fix(deps): update npm production dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@paperclipai/plugin-sdk (source)	^2026.626.0 → ^2026.817.0
react (source)	^19.2.7 → ^19.2.8

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

paperclipai/paperclip (@​paperclipai/plugin-sdk)

v2026.817.0

Compare Source

Paperclip v2026.817.0

Released: 2026-08-17

Paperclip v2026.817.0 is the first stable release since 2026.722.0 — and the first stable ever published through the new canary → nightly → beta → stable release channels. This exact build shipped as a canary, was smoke-tested and promoted to nightly, soaked as 2026.811.0-beta.0, and only then was promoted to stable. It carries 311 commits spanning a first-class Decisions workflow, full-fidelity company Import/Export, a managed CLI install lifecycle, a chat-style task view, and a long list of fixes and performance work.

Breaking Changes

None of these require action for a typical install, but read through before upgrading:

• Docker :latest now means stable. Previously :latest tracked every master merge. If you relied on that behavior, switch to :canary (or :nightly for a smoke-gated daily). Stable images also get :YYYY.MDD.P version tags and every image gets :sha-<short-sha> for exact pinning. (#​11006)
• Experimental Cloud Sync is removed. The host-to-host sync transport (previously flag-gated) is gone; company Import/Export is the single supported data-movement path. Migration 0196 drops the old sync-state tables. Your company data is untouched — only the experimental transport's own bookkeeping is removed. (#​10507)
• Standard-trust agents can write to company-visible issues. Comments, issue updates, child-task creation, and assignment now follow one default-open rule based on issue visibility, instead of per-channel ownership grants. Company, user, trust-scope, and run-lifecycle controls still apply, and cross-issue side effects are contained and attributed. (#​10804, #​10837)
• Archived projects are excluded from the default project list route. Pass the explicit filter to include them. (#​10146)

Highlights

• Release channels: canary → nightly → beta → stable — Paperclip now ships on four channels. canary publishes on every merge to master; nightly republishes the newest green canary once a night, but only after the full release smoke suite (real Docker container, browser-driven onboarding) passes against the exact published artifact; beta is a maintainer-promoted nightly behind an approval gate, re-smoked after publish; and every stable must first soak as a beta for at least 3 days. Install with npx paperclipai@latest (stable), @beta, @nightly, or @canary, or pull ghcr.io/paperclipai/paperclip:latest / :beta / :nightly / :canary. Docker :latest now means stable — see Breaking Changes above. Full details in doc/CHANNELS.md. (#​11006, #​11008)
• Decisions: a first-class propose/decide workflow — Agents can now propose multi-option actions instead of performing them, and humans decide from a governed, auditable surface. Decisions v1 adds the propose mode itself (typed options and inputs, stale-target detection, audited effect execution), durable decision queues with a prioritized, decide-now-ranked attention feed, and a Decisions desk with triage controls, an aging shelf, and reversible retention. Completed-target decisions retire automatically and link back to their targets. (#​10010, #​10651, #​10672, #​10785, #​10474, #​10892)
• Full-fidelity company Import/Export replaces Cloud Sync — The experimental host-to-host Cloud Sync transport is gone; Import/Export is now the single way to move a company between instances (self-hosted ↔ cloud, or plain backups), with no reachability or cross-instance auth requirements. Bundles (schemaVersion 6) now carry labels, blockers, issue documents, work products, monitors, and every attachment as content-addressed sha256 blobs verified before a single row is written. Imports run as durable async jobs with batched inserts and an integrity guard, packages upload as compressed zips, and the upload cap is now 1 GB and operator-configurable via PAPERCLIP_IMPORT_ZIP_MAX_BYTES. (#​10507, #​10523, #​10531, #​10538, #​11184)
• Managed install, update, and service lifecycle in the CLI — The paperclipai CLI can now install Paperclip as a durable, self-updating service instead of an ephemeral npx process: managed install with a per-user payload store and stable command shim, side-by-side updates with pre-update backups and retained rollback state, plus service, uninstall, doctor, and bootstrap-installer support across Linux, macOS, containers, and WSL. Managed updates preserve your env files and extensions. (#​10045, #​10980, #​11005)
• One Activity page for "who changed what" — The basic Activity list and the separate Audit page merged into a single rich Activity page built on the audit feed: full history, filters, a scope toggle for all actors vs. agent actions only, and a per-agent audit tab on agent detail. Privileged controls are hidden from members without the audit permission, and cross-task agent writes now come with attribution, audit receipts, and actionable denial messages. (#​10838, #​10831, #​9744, #​10843)

Improvements

• Multi-project workspace sync, on by default — Runs that reference multiple projects now sync every referenced project into the workspace by default, with per-project authorization resolved at run prep and partial-sync warnings surfaced on the run. @​-mentioned projects are also staged into remote sandboxes over the confined transport. (#​10473, #​10469, #​10380, #​10564)
• Shared workspace concurrency controls — Issue runs on a shared workspace are serialized with bounded busy deferrals, and the concurrency limit is configurable from the workspace policy editor. (#​10699, #​10759, #​10771)
• Human-approved secret proposals — Agents that encounter credentials during work can hand them into Paperclip as inert proposals; nothing becomes a live secret or binding until an authorized human reviews and approves. Secret details also gained write-through editing of external values and deep links. (#​9934, #​10196)
• Agent-to-agent governance surfaces — Issue-thread interactions support governed agent addressees, so one agent can explicitly address another for a response, with server-side authorization, withdrawal, and terminal-issue expiry. Agents can resolve review confirmations under explicit review verdict policies, review rounds are capped with exhausted reviews escalated to the responsible human, delegation cycles back to an open ancestor's creator are refused, and assignment to paused agents is refused (with warnings when an escalation path routes to a paused manager). (#​10252, #​10251, #​10939, #​10931, #​10650, #​10658, #​10648, #​10657)
• Task-scoped egress grants for confined runs — On Kubernetes confinement, tasks that legitimately need GitHub or package registries can request narrow, issue-scoped egress grants that become run-label-selected network policies, instead of the operator enabling broad namespace-wide egress. Denied requests explain the governing policy and how to request a grant. (#​10155)
• Cache-adjusted run cost — Adapters can report the provider-billed cost after prompt-cache discounts, so cache-heavy runs stop being priced wrong in the cost ledger. (#​10349)
• Routines: activity-gated run policy — Routines can gate advanced runs on recent activity, exposed through both the editor and the API, and the routines list groups by folder name. (#​10225, #​9438, #​10201)
• Model catalog updates — Claude Opus 5 and Claude Sonnet 5 join the Claude adapter's static model fallback, and GPT-5.6 model metadata is resolved at source for Codex. Cheap model profiles are now disabled by default for new agents: an adapter's cheap profile requires an explicit operator opt-in at agent creation, and Codex's cheap profile no longer defaults to a hardcoded model (existing agents are unchanged). (#​10327, #​10280, #​9780, #​10019)
• Daytona sandbox improvements — Agent output streams live from Daytona sandboxes (no more host output polling), sessions are persistent with plain command dispatch, and an advisory bwrap wrapper with capability probes hardens execution; app-home ownership is ensured before the privilege drop. (#​11049, #​10941, #​10541, #​10554, #​10805, #​10530)
• Quieter, clearer system messaging — Recovery notices are structured and humanized into compact rows with evidence on demand, recovery updates are quieter overall, recovery and blocked-notice copy is rewritten in plain language, and workspace-ready comments render as compact system notices. (#​11075, #​10542, #​10065, #​10636)
• UI quality of life — Task chat composer drafts persist across navigation, task lists gained recency separators, copy and feedback actions returned to the agent bubble footer, the task identifier shows in the task-detail breadcrumb, and page loads got animated paperclip loaders. Task priority controls are hidden from the UI (the data model, API, and search DSL are fully intact). (#​11076, #​10454, #​11025, #​10933, #​10456, #​11024)
• Per-user document stars — Star documents for yourself without affecting anyone else. (#​9952)
• Faster steady-state server — Steady-state DB hot paths in the dashboard, attention, and productivity sweeps were cut down, attention feed queries run in parallel instead of strictly sequential (a big win when Postgres is network-attached), and new indexes cover the recovery-sweep lookups. (#​10992, #​10795, #​10969)
• Faster sandbox startup — Sandbox run startup sheds round trips across the board: git-workspace staging coalesces into one confined sync, dead start round trips are folded, the two bridge setups run in parallel, the started sandbox handle is cached per lease, remote script writes skip on content-hash match, staging happens once per remote session, and exec wrappers drop nvm sourcing with an opt-in no-profile fast path. (#​10488, #​10485, #​10334, #​10335, #​10377, #​10089, #​10443, #​10352)
• Snappier UI navigation — Issue detail navigation is warmed ahead of the click. (#​10416)
• Observability — Sandbox startup and execution now emit granular OpenTelemetry spans (provider round trips, pack/transfer, cache-hit flags, per-step timing attribution), and manual spans export correctly. (#​10758, #​10764, #​10999, #​10204, #​10565)

Experimental

These ship behind experimental settings toggles.

• Chat-style task view — An opt-in "Chat-Style Tasks" experiment turns the issue detail page into a conversation: the thread leads, the composer stays at the bottom, live tool activity folds into compact summaries, and properties/plan/artifacts move into header tabs. A second iteration added a rich-text composer with attachment chips, live-turn narration, and a mobile layout. (#​10606, #​10707)
• Apps and Connections — Notion connects through MCP OAuth with PKCE and dynamic client registration — no manual OAuth credential setup — and companies can hold multiple connections to the same provider, with explicit review decisions for quarantined actions. (#​11009, #​11060, #​11040)
• Status cards — An experimental status card view compiles a single-prompt, agent-generated status update, joining summary-mentioned issues to the watched set. (#​10101, #​10202, #​10205)
• Simplified English interactions — An experimental flag renders agent interactions in Simplified English, with an optional /simplified-english skill in the catalog. (#​10934, #​10410)

Fixes

• Real version numbers everywhere — Published Docker images now stamp the real build version instead of the package.json placeholder, bake in the build commit, and expose the running commit on the unauthenticated health response — so --version, the UI, and /health finally agree on what you're running. (#​10257, #​10566, #​10563)
• Config preservation — Managed config repair preserves extensions and guards invalid repairs, managed environment drift survives boot, and skill sync / package import no longer silently replace an operator's skill selections — replacement now requires an explicit merge mode. (#​11005, #​10979, #​10978)
• Inbox correctness — Tasks completed by human users archive properly, passive issue views stay out of Mine, archived-by-you items stay archived, inbox re-sorts defer to attention boundaries so items stop jumping mid-read, empty search sections hide, and external object summaries no longer leak into the inbox. (#​10668, #​10581, #​10623, #​10700, #​10020)
• Workspace resilience — Execution workspaces whose recorded branch no longer exists self-heal, isolated workspace provisioning self-heals when the base CLI is broken, sandbox git copy-back bundles against the merge-base so diverged or reset workspaces still import, delivered workspaces are recognized and terminal worktrees reaped, and isolated setup defers until runtime start. (#​10578, #​10574, #​10601, #​10908, #​10653)
• Codex adapter reliability — Mid-turn harness crashes are classified structurally as retriable infrastructure errors, silent active builds are preserved, control-plane access is preserved in sandbox runs, sandbox runs can use the sandbox image's own Codex login, and a duplicate --skip-git-repo-check flag injection is gone. (#​10210, #​10153, #​10152, #​10582, #​10595)
• Plugin runtime fixes — Plugin agent session turns and replies deliver reliably, freshly-started plugin workers receive their stored config, and proactive worker-to-host calls resolve a company scope. (#​10137, #​10092, #​10103)
• Backup retention respects calendar months — Monthly backup pruning now uses calendar-month boundaries instead of a fixed 30-day approximation, so it no longer deletes valid month-end backups early. Isolated worktree dev instances also stop scheduling their own redundant backup streams. (#​3718, #​10520)
• Server hardening — Company-export YAML renders iteratively to stop a stack overflow on large companies, PAPERCLIP_DECISION_SIGNING_SECRET is no longer required at startup (a secure persisted instance key is used when absent), duplicate built-in agents are prevented and self-healed, routine checkout conflicts return 409, and due timer intervals are claimed atomically. (#​10854, #​10594, #​10223, #​3790, #​10584)
• UI paper cuts — White-on-white text on light-mode chat bubbles, the Live badge and Working shimmer surviving task teardown, blockquotes the markdown editor escaped as \>, clipboard copy over plain HTTP, plans not showing in the Plan pane, agent detail lingering after termination, and the full selected timeline window not loading are all fixed. (#​10952, #​10985, #​10466, #​10875, #​10930, #​10451, #​9576)

Upgrade Guide

• Migrations: this release adds 28 database migrations (0184 through 0211) covering Decisions, status cards, document memberships, interaction governance, and new indexes. Migrations run automatically on startup — no manual action required. Note that 0196 drops the tables belonging to the removed experimental Cloud Sync transport (see Breaking Changes).
• New optional environment variables (all have sensible defaults; set only if you need them):
  • PAPERCLIP_IMPORT_ZIP_MAX_BYTES — company import zip upload cap (default 1 GB). (#​11184)
  • DATABASE_PREPARED_STATEMENTS, DATABASE_POOL_MAX, DATABASE_IDLE_TIMEOUT_SECONDS, DATABASE_CONNECT_TIMEOUT_SECONDS — DB client tuning; set DATABASE_PREPARED_STATEMENTS=false when connecting through a transaction-mode pooler (pgbouncer, Supavisor, Neon pooled hosts). (#​10795)
  • RUN_LOG_S3_INFLIGHT_MIRROR_SECONDS — opt-in throttled mirroring of in-flight run logs to S3 with a graceful-shutdown flush; unset means no change. (#​10512)
  • PAPERCLIP_DECISION_SIGNING_SECRET — optional override for decision signing; when absent, a secure persisted instance key is used automatically. (#​10594)
• Docker users: decide which channel you want. If you tracked :latest for master builds, that lane is now :canary; :latest only moves on stable releases from here on.
• Downgrading across channels (e.g. nightly back to stable) can mean running an older schema than your data was created with — treat a downgrade like a restore and back up your data directory first.

Contributors

This release has 311 commits from 17 contributors. Thank you to everyone who contributed to this release!

@​bluzername, @​LeonSGP43, @​myaji35, @​noahrasheta, @​samrusani, @​santhiprakash, @​scokeepa, @​sparkeros

v2026.722.0

Compare Source

Paperclip v2026.722.0

Released: 2026-07-22

Highlights

• Run-bound agent secret access — Agents can now fetch the secrets they've been granted on demand through a run-bound API, instead of relying only on ambient environment injection. A new access.* delivery mode exposes API-only secrets, GET /api/agents/me/secrets lists just the aliases an agent is granted, and POST /api/agents/me/secrets/:key/value returns a value with Cache-Control: no-store. Every value read is written to both the security audit trail and the operator activity log, low-trust review/skill-test tokens stay denied, and a new Secret access editor lets you manage per-agent grants from agent settings. (#​9921)
• Local agents run on Windows — The embedded ACPX engine no longer wraps local agent commands in a generated Bash script, so Claude, Codex, Gemini, and custom ACP adapters now spawn natively on Windows as well as Linux. Environment variables are injected through ACPX session options, child stderr is captured in-process, .cmd npm/pnpm shims are preferred on Windows, and symlink EPERM failures fall back to copies. A real Node ACP spawn smoke now runs on both Ubuntu and Windows. (#​9980)

Improvements

• User-named PAPERCLIP_* bindings now reach your agents — The heartbeat previously stripped every PAPERCLIP_-prefixed env binding before resolution, so a secret you deliberately named something like PAPERCLIP_CLOUD_PROD_PROVIDER_RAILWAY_TOKEN was silently dropped. Now only PAPERCLIP_API_KEY is categorically rejected, harness-assigned runtime vars always win, and every other PAPERCLIP_* binding flows through to the run environment. (#​9974)
• Sturdier telemetry client — The telemetry client now matches the wire contract: payloads are chunked, batch IDs are deterministic, retries are batched with backoff, and the local store is bounded. A silent-drop baseline is pinned and caps/backoff are now a configurable surface. Telemetry remains anonymized and can be disabled with DO_NOT_TRACK=1 or PAPERCLIP_TELEMETRY_DISABLED=1. (#​9946, #​9906, @​nickyleach)
• Slash-named secrets browse as folders — Secrets whose names contain slashes now navigate as nested folders in the UI. (#​9913)
• Searchable agent picker for secret access — Granting per-agent secret access now uses a searchable agent picker instead of a long flat list. (#​9918)
• Cleaner external object labels and star controls — External object labels and the star controls that sit next to them were simplified for less visual noise. (#​9929)
• Safer sandbox CODEX_HOME sync — The codex-local adapter now stages an explicit allowlist when syncing CODEX_HOME into the sandbox, rather than copying the whole home directory. (#​9972, @​nickyleach)

Experimental

These features ship gated behind experimental settings — enable Apps under experimental settings to try them out.

• Connections v3 foundation — The groundwork for one-click Connected Apps landed: a v3 schema core adds a stable company-scoped connection UID, explicit ownership/auth/transport fields, a subject-aware connection_grants table, and multi-key credentials (with the legacy remote_http transport renamed to mcp_remote). On top of that, a generated AppDefinition Wave 1 catalog gives browse and setup a single typed contract, and a runtime layer adds subject-aware authorization state, scoped key handling, and OpenAPI-registered grant routes that fail closed for unknown scopes. (#​9958, #​9981, #​9982)

Fixes

• Archived inbox items stay archived — Items you've archived no longer resurface in the inbox. (#​9931)
• Execution-policy final approval finishes cleanly — Approving the final stage of an execution policy now terminates the policy instead of rewinding it back to stage 1. (#​7936, @​HKTITAN)
• Accept Office issue attachments — Office document attachments (Word, Excel, PowerPoint) are now accepted on issues. (#​8562, @​samrusani)
• Redact HTTP cookies from server logs — Cookie headers are now redacted from server logs so session material doesn't leak into log output. (#​7977, @​nosolosoft)
• No more 500s from run-authored comments — createdByRunId is sanitized on comment insert, fixing a class of 500 errors. (#​9489, @​digitalflanker-ux)
• Preserve terminal status on issue release — Releasing an issue no longer clobbers a terminal (done/cancelled) status. (#​7524, @​harshkotak)
• Fail loudly on invalid config files — An invalid config file now surfaces a clear error instead of being silently ignored. (#​9041, @​lesbass)
• Non-clickable pending-approval guidance — The pending-approval admin guidance on the invite screen is no longer a misleading clickable element. (#​6786, @​le-czs)
• Cron validity settles with radix-ui 1.6.4 — Cron validity handling and a settle-branch test were synced for radix-ui 1.6.4. (#​9966, @​nickyleach)
• CLI import selection fixes — Cleared import selections no longer drop the extension file, and missing company-manifest fields were added to the import-selection test fixture. (#​2379, @​kevinmanase, #​9978, @​aaymeloglu)
• Cloud-managed instances pass the health gate — Cloud-managed instances are now treated as bootstrapped in the health gate so they don't stall on startup. (#​9912)

Upgrade Guide

• This release adds two additive database migrations for the Connections v3 foundation (0182_connections_v3_schema_core, 0183_connection_user_authorization_state), which backfill stable connection UIDs, create default workspace grants, and rename the remote_http transport to mcp_remote. Migrations run automatically on startup — no manual action is required.
• If you previously set a static PAPERCLIP_API_KEY in adapter/config env to override the run token, that override no longer applies — the harness-minted run token is now the only source of the run API key. All other PAPERCLIP_*-named bindings now flow through to the run environment as expected.
• Connections/Apps remain gated behind experimental settings. Enable Apps under experimental settings to try the Connections v3 surfaces.

Contributors

This release has 44 commits from 13 contributors. Thank you to everyone who contributed to this release!

@​aaymeloglu, @​digitalflanker-ux, @​harshkotak, @​HKTITAN, @​kevinmanase, @​le-czs, @​lesbass, @​MindSyncHub, @​nickyleach, @​nosolosoft, @​samrusani

v2026.720.0

Compare Source

Paperclip v2026.720.0

Released: 2026-07-20

Highlights

• Skill Studio & skill organization — A three-pane skill IDE with sandboxed test runs, so you can author, edit, and try out skills without leaving Paperclip. Skills now organize into nested folders with a dedicated "My Skills" view, you can import skills straight from a project, and company skill policy is open-by-default with core UX for tightening it. Company skill forks run prechecks before they land, and markdown edits get proper dirty-tracking and save. (#​9241, #​9235, #​9356, #​9633, #​9620, #​9564)
• Attention queue & Decisions — A new attention queue and Decisions surface bring everything that needs your input into one place, with faster scrolling and readable, mobile-friendly decision rows. (#​9380, #​9468, #​9472)
• Better search — Search gains filters, sorting, and operators, with command-palette parity so you can find issues and entities the same way everywhere, plus a new bulk extract endpoint. (#​9327, #​9507)
• Tougher, self-healing runs — Run restart recovery, workspace self-heal, quota-aware retries, and failed-run metrics mean your instance tries harder before it involves you. Recovery is now routed by failure cause, waits for provider quota resets, throttles serial repeats, and reports observability metrics with a rate alert. Plan-approval continuations and external-wait liveness are durable across failed wakes, and resolved blockers reliably wake the tasks that depend on them. (#​9183, #​9331, #​9373, #​9229, #​9634, #​9635, #​9651, #​9644)

Improvements

• Sandbox execution — ACP sessions can now run in sandbox execution targets, with sandbox support for the Grok local adapter, custom-image snapshots applied across config tests and saves, and a sandbox wall-clock backstop raised to four hours for long-running work. (#​9390, #​9338, #​9385, #​9232)
• Issue monitors are visible everywhere — External-service and issue monitors now surface across task surfaces and in issue properties, so you can see what a task is waiting on at a glance. (#​9783)
• Reworked secrets dialog with in-sheet agent access — The secrets dialog was reworked and you can now grant per-agent secret access directly in the sheet. (#​9797)
• Agents can safely tidy inboxes — Agents can now archive and tidy user inboxes under a governed inbox-archive access policy. (#​9724, #​9658, #​9654)
• Active PR gardening workflow — A new PR-gardening workflow keeps open pull requests moving. (#​9510)
• Stable workspace service controls — The workspace service control bar was stabilized so start/stop/restart controls behave predictably. (#​9705)
• Responsible-user attribution on activity logs — Activity logs now stamp the responsible user, and issue attribution is explicit. (#​9731)
• Clearer blocked-issue messaging — When a message won't reopen a blocked issue, the UI now explains why (Rule C). (#​9417)
• Interruptible queued runs — You can now interrupt queued issue runs instead of waiting them out. (#​9725)
• Clearer task-level model overrides — Issue properties now clarify task-level model overrides. (#​9710)
• Design-system convergence — Single-source design tokens, a visual regression suite, and a retuned theme, plus broad Card/Badge adoption, a multiplicative radius ladder, and unified list surfaces. Task status glyphs now use Lucide icons. (#​9134, #​9240, #​9395)
• Activity-gated routines — Scheduled runs can be gated on external activity, so routines only fire when there's real work to do. (#​9436)
• ACP is the default engine for local adapters — Local coding adapters now run through ACP by default, with local coding processes confined for safety, and the Claude ACP client was updated. (#​9238, #​9504, #​9484)
• Spend & cost telemetry — ACP-lane usage and cost now flow into spend telemetry, unpriced CLI usage is recorded, and credential-health retention is documented. (#​9471, #​9505, #​9248, @​nickyleach)
• Durable run logs — Run logs are now mirrored to a durable object-storage-backed store. (#​8984, @​stubbi)
• Codex & model updates — Updated Codex adapter GPT-5.6 defaults and added gpt-5.4-mini to Codex/OpenCode selection (plus openai/gpt-5.5 to OpenCode). (#​9352, #​4357, @​supertaz)
• Ship ripgrep in the agent runtime image — rg is now available out of the box in the base agent image. (#​8976, @​stubbi)
• Fewer redundant wakes — Redundant issue re-wakes are throttled and the execution contract is injected once per fresh heartbeat, cutting duplicate token spend. (#​9470, #​9469)
• Show source SHA for unreleased builds — Builds that aren't on a formal release now surface their source SHA, preserved even without Git metadata. (#​9508, #​9638)
• Prose editor for agent instructions — Markdown agent instructions now use the prose editor. (#​9332)
• Health-gated dev services — Paperclip dev services now require health readiness before they're considered up. (#​9269)
• Harder environment deletion — Environment deletion is hardened and now shows its delete blast radius. (#​9250, @​nickyleach)
• Faster release verification — The release verify workflow is parallelized and npm registry version queries are batched. (#​9168, #​9202)

Experimental

These features ship gated behind experimental settings — enable them under experimental settings to try them out.

• MCP Tool Gateway & Apps — A first-class, governed way to connect Model Context Protocol tools. A named MCP gateway brokers every tool call, governed access contracts and a tool-access policy decide which agents and profiles may use which tools, and the new Tools, Profiles, and Apps surfaces let you wire up, install, and smoke-test connections from the UI. (#​9556, #​9557, #​9558, #​9559, #​9560, #​9561, #​9562, #​9563)
• Built-in Summarizer & summary slots — A built-in summarizer agent and summary slots surface concise, always-current summaries right in the UI. (#​9713)
• Decision Training — A new decision-training library and inspector let you capture decision snapshots and review how your agents decide over time, backed by a snapshot foundation and image galleries for decisions with visual context. (#​9702, #​9779, #​9532)
• Cases — A new first-class Case object gives you a structured, document-backed record for things like releases and social threads. (#​9198)

Fixes

• Cross-tenant existence oracle closed — The API now returns 404 instead of 403 so it no longer leaks whether another tenant's resource exists. (#​3967, @​stubbi)
• Stronger public invites — Invite-token entropy is widened and public invite endpoints are rate-limited. (#​8979, @​stubbi)
• apiCompression no longer corrupts auth — Fixed gzip clients getting corrupted or dropped Better Auth responses. (#​9381)
• React performance-track memory leak — Reaped React 19.2 performance-track measures that were leaking memory in long-lived tabs. (#​9827)
• No more duplicate tasks or recovery loops — Duplicate task creation and recovery loops are prevented, repeated creates are deduplicated, and cancelled productivity-review loops are stopped. (#​9648, #​9650, #​5210, @​YanisThePie)
• Reliable hot restart — Hot-restart run adoption is restored and a hot-restart shutdown deadlock is fixed. (#​9647, #​9670)
• Durable continuations — Accepted-interaction continuation recovery is bounded, stranded recovery continuations are restored, and stale handoff alarms are suppressed during live continuation. (#​9656, #​9630, #​9695)
• Codex auth hardening — Refresh auth failures are classified, a host-unusable Codex auth merge fails closed, Codex models are configured at startup, the output-inactivity timeout is raised to 30 minutes, raw child output counts as activity, and shadowed sandbox auth is flagged. Codex auth-merge scripts moved into the adapter with an outbound copy-back home-asset restore path. (#​9598, #​9276, #​9700, #​9699, #​9632, #​9259, #​9785, #​9787, #​9788, @​nickyleach)
• Explain AWS secret failures — AWS secret creation failures are now explained in the UI instead of failing silently. (#​9645)
• Routine catch-up coalescing — Sub-hourly catch-up runs are coalesced so a backlog doesn't stampede. (#​9649)
• Worktree port conflicts — Recurring worktree port conflicts are prevented, and adapter env is forwarded to local agents while runtime env stays authoritative. (#​9642, #​9617)
• Search & PR-gardening hardening — Extract match limits are honored and PR-gardening candidate discovery is hardened. (#​9652)
• Company skills honor responsible-user grants — Company skill access now honors responsible-user grants. (#​9571)
• Decision cards survive machine comments — Machine-authored comments no longer supersede decision cards. (#​9015, @​nsollazzo)
• PID persistence for adapters — onSpawn is forwarded to the Hermes and process adapters so PIDs persist. (#​8722, @​machjesusmoto)
• Reliable process teardown — runChildProcess now escalates to SIGKILL on liveness rather than trusting child.killed. (#​8598, @​justinltodd)
• System comments show as "You" — System-authored comments now display as "You" instead of "Paperclip". (#​6330, @​BorClaw)
• Correct heartbeat activity attribution — Heartbeat invoke/resume now uses run.id for the activity log. (#​3424, @​tmartin2113)
• Prefix-aware export/import links — Company export/import links are prefix-aware again behind a path prefix. (#​6648, @​qbamca)
• Tolerate empty profile names — Empty-string user names in profile/session parsing no longer break. (#​8986, @​stubbi)
• Worktree repair — Dirty and foreign-branch execution worktrees are repaired, target attestation is required before repair, and worktree execution only starts after activation. (#​9297, #​9414, #​9374)
• Workspace branch reconciliation — Added auto-forward execution-workspace branch reconciliation and its route, and avoided freezing an accepted-plan workspace branch before child realization. (#​9172, #​9170, #​9233, @​nickyleach)
• Request-storm and polling fixes — Fixed a request-storm polling loop, issue-list coalescing, bounded the shared polling cache, event-sourced the company live-runs list, and cut live-update churn that inflated tab memory. (#​9190, #​9406, #​9627, #​9701, #​9624)
• Live-run readability & memory — Live run streaming text is more readable, live agent-run transcript buffers are capped to bound tab memory, and markdown mention observers

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.