d627632874
Docs for parent release `v2026.1106.0` (`d69631b0`), up from `v2026.1023.0` (`1b4c8038`): 515 parent commits. ## How this branch was built The tag is 914 commits behind what `nightly` has drafted, so this branch isn't cut from `nightly` HEAD. It starts at nightly commit `1952052` (parent `043f2514`), 19 commits before the tag, then adds: - the `main` hotfix (#160) - the sync tooling from `nightly` - docs for those 19 commits Later nightly drafts stay on `nightly`, so no pages had to be removed. No `nightly-draft/*` PRs are open. ## What changed - **Runner by default:** new Claude, Codex, OpenCode and Pi agents start on Paperclip Runner on supported hosts, with **Legacy runner** and **Upgrade runner**. - **Workspaces:** cleanup of finished workspaces, optional Git expiration, and restore points for unsaved work. Restore points are off by default. - **New pages:** Prompt injection prevention, Google Workspace, GitHub Copilot, Speko, Braintrust, Daytona, Ditto and Unikraft. - **Breaking and upgrade notes:** the run history limit, Sentry run failures off by default and the DSN variables, the Docker start command for custom images, `--yes` on `instructions-file:delete`, and slower migrations on large instances. - **Also covered:** project repositories as skill sources, roster bulk edit, Artifacts V1 (experimental, off by default), composer dismissal, `expectedStatusVersion`, `unexecuted_review_stage`, and plugin workspace providers. - **Changelog:** a v2026.1106.0 entry in `reference/changelog.md`. ## Older text corrected These were wrong at the tag, and most are also wrong on the live site: - which permissions let an agent read a peer's configuration or change instructions (`api/agents.md`) - `decideNowCount`, which doesn't exist; the field is `deskBadgeCount` - `file-resources` routes, which are board-only - the **Create project** dialog fields, a CEO rule the code doesn't enforce, and where a terminated agent's reports appear - `instructions-file:put` and `:delete` examples that always failed (`cli/agent.md`) - a curl example that returned `422` (`api/cases.md`) - Google Workspace **Reconnect** instructions, which claimed it reopens the service picker - the `permissionKey` table, which listed 8 of 21 keys - drafting text at the end of `api/agents.md` ## ⚠ Please check these - **Product behaviour that may be a parent bug.** The docs now describe the tag's code, which you may prefer to fix upstream: - The project **Environment** dropdown saves a choice, but runs ignore it (`experimental/environments.md`). - `environments:manage` is granted by roles but no environment route checks it. - `suggest-changes` is documented as agent-only, because only agents have a consent path. Company skill policy decides skill edits. - **Reader-visible mismatches in the parent UI.** The docs follow the code. Upstream copy still mentions a "Built-in agents tab", says Copilot "awaits qualification", and tells people to "Reconnect Google Workspace to change access". ## ⚠ Post-tag leaks removed Nothing to remove from an already-drafted page: post-tag surfaces such as 1Password, Vercel, Supabase deploy, custom gateway onboarding and Artifacts V1 as default never came onto this branch. Authors left out post-tag hunks of the next nightly draft, and the reasons are in the run notes. ## ⚠ Drift None. Zero findings at the tag, from a full parent snapshot. ## ⚠ Verification Failures The tag-accuracy gate reports one leak and nine review entries. None is a real failure: - **Leak:** `reference/cli/service.md`, `paperclipai payload and`. This is a false positive; it's prose from a real message at `cli/src/commands/service.ts:184`. - **Review, 8 new connector pages:** the gate can't confirm new pages. Reviewers confirmed each surface exists at the tag. - **Review, `local_tools`:** an example value from the tag's Runner README. Not provable from code, and kept deliberately: - `sandbox-providers.md` uses `sandbox.yaml`. The tag's README says `install.yaml`, which returned 404 when checked. The upstream fix is post-tag. - The Google Workspace row about older OAuth brokers rests on release notes and a design doc. The broker isn't in this repo. - External claims about provider behaviour (for example Braintrust, Daytona, Unikraft and Google scopes). ## ↻ Renames detected None. The rename helper wasn't run: the 19-commit delta adds no new adapter, skill, or plugin directories that it would check. ## Verification All checks read a checkout pinned to the tag. - **First round:** authors, a release-notes audit, an audit of corrections stranded on `nightly`, an audit of 321 lines the last realign dropped from `main` (about 130 checked directly in code), and six fresh verifiers. - **Second round:** seven new verifiers re-checked every changed area, tracing behaviour rather than matching labels, and fixed about 50 more defects. That volume means more may remain. - **Limits of that second round:** - Each verifier reported what it only string-matched. That includes parts of Artifacts V1, the **Upgrade runner** notice, Copilot run behaviour, and some Plugin SDK contract text. - The second-round fixes themselves weren't reviewed by a third round. - **Gates:** `docs:build`, `docs:test` and `sync:check` pass. - **Nothing was run against a live instance.** All of this comes from reading code. ## Screenshots **196 of 278 screenshots are stale and none were recaptured.** The list is in `SCREENSHOTS_PENDING.md`. Some visibly differ from the text, such as the removed **Run with provider trace** button and the old roster tabs. ## After merge 1. Keep the PR title as is: `tag-docs-release.yml` reads the version from it. 2. Confirm the `docs/v2026.1106.0` tag exists. 3. Run `node scripts/sync/realign-nightly.mjs release/v2026.1106.0 --push`, then audit for dropped lines and duplicated paragraphs, and set `nightly` state back to `branch_mode: nightly`. 4. Check that `docs.paperclip.ing` serves the release: a new page, a new claim, and the changelog's top entry. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: DevRel Gemini <[email protected]> Co-authored-by: Paperclip <[email protected]> Co-authored-by: Dotta <[email protected]> Co-authored-by: ClaudeCoder <[email protected]>
6.1 KiB
paperclip_version, seo_title, seo_description
| paperclip_version | seo_title | seo_description |
|---|---|---|
| v2026.1106.0 | Custom AI Endpoints and Bedrock | Connect a Responses, Messages, Chat Completions, local, or Bedrock endpoint. Match its API format to the agent harness and select a model explicitly. |
Custom model providers
Use an existing model gateway, a model server in your agent's environment, or Amazon Bedrock to supply model access. You save the route and credential as an AI connection, then select that connection on a compatible agent.
These connections are available without an experimental setting. They supply model access and do not add tool actions or a Permissions action catalog.
Choose the API format
The format must match the harness that runs your agent. Selecting a model from another provider does not change the harness.
| Connection or API format | Compatible harness |
|---|---|
| Responses API / OpenAI Responses · Codex | Codex |
| Messages API / Anthropic Messages · Claude | Claude |
| Chat Completions API / Chat Completions · OpenCode, Hermes | OpenCode or Hermes |
| Local endpoint | The harness matching its selected Responses, Messages, or Chat Completions format |
| Amazon Bedrock | Claude |
| OpenRouter | Claude, Codex, OpenCode, or Hermes with a routed OpenRouter connection; see OpenRouter. |
Paperclip Runner uses the same compatibility rules for its Codex, OpenCode, and ACP Claude providers. Its Cursor and Grok profiles do not become compatible by selecting a custom endpoint.
Connect a gateway or local endpoint
- Open Connectors and select Responses API, Messages API, Chat Completions API, or Local endpoint.
- Enter Provider URL, using the base URL expected by that provider.
- Review API format and Authentication.
- Enter the credential when authentication is required.
- Optionally add Model IDs (comma separated) using provider model IDs or gateway aliases.
- Choose the connection's human audience and agent access, then select Connect.
The general model-provider setup also groups Custom gateway and Local endpoint under Advanced providers.
| Authentication | Availability |
|---|---|
| Bearer token | Responses, Messages, and Chat Completions |
| API key · x-api-key | Messages only |
| No authentication | Gateway and local routes that do not require a key |
Remote gateway URLs require HTTPS. They cannot contain embedded credentials, query parameters, or a fragment. Local endpoints require localhost or a loopback address and may use HTTP, for example http://localhost:11434/v1.
A local address is relative to the agent's execution environment. If your agent runs in a sandbox, localhost means that sandbox, not your laptop or the Paperclip server. Make the model service available there before running the agent.
Connect Amazon Bedrock
Choose Amazon Bedrock, enter AWS region, select Bedrock API key authentication, and supply the key. You can add the Bedrock model IDs you want to use.
This connection supports a Bedrock API key and region. It does not accept a custom base URL or an AWS access-key pair. Paperclip projects the connection into the Claude harness using the Bedrock route.
Select the connection and model
Open the agent's Connection selector and choose the named compatible account. Custom routed connections require explicit selection; you cannot make one the responsible user's provider default.
When you create a new agent, the Connect a model step shows three tiles side by side: the provider's subscription, the provider's API key, and Advanced (tagged Custom Gateway). Choose Advanced to pick a saved compatible connection, or set up a new OpenRouter, Amazon Bedrock, Custom gateway, or Local endpoint connection without leaving agent setup. Then select Use connection.
A personal account can be selected explicitly, or a connection manager can share an account with the company. Every run still needs a responsible user who may use the credential, and the connection must be available to the agent. See How connector access works.
Use an exact model ID supplied by the endpoint. The IDs saved on the connection become model-picker choices; you can also enter an ID on the agent. Paperclip does not automatically fetch a model catalog from arbitrary gateways, local servers, or Bedrock. An OpenRouter connection without saved model IDs uses OpenRouter's public catalog and offers a refresh.
OpenCode uses paperclip/<model-id> for custom endpoints and openrouter/<model-id> for OpenRouter. The picker adds the harness prefix; Claude, Codex, and Hermes use the raw upstream ID.
Verify in the execution environment
Saving a custom connection is not proof that its endpoint, credential, or selected model works. Give the configured agent a short task and watch its run:
Reply with the single word: ready
This can consume provider usage. Check the account and model selected on the agent first. A local service that works in your browser may still be unreachable from the agent's environment.
Note: This is an example test, not a recorded live result.
Reconnect and troubleshoot
Reconnect replaces the credential while preserving the endpoint, API format, model list, and access. To change the route itself, create another connection and select it on the agent.
| Problem | Next step |
|---|---|
| The connection is incompatible | Match the API format to the harness in the table above. |
| The model list is empty | Add provider IDs to the connection or enter the model on the agent. |
| A local endpoint cannot be reached | Start the service inside the execution environment and check its loopback URL. |
| A gateway refuses the key | Check its selected authentication format and reconnect with a valid credential. |
| A task needs authentication | Use the task's connection card to reconnect if you own the account; otherwise its owner must restore access. |