Plugin stuck on "Loading live data…" — bundled @paperclipai/plugin-sdk@2026.318.0 incompatible with newer hosts (INVOCATION_SCOPE_DENIED)

[qveys]

Plugin stuck on "Loading live data…" — bundled @paperclipai/plugin-sdk@2026.318.0 is incompatible with newer hosts (INVOCATION_SCOPE_DENIED on state.get)

Summary

After installing @agent-analytics/paperclip-live-analytics-plugin@0.1.11 on a current Paperclip host, every plugin surface (page, dashboard widget, sidebar) is permanently stuck on "Loading live data…". It never shows data and never shows an error in the UI.

The host rejects every data request from the plugin worker with a 502 / INVOCATION_SCOPE_DENIED.

Environment

• Plugin: @agent-analytics/paperclip-live-analytics-plugin@0.1.11 (latest on npm)
• Bundled SDK (pinned in the plugin's dependencies): @paperclipai/plugin-sdk@2026.318.0
• Paperclip host: paperclipai / @paperclipai/server / @paperclipai/plugin-sdk all at 2026.609.0
• Self-hosted (Docker)

Symptom

UI shows the loading && !content fallback forever (dist/ui/index.js, PageInner → "Loading live data…"), because the host never returns a payload for live.page.load / live.widget.load / settings.load.

Host logs, one per data request:

ERROR: POST /plugins/<id>/data/live.page.load 502 —
Plugin "<id>" is not allowed to perform "state.get":
the worker referenced a missing, expired, or unknown invocation scope
{ bridgeMethod: "getData", dataKey: "live.page.load", bridgeCode: "INVOCATION_SCOPE_DENIED" }

ERROR: host handler error { service: "plugin-worker", method: "state.get" }

The plugin worker activates fine (plugin-loader: plugin activated successfully, worker: true); the failure is purely on the host↔worker bridge calls.

Root cause

The plugin ships its own nested copy of @paperclipai/plugin-sdk@2026.318.0 under
node_modules/@agent-analytics/paperclip-live-analytics-plugin/node_modules/@paperclipai/plugin-sdk.

The worker does import { definePlugin, runWorker } from "@paperclipai/plugin-sdk", and Node resolves that bare specifier to the nested 318 copy, not the host-hoisted 609 SDK.

Between 2026.318 and 2026.609 the host introduced a company-scoped invocation scope mechanism for bridge calls (protocol.js gains scope handling, host-client-factory.js exports a new InvocationScopeDeniedError). The 2026.318 worker SDK never attaches that scope token to state.get, so a 2026.609 host denies every state read → the plugin can never load its own config/live state.

Reproduction

1. Install the plugin on a Paperclip host running @paperclipai/server@2026.609.0 (or any host that enforces invocation scopes).
2. Open the plugin page for a company.
3. Page stays on "Loading live data…"; host logs show INVOCATION_SCOPE_DENIED on state.get.

Workaround (confirmed)

Force the worker to resolve the host-hoisted SDK by neutralising the nested copies, then restart the host so the worker respawns:

PLUGIN=node_modules/@agent-analytics/paperclip-live-analytics-plugin/node_modules/@paperclipai
mv "$PLUGIN/plugin-sdk" "$PLUGIN/plugin-sdk.bak"
mv "$PLUGIN/shared"     "$PLUGIN/shared.bak"
# restart the paperclip host/container so the plugin worker is respawned

After this, INVOCATION_SCOPE_DENIED disappears and the worker activates against the 609 SDK. (The override is lost on any reinstall/update of the plugin.)

Suggested fix

• Republish the plugin built against a current @paperclipai/plugin-sdk (≥ the host's invocation-scope release), and/or
• Treat @paperclipai/plugin-sdk as a peer dependency (or otherwise avoid bundling/nesting a pinned copy) so it resolves to the host's SDK rather than a stale pinned version.

Happy to provide full logs or test a pre-release build.