Paperclip adds a plugin-owned organization menu while keeping host authorization

Paperclip merged an extension point on September 22 that lets a plugin replace its organization switcher without editing the host sidebar. The new organizationSwitcher slot is a React-only interface requiring the existing ui.sidebar.register capability. It receives display state, an icon renderer and host-owned navigation and logout callbacks. It does not introduce an account system or change company authorization.

The contribution gives distributions a supported place to customize organization navigation while retaining the built-in menu as a fallback. Absent, ambiguous, missing, failed or unsupported contributions do not leave the sidebar dependent on a broken replacement. Selection is resolved against the current account query before mounting, and replacement state resets when the account or company changes. Both sidebar menu variants use the optional surface.

That is a product-platform decision as much as a UI change. Paperclip is keeping distribution-specific presentation in plugins while retaining a small host contract for session cleanup and navigation. The source is explicit that plugin UI remains trusted same-origin code. Passing a list of organizations to a component does not give that component authorization to make account requests on the user's behalf.

The facts

- PR #13832 merged into master on September 22 at 23:39 UTC. - The optional organizationSwitcher slot requires the ui.sidebar.register capability and a React contribution. - The host supplies navigation and logout callbacks while preserving its built-in menu fallback. - Replacement state resets on account or company changes, and selection uses the current account query. - The author reports 26 targeted tests and 6,580 UI tests, plus isolated browser checks with fixture-backed remote accounts. - The change requires no database migration and does not change company authorization.

Why it matters

A customizable control plane can become fragile if every distribution must fork its core navigation. A narrow extension point reduces that pressure, but only if failure recovery and session ownership stay explicit. The contribution separates which menu the user sees from which account operations the server will authorize, rather than presenting custom UI as a security boundary.

Current

Checked September 23, 2026. The inspected release baseline is v2026.916.1. The primary source is merged 2026-09-22T23:39:12Z. Tagged release availability and development-source state are separate: a release baseline does not establish that a proposed setting or newly merged feature is in an installed package.

Evidence

Primary: paperclipai/paperclip PR #13832 (https://github.com/paperclipai/paperclip/pull/13832). Context and implementation: paperclipai/paperclip — PLUGIN_AUTHORING_GUIDE.md (source) (https://github.com/paperclipai/paperclip/blob/1d4390697065af3656e7799db971363768b78f7c/doc/plugins/PLUGIN_AUTHORING_GUIDE.md); paperclipai/paperclip — PluginOrganizationSwitcher.tsx (source) (https://github.com/paperclipai/paperclip/blob/1d4390697065af3656e7799db971363768b78f7c/ui/src/components/PluginOrganizationSwitcher.tsx). The linked source text was inspected; reported experiments and test results remain attributed to their authors.

Operator take

A distribution adopting the slot should exercise missing and duplicate contributions, expired sessions, keyboard dismissal and account changes while a replacement is mounted. Verify that the fallback really remains available when discovery or rendering fails. Treat the plugin as trusted code, not a sandboxed tenant, and preserve host-owned logout. The most valuable integration test is not a screenshot of the happy path but a recoverable menu after its optional provider stops working.

Caveat

Merged source is confirmed, not inclusion in an installed release. Remote account responses in browser checks were fixtures. The author reports local full-suite environment failures separately from green Linux CI, and does not claim the earlier supervisor-startup failure's root cause was established.