Rebase onto upstream/master (2026-06-24) (#191)

Incorporated 19 upstream commits (cd38c15..ef37203):
- External object references across issue surfaces (paperclipai#8512)
- fix: upstream deployed document-comment, routine-annotation, workspace & board-polling fixes (paperclipai#8536)
- feat(control-plane): add annotation and workspace controls (paperclipai#8229)
- build(deps): bump hermes-paperclip-adapter from 0.2.0 to 0.3.0 (paperclipai#8463)
- build(deps): bump lucide-react from 0.574.0 to 0.577.0 (paperclipai#8467)
- build(deps): bump @agentclientprotocol/claude-agent-acp from 0.47.0 to 0.48.0 (paperclipai#8469)
- build(deps): bump actions/checkout from 6 to 7 (paperclipai#8461)
- build(deps): bump @codemirror/view from 6.39.15 to 6.43.1 (paperclipai#8468)
- build(deps): bump @cursor/sdk from 1.0.18 to 1.0.19 (paperclipai#8462)
- build(deps): bump tailwind-merge from 3.4.1 to 3.6.0 (paperclipai#8465)
- build(deps-dev): bump esbuild from 0.28.0 to 0.28.1 (paperclipai#8470)
- build(deps): bump better-auth from 1.4.18 to 1.6.20 (paperclipai#8464)
- build(deps): align react-dom with react@19.2.7 (paperclipai#8557)
- fix(deps): regenerate lockfile so react/react-dom resolve to 19.2.7 (paperclipai#8559)
- build(deps-dev): bump @storybook/addon-docs from 10.3.5 to 10.4.6 (paperclipai#8466)
- Fix Daytona resource overrides for image-backed sandboxes (paperclipai#8564)
- fix: default Daytona sandboxes to auto-archive so they leave the disk quota (paperclipai#8561)
- fix(openclaw-gateway): drop root paperclip params (paperclipai#4416)
- perf(ci): build standalone public packages concurrently (paperclipai#8567)

No merge conflicts.

Author: stubbi

.github/workflows/agent-runtime-images.yml

@@ -29,7 +29,7 @@ jobs:
   build-and-sign:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU (multi-arch builds)
         uses: docker/setup-qemu-action@v3

.github/workflows/commitperclip-review.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout base branch (never PR code)
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
 

.github/workflows/docker.yml

@@ -24,7 +24,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v4

.github/workflows/e2e.yml

@@ -16,7 +16,7 @@ jobs:
       PAPERCLIP_E2E_SKIP_LLM: ${{ inputs.skip_llm && 'true' || 'false' }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: pnpm/action-setup@v6
         with:

.github/workflows/pr.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -59,6 +59,9 @@ jobs:
       - name: Test general-server shard partition
         run: node --test ./scripts/__tests__/run-vitest-stable-shard.test.mjs
 
+      - name: Test standalone package build concurrency
+        run: node --test ./scripts/__tests__/build-standalone-concurrency.test.mjs
+
       - name: Validate release package manifest
         run: node ./scripts/release-package-map.mjs check
 
@@ -101,7 +104,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -161,7 +164,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -220,7 +223,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -270,7 +273,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -304,7 +307,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
@@ -358,7 +361,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6

.github/workflows/refresh-lockfile.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6

.github/workflows/release-smoke.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v6

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -77,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -129,7 +129,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.source_ref }}
@@ -170,7 +170,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.source_ref }}
@@ -214,7 +214,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
           ref: ${{ inputs.source_ref }}

cli/src/__tests__/worktree.test.ts

@@ -874,7 +874,7 @@ describe("worktree helpers", () => {
     }
   });
 
-  it("reseed preserves the current worktree ports, instance id, and branding", async () => {
+  itEmbeddedPostgres("reseed preserves the current worktree ports, instance id, and branding", async () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-reseed-"));
     const repoRoot = path.join(tempRoot, "repo");
     const sourceRoot = path.join(tempRoot, "source");

doc/plans/2026-04-24-external-object-reference-backfill.md

@@ -0,0 +1,28 @@
+# External Object Reference Backfill
+
+## Purpose
+
+Backfill existing issue titles, descriptions, comments, and documents into `external_object_mentions` after the Phase 3 detector registry and mention sync service exist.
+
+## Command Shape
+
+Add a command parallel to the internal issue-reference backfill:
+
+```sh
+pnpm external-objects:backfill
+pnpm external-objects:backfill -- --company <company-id>
+pnpm external-objects:backfill -- --dry-run
+```
+
+## Required Behavior
+
+- Scan issue title and description sources, issue comments, and issue documents through the same external-object mention sync service used by write hooks.
+- Preserve company boundaries: every scan query, mention upsert, object upsert, and dry-run summary must include `company_id`.
+- Use shared URL extraction and canonicalization helpers so raw URLs, URL userinfo, query strings, and fragments are never persisted.
+- Replace mentions per source instead of appending, using the same source key shape as live write sync.
+- Report counts by company, source kind, provider key, object type, skipped userinfo URLs, and unresolved URLs.
+- Default to a non-interactive safe run; `--dry-run` must avoid writes while still reporting what would change.
+
+## Phase 3 Hook
+
+The command should be implemented only after the detector registry can classify URLs and the service can upsert mentions/placeholders consistently. Until then, Phase 2 owns the schema and shared helpers that make the command safe.