Paperclip v2026.824.0

Released: 2026-08-24

Paperclip v2026.824.0 is a fast follow to 2026.817.0 — and the first stable to walk the full canary → nightly → beta → stable happy path end to end, soaking as 2026.818.0-beta.1 before promotion. It carries 172 commits: chat-style tasks graduate from experiment to the default experience, managed runtime previews become reachable over Tailscale HTTPS, sandbox execution gains a verified provider capability contract, you can sign in to Claude and Codex from inside the product, large company imports survive dropped connections, and a large batch of long-standing community fixes lands.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Chat-style tasks are the default. The "Chat-Style Tasks" experiment toggle is gone; the task detail page is now the conversation view for everyone. A new "Classic Task Interface" preference (enableClassicTaskInterface, replacing enableTaskChatRedesign in instance settings) restores the pre-chat page — page-level header, plain comment thread, fixed Properties sidebar — but chat-only features are unavailable there. (#11101)
• Sandbox session-output streaming is now capability-driven, and three operator flags are gone. The server's streamAgentSessionOutput setting and the Daytona plugin's useSessions and useLogStream keys no longer exist; the verified provider capability snapshot is the only streaming decision, with an automatic poll fallback. Saved configurations that still carry the removed keys load fine — the keys are simply inert. (#11463, #11557)
• Managed dev runtimes now default to Tailscale HTTPS previews. When the host broker is available, eligible Paperclip-managed worktree runtimes are exposed as tailscale_https instead of loopback HTTP. Set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off to keep the old behavior, or force to fail closed when the broker is missing. Managed runtime control routes also gained two new 409 responses (workspace_runtime_control_in_progress, workspace_runtime_lease_conflict) — callers that assumed a control always starts must handle a conflict. (#11524, #11525)
• Interaction resolver policy defaults to anyone for new interactions. Every interaction kind now goes through one resolver-policy evaluator with recorded provenance, instead of per-route rules that blocked valid agents. Migration 0218 deliberately does not widen anything already pending: existing rows keep their old restrictions under new names (board_or_agents → not_creator, board_only → human_only). (#11376)
• The decision-training surfaces are removed from the Decisions desk — the training library route, row actions, and drawer. The backend snapshot contract is unchanged and no data migration runs. (#11225)

Highlights

• Chat-style tasks, now the default experience — Last release's experimental conversation view is now how every task works, and it grew up on the way: cleaner message spacing and agent bubbles, searchable assignment and the sub-task tree in the properties pane, document comments docked in a side gutter, and a chat sidebar that surfaces every issue document and agent artifact. Blocked tasks show their blockers as links with live, ordered blocker work right in the thread, and an issue with a live run shows a calm in-flight notice instead of a false alarm. Onboarding is chat-first too: finishing the wizard drops you straight into your first task's conversation, where the agent greets you, asks clarifying questions, and proposes a plan you approve item by item. (#11101, #11263, #11226, #11456, #11487, #11423)
• HTTPS previews for managed runtimes, over Tailscale — A managed runtime service used to listen on plain loopback HTTP, so an agent's branch preview was unreachable from a phone or a second computer. Paperclip can now expose it at a real HTTPS URL on your tailnet, built in three deliberate layers: a separate least-privilege host broker that authorizes every mapping (peer credentials, a fixed port range, protected-port denies, append-only audit), the exposure lifecycle with durable issue-owned runtime leases and bounded control recovery so a stranded control can never block the lane forever, and a single port-pair mediator so a start can never collide with or adopt another issue's service — every mismatch fails closed and names the conflict. (#11524, #11525, #11526)
• Sign in to Claude and Codex from inside Paperclip — The new-agent page now offers Claude subscription login before you create the agent, on both Test lanes, with diagnostics kept in redacted server logs and login URLs normalized to allowlisted Anthropic hosts. Under the hood, a guarded setup-token flow drives claude setup-token through a sandbox pseudo-terminal with owner-bound sessions and one-time token delivery, and the Codex adapter gets an equivalent sandbox device-login that promotes the credential only after readiness checks and then deletes the temporary sandbox. Deployments behind a TLS-terminating platform edge (Railway, Render, Fly, …) can declare CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true so the transport guard stops warning about a connection that is HTTPS to the user, and a promoted device-login credential now survives managed-home re-seeding. (#11347, #11286, #11237, #11579, #11578)
• A real capability contract for sandbox providers — Last release introduced live output streaming and persistent sessions for Daytona; this release makes those behaviors provable instead of configured. Providers declare capabilities in their manifest, the live worker verifies them, and the server resolves the effective set fail-closed as the intersection of declared, verified, and configured — a declared capability can never grant a method the worker didn't prove. Streaming and persistent sessions now turn on wherever the verified snapshot allows, with an automatic poll fallback, and the three operator flags that used to gate them are gone (see Breaking Changes). (#11463, #11557)
• Chunked, resumable company imports — Last release raised the import cap to 1 GB; this release makes the transfer worthy of it. A dropped connection at 90% used to start the whole upload over — imports now move as verified ~32 MB parts spooled to disk with a durable run ledger, so an interrupted transfer resumes from the parts already uploaded (across dropped connections, page refreshes, and server restarts) and peak upload memory drops to one part. The Import page and CLI gained the resumable upload and a chunked preview, bundles now preserve task timestamps and hierarchy through export/import, imported agents keep their own adapter instead of being coerced to the destination's CEO adapter, and freshly imported tasks stay quiescent under the productivity review sweep. (#11223, #11224, #11193, #11192, #11191)

Improvements

• Onboarding meets you where you are — A company with no agent is sent into onboarding automatically, opening at the right step: the mission step is skipped when the company already has one, an existing mission is carried into the wizard, and the step is decided once instead of jumping under a mid-flow customer. The wizard's agent and connect-model steps were reworked for the chat-first flow, no longer keep an invisible disabled adapter selected, and the decorative panel follows your theme. (#11352, #11416, #11429, #11371, #11379)
• Paperclip Cloud onboarding seed — An instance can now receive the mission, first agent, and first task collected during Paperclip Cloud signup and apply them at activation, so a seeded stack opens ready to work instead of asking again. (#11098)
• Managed sandbox deployments — Tenants can edit environment variables on a platform-managed sandbox environment (and only that), and a managed-sandbox-only mode hides local execution entirely with run selection failing closed. Bundled providers' documented credential env vars (e.g. DAYTONA_API_KEY) now reach their plugin workers, and the synthetic "Local" default option respects the mode. (#11200, #11244)
• Archived work reopens in place — An archived isolated execution workspace can be reopened where it was, including archived git worktrees for managed-checkout projects. Cold arrivals on an archived company's URL are bounced to a clear page with a one-click Unarchive. (#11322, #11395, #11302)
• Review governance — Review-policy verdicts are serialized and transactional, a verdict can no longer bypass a policy by downgrading, the requester is persisted atomically, and the UI badges the review policy when it is what constrains approval. (#11405, #10938)
• Agents can look up secrets by name — A read-only /secrets/catalog endpoint maps secret names to ids for agents wiring env bindings — no values, no provider config. Issue-document annotations are also included in agent review context, so feedback left on a document reaches the agent that acts on it. (#9530, #11332)
• Search that scales — The parent-issue picker searches on the server instead of the loaded page, and the issues list API gained an updatedSince filter. (#11334, #9050)
• Observability — Host-side stage.sync steps are instrumented and the agent process span is homed correctly, continuing last release's sandbox-startup tracing work. (#11301)
• See your channel with paperclipai channels — the new command shows every release lane (stable, beta, nightly, canary), the version each currently resolves to, and which one your install follows. (#11210)

Fixes

• Deployments behind an authenticating proxy work end to end — The live-events WebSocket now authenticates cloud-proxied browsers (previously it could never connect through an auth-terminating proxy), the service worker's fetch fallback always answers with a real Response instead of a blank page, the web app manifest is fetched with credentials, and the UI survives first load against a cold backend. The archived-company selection ping-pong that could trap a session in a redirect loop is gone. (#11290, #11292, #11245, #11246, #11300)
• Everything is scoped to the signed-in account — Invite membership checks, company selection, and query caches are all keyed to the account that is actually signed in, caches clear on sign-out, and the stored company survives a failed company request instead of being dropped. Onboarding drafts verify ownership against a list fetched this session and never restore wizard state for a company the user does not own. (#11417, #11430, #11380, #11477, #11382, #11370)
• Security hardening — Tool-access routes no longer leak cross-tenant ID oracles, routine webhooks reject HMAC replays, routine detail responses exclude assignee configuration, page-publish uploader credentials are scoped to the publish helper, execution workspace summaries are isolated, only accessible workspace file links are highlighted, the heartbeat-fallback comment can never publish a raw transcript, and CLI guidance shown to users goes through the safe npx form. (#9589, #9994, #9818, #10894, #10790, #11090, #10143, #11343, #11400)
• Runs keep their context — Agent sessions are reused across execution handoffs and kept across issue comments, comment-wake decisions read post-insert issue state, stale closure-comment wakeups on done issues stop, successful-run handoff recovery skips recovery-action-driven and plugin-managed runs, and ACP run lifecycle corrections settle failures, sync workspaces back, and clean up leases properly. (#9917, #10111, #10068, #8656, #9010, #9047, #11454)
• Sandbox plumbing resilience — The sandbox stdin file race is closed with atomic writes and a fault-tolerant poller, stdin writes are ordered in the process-session bridge, the callback bridge poll loop has a per-iteration timeout and watchdog, bridge traffic forwards to the local listen origin, the agent-hire skill's routes pass the callback bridge, runs that hit a provider worker restart window retry instead of failing setup, Daytona liveness calls are bounded per call, and syncOut accepts bsdtar tarball listings. (#11235, #11406, #11341, #10017, #8978, #10212, #11408, #11289)
• Adapter reliability — Claude local pipes the print prompt via stdin and no longer fails root-only permission skips; Codex local skips benign stderr warnings when deriving a fallback error; OpenCode retries its models preflight under transient contention and treats the availability probe as non-fatal; Grok reports real token usage and cost instead of hardcoded zeros; Cursor cloud drops an unreachable API callback; hiring onto an adapter the instance cannot run is refused; and adapters load on Windows (pathToFileURL before dynamic import). (#9500, #9463, #10003, #9225, #10294, #10433, #8546, #10256, #4287)
• Server correctness — DELETE /api/issues/:id succeeds for issues with dependents (comments and read-state cascade; cost and finance records are kept with their issue reference cleared), non-UUID company refs return 404 instead of 500, cross-package Zod errors are recognized, wiring blockers in a PATCH no longer implicitly reopens a blocked issue, unsigned ask-first requests stay out of the review queue without being cancelled, the terminal workspace reaper stops starving on its oldest candidates, the agent run JWT default TTL is aligned to the documented 48h so suspended-laptop runs stop waking with an expired credential, an explicit PAPERCLIP_API_URL overrides the derived runtime URL in run env, base-URL ports are only rewritten for loopback hosts, and silent nonzero exits in the Hermes flow surface as failures. (#11331, #9959, #10168, #10269, #11338, #11238, #10176, #10339, #10258, #10107)
• Workspace Git scans are bounded — One bounded scheduler now coalesces and caps every expensive workspace Git scan (a request storm once produced ~270 concurrent git status processes and starved health checks), and the browser only starts scans when the file panel is open and visible. (#11572)
• UI paper cuts — The queued-message interrupt action is back, agent secret access moved to a searchable secrets tab, slash autocomplete scrolls inside dialogs, inbox archive gained an undo toast and folded subtasks are remembered, inbox routing honors the saved policy for explicit targets, board approval prose renders as markdown, create-dialog badges use the real issue prefix, issue-document deep links route correctly, truncated issue descriptions are flagged, generated invite links prefer the public base URL, selected run lifecycle and logs stay current, and the mobile task chat gained blocker actions, a composer aligned with the thread, and a new-task dialog that stays above the keyboard. (#11374, #11283, #11222, #11220, #11069, #11221, #9817, #8550, #11551, #4771, #7619, #10169, #11282, #11296, #11281)
• Odds and ends — Skill sync refreshes project folders in place instead of replacing them, issue writes through board keys work regardless of assignee, environment-secret bindings resolve their company context on first save, and worktree-mode dev instances warn when the embedded-Postgres data directory sits in the OS temp dir. (#11066, #9025, #11291, #8283)

Upgrade Guide

• Migrations: this release adds 11 database migrations (0212 through 0222), covering the one-per-company onboarding first task (0212), resumable company transfer runs (0213), adapter device-login sessions (0214, 0215), Cloud onboarding seeds (0216), issue-deletion foreign-key policies (0217), interaction resolver-policy defaults and provenance (0218), runtime exposure state (0219), execution-workspace runtime leases (0220), Claude setup-token sessions (0221), and environment-lease references that survive environment deletion (0222). Migrations run automatically on startup — no manual action required. Nothing drops a table or deletes data; note that 0218 rewrites resolver-policy values on existing pending interactions (conservatively — see Breaking Changes) and 0217/0222 change what happens to dependent rows on delete.
• New optional environment variables (all have sensible defaults; set only if you need them):
  • PAPERCLIP_MANAGED_RUNTIME_HTTPS — auto (default), off, or force; controls the Tailscale HTTPS default for managed runtime previews (see Breaking Changes). PAPERCLIP_TAILSCALE_BROKER_SOCKET and PAPERCLIP_TAILSCALE_DNS_NAME override the broker socket path and the tailnet DNS name; PAPERCLIP_VITE_HMR_PROTOCOL (ws/wss) pins the dev-preview HMR protocol. (#11524, #11525)
  • CLAUDE_LOGIN_TRUSTED_PROXIES — allowlisted proxy peers for the Claude login transport guard; CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true — declare platform-edge TLS termination on managed platforms where the proxy addresses aren't knowable. (#11286, #11579)
  • PAPERCLIP_ONBOARDING_SEED_ADAPTER_TYPE — adapter type for the agent created by a Cloud onboarding seed. (#11098)
  • SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR — where durable sandbox cleanup records are spooled; PAPERCLIP_PROCESS_SESSION_STDIN_MAX_RETRIES — retry ceiling for the sandbox stdin poller. (#11347, #11235)
• Removed configuration keys: streamAgentSessionOutput (server) and useSessions / useLogStream (Daytona plugin) no longer do anything — remove them from saved configs at your leisure; they load but are inert. (#11557)
• Agent run JWT TTL: the server default now matches the documented 48h (PAPERCLIP_AGENT_JWT_TTL_SECONDS=172800). If you relied on the old implicit 1h expiry, set the variable explicitly. (#10176)
• HTTPS previews: to use them, install Tailscale on the host and run the new broker (see the @paperclipai/tailscale-https-broker README); to opt out, set PAPERCLIP_MANAGED_RUNTIME_HTTPS=off. Nothing else changes for unmanaged or custom services.

Contributors

This release has 172 commits from 32 contributors. Thank you to everyone who contributed to this release!

@0xopaque, @adamteale, @ApolinarioRatio, @austinpilz, @christianlappin, @cucurigoo, @dmndbrp-oss, @dylanroy, @edgardfrz, @fronc, @futhgar, @panbanda, @raviy06, @samrusani, @santastabber, @sauerdaniel, @seb-veto, @Sergio-LPA, @stubbi, @ulisavo, @vmarchaud, @webdevdot