@papi-ai/server 0.7.104 → 0.7.106

package/dist/backfill-cycle-metrics.js

@@ -201,6 +201,7 @@ __export(git_exports, {
   ensureLatestDevelop: () => ensureLatestDevelop,
   ensureTagAtHead: () => ensureTagAtHead,
   fetchBaseBranch: () => fetchBaseBranch,
+  findCollidingWork: () => findCollidingWork,
   findContributorReleasePullRequests: () => findContributorReleasePullRequests,
   findTaskCommitsOnBase: () => findTaskCommitsOnBase,
   getBaseDivergence: () => getBaseDivergence,
@@ -1493,6 +1494,23 @@ function getRemoteBranchFiles(cwd, branch, baseBranch) {
     return [];
   }
 }
+function findCollidingWork(cwd, baseBranch, filesLikelyTouched) {
+  if (filesLikelyTouched.length === 0) return null;
+  const prs = listOpenPullRequests(cwd);
+  if (!prs || prs.length === 0) return null;
+  const wanted = new Set(filesLikelyTouched);
+  for (const pr of prs) {
+    const branchFiles = getRemoteBranchFiles(cwd, pr.headRefName, baseBranch);
+    const overlap = branchFiles.filter((f) => wanted.has(f));
+    if (overlap.length > 0) {
+      return {
+        label: `PR #${pr.number} "${pr.title}" (branch \`${pr.headRefName}\`, opened by ${pr.author})`,
+        files: overlap
+      };
+    }
+  }
+  return null;
+}
 var AUTO_WRITTEN_PATHS, GIT_NETWORK_TIMEOUT_MS, MERGE_RETRY_DELAY_MS, MERGE_MAX_RETRIES, GIT_FETCH_TIMEOUT_MS;
 var init_git = __esm({
   "src/lib/git.ts"() {
@@ -1684,7 +1702,6 @@ var init_proxy_adapter = __esm({
       "getBuildReportsSince",
       "getContextHashes",
       "getContextUtilisation",
-      "getCostSnapshots",
       "getCostSummary",
       "getCurrentNorthStar",
       "getCycleHealth",
@@ -1891,11 +1908,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config) {
         this.endpoint = config.endpoint.replace(/\/$/, "");
         this.apiKey = config.apiKey;
         this.projectId = config.projectId ?? "";
+        this.papiDir = config.papiDir ?? null;
         this.onAuthRejected = config.onAuthRejected;
       }
       /**
@@ -1971,6 +1990,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -2338,9 +2358,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       getCostSummary(cycleNumber) {
         return this.invoke("getCostSummary", [cycleNumber]);
       }
-      getCostSnapshots() {
-        return this.invoke("getCostSnapshots");
-      }
+      // task-3332: getCostSnapshots retired — see the removal note on CostSnapshot
+      // in packages/shared/src/entities.ts.
       appendCycleMetrics(snapshot) {
         return this.invoke("appendCycleMetrics", [snapshot]);
       }
@@ -2604,7 +2623,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -2691,7 +2710,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -2950,6 +2971,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -2981,12 +3003,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -3007,25 +3029,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -3044,11 +3047,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId }, projectId);
+      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter.setProjectPapiDir) {
+        await adapter.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter.getProjectInfo && adapter.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -3087,7 +3108,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter.probeConnection();
       if (!connected) {

package/dist/index.js

@@ -971,6 +971,7 @@ __export(git_exports, {
   ensureLatestDevelop: () => ensureLatestDevelop,
   ensureTagAtHead: () => ensureTagAtHead,
   fetchBaseBranch: () => fetchBaseBranch,
+  findCollidingWork: () => findCollidingWork,
   findContributorReleasePullRequests: () => findContributorReleasePullRequests,
   findTaskCommitsOnBase: () => findTaskCommitsOnBase,
   getBaseDivergence: () => getBaseDivergence,
@@ -2263,6 +2264,23 @@ function getRemoteBranchFiles(cwd, branch, baseBranch) {
     return [];
   }
 }
+function findCollidingWork(cwd, baseBranch, filesLikelyTouched) {
+  if (filesLikelyTouched.length === 0) return null;
+  const prs = listOpenPullRequests(cwd);
+  if (!prs || prs.length === 0) return null;
+  const wanted = new Set(filesLikelyTouched);
+  for (const pr of prs) {
+    const branchFiles = getRemoteBranchFiles(cwd, pr.headRefName, baseBranch);
+    const overlap = branchFiles.filter((f) => wanted.has(f));
+    if (overlap.length > 0) {
+      return {
+        label: `PR #${pr.number} "${pr.title}" (branch \`${pr.headRefName}\`, opened by ${pr.author})`,
+        files: overlap
+      };
+    }
+  }
+  return null;
+}
 var AUTO_WRITTEN_PATHS, GIT_NETWORK_TIMEOUT_MS, MERGE_RETRY_DELAY_MS, MERGE_MAX_RETRIES, GIT_FETCH_TIMEOUT_MS;
 var init_git = __esm({
   "src/lib/git.ts"() {
@@ -2520,7 +2538,6 @@ var init_proxy_adapter = __esm({
       "getBuildReportsSince",
       "getContextHashes",
       "getContextUtilisation",
-      "getCostSnapshots",
       "getCostSummary",
       "getCurrentNorthStar",
       "getCycleHealth",
@@ -2727,11 +2744,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config2) {
         this.endpoint = config2.endpoint.replace(/\/$/, "");
         this.apiKey = config2.apiKey;
         this.projectId = config2.projectId ?? "";
+        this.papiDir = config2.papiDir ?? null;
         this.onAuthRejected = config2.onAuthRejected;
       }
       /**
@@ -2807,6 +2826,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -3174,9 +3194,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       getCostSummary(cycleNumber) {
         return this.invoke("getCostSummary", [cycleNumber]);
       }
-      getCostSnapshots() {
-        return this.invoke("getCostSnapshots");
-      }
+      // task-3332: getCostSnapshots retired — see the removal note on CostSnapshot
+      // in packages/shared/src/entities.ts.
       appendCycleMetrics(snapshot) {
         return this.invoke("appendCycleMetrics", [snapshot]);
       }
@@ -3440,7 +3459,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -3527,7 +3546,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -7274,6 +7295,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config2);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -7305,12 +7327,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -7331,25 +7353,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -7368,11 +7371,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId }, projectId);
+      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter2.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter2.setProjectPapiDir) {
+        await adapter2.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter2.getProjectInfo && adapter2.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter2.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter2.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter2.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -7411,7 +7432,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter2 = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter2.probeConnection();
       if (!connected) {
@@ -7540,21 +7562,27 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+0a. MCHAT REALITY. Most hosts load MCP tools at CONVERSATION START \u2014 tools added or authenticated mid-chat are invisible in that chat. If the user says PAPI "is not working" or "failed to connect" but your tool list has no papi tools, do NOT retry the install or re-run OAuth: the link almost certainly succeeded already. Tell them plainly: "PAPI connected fine \u2014 tools only load in a NEW conversation. Start a fresh chat and run \`papi\` there." Never claim the connection failed when you simply cannot see the tools.
+
+0b. ONE CHAT, ONE PROJECT. Each conversation binds to ONE PAPI project at a time. If the user has several projects, orient names which one is connected \u2014 confirm it matches the repo the user is working in before writing anything. Wrong project? Run \`project_switch\` (or pass \`project="<slug>"\` per call), and say a fresh conversation is the cleanest switch.
+
+1. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
 
-1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+2. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
-2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
+3. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
-3. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
+4. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
 
-4. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
+5. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
 
-5. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
+6. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
 
-6. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
+7. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
 
-PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.`;
+PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.
+
+DATA HANDLING: PAPI stores structured project metadata only (never your source code), runs no AI calls from its servers \u2014 https://getpapi.ai/trust states exactly who can read what.`;
 
 // src/lib/response.ts
 function textResponse(text, usage) {
@@ -12789,6 +12817,13 @@ async function resolveCallerLatestCycle(adapter2, callerUserId) {
   }
   return newest;
 }
+function unownedCycleNumbers(cycles) {
+  const unowned = /* @__PURE__ */ new Set();
+  for (const c of cycles) {
+    if (c.userId == null) unowned.add(c.number);
+  }
+  return unowned;
+}
 async function validateAndPrepare(adapter2, force, callerUserId, adapterType) {
   let mode;
   let cycleNumber;
@@ -12813,23 +12848,37 @@ Run \`release\` first, or pass \`force: true\` to bypass this block.`
       );
     }
     if (!force) {
+      const callerCycleNumbers = callerUserId ? (await adapter2.readCycles()).filter((c) => c.userId === callerUserId).map((c) => c.number) : null;
       const inReviewTasks = await adapter2.queryBoard({
         status: ["In Review"],
         compact: true
       });
-      const staleTasks = inReviewTasks.filter(
-        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2
+      const staleMine = inReviewTasks.filter(
+        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && (callerCycleNumbers === null || callerCycleNumbers.includes(t.cycle))
       );
-      if (staleTasks.length > 0) {
-        const taskList = staleTasks.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
+      if (staleMine.length > 0) {
+        const taskList = staleMine.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
         throw new Error(
-          `Stale reviews detected \u2014 ${staleTasks.length} task(s) have been In Review for 2+ cycles:
+          `Stale reviews detected \u2014 ${staleMine.length} task(s) have been In Review for 2+ cycles:
 
 ${taskList}
 
 Run \`review_submit\` to clear them, or pass \`force: true\` to bypass this block.`
         );
       }
+      if (callerCycleNumbers !== null) {
+        const unowned = unownedCycleNumbers(await adapter2.readCycles());
+        const staleTheirs = inReviewTasks.filter(
+          (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && !callerCycleNumbers.includes(t.cycle) && // A task in a cycle with no known owner is unowned legacy data —
+          // do not attribute it to a teammate either.
+          !unowned.has(t.cycle)
+        );
+        if (staleTheirs.length > 0) {
+          strategyReviewWarning += `> \u2139\uFE0F ${staleTheirs.length} task(s) are In Review from other members' cycles (2+ cycles stale). They do not block your planning \u2014 but the review queue may need attention.
+
+`;
+        }
+      }
     }
     const autoCompleted = await assertSingleActiveCycle(adapter2, { autoComplete: force === true, userId: callerUserId ?? void 0 });
     for (const note of autoCompleted) {
@@ -27762,7 +27811,7 @@ function resolveAdHocCycle(cycle, latest, latestComplete) {
   if (cycle === "current") return latest;
   return latestComplete ? latest + 1 : latest;
 }
-async function recordAdHoc(adapter2, input) {
+async function recordAdHoc(adapter2, config2, input) {
   const [health, phases] = await Promise.all([
     adapter2.getCycleHealth(),
     adapter2.readPhases()
@@ -27784,9 +27833,16 @@ async function recordAdHoc(adapter2, input) {
     if (!existing) {
       throw new Error(`Task "${input.taskId}" not found on the board. Check the task ID and try again.`);
     }
-    if (!existing.assigneeId) {
+    if (existing.assigneeId) {
+      const gate = await resolveOwnerGate(adapter2, config2);
+      if (gate.enforced && (!gate.callerUserId || gate.callerUserId !== existing.assigneeId)) {
+        throw new Error(
+          `Task "${input.taskId}" (${existing.title}) is claimed by another member \u2014 ad-hoc work cannot be recorded against it. Have the claimer record it, or run \`task_unclaim\` to release it first.`
+        );
+      }
+    } else {
       warnings.push(
-        `\u2139\uFE0F ${input.taskId} has no assignee \u2014 recording ad-hoc work against an unclaimed pool task. If someone else might be building it too, check for an open PR/branch on the same files before merging.`
+        `\u2139\uFE0F ${input.taskId} has no assignee \u2014 recording ad-hoc work against an unclaimed pool task. ` + (input.collidingWorkNote ?? `If someone else might be building it too, check for an open PR/branch on the same files before merging.`)
       );
     }
     const updatePayload = {
@@ -28043,7 +28099,22 @@ async function handleAdHoc(adapter2, config2, args) {
   const gitUsable = !overrideNote && isGitAvailable() && isGitRepo(config2.projectRoot);
   const currentBranch = gitUsable ? getCurrentBranch(config2.projectRoot) : null;
   const baseBranch = gitUsable ? resolveBaseBranch(config2.projectRoot, config2.baseBranch) : null;
-  const result = await recordAdHoc(target, {
+  let collidingWorkNote;
+  if (taskId && gitUsable && baseBranch) {
+    try {
+      const existingTask = await target.getTask(taskId);
+      const filesLikelyTouched = existingTask?.buildHandoff?.filesLikelyTouched ?? [];
+      if (existingTask && !existingTask.assigneeId && filesLikelyTouched.length > 0) {
+        const collision = findCollidingWork(config2.projectRoot, baseBranch, filesLikelyTouched);
+        if (collision) {
+          const fileList = collision.files.slice(0, 3).join(", ") + (collision.files.length > 3 ? ", \u2026" : "");
+          collidingWorkNote = `${collision.label} already touches ${collision.files.length === 1 ? "the same file" : `${collision.files.length} of the same files`} (${fileList}) \u2014 check it before merging.`;
+        }
+      }
+    } catch {
+    }
+  }
+  const result = await recordAdHoc(target, config2, {
     title: title || "",
     taskId,
     notes: rawNotes,
@@ -28058,7 +28129,8 @@ async function handleAdHoc(adapter2, config2, args) {
     stage: stageArg,
     hold: holdArg,
     currentBranch,
-    baseBranch
+    baseBranch,
+    collidingWorkNote
   });
   if (!holdArg && gitUsable) {
     try {
@@ -29090,6 +29162,27 @@ var reviewSubmitTool = {
           }
         },
         required: ["verdict", "summary", "findings"]
+      },
+      proposal: {
+        type: "object",
+        description: 'task-3388, OPTIONAL (build-acceptance + verdict:"accept" only): propose a Decision or a Convention the build or the review itself settled. Same mechanism as build_execute\u2019s `proposal` (task-3273) \u2014 PAPI never mints one for you. A proposal that passes all four admission tests is QUEUED for the owner behind a decision gate, and nothing is written as an Active Decision. YOU apply the four tests (they are stated in the planning prompts); the server routes on your answers and makes no judgement about the content. Fails "arguable today" only and it is recorded as a Convention instead, riding every future build. Fails "constrains future work" and it is returned to you with the reason, unrecorded.',
+        properties: {
+          title: { type: "string", description: "One line stating the stance or rule." },
+          body: { type: "string", description: "What was decided or settled, and why." },
+          module: { type: "string", description: "Optional module scope. Only used when this lands as a Convention." },
+          tests: {
+            type: "object",
+            description: "The four admission tests, each answered explicitly. An omitted test is NOT a failed test \u2014 the proposal is refused rather than routed.",
+            properties: {
+              alternativesWereReal: { type: "boolean", description: "(a) Something else could genuinely have been chosen." },
+              constrainsFutureWork: { type: "boolean", description: "(b) It changes what a task nobody has written yet will do." },
+              arguableToday: { type: "boolean", description: "(c) A competent person could argue the other side right now." },
+              reversalCostsMore: { type: "boolean", description: "(d) Reversing it costs more than making it did." }
+            },
+            required: ["alternativesWereReal", "constrainsFutureWork", "arguableToday", "reversalCostsMore"]
+          }
+        },
+        required: ["title", "body", "tests"]
       }
     },
     required: ["task_id", "stage", "verdict", "comments"],
@@ -29705,6 +29798,30 @@ Next: address the feedback, then run \`build_execute ${taskId}\` to resubmit.`;
       }
     } catch {
     }
+    let proposalNote = "";
+    if (args.proposal !== void 0) {
+      if (!(stage === "build-acceptance" && verdict === "accept")) {
+        proposalNote = "\n\n---\n\n**Proposal not recorded.** `proposal` is only accepted on a build-acceptance `accept` \u2014 nothing has settled on a handoff-review or a non-accept verdict.\n\nThe review itself is unaffected \u2014 only the proposal was skipped.";
+      } else {
+        const validated = validateProposal(args.proposal);
+        if ("error" in validated) {
+          proposalNote = `
+
+---
+
+**Proposal not recorded.** ${validated.error}
+
+The review itself is unaffected \u2014 only the proposal failed.`;
+        } else {
+          const routing = routeProposal(validated.proposal);
+          const applied = await applyProposal(adapter2, routing, validated.proposal, {
+            cycleNumber: result.currentCycle,
+            sourceTaskId: result.taskId
+          });
+          proposalNote = formatProposalOutcome(routing, validated.proposal, applied);
+        }
+      }
+    }
     tracker.mark("format-response");
     return textResponse(
       `**${result.stageLabel}** recorded for ${result.taskId}.
@@ -29712,7 +29829,7 @@ Next: address the feedback, then run \`build_execute ${taskId}\` to resubmit.`;
 - **Verdict:** ${result.verdict}
 - **Comments:** ${trimForEcho(result.comments)}
 
-${statusNote}${capabilityReviewSkippedNote}${autoReviewNote}${securityNote}${adConflictNote}${unblockNote}${docClosureNote}${regenNote}${mergeNote}${overlapNote}${batchSummaryNote}${autoReleaseNote}${nextStepNote}${phaseNote}`
+${statusNote}${capabilityReviewSkippedNote}${autoReviewNote}${securityNote}${adConflictNote}${unblockNote}${docClosureNote}${regenNote}${mergeNote}${overlapNote}${batchSummaryNote}${autoReleaseNote}${nextStepNote}${phaseNote}${proposalNote}`
     );
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -30746,6 +30863,41 @@ function formatUnblockSection(candidates) {
   return lines.join("\n");
 }
 
+// src/lib/decision-drafts.ts
+async function findPendingDecisionDrafts(adapter2) {
+  let blockedProbe;
+  try {
+    blockedProbe = await adapter2.queryBoard({ status: ["Blocked"], compact: true });
+  } catch {
+    return [];
+  }
+  if (blockedProbe.length === 0) return [];
+  const drafts = [];
+  for (const task of blockedProbe) {
+    const blocker = task.blocker;
+    if (!blocker || blocker.type !== "decision-gate" || blocker.ref !== PROPOSED_DECISION_REF) continue;
+    const evidence = (task.notes ?? "").split("\n")[0]?.trim() ?? "";
+    drafts.push({
+      taskId: task.displayId ?? task.id,
+      taskTitle: task.title,
+      evidence
+    });
+  }
+  return drafts;
+}
+function formatPendingDecisionDrafts(drafts) {
+  if (drafts.length === 0) return "";
+  const lines = ["## Decisions Awaiting Your Call"];
+  lines.push(
+    `${drafts.length} decision${drafts.length === 1 ? "" : "s"} proposed during a build, waiting on you \u2014 mint with \`strategy_change\` to make it a real Active Decision, or \`board_edit <task> status:Cancelled\` to dismiss it. Neither is automatic.`
+  );
+  lines.push("");
+  for (const d of drafts) {
+    lines.push(`- **${formatRef(d.taskId, d.taskTitle)}**${d.evidence ? ` \u2014 ${d.evidence}` : ""}`);
+  }
+  return lines.join("\n");
+}
+
 // src/lib/deferred-gate.ts
 var GATE_PHRASES = [
   "depends on",
@@ -31986,10 +32138,18 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
         const handshake = buildHandshakeResult(proxyVersion);
         return handshake.mismatch && handshake.warning ? handshake.warning : void 0;
       }),
-      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles
+      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles.
+      // task-3736: the read is scoped to the CALLER (unassigned-or-mine, the same
+      // predicate task-3397 pinned). Unscoped, a teammate's Backlog P1s were aged
+      // against the CALLER's cycle count — a member at cycle 372 reading a
+      // teammate's cycle-5 task as "367+ cycles" stalled. Cycle identity is
+      // (project_id, user_id, number) since task-3335; cross-member cycle-age
+      // arithmetic is meaningless. The caller's own unclaimed pool P1s still
+      // count — unclaimed work is everyone's to claim, and its createdCycle is
+      // the cycle that planned it.
       tracked("p1-stall", async () => {
         const p1BacklogTasks = await adapter2.queryBoard({ status: ["Backlog"], priority: ["P1 High"] });
-        const stalledP1 = p1BacklogTasks.filter(
+        const stalledP1 = scopeTasksToCaller(p1BacklogTasks, callerUserId).filter(
           (t) => t.createdCycle != null && currentCycle2 - t.createdCycle >= 3
         );
         if (stalledP1.length === 0) return void 0;
@@ -32288,7 +32448,8 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
         }
         let unrecordedNote2 = "";
         try {
-          const unrecorded = detectUnrecordedCommits(config2.projectRoot, config2.baseBranch);
+          const { compareRef } = getBaseDivergence(config2.projectRoot, config2.baseBranch, { timeoutMs: ORIGIN_FETCH_TIMEOUT_MS });
+          const unrecorded = detectUnrecordedCommits(config2.projectRoot, compareRef);
           if (unrecorded.length > 0) {
             const doneTasks = await adapter2.queryBoard({ status: ["Done"] });
             const adHocDoneTasks = doneTasks.filter((t) => t.cycle == null);
@@ -32417,8 +32578,14 @@ ${versionDrift}` : "";
     }
     tracker.mark("parallel-tail");
     const sharedContributorsPromise = adapterSupports(adapter2, "listContributors") ? adapter2.listContributors().catch(() => []) : Promise.resolve([]);
-    const [unblockCandidates, subAgents, teamSummaryLine, releaseHistoryLine, cohortVisibilityLine, carryForwardRefs] = await Promise.all([
+    const [unblockCandidates, pendingDecisionDrafts, subAgents, teamSummaryLine, releaseHistoryLine, cohortVisibilityLine, carryForwardRefs] = await Promise.all([
       tracked("unblock-candidates", () => findUnblockCandidates(adapter2, currentCycle2))().catch(() => []),
+      // task-3388: pending decision-proposal drafts (build_execute/review_submit's
+      // `proposal` param, task-3273/3388) — mandatory reader, deliberately
+      // uncapped and separate from the housekeeping-suggestion unblock list above
+      // (see lib/decision-drafts.ts for why). Runs on every orient call, not
+      // gated behind deep_housekeeping — same posture as unblock-candidates.
+      tracked("pending-decision-drafts", () => findPendingDecisionDrafts(adapter2))().catch(() => []),
       // task-1866: discover project sub-agents for the orient surface (read-only, never throws).
       listAgents(config2.projectRoot),
       // task-2071 (MU-3) + task-2072 (MU-5): team summary + release-history — both
@@ -32437,6 +32604,10 @@ ${versionDrift}` : "";
     const unblockNote = unblockSection ? `
 
 ${unblockSection}` : "";
+    const decisionDraftsSection = formatPendingDecisionDrafts(pendingDecisionDrafts);
+    const decisionDraftsNote = decisionDraftsSection ? `
+
+${decisionDraftsSection}` : "";
     const teamSummary = [teamSummaryLine, releaseHistoryLine, cohortVisibilityLine].filter(Boolean).join("\n") || void 0;
     let deferredGateNote = "";
     if (deepHousekeeping) {
@@ -32472,7 +32643,7 @@ ${formatRuntimeIdentity(getRuntimeIdentity(config2, serverVersion))}`;
     let effStaleSkillsNote = staleSkillsNote;
     let effResearchSignalsNote = researchSignalsNote;
     const droppedNotes = [];
-    const assembleOrientOutput = () => projectOverrideLine + projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment, subAgents, projectName, teamSummary, clientName, carryForwardRefs) + runtimeIdentityNote + unblockNote + deferredGateNote + feedbackResolvedNote + alertsNote + ttfvNote + reconciliationNote + mergedInProgressNote + unrecordedNote + unregisteredDocsNote + effStaleSkillsNote + effResearchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + effOnboardingCoachingNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + effDeepHint + enrichmentFilesSection;
+    const assembleOrientOutput = () => projectOverrideLine + projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment, subAgents, projectName, teamSummary, clientName, carryForwardRefs) + runtimeIdentityNote + unblockNote + decisionDraftsNote + deferredGateNote + feedbackResolvedNote + alertsNote + ttfvNote + reconciliationNote + mergedInProgressNote + unrecordedNote + unregisteredDocsNote + effStaleSkillsNote + effResearchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + effOnboardingCoachingNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + effDeepHint + enrichmentFilesSection;
     const orientBudgetSoft = Number(process.env.PAPI_ORIENT_CONTEXT_BUDGET) || 6e4;
     let assembled = assembleOrientOutput();
     if (Buffer.byteLength(assembled, "utf-8") > orientBudgetSoft && effDeepHint) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.104",
+  "version": "0.7.106",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",