corporateai 0.0.1

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "corporateai",
+  "version": "0.0.1",
+  "description": "Control plane for AI-agent companies",
+  "private": false,
+  "type": "module",
+  "scripts": {
+    "dev": "node scripts/dev-runner.mjs watch",
+    "dev:watch": "node scripts/dev-runner.mjs watch",
+    "dev:once": "node scripts/dev-runner.mjs dev",
+    "dev:server": "pnpm --filter @corporateai/server dev",
+    "dev:ui": "pnpm --filter @corporateai/ui dev",
+    "build": "node scripts/workspace-compat.mjs build",
+    "typecheck": "node scripts/workspace-compat.mjs typecheck",
+    "test": "vitest",
+    "test:run": "node scripts/workspace-compat.mjs test:run",
+    "db:generate": "pnpm --filter @corporateai/db generate",
+    "db:migrate": "pnpm --filter @corporateai/db migrate",
+    "secrets:migrate-inline-env": "tsx scripts/migrate-inline-env-secrets.ts",
+    "db:backup": "./scripts/backup-db.sh",
+    "corporateai": "node cli/dist/index.js",
+    "build:npm": "./scripts/build-npm.sh",
+    "release": "./scripts/release.sh",
+    "release:canary": "./scripts/release.sh canary",
+    "release:stable": "./scripts/release.sh stable",
+    "release:github": "./scripts/create-github-release.sh",
+    "release:rollback": "./scripts/rollback-latest.sh",
+    "check:tokens": "node scripts/check-forbidden-tokens.mjs",
+    "docs:dev": "cd docs && npx mintlify dev",
+    "smoke:openclaw-join": "./scripts/smoke/openclaw-join.sh",
+    "smoke:openclaw-docker-ui": "./scripts/smoke/openclaw-docker-ui.sh",
+    "smoke:openclaw-sse-standalone": "./scripts/smoke/openclaw-sse-standalone.sh",
+    "test:e2e": "npx playwright test --config tests/e2e/playwright.config.ts",
+    "test:e2e:headed": "npx playwright test --config tests/e2e/playwright.config.ts --headed",
+    "evals:smoke": "cd evals/promptfoo && npx promptfoo@0.103.3 eval",
+    "test:release-smoke": "npx playwright test --config tests/release-smoke/playwright.config.ts",
+    "test:release-smoke:headed": "npx playwright test --config tests/release-smoke/playwright.config.ts --headed"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.58.2",
+    "cross-env": "^10.1.0",
+    "esbuild": "^0.27.3",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.5"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "packageManager": "pnpm@9.15.4",
+  "pnpm": {
+    "patchedDependencies": {
+      "embedded-postgres@18.1.0-beta.16": "patches/embedded-postgres@18.1.0-beta.16.patch"
+    }
+  }
+}
+

package/pnpm-workspace.yaml

@@ -0,0 +1,4 @@
+packages:
+  - server
+  - ui
+  - cli

package/releases/v0.0.1.md

@@ -0,0 +1,36 @@
+# Release v0.0.1 — Early Preview
+
+This is an early preview release of Corporate (v0.0.1).
+
+Highlights
+
+- Initial marketing README and project metadata
+- Release tag `v0.0.1`
+
+Notes
+
+- This is an early, opinionated build intended for evaluation and early adopters.
+- Self-hosted and open-source; expect rough edges and ongoing changes.
+
+How to run
+
+Quick (one-liner via npx)
+
+```bash
+npx corporateai onboard --yes
+```
+
+Note: the `npx` shortcut requires a published `corporateai` CLI package. If the CLI isn't published for your environment yet, use the manual steps below.
+
+Manual (from source)
+
+```bash
+git clone https://github.com/EvanGribar/corporate.git
+cd corporate
+pnpm install
+pnpm dev
+```
+
+Feedback
+
+Please report bugs or feature requests via GitHub Issues or Discussions.

package/releases/v0.2.7.md

@@ -0,0 +1,15 @@
+# v0.2.7
+
+> Released: 2026-03-04
+
+## Improvements
+
+- **Onboarding resilience** — The setup wizard now continues after a failed environment test instead of getting stuck. If your Anthropic API key doesn't work, you can retry or clear it and proceed with a different configuration.
+- **Docker onboarding flow** — Cleaner defaults for the Docker smoke test and improved console guidance during `npx` onboarding runs.
+- **Issue search in skills** — The Paperclip skill reference now documents the `q=` search parameter for finding issues by keyword.
+
+## Fixes
+
+- **Markdown list rendering** — Fixed list markers (`-`, `*`) not rendering correctly in the editor and comment views.
+- **Archived companies hidden** — The new issue dialog no longer shows archived companies in the company selector.
+- **Embedded Postgres requirement** — The server now correctly requires the `embedded-postgres` dependency when running in embedded DB mode, preventing startup failures.

package/releases/v0.3.0.md

@@ -0,0 +1,54 @@
+# v0.3.0
+
+> Released: 2026-03-09
+
+## Highlights
+
+- **New adapters: Cursor, OpenCode, and Pi** — Paperclip now supports three additional local coding agents. Cursor and OpenCode integrate as first-class adapters with model discovery, run-log streaming, and skill injection. Pi adds a local RPC mode with cost tracking. All three appear in the onboarding wizard alongside Claude Code and Codex. ([#62](https://github.com/EvanGribar/corporate/pull/62), [#141](https://github.com/EvanGribar/corporate/pull/141), [#240](https://github.com/EvanGribar/corporate/pull/240), [#183](https://github.com/EvanGribar/corporate/pull/183), @aaaaron, @Konan69, @richardanaya)
+- **OpenClaw gateway adapter** — A new gateway-only OpenClaw flow replaces the legacy adapter. It uses strict SSE streaming, supports device-key pairing, and handles invite-based onboarding with join-token validation. ([#270](https://github.com/EvanGribar/corporate/pull/270))
+- **Inbox and unread semantics** — Issues now track per-user read state. Unread indicators appear in the inbox, dashboard, and browser tab (blue dot). The inbox badge includes join requests and approvals, and inbox ordering is alert-focused. ([#196](https://github.com/EvanGribar/corporate/pull/196), @hougangdev)
+- **PWA support** — The UI ships as an installable Progressive Web App with a service worker and enhanced manifest. The service worker uses a network-first strategy to prevent stale content.
+- **Agent creation wizard** — A new choice modal and full-page configuration flow make it easier to add agents. The sidebar AGENTS header now has a quick-add button.
+
+## Improvements
+
+- **Mermaid diagrams in markdown** — Fenced `mermaid` blocks render as diagrams in issue comments and descriptions.
+- **Live run output** — Run detail pages stream output over WebSocket in real time, with coalesced deltas and deduplicated feed items.
+- **Copy comment as Markdown** — Each comment header has a one-click copy-as-markdown button.
+- **Retry failed runs** — Failed and timed-out runs now show a Retry button on the run detail page.
+- **Project status clickable** — The status chip in the project properties pane is now clickable for quick updates.
+- **Scroll-to-bottom button** — Issue detail and run pages show a floating scroll-to-bottom button when you scroll up.
+- **Database backup CLI** — `corporateai db:backup` lets you snapshot the database on demand, with optional automatic scheduling.
+- **Disable sign-up** — A new `auth.disableSignUp` config option (and `AUTH_DISABLE_SIGNUP` env var) lets operators lock registration. ([#279](https://github.com/EvanGribar/corporate/pull/279), @JasonOA888)
+- **Deduplicated shortnames** — Agent and project shortnames are now auto-deduplicated on create and update instead of rejecting duplicates. ([#264](https://github.com/EvanGribar/corporate/pull/264), @mvanhorn)
+- **Human-readable role labels** — The agent list and properties pane show friendly role names. ([#263](https://github.com/EvanGribar/corporate/pull/263), @mvanhorn)
+- **Assignee picker sorting** — Recent selections appear first, then alphabetical.
+- **Mobile layout polish** — Unified GitHub-style issue rows across issues, inbox, and dashboard. Improved popover scrolling, command palette centering, and property toggles on mobile. ([#118](https://github.com/EvanGribar/corporate/pull/118), @MumuTW)
+- **Invite UX improvements** — Invite links auto-copy to clipboard, snippet-only flow in settings, 10-minute invite TTL, and clearer network-host guidance.
+- **Permalink anchors on comments** — Each comment has a stable anchor link and a GET-by-ID API endpoint.
+- **Docker deployment hardening** — Authenticated deployment mode by default, named data volume, `PAPERCLIP_PUBLIC_URL` and `PAPERCLIP_ALLOWED_HOSTNAMES` exposed in compose files, health-check DB wait, and Node 24 base image. ([#400](https://github.com/EvanGribar/corporate/pull/400), [#283](https://github.com/EvanGribar/corporate/pull/283), [#284](https://github.com/EvanGribar/corporate/pull/284), @AiMagic5000, @mingfang)
+- **Updated model lists** — Added `claude-sonnet-4-6`, `claude-haiku-4-6`, and `gpt-5.4` to adapter model constants. ([#293](https://github.com/EvanGribar/corporate/pull/293), [#110](https://github.com/EvanGribar/corporate/pull/110), @cpfarhood, @artokun)
+- **Playwright e2e tests** — New end-to-end test suite covering the onboarding wizard flow.
+
+## Fixes
+
+- **Secret redaction in run logs** — Env vars sourced from secrets are now redacted by provenance, with consistent `secretKeys` tracking. ([#261](https://github.com/EvanGribar/corporate/pull/261), @mvanhorn)
+- **SPA catch-all 500s** — The server serves cached `index.html` in the catch-all route and uses `root` in `sendFile`, preventing 500 errors on dotfile paths and SPA refreshes. ([#269](https://github.com/EvanGribar/corporate/pull/269), [#78](https://github.com/EvanGribar/corporate/pull/78), @mvanhorn, @MumuTW)
+- **Unmatched API routes return 404 JSON** — Previously fell through to the SPA handler. ([#269](https://github.com/EvanGribar/corporate/pull/269), @mvanhorn)
+- **Agent wake logic** — Agents wake when issues move out of backlog, skip self-wake on own comments, and skip wakeup for backlog-status changes. Pending-approval agents are excluded from heartbeat timers. ([#159](https://github.com/EvanGribar/corporate/pull/159), [#154](https://github.com/EvanGribar/corporate/pull/154), [#267](https://github.com/EvanGribar/corporate/pull/267), [#72](https://github.com/EvanGribar/corporate/pull/72), @Logesh-waran2003, @cschneid, @mvanhorn, @STRML)
+- **Run log fd leak** — Fixed a file-descriptor leak in log append that caused `spawn EBADF` errors. ([#266](https://github.com/EvanGribar/corporate/pull/266), @mvanhorn)
+- **500 error logging** — Error logs now include the actual error message and request context instead of generic pino-http output.
+- **Boolean env parsing** — `parseBooleanFromEnv` no longer silently treats common truthy values as false. ([#91](https://github.com/EvanGribar/corporate/pull/91), @zvictor)
+- **Onboarding env defaults** — `onboard` now correctly derives secrets from env vars and reports ignored exposure settings in `local_trusted` mode. ([#91](https://github.com/EvanGribar/corporate/pull/91), @zvictor)
+- **Windows path compatibility** — Migration paths use `fileURLToPath` for Windows-safe resolution. ([#265](https://github.com/EvanGribar/corporate/pull/265), [#413](https://github.com/EvanGribar/corporate/pull/413), @mvanhorn, @online5880)
+- **Secure cookies on HTTP** — Disabled secure cookie flag for plain HTTP deployments to prevent auth failures. ([#376](https://github.com/EvanGribar/corporate/pull/376), @dalestubblefield)
+- **URL encoding** — `buildUrl` splits path and query to prevent `%3F` encoding issues. ([#260](https://github.com/EvanGribar/corporate/pull/260), @mvanhorn)
+- **Auth trusted origins** — Effective trusted origins and allowed hostnames are now applied correctly in public mode. ([#99](https://github.com/EvanGribar/corporate/pull/99), @zvictor)
+- **UI stability** — Fixed blank screen when prompt templates are emptied, search URL sync causing re-renders, issue title overflow in inbox, and sidebar badge counts including approvals. ([#262](https://github.com/EvanGribar/corporate/pull/262), [#196](https://github.com/EvanGribar/corporate/pull/196), [#423](https://github.com/EvanGribar/corporate/pull/423), @mvanhorn, @hougangdev, @RememberV)
+
+## Contributors
+
+Thank you to everyone who contributed to this release!
+
+@aaaaron, @AiMagic5000, @artokun, @cpfarhood, @cschneid, @dalestubblefield, @Dotta, @eltociear, @fahmmin, @gsxdsm, @hougangdev, @JasonOA888, @Konan69, @Logesh-waran2003, @mingfang, @MumuTW, @mvanhorn, @numman-ali, @online5880, @RememberV, @richardanaya, @STRML, @tylerwince, @zvictor
+

package/releases/v0.3.1.md

@@ -0,0 +1,55 @@
+# v0.3.1
+
+> Released: 2026-03-12
+
+## Highlights
+
+- **Gemini CLI adapter** — Full local adapter support for Google's Gemini CLI. Includes API-key detection, turn-limit handling, sandbox and approval modes, skill injection into `~/.gemini/`, and yolo-mode default. ([#452](https://github.com/EvanGribar/corporate/pull/452), [#656](https://github.com/EvanGribar/corporate/pull/656), @aaaaron)
+- **Run transcript polish** — Run transcripts render markdown, fold command stdout, redact home paths and user identities, and display humanized event labels across both detail and live surfaces. ([#648](https://github.com/EvanGribar/corporate/pull/648), [#695](https://github.com/EvanGribar/corporate/pull/695))
+- **Inbox refinements** — Improved tab behavior, badge counts aligned with visible unread items, better mobile layout, and smoother new-issue submit state. ([#613](https://github.com/EvanGribar/corporate/pull/613))
+- **Improved onboarding wizard** — Onboarding now shows Claude Code and Codex as recommended adapters, collapses other types, and features animated step transitions with clickable tabs. Adapter environment checks animate on success and show debug output only on failure. ([#700](https://github.com/EvanGribar/corporate/pull/700))
+
+## Improvements
+
+- **Instance heartbeat settings sidebar** — View and manage heartbeat configuration directly from the instance settings page with compact grouped run lists. ([#697](https://github.com/EvanGribar/corporate/pull/697))
+- **Project and agent configuration tabs** — New tabbed configuration UI for projects and agents, including execution workspace policy settings. ([#613](https://github.com/EvanGribar/corporate/pull/613))
+- **Agent runs tab** — Agent detail pages now include a dedicated runs tab.
+- **Configurable attachment content types** — The `PAPERCLIP_ALLOWED_ATTACHMENT_TYPES` env var lets operators control which file types can be uploaded. ([#495](https://github.com/EvanGribar/corporate/pull/495), @subhendukundu)
+- **Default max turns raised to 300** — Agents now default to 300 max turns instead of the previous limit. ([#701](https://github.com/EvanGribar/corporate/pull/701))
+- **Issue creator shown in sidebar** — The issue properties pane now displays who created each issue. ([#145](https://github.com/EvanGribar/corporate/pull/145), @cschneid)
+- **Company-aware 404 handling** — The UI now shows company-scoped not-found pages instead of a generic error.
+- **Tools for Worktree workflow for developers** — New `corporateai worktree:make` command provisions isolated development instances with their own database, secrets, favicon branding, and git hooks. Worktrees support minimal seed mode, start-point selection, and automatic workspace rebinding. ([#496](https://github.com/EvanGribar/corporate/pull/496), [#530](https://github.com/EvanGribar/corporate/pull/530), [#545](https://github.com/EvanGribar/corporate/pull/545))
+
+## Fixes
+
+- **Gemini Docker build** — Include the Gemini adapter manifest in the Docker deps stage so production builds succeed. ([#706](https://github.com/EvanGribar/corporate/pull/706), @zvictor)
+- **Approval retries made idempotent** — Duplicate approval submissions no longer create duplicate records. ([#502](https://github.com/EvanGribar/corporate/pull/502), @davidahmann)
+- **Heartbeat cost recording** — Costs are now routed through `costService` instead of being recorded inline, fixing missing cost attribution. ([#386](https://github.com/EvanGribar/corporate/pull/386), @domocarroll)
+- **Claude Code env var leak** — Child adapter processes no longer inherit Claude Code's internal environment variables. ([#485](https://github.com/EvanGribar/corporate/pull/485), @jknair)
+- **`parentId` query filter** — The issues list endpoint now correctly applies the `parentId` filter. ([#491](https://github.com/EvanGribar/corporate/pull/491), @lazmo88)
+- **Remove `Cmd+1..9` shortcut** — The company-switch keyboard shortcut conflicted with browser tab switching and has been removed. ([#628](https://github.com/EvanGribar/corporate/pull/628), @STRML)
+- **IME composition Enter** — Pressing Enter during IME composition in the new-issue title no longer moves focus prematurely. ([#578](https://github.com/EvanGribar/corporate/pull/578), @kaonash)
+- **Restart hint after hostname change** — The CLI now reminds users to restart the server after changing allowed hostnames. ([#549](https://github.com/EvanGribar/corporate/pull/549), @mvanhorn)
+- **Default `dangerouslySkipPermissions` for unattended agents** — Agents running without a terminal now default to skipping permission prompts instead of hanging. ([#388](https://github.com/EvanGribar/corporate/pull/388), @ohld)
+- **Remove stale `paperclip` property from OpenClaw Gateway** — Cleaned up an invalid agent parameter that caused warnings. ([#626](https://github.com/EvanGribar/corporate/pull/626), @openagen)
+- **Issue description overflow** — Long descriptions no longer break the layout.
+- **Worktree JWT persistence** — Environment-sensitive JWT config is now correctly carried into worktree instances.
+- **Dev migration prompt** — Fixed embedded `db:migrate` flow for local development.
+- **Markdown link dialog positioning** — The link insertion dialog no longer renders off-screen.
+- **Pretty logger metadata** — Server log metadata stays on one line instead of wrapping.
+
+## Upgrade Guide
+
+Two new database migrations (`0026`, `0027`) will run automatically on startup:
+
+- **Migration 0026** adds the `workspace_runtime_services` table for worktree-aware runtime support.
+- **Migration 0027** adds `execution_workspace_settings` to issues and `execution_workspace_policy` to projects.
+
+Both are additive (new table and new columns) — no existing data is modified. Standard `corporateai` startup will apply them automatically.
+
+## Contributors
+
+Thank you to everyone who contributed to this release!
+
+@aaaaron, @adamrobbie-nudge, @cschneid, @davidahmann, @domocarroll, @jknair, @kaonash, @lazmo88, @mvanhorn, @ohld, @openagen, @STRML, @subhendukundu, @zvictor
+

package/releases/v2026.318.0.md

@@ -0,0 +1,66 @@
+# v2026.318.0
+
+> Released: 2026-03-18
+
+## Highlights
+
+- **Plugin framework and SDK** — Full plugin system with runtime lifecycle management, CLI tooling, settings UI, breadcrumb and slot extensibility, domain event bridge, and a kitchen-sink example. The Plugin SDK now includes document CRUD methods and a testing harness. ([#904](https://github.com/EvanGribar/corporate/pull/904), [#910](https://github.com/EvanGribar/corporate/pull/910), [#912](https://github.com/EvanGribar/corporate/pull/912), [#909](https://github.com/EvanGribar/corporate/pull/909), [#1074](https://github.com/EvanGribar/corporate/pull/1074), @gsxdsm, @mvanhorn, @residentagent)
+- **Upgraded costs and budgeting** — Improved cost tracking and budget management surfaces. ([#949](https://github.com/EvanGribar/corporate/pull/949))
+- **Issue documents and attachments** — Issues now support inline document editing, file staging before creation, deep-linked documents, copy and download actions, and live-event refresh. ([#899](https://github.com/EvanGribar/corporate/pull/899))
+- **Hermes agent adapter** — New `hermes_local` adapter brings support for the Hermes CLI as an agent backend. ([#587](https://github.com/EvanGribar/corporate/pull/587), @teknium1)
+- **Execution workspaces (EXPERIMENTAL)** — Isolated execution workspaces for agent runs, including workspace operation tracking, reusable workspace deduplication, and work product management. Project-level workspace policies are configurable. ([#1038](https://github.com/EvanGribar/corporate/pull/1038))
+- **Heartbeat token optimization** — Heartbeat cycles now skip redundant token usage.
+
+## Improvements
+
+- **Session compaction is adapter-aware** — Compaction logic now respects per-adapter context limits.
+- **Company logos** — Upload and display company logos with SVG sanitization and enhanced security headers for asset responses. ([#162](https://github.com/EvanGribar/corporate/pull/162), @JonCSykes)
+- **App version label** — The sidebar now displays the running Paperclip version. ([#1096](https://github.com/EvanGribar/corporate/pull/1096), @saishankar404)
+- **Project tab caching** — Active project tab is remembered per-project; tabs have been renamed and reordered. ([#990](https://github.com/EvanGribar/corporate/pull/990))
+- **Copy-to-clipboard on issues** — Issue detail headers now include a copy button; HTML entities no longer leak into copied text. ([#990](https://github.com/EvanGribar/corporate/pull/990))
+- **Me and Unassigned assignee options** — Quick-filter assignee options for the current user and unassigned issues. ([#990](https://github.com/EvanGribar/corporate/pull/990))
+- **Skip pre-filled fields in new issue dialog** — Tab order now skips assignee and project fields when they are already populated. ([#990](https://github.com/EvanGribar/corporate/pull/990))
+- **Worktree cleanup command** — New `worktree:cleanup` command, env-var defaults, and auto-prefix for worktree branches. ([#1038](https://github.com/EvanGribar/corporate/pull/1038))
+- **Release automation** — Automated canary and stable release workflows with npm trusted publishing and provenance metadata. ([#1151](https://github.com/EvanGribar/corporate/pull/1151), [#1162](https://github.com/EvanGribar/corporate/pull/1162))
+- **Documentation link** — Sidebar documentation link now points to external docs.paperclip.ing.
+- **Onboarding starter task delay** — Starter tasks are no longer created until the user launches.
+
+## Fixes
+
+- **Embedded PostgreSQL hardening** — Startup adoption, data-dir verification, and UTF-8 encoding are now handled reliably. (@vkartaviy)
+- **`os.userInfo()` guard** — Containers with UID-only users no longer crash; HOME is excluded from the cache key. ([#1145](https://github.com/EvanGribar/corporate/pull/1145), @wesseljt)
+- **opencode-local HOME resolution** — `os.userInfo()` is used for model discovery instead of relying on the HOME env var. ([#1145](https://github.com/EvanGribar/corporate/pull/1145), @wesseljt)
+- **dotenv cwd fallback** — The server now loads `.env` from `cwd` when `.paperclip/.env` is missing. ([#834](https://github.com/EvanGribar/corporate/pull/834), @mvanhorn)
+- **Plugin event subscription wiring** — Fixed subscription cleanup, filter nullability, and stale diagram. ([#988](https://github.com/EvanGribar/corporate/pull/988), @leeknowsai)
+- **Plugin slot rendering** — Corrected slot registration and rendering for plugin UI extensions. ([#916](https://github.com/EvanGribar/corporate/pull/916), [#918](https://github.com/EvanGribar/corporate/pull/918), @gsxdsm)
+- **Archive project UX** — Archive now navigates to the dashboard and shows a toast; replaced `window.confirm` with inline confirmation.
+- **Markdown editor spacing** — Image drop/paste adds proper newlines; header top margins increased.
+- **Workspace form refresh** — Forms now refresh when projects are accessed via URL key and allow empty saves.
+- **Legacy migration reconciliation** — Fixed migration reconciliation for existing installations.
+- **`archivedAt` type coercion** — String-to-Date conversion before Drizzle update prevents type errors.
+- **Agent HOME env var** — `AGENT_HOME` is now set correctly for child agent processes. ([#864](https://github.com/EvanGribar/corporate/pull/864))
+- **Sidebar scrollbar hover track** — Fixed scrollbar track visibility on hover. ([#919](https://github.com/EvanGribar/corporate/pull/919))
+- **Sticky save bar on non-config tabs** — Hidden to prevent layout push.
+- **Empty goals display** — Removed "None" text from empty goals.
+- **Runs page padding** — Removed unnecessary right padding.
+- **Codex bootstrap logs** — Treated as stdout instead of stderr.
+- **Dev runner syntax** — Fixed syntax issue in plugin dev runner. ([#914](https://github.com/EvanGribar/corporate/pull/914), @gsxdsm)
+- **Process list** — Fixed process list rendering. ([#903](https://github.com/EvanGribar/corporate/pull/903), @gsxdsm)
+
+## Upgrade Guide
+
+Ten new database migrations (`0028`–`0037`) will run automatically on startup:
+
+- **Migrations 0028–0029** add plugin framework tables.
+- **Migrations 0030–0037** extend the schema for issue documents, execution workspaces, company logos, cost tracking, and plugin enhancements.
+
+All migrations are additive (new tables and columns) — no existing data is modified. Standard `corporateai` startup will apply them automatically.
+
+If you use the `.env` file, note that the server now falls back to loading `.env` from the current working directory when `.paperclip/.env` is not found.
+
+## Contributors
+
+Thank you to everyone who contributed to this release!
+
+@gsxdsm, @JonCSykes, @leeknowsai, @mvanhorn, @residentagent, @saishankar404, @teknium1, @vkartaviy, @wesseljt
+

package/releases/v2026.325.0.md

@@ -0,0 +1,78 @@
+# v2026.325.0
+
+> Released: 2026-03-25
+
+## Highlights
+
+- **Company import/export** — Full company portability with a file-browser UX for importing and exporting agent companies. Includes rich frontmatter preview, nested file picker, merge-history support, GitHub shorthand refs, and CLI `company import`/`company export` commands. Imported companies open automatically after import, and heartbeat timers are disabled for imported agents by default. ([#840](https://github.com/EvanGribar/corporate/pull/840), [#1631](https://github.com/EvanGribar/corporate/pull/1631), [#1632](https://github.com/EvanGribar/corporate/pull/1632), [#1655](https://github.com/EvanGribar/corporate/pull/1655))
+- **Company skills library** — New company-scoped skills system with a skills UI, agent skill sync across all local adapters (Claude, Codex, Pi, Gemini), pinned GitHub skills with update checks, and built-in skill support. ([#1346](https://github.com/EvanGribar/corporate/pull/1346))
+- **Routines and recurring tasks** — Full routines engine with triggers, routine runs, coalescing, and recurring task portability. Includes API documentation and routine export support. ([#1351](https://github.com/EvanGribar/corporate/pull/1351), [#1622](https://github.com/EvanGribar/corporate/pull/1622), @aronprins)
+
+## Improvements
+
+- **Inline join requests in inbox** — Join requests now render inline in the inbox alongside approvals and other work items.
+- **Onboarding seeding** — New projects and issues are seeded with goal context during onboarding for a better first-run experience.
+- **Agent instructions recovery** — Managed agent instructions are recovered from disk on startup; instructions are preserved across adapter switches.
+- **Heartbeats settings page** — Shows all agents regardless of interval config; added a "Disable All" button for quick bulk control.
+- **Agent history via participation** — Agent issue history now uses participation records instead of direct assignment lookups.
+- **Alphabetical agent sorting** — Agents are sorted alphabetically by name across all views.
+- **Company org chart assets** — Improved generated org chart visuals for companies.
+- **Improved CLI API connection errors** — Better error messages when the CLI cannot reach the Paperclip API.
+- **Markdown mention links** — Custom URL schemes are now allowed in Lexical LinkNode, enabling mention pills with proper linking behavior. Atomic deletion of mention pills works correctly.
+- **Issue workspace reuse** — Workspaces are correctly reused after isolation runs.
+- **Failed-run session resume** — Explicit failed-run sessions can now be resumed via honor flag.
+- **Docker image CI** — Added Docker image build and deploy workflow. ([#542](https://github.com/EvanGribar/corporate/pull/542), @albttx)
+- **Project filter on issues** — Issues list can now be filtered by project. ([#552](https://github.com/EvanGribar/corporate/pull/552), @mvanhorn)
+- **Inline comment image attachments** — Uploaded images are now embedded inline in comments. ([#551](https://github.com/EvanGribar/corporate/pull/551), @mvanhorn)
+- **AGENTS.md fallback** — Claude-local adapter gracefully falls back when AGENTS.md is missing. ([#550](https://github.com/EvanGribar/corporate/pull/550), @mvanhorn)
+- **Company-creator skill** — New skill for scaffolding agent company packages from scratch.
+- **Reports page rename** — Reports section renamed for clarity. ([#1380](https://github.com/EvanGribar/corporate/pull/1380), @DanielSousa)
+- **Eval framework bootstrap** — Promptfoo-based evaluation framework with YAML test cases for systematic agent behavior testing. ([#832](https://github.com/EvanGribar/corporate/pull/832), @mvanhorn)
+- **Board CLI authentication** — Browser-based auth flow for the CLI so board users can authenticate without manually copying API keys. ([#1635](https://github.com/EvanGribar/corporate/pull/1635))
+
+## Fixes
+
+- **Embedded Postgres initdb in Docker slim** — Fixed initdb failure in slim containers by adding proper initdbFlags types. ([#737](https://github.com/EvanGribar/corporate/pull/737), @alaa-alghazouli)
+- **OpenClaw gateway crash** — Fixed unhandled rejection when challengePromise fails. ([#743](https://github.com/EvanGribar/corporate/pull/743), @Sigmabrogz)
+- **Agent mention pill alignment** — Fixed vertical misalignment between agent mention pills and project mention pills.
+- **Task assignment grants** — Preserved task assignment grants for agents that have already joined.
+- **Instructions tab state** — Fixed tab state not updating correctly when switching between agents.
+- **Imported agent bundle frontmatter** — Fixed frontmatter leakage in imported agent bundles.
+- **Login form 1Password detection** — Fixed login form not being detected by password managers; Enter key now submits correctly. ([#1014](https://github.com/EvanGribar/corporate/pull/1014))
+- **Pill contrast (WCAG)** — Improved mention pill contrast using WCAG contrast ratios on composited backgrounds.
+- **Documents horizontal scroll** — Prevented documents row from causing horizontal scroll on mobile.
+- **Toggle switch sizing** — Fixed oversized toggle switches on mobile; added missing `data-slot` attributes.
+- **Agent instructions tab responsive** — Made agent instructions tab responsive on mobile.
+- **Monospace font sizing** — Adjusted inline code font size and added dark mode background.
+- **Priority icon removal** — Removed priority icon from issue rows for a cleaner list view.
+- **Same-page issue toasts** — Suppressed redundant toasts when navigating to an issue already on screen.
+- **Noisy adapter log** — Removed noisy "Loaded agent instructions file" log message from all adapters.
+- **Pi local adapter** — Fixed Pi adapter missing from `isLocal` check. ([#1382](https://github.com/EvanGribar/corporate/pull/1382), @lucas-stellet)
+- **CLI auth migration idempotency** — Made migration 0044 idempotent to avoid failures on re-run.
+- **Dev restart tracking** — `.paperclip` and test-only paths are now ignored in dev restart detection.
+- **Duplicate CLI auth flag** — Fixed duplicate `--company` flag on `auth login`.
+- **Gemini local execution** — Fixed Gemini local adapter execution and diagnostics.
+- **Sidebar ordering** — Preserved sidebar ordering during company portability operations.
+- **Company skill deduplication** — Fixed duplicate skill inventory refreshes.
+- **Worktree merge-history migrations** — Fixed migration handling in worktree contexts. ([#1385](https://github.com/EvanGribar/corporate/pull/1385))
+
+## Upgrade Guide
+
+Seven new database migrations (`0038`–`0044`) will run automatically on startup:
+
+- **Migration 0038** adds process tracking columns to heartbeat runs (PID, started-at, retry tracking).
+- **Migration 0039** adds the routines engine tables (routines, triggers, routine runs).
+- **Migrations 0040–0042** extend company skills, recurring tasks, and portability metadata.
+- **Migration 0043** adds the Codex managed-home and agent instructions recovery columns.
+- **Migration 0044** adds board API keys and CLI auth challenge tables for browser-based CLI auth.
+
+All migrations are additive (new tables and columns) — no existing data is modified. Standard `corporateai` startup will apply them automatically.
+
+If you use the company import/export feature, note that imported companies have heartbeat timers disabled by default. Re-enable them manually from the Heartbeats settings page after verifying adapter configuration.
+
+## Contributors
+
+Thank you to everyone who contributed to this release!
+
+@alaa-alghazouli, @albttx, @AOrobator, @aronprins, @cryppadotta, @DanielSousa, @lucas-stellet, @mvanhorn, @richardanaya, @Sigmabrogz
+

package/report/2026-03-13-08-46-token-optimization-implementation.md

@@ -0,0 +1,48 @@
+# Token Optimization Implementation Report
+
+Implemented the token-optimization plan across heartbeat orchestration, issue context APIs, adapter prompt construction, skill exposure, and agent configuration UX.
+
+The main behavior changes are:
+
+- Heartbeat telemetry now normalizes sessioned local adapter usage as per-run deltas instead of blindly trusting cumulative session totals.
+- Timer and manual wakes now preserve task sessions by default; fresh sessions are forced only for explicit `forceFreshSession` wakes or new issue assignment wakes.
+- Heartbeat session rotation is now policy-driven in the control plane, with a handoff note injected when a session is compacted and restarted.
+- Paperclip issue context now has incremental APIs: `GET /api/agents/me/inbox-lite`, `GET /api/issues/:id/heartbeat-context`, and comment delta queries via `GET /api/issues/:id/comments?after=...&order=asc`.
+- The `paperclip` skill now teaches agents to use those compact/incremental APIs first, while keeping full-thread fetches as a cold-start fallback.
+- All local adapters now separate first-session bootstrap prompts from per-heartbeat prompt templates, and emit prompt size metrics in invocation metadata.
+- Adapter create flows now persist `bootstrapPromptTemplate` correctly.
+- The agent config UI now explains the difference between bootstrap prompts and heartbeat prompts and warns about prompt churn.
+- Runtime skill defaults now include `paperclip`, `para-memory-files`, and `paperclip-create-agent`. `create-agent-adapter` was moved to `.agents/skills/create-agent-adapter`.
+
+Important follow-up finding from real-run review:
+
+- `codex_local` currently injects Paperclip skills into the shared Codex skills home (`$CODEX_HOME/skills` or `~/.codex/skills`) rather than mounting a worktree-local skill directory.
+- If a Paperclip-owned skill symlink already points at another live checkout, the adapter currently skips it instead of repointing it.
+- In practice, this means a worktree can contain newer `skills/paperclip/SKILL.md` guidance while Codex still follows an older checkout's skill content.
+- That likely explains why PAP-507 still showed full issue/comment reload behavior even though the incremental context work was already implemented in this branch.
+- This should be treated as a separate follow-up item for `codex_local` skill isolation or symlink repair.
+
+Files with the most important implementation work:
+
+- `server/src/services/heartbeat.ts`
+- `server/src/services/issues.ts`
+- `server/src/routes/issues.ts`
+- `server/src/routes/agents.ts`
+- `server/src/routes/access.ts`
+- `skills/paperclip/SKILL.md`
+- `packages/adapters/*/src/server/execute.ts`
+- `packages/adapters/*/src/ui/build-config.ts`
+- `ui/src/components/AgentConfigForm.tsx`
+
+Verification completed successfully:
+
+- `pnpm -r typecheck`
+- `pnpm test:run`
+- `pnpm build`
+
+While verifying, I also fixed two existing embedded-postgres typing mismatches so repo-wide `typecheck` and `build` pass again:
+
+- `packages/db/src/migration-runtime.ts`
+- `cli/src/commands/worktree.ts`
+
+Next useful follow-up is measuring the before/after effect in real runs now that telemetry is less misleading and prompt/session reuse behavior is consistent across adapters.

package/scripts/backup-db.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Backup the configured Paperclip database to the configured backup directory
+# (default: ~/.paperclip/instances/<instance-id>/data/backups)
+#
+# Usage:
+#   ./scripts/backup-db.sh
+#   pnpm db:backup
+#
+# The embedded postgres must be running (start with: pnpm dev)
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+cd "$PROJECT_ROOT"
+exec pnpm corporateai db:backup "$@"

package/scripts/build-npm.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# build-npm.sh — Build the corporateai CLI package for npm publishing.
+#
+# Uses esbuild to bundle all workspace code into a single file,
+# keeping external npm dependencies as regular package dependencies.
+#
+# Usage:
+#   ./scripts/build-npm.sh               # full build
+#   ./scripts/build-npm.sh --skip-checks  # skip forbidden-token check (CI without token list)
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CLI_DIR="$REPO_ROOT/cli"
+DIST_DIR="$CLI_DIR/dist"
+
+skip_checks=false
+skip_typecheck=false
+for arg in "$@"; do
+  case "$arg" in
+    --skip-checks) skip_checks=true ;;
+    --skip-typecheck) skip_typecheck=true ;;
+  esac
+done
+
+echo "==> Building corporateai for npm"
+
+# ── Step 1: Forbidden token check ──────────────────────────────────────────────
+if [ "$skip_checks" = false ]; then
+  echo "  [1/5] Running forbidden token check..."
+  node "$REPO_ROOT/scripts/check-forbidden-tokens.mjs"
+else
+  echo "  [1/5] Skipping forbidden token check (--skip-checks)"
+fi
+
+# ── Step 2: TypeScript type-check ──────────────────────────────────────────────
+if [ "$skip_typecheck" = false ]; then
+  echo "  [2/6] Type-checking..."
+  cd "$REPO_ROOT"
+  pnpm -r typecheck
+else
+  echo "  [2/6] Skipping type-check (--skip-typecheck)"
+fi
+
+# ── Step 3: Bundle CLI with esbuild ────────────────────────────────────────────
+echo "  [3/6] Bundling CLI with esbuild..."
+cd "$CLI_DIR"
+rm -rf dist
+
+node --input-type=module -e "
+import esbuild from 'esbuild';
+import config from './esbuild.config.mjs';
+await esbuild.build(config);
+"
+
+chmod +x dist/index.js
+
+# ── Step 4: Validate bundled entrypoint syntax ─────────────────────────────────
+echo "  [4/6] Verifying bundled entrypoint syntax..."
+node --check "$DIST_DIR/index.js"
+
+# ── Step 5: Back up dev package.json, generate publishable one ─────────────────
+echo "  [5/6] Generating publishable package.json..."
+cp "$CLI_DIR/package.json" "$CLI_DIR/package.dev.json"
+node "$REPO_ROOT/scripts/generate-npm-package-json.mjs"
+
+# Copy root README so npm shows the repo README on the package page
+cp "$REPO_ROOT/README.md" "$CLI_DIR/README.md"
+
+# ── Step 6: Summary ───────────────────────────────────────────────────────────
+BUNDLE_SIZE=$(wc -c < "$DIST_DIR/index.js" | xargs)
+echo "  [6/6] Build verification..."
+echo ""
+echo "Build complete."
+echo "  Bundle: cli/dist/index.js (${BUNDLE_SIZE} bytes)"
+echo "  Source map: cli/dist/index.js.map"
+echo ""
+echo "To preview:   cd cli && npm pack --dry-run"
+echo "To publish:   cd cli && npm publish --access public"
+echo "To restore:   mv cli/package.dev.json cli/package.json"