Files
0ea1994fa7 Release docs for paperclip v2026.1023.0 (#156)
## Summary

Release docs for Paperclip **v2026.1023.0** (parent tag commit
`1b4c8038`).

- **Window:** `v2026.1012.0` → `v2026.1023.0`. The tag was cut from
parent `master` at 2026-10-12, so the cumulative window is the
merge-base `22a3ea34` → `1b4c8038`. That's 200 commits and 2,501 files,
with no compare truncation.
- **Branch:** cut from `nightly` (`1b81e21`). Nightly had drafted
against parent master up to `043f2514` (Oct 22), which is 496 commits
past the tag. Most of nightly's #151–#155 work is post-tag.
- **Review:** six reviewers checked all 161 changed pages hunk by hunk
against a local checkout of the tag, using post-tag history
(`1b4c8038..043f2514`) to date each claim. The tag-accuracy gate was
then re-run on the result.

**Headline doc changes:**
- **New pages (21):**
  - [Custom model providers](docs/connectors/custom-model-providers.md)
  - [Decision Models API](docs/reference/api/decision-models.md)
  - [Cases](docs/experimental/cases.md)
  - [External agents: OpenAI Dot](docs/experimental/external-agents.md)
  - [Agent cryptographic identity](docs/guides/org/agent-identity.md)
- [Agent complaints and
suggestions](docs/administration/agent-commentary.md)
  - [Runtime Commands](docs/reference/cli/runtime.md)
- 14 connector guides: Bitly, Calendly, Context7, Enterpret, Exa,
Firecrawl, Gauge, GSC Wizard, Make, Parallel Search, Superagent, Tavily,
Telem.AI and Windsor.ai
- **Updated pages:**
  - Private tasks and projects, with sharing and inherited privacy.
- Costs: estimated, unpriced and subscription spend, the Overview
breakdowns, provider cost reports, and the Decisions view.
  - Operators get default company editing permissions (#15377).
  - Agent setup checks and your primary agent.
  - Slack: automatic setup and **Require at-mention**.
  - The simplified dedicated GitHub App setup.
  - Cursor and Pi on Paperclip Runner, and the **Harness** label.
  - Expanded assistant MCP tools and the `paperclip:configure` scope.
  - CSV and HTML artifact previews.
  - The plugin agent lifecycle contract.
- Server-host AI sign-in, and new Linear, Airtable and Hugging Face
methods.
- A changelog entry, and 102 pages stamped `paperclip_version:
v2026.1023.0`.

### ⚠ Post-tag leaks removed

These document parent `master` features that are **not in
v2026.1023.0**. They stay on `nightly` for a later release.

- **Pages removed (7):**
  - `connectors/github-copilot.md` (92b23813)
  - `connectors/google-workspace.md` (23b2ceb0)
  - `connectors/braintrust.md` (92cfd701)
  - `connectors/daytona.md` (0b62c736)
  - `connectors/ditto.md` (a1e2173c)
  - `connectors/speko.md` (22d05644)
  - `connectors/prompt-injection-prevention.md` (2c96f767)

Their nav entries and catalog rows are already removed, and no page
links to them.
- **Reverted to `main`:**
  - 54 pages whose nightly changes were all post-tag. That includes:
- The Google per-app "no longer listed" notes and Gmail archive
(23b2ceb0, e4ce9890).
- The skills guide and the company-skill-policy API (repository packages
and auto-updates: a9830414, 473c80d1, df4ee06e).
    - The Cases API (handoffs and workflows: 505e1a55, 0a5f1546).
- The companies API (observability and prompt injection: ac9459ba,
2c96f767).
- `deploy/docker.md`, the claude-code and hermes adapters, and
`cli/agent.md` / `cli/service.md` (`--runner`, managed-shim guard).
  - The rest only changed Sources-link SHAs or had nightly-only wording.
- **Sections trimmed:**
- The Runner-default rollout, its upgrade notice and `runner` fields
(adb69e8f, 8193abb9, 39e44a9d, 734c2653).
  - Grok Bot and Muse (b8ffeb97, e6dcc6b0).
  - Task workspaces and plugin project storage (f329b24e, 8b4ab65b).
  - Task Retry and recovery status lines (d33b40a5).
- The commentary read API, `commentary:view`, and Pipelines removal
(e6dcd1e8, e5927e1d, 90777488).
  - Scoped and async budget enforcement (30b753f6).
- Plugin WebSocket routes, agent detail tabs, resource-lifecycle
delivery and Runner tasks (42715d45, db65a086, 33cc567f).
- Slack managed Cloud setup and DM at-mention changes (f0e12c85,
df06df23).
- Review-bot queued-comment, reconnect and naming changes (3b8324a2,
52459590, 7eea9d82).
  - OpenRouter attribution headers (9179d8dc).
  - Agent, project and routine search (7b9334cd).
  - Artifacts upload (762d680d).
- Env-var rows: `NATIVE_HARNESS_BACKUP_*`, `WORKSPACE_COMPACTION_*`,
`GIT_CACHE_*`/`GIT_BASE_*`, `SKILL_VERSION_RETENTION_*`, `NATIVE_MCP_*`
and `SENTRY_RUN_FAILURES`.
  - `/api/liveness` (a0651c96).
- Source links pinned to post-tag commits now point at the tag commit.

### ⚠ Drift

Checked against the tag (`check-drift --against 1b4c8038`). There are 33
candidates, the same set as the last nightly runs:
- **High:** `PAPERCLIP_WORKSPACE_GIT_SCAN_*`,
`PAPERCLIP_WORKSPACE_GIT_SNAPSHOT_TIMEOUT_MS`, `PAPERCLIP_RUNNER_API_*`,
`PAPERCLIP_MCP_AUTHORIZATION_ORIGIN` and `PAPERCLIP_CLOUD_CONNECTOR_*`
are known false positives. They're read through helpers or `env.`
receivers the checker doesn't scan.
- **High:** `PAPERCLIP_ID_CONNECTOR_*` is documented as retired, which
is intentional.
- Verify: `agent-avatars` (`:file` param), `companies/import/transfers*`
(constant route path), `chats/{agentRef}` (`router[method]` loop), and
`mcp/requests/{id}` plus the Dot pairing routes (array registration in
`public-mcp.ts`). These are known false positives.

### ⚠ Verification Failures / review notes

- **Tag-accuracy gate false positives:**
- `cli/runtime.md`: `--sha256` is a `.requiredOption` in
`cli/src/commands/runtime.ts`. `SSL_CERT_FILE`, `SSL_CERT_DIR` and
`NODE_EXTRA_CA_CERTS` are passed through by key list in
`buildPiSetupEnvironment`.
- `plugins/sdk.md`: `ENVIRONMENT_ACQUISITION_PROVIDER_STATES` is an SDK
export.
- `skills.md`: `PAPERCLIP_HELPER_STATE_DIR` is read in the skill's
upload script.
- `adapters/cursor-local.md`: the `acpx*` fields are validated in
`paperclip-runner-permissions.ts`.
- **New pages the gate can't auto-confirm:** each was confirmed by hand
at the tag, against the app definitions, routes and UI.
- **Claims kept on weaker evidence (commit message or UI string, not
code) — please eyeball:**
  - "a new bot starts in mentions-only mode" (github-setup).
  - "Mentions work in issue and PR descriptions" (review-bot setup).
  - Airtable's "HTTPS or localhost" sign-in note.
  - The "37 tools" figure on assistant-connections.
  - Reservation semantics on the costs guide.

### Screenshots

142 of 278 screenshots depend on UI files changed in this window (see
`SCREENSHOTS_PENDING.md`). They were last captured against v2026.1012.0
(#150), and a recapture is still pending.

### Checks

`docs:build` and `sync:check` pass: no broken links, and the only
orphans are the four pre-existing ones (`you-com`, `hosted-beta` and the
two intentional CLI redirect pages). All eight `docs:test` suites pass.

### After merge

1. Confirm the `docs/v2026.1023.0` tag was created.
2. Run `node scripts/sync/realign-nightly.mjs release/v2026.1023.0
--push`.
3. Re-apply this branch's decisions on `nightly`.
4. Flip `nightly`'s state back to `branch_mode: nightly`.
5. Verify docs.paperclip.ing serves the changelog entry and new pages.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
Co-authored-by: DevRel Gemini <[email protected]>
Co-authored-by: Paperclip <[email protected]>
Co-authored-by: Dotta <[email protected]>
Co-authored-by: ClaudeCoder <[email protected]>
2026-10-24 13:01:34 +02:00

4.4 KiB

paperclip_version, seo_title, seo_description
paperclip_version seo_title seo_description
v2026.1023.0 Netlify Connector Let agents work with Netlify teams and sites. Reading deploy status versus starting a deploy, team scope, a read test, and troubleshooting.

Netlify

Agents can work with your Netlify teams and sites — checking deploy status, inspecting configuration, and investigating build failures.

Before you connect

  • A Netlify account with access to the team and sites you want agents to use.
  • If you belong to several Netlify teams, know which one you want. Reach follows the account, and there is no team picker in Paperclip.

Connect Netlify

  1. Open Connectors and select Netlify.
  2. Read the access line above the main button. It says who the connection signs in as and which agents can use it. To pick a different identity, narrow the agents, or use another sign-in method, select Change.
  3. Select Continue to Netlify and complete browser sign-in.

Paperclip registers its client with Netlify automatically, so there is nothing to set up in a developer console.

Choose access

Reach is the authorizing Netlify account's: the teams it belongs to and the sites within them, subject to Netlify's own role permissions.

The distinction that matters here is between observing a deploy and causing one:

What an agent does Consequence
Reads deploy status, logs, and build history Nothing changes. Safe to leave Allowed
Reads site and environment configuration May expose environment variable names, and sometimes values
Starts a deploy Depends on the target — see below
Changes site configuration Can change how the production site builds and behaves

Not every deploy is a production deploy. Netlify distinguishes production deploys from deploy previews and branch deploys, and only the first replaces what visitors see. Treat that as a reason to be careful about which deploy an agent can trigger, not a reason to assume every deploy is safe or that every deploy is live — check what a given action targets before allowing it.

Warning: A production deploy puts code in front of real users, and a configuration change can break a site. Keep deploy and configuration actions on Ask first or Off. Reading build logs to diagnose a failure is the common, safe use of this connector; triggering the rebuild is the part a person should approve.

Netlify environment variables frequently hold API keys. An agent that can read site configuration may surface them, so prefer Just agents I pick for a connection with configuration access. See Set action permissions.

Try it

List the Netlify sites this account can see, and tell me the status and time of the most recent deploy for one of them. Do not start a deploy.

Compare against the Netlify dashboard. A deploy-status read is the natural first check because it is also the connector's most common real use.

Note: Illustrative task, not a recorded test result.

Troubleshooting and limitations

Problem Likely cause Fix
A site is missing The authorizing account is not a member of that team Add it to the team in Netlify; no reconnect needed
An action is refused The account's Netlify role does not permit it Adjust the role in Netlify, or leave the capability off
A deploy started unexpectedly A deploy action was set to Allowed Set it to Ask first. Recovery is yours to do in Netlify — cancel the running build, or publish a previous deploy. Paperclip does not roll anything back
Build logs are truncated Netlify's own log retention and size limits Check the full log in the Netlify dashboard
An expected capability is absent Netlify's server does not expose it Use Refresh actions; otherwise it is unavailable
Needs attention The grant expired or was revoked Select Reconnect

Limitations: one Netlify account per connection. No team or site filter inside Paperclip. Paperclip cannot roll back a deploy — do that in Netlify.