory (#13451), starting runs survive overlapping deployments (#13285), and run polling and workspace inspection amplification are reduced (#13174).
• Sandboxes and workspaces — A stuck sandbox plugin blocks runs visibly and errored bundled plugins re-enable at boot (#12957, @stubbi), stalled sandbox startup cancels without waiting out setup (#13352), workspace setup recovers and retries (#13353), legacy Daytona startup failures recover from the task and inbox (#13272), all of a project's repositories are provisioned for local and sandbox tasks (#13442), transient workspace bootstrap scans recover instead of failing the run (#13481), sandbox files publish on both legacy and native runners (#13493), and run-event payloads preserve NUL characters (#13325).
• The web app — The service worker is stamped with a per-build id so deploys actually reach parked tabs (#12725), workspace-ready notices render as compact system notices instead of agent bubbles (#12716), feed cards are fully clickable (#13294), the task-page archive shortcut is back (#13253), agent instructions no longer save falsely (#12502), company navigation is limited to accessible memberships (#13039), Recent Tasks stops echoing storage feedback across tabs (#13402), and plan-to-auto transitions only happen on plan confirmation (#12695).
• Adapters — The qualifier-less Claude usage-limit message is detected in quota classification (#12475), Codex sign-in and the environment test agree on which credential a run uses (#13064), Codex startup trust, history reads, and resume usage are corrected (#13110), Grok stages its environment test from a host directory and survives an absent workspace (#13416), and unintended engine fallback is prevented while preserving usable runtime defaults (#13105).

Upgrade Guide

• No new platform requirements: the Node.js 24.11.0 floor from v2026.831.0 is unchanged.
• Migrations: this release adds 49 database migrations (0231 through 0279). They run automatically on startup. By train: cleanup of redundant auto-created app-connection tool-profile rows (0231), connection grants and delegated identities (0232), managed external MCP connectors (0233), native-runner provider traces, run-event uniqueness, backends, session recovery, and session goals (0234–0235, 0237–0238, 0248), removal of stored cheap-model profiles (0236), durable GitHub identities and per-person execution identity contexts (0239–0245), connecting services and reviewing connection actions from tasks (0246–0247, 0249), durable task recovery (0250–0254), the chat provider and data foundation (0255–0270), per-agent Codex login bindings (0271), AgentMail inboxes (0272), deployment-safe starting runs (0273), agent chat (0274), iMessage Photon (0275), AI connection and per-user provider defaults (0276–0277), and announcement dismissal state (0278–0279). Only 0231 and 0236 discard data — redundant tool-profile include rows and the removed cheap-model profiles respectively; everything else is additive.
• New optional environment variables:
  • SENTRY_DSN_FRONTEND / SENTRY_DSN_BACKEND — separate browser and server error monitoring; the legacy SENTRY_DSN still works as a fallback for either. (#12678)
  • PAPERCLIP_ANNOUNCEMENTS_ENABLED — in-app announcements are on by default; set to false to opt out. PAPERCLIP_ANNOUNCEMENTS_FEED_URL overrides the feed (default https://pages.paperclip.ing/announcements/v1/current.json). (#13403)
  • PAPERCLIP_TOKEN_BROKER_ALLOWED_HOSTS — comma-separated extra hosts the sandbox token broker may reach, for remote MCP setups (default: none). (#12339)
  • PAPERCLIP_DISABLE_CWD_ENV_FILE — set to true to stop the server from loading a .env file from its working directory (default: it loads). (#12894)
• Removed API surface: modelProfiles is gone from adapter metadata, agent runtime configuration, and task overrides (#12683); plaintext env values in agent responses are redacted (#9860); Anthropic's legacy REST connection setup option is removed (#13346).
• Behavior changes to note: the experimental Paperclip Runner gate enableNativeRunner now defaults to on for self-hosted instances — explicitly configured agents only, nothing switches automatically, cloud-managed instances stay off (#13068); new standard-trust agents can hire other agents by default (#12814), unset Claude models resolve to Opus 5 (#13055), Apps is no longer behind an experimental gate (#12728), and X-Forwarded-Host requires proxy trust (see Breaking Changes).

Contributors

This release has 503 commits from 15 contributors. Thank you to everyone who contributed to this release!

@aaymeloglu, @glovario, @im0xMagnus, @lorenzozane, @Maxxsong7, @melbinjp, @rsclafani, @stubbi, @zannis