nickyleachandPaperclip 888e64cd73 fix(server): contain retired skill releases and reject bearer headers in skill content ...

Mark the two frozen skill-release snapshots retired in the release
manifest, and enforce that flag at every point that can hand one to an
agent: reject a new pin on a retired release, fail closed instead of
materializing a retired snapshot at runtime, migrate existing agent
pins off retired releases, and disable a retired release in the agent
selector while keeping it visible for history.

Add a server-side content guard that rejects any company-skill file
carrying a bearer Authorization header, applied to both the single-file
write path and a new restore endpoint that validates a version's whole
file set before writing any of it back.

Co-authored-by: Paperclip <noreply@paperclip.ing>

2026-09-16 11:43:54 +00:00

..

scripts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00

src

fix(server): contain retired skill releases and reject bearer headers in skill content

2026-09-16 11:43:54 +00:00

CHANGELOG.md

fix: bound workspace Git scans (#11572)

2026-08-17 22:11:30 -05:00

package.json

fix: preserve runner recovery, warm sessions, and task outcomes (#13338)

2026-09-12 19:41:15 -05:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

fix(server): bundle the vendored paperclip-runner instead of hand-mirroring its deps (#13121)

2026-09-09 16:38:17 -07:00