Paperclip
Paperclip isolates Codex accounts at the gateway boundary
Paperclip proposes isolated multi-account Codex authentication, resolves per-user connection grants at gateway execution and adds device-login building blocks without leaking callback secrets. The three records move identity selection from ambient host state into an explicit execution-time decision.
paperclipai/paperclip PR #11195 is the inspected primary source: “feat(codex): add isolated multi-account authentication.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- paperclipai/paperclip PR #11195 was created 2026-08-10T23:16:08Z and was open at inspection; its title is “feat(codex): add isolated multi-account authentication.” - paperclipai/paperclip PR #11144 was created 2026-08-10T02:40:53Z and was open at inspection; its title is “feat(connections): resolve per-user connection grants at gateway execution.” - paperclipai/paperclip PR #11097 was created 2026-08-08T15:55:26Z and was closed at inspection; its title is “feat(adapter-codex-local): add secure device-login building blocks.” - The repository reported 76488 stars, 5083 open issues, default branch master, and last push 2026-08-11T00:51:42Z. - The latest tagged-release baseline checked was v2026.722.0 published 2026-07-22T23:05:41Z.
What changed
paperclipai/paperclip PR #11195 reports: Thinking Path - Paperclip is the open source app people use to manage AI agents for work - [Which subsystem or capability is involved] - [What problem or gap exists] - [Why it needs to be addressed] - This pull request... - The benefit is... Linked Issues or Issue Description What Changed Verification Risks For core feature work, check ROADMAP.md first and discuss it in #dev before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See CONTRIBUTING.md. Model Used Checklist [ ] I have included a thinking path that traces from project context to this change [ ] I have specified the model used (with version and capability details) [ ] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work [ ] I have searched GitHub for duplicate or related PRs and linked them above [ ] I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b)
paperclipai/paperclip PR #11144 reports: Thinking Path - Paperclip is the open source app people use to manage AI agents for work - Agents connect to third-party tools (Gmail, Calendar, Slack, etc.) through the tool gateway's connection/grant model - Some of those tools (Gmail, Calendar, a user-scoped Slack grant) have no legitimate non-personal identity -- there is no "workspace Gmail account" the way there's a Slack bot token or a GitHub App - The v3 connections schema (#9958) already added connection_grants with user subjects, self-only start-authorization, a fail-closed mintConnectionTokenForAgent, and the "Connect your account" interaction card, explicitly naming "per-user authorization, token brokering" as a later phase -- but none of it was wired into the path agents actually call to execute a tool - Without this, a personal_only connection would silently fall back to the connection's own shared credential (or a workspace-kind grant), defeating the entire point of per-user auth - This pull request wires per-user grant resolution into the gateway's remote-HTTP execution path: it resolves the run's responsibleUserId, uses that person's own connection_grants row, refreshes an expired token via
paperclipai/paperclip PR #11097 reports: Thinking Path - Paperclip connects AI agents to local and remote runtimes. - The Codex local adapter needs a safe device-login flow. - A future sandbox integration needs strict prompt validation, secret protection, cleanup, and private credential storage. - This pull request adds tested building blocks for that flow. - The result gives a later Daytona integration a clear security boundary. Linked Issues or Issue Description No public issue covers this change. Problem or motivation** The Codex local adapter has no safe, reusable flow to prove device login inside an isolated sandbox. Proposed solution** Add parser, runner, credential export, and proof helpers. Validate the prompt, protect login data, store credentials in a private run-scoped home, and dispose all sandbox resources. Alternatives considered** Do not connect a production Daytona driver in this change. Use an injected sandbox driver and focused tests first. This keeps the security controls testable before live provider integration. Roadmap alignment** The change extends the Codex local adapter. It does not add a core Paperclip route or duplicate a planned core feature. Additional
Why it matters
Multi-user agent systems cannot safely share a single implicit CLI login. Account choice, connection grant and device flow need one auditable owner at the moment work crosses the gateway. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-11. The tagged-release baseline was v2026.722.0 published 2026-07-22T23:05:41Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/paperclipai/paperclip/pull/11195. Supporting records are https://github.com/paperclipai/paperclip/pull/11144 and https://github.com/paperclipai/paperclip/pull/11097. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Bind credentials to user and execution identity, keep device codes out of durable logs, and reject fallback to another account when the selected grant is absent. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.