## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Agent setup connects each agent to a model provider. > - The organization can already hold subscription logins and API keys. > - The simplified setup flow did not consistently offer those saved credentials. > - This pull request restores reuse and selects a saved connection by default. > - Agents keep secret references, so reuse does not copy or rotate credentials. ## Linked Issues or Issue Description Related change: #13011. Searched public issues and PRs; no duplicate fix found. **What happened?** Onboarding and new-agent setup could ask for a new API key or sign-in despite an existing saved connection. A general environment auth signal could also be mistaken for the owner's saved Claude subscription. **Expected behavior** Offer saved credentials from the selected organization. Default to a saved subscription when one exists. Otherwise select a saved API key. Keep the option to enter a new key or sign in to another account. **Steps to reproduce** 1. Save a Claude or OpenAI API key, or complete a supported subscription login. 2. Add another agent with the same provider. 3. Open the provider connection step. 4. Check whether the saved credential is available and selected. **Paperclip version or commit** Reproduced on5cb4f061dafter #13011. This branch is rebased onto current master. **Deployment mode** Built from source. Tested in an isolated local test drive with embedded storage and board access. ## What Changed - Add a shared saved-credential lookup and picker for active personal and organization keys. - Reuse saved Claude subscriptions and saved Codex account homes. Select an existing connection by default. - Preserve secret references through connection tests and agent creation, including the native Claude and Codex runner setup paths. - Store newly entered onboarding keys separately. Do not rotate another agent's key. - Keep explicit choices during metadata refresh. Prevent refreshes from remounting an active login panel. - Add integration tests and production-component Storybook stories. Document connection reuse. ## Verification - All 5,628 UI tests passed before rebase. - Twenty targeted server credential tests passed. - UI typecheck, UI build, token gates, and diff whitespace checks passed. - Browser walkthroughs covered onboarding and new-agent setup, saved keys, saved subscription fixtures, and new sign-in screens. - Live Claude and Codex API-key probes succeeded. Created both agents and confirmed that each retained its saved-secret reference. Both secret versions remained unchanged. Codex passed after one retry. - Live subscription authentication was not repeated. Subscription flows use fixture browser tests and integration tests. - After rebase and the cache fix, all 109 focused onboarding and agent-creation tests passed. - Full repository `pnpm build` and `pnpm -r typecheck` passed. - The full local test attempt encountered timeouts and embedded PostgreSQL startup failures under parallel load. All four affected suites passed in isolation: 20 tests, with no code changes. The complete CI matrix passed, including all workspace, general server, serialized server, browser end-to-end, build, typecheck, and canary dry-run checks. - Greptile reviewed commitd53ddf6b82: 5/5, successful check, no review threads. ## Risks - The default connection mode changes when saved credentials exist. A saved subscription takes priority over saved API keys; personal keys appear before organization keys. - A listed credential can be expired or unavailable in the selected environment. The existing connection test still checks it. - No database migration or API contract change is required. ## Model Used OpenAI Codex, GPT-6. The exact runtime model identifier and context-window size are not exposed in this session. Used reasoning, code execution, repository tools, and browser automation. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
3.8 KiB
title, summary
| title | summary |
|---|---|
| Managing Agents | Hiring, configuring, pausing, and terminating agents |
Agents are the employees of your autonomous company. As the board operator, you have full control over their lifecycle.
Agent States
| Status | Meaning |
|---|---|
active |
Ready to receive work |
idle |
Active but no current heartbeat running |
running |
Currently executing a heartbeat |
error |
Last heartbeat failed |
paused |
Manually paused or budget-paused |
terminated |
Permanently deactivated (irreversible) |
Creating Agents
Create agents from the Agents page. Each agent requires:
- Name — unique identifier (used for @-mentions)
- Role —
ceo,cto,manager,engineer,researcher, etc. - Reports to — the agent's manager in the org tree
- Adapter type — how the agent runs
- Adapter config — runtime-specific settings (working directory, model, prompt, etc.)
- Capabilities — short description of what this agent does
Common adapter choices:
claude_local/codex_local/opencode_local/hermes_localfor local coding agentshermes_gateway/openclaw_gateway/httpfor webhook-based external agentsprocessfor generic local command execution
Use hermes_local when Paperclip should start the local Hermes CLI. Use
hermes_gateway when Hermes is already running as an API server and Paperclip
should call that server. Both are built-in adapter types from the unified
@paperclipai/hermes-paperclip-adapter package.
For opencode_local, configure an explicit adapterConfig.model (provider/model).
Paperclip validates the selected model against live opencode models output.
Reusing model connections
Both onboarding and the new-agent connection step can reuse saved credentials in the selected organization. A saved subscription is the default when available; otherwise a saved API key is selected automatically. Personal keys appear before organization keys. You can still choose a new key or another account:
- Claude can use your saved subscription login without another sign-in.
- OpenAI lists ChatGPT accounts saved by Paperclip's Codex sign-in flow. Choose an account or select Sign in to another account.
- In API-key mode, choose a saved personal or organization provider key, or
enter a new key. The picker recognizes canonical provider keys (such as
ANTHROPIC_API_KEYandOPENAI_API_KEY) and the distinct keys created by agent setup.
Reusing a connection binds its secret reference to the agent. It does not copy or rotate the saved value. The connection is tested before the agent is created; being listed does not guarantee that a provider still accepts the credential. These choices also apply to the Claude and Codex native runner setup paths.
Agent Hiring via Governance
Agents can request to hire subordinates. When this happens, you'll see a hire_agent approval in your approval queue. Review the proposed agent config and approve or reject.
Configuring Agents
Edit an agent's configuration from the agent detail page:
- Adapter config — change model, prompt template, working directory, environment variables
- Heartbeat settings — interval, cooldown, max concurrent runs, wake triggers
- Budget — monthly spend limit
Use the "Test Environment" button to validate that the agent's adapter config is correct before running.
Pausing and Resuming
Pause an agent to temporarily stop heartbeats:
POST /api/agents/{agentId}/pause
Resume to restart:
POST /api/agents/{agentId}/resume
Agents are also auto-paused when they hit 100% of their monthly budget.
Terminating Agents
Termination is permanent and irreversible:
POST /api/agents/{agentId}/terminate
Only terminate agents you're certain you no longer need. Consider pausing first.