@papi-ai/server 0.7.105 → 0.7.106

package/dist/backfill-cycle-metrics.js

@@ -1908,11 +1908,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config) {
         this.endpoint = config.endpoint.replace(/\/$/, "");
         this.apiKey = config.apiKey;
         this.projectId = config.projectId ?? "";
+        this.papiDir = config.papiDir ?? null;
         this.onAuthRejected = config.onAuthRejected;
       }
       /**
@@ -1988,6 +1990,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -2620,7 +2623,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -2707,7 +2710,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -2966,6 +2971,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -2997,12 +3003,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -3023,25 +3029,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -3060,11 +3047,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId }, projectId);
+      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter.setProjectPapiDir) {
+        await adapter.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter.getProjectInfo && adapter.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -3103,7 +3108,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter.probeConnection();
       if (!connected) {

package/dist/index.js

@@ -2744,11 +2744,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config2) {
         this.endpoint = config2.endpoint.replace(/\/$/, "");
         this.apiKey = config2.apiKey;
         this.projectId = config2.projectId ?? "";
+        this.papiDir = config2.papiDir ?? null;
         this.onAuthRejected = config2.onAuthRejected;
       }
       /**
@@ -2824,6 +2826,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -3456,7 +3459,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -3543,7 +3546,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -7290,6 +7295,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config2);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -7321,12 +7327,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -7347,25 +7353,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -7384,11 +7371,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId }, projectId);
+      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter2.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter2.setProjectPapiDir) {
+        await adapter2.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter2.getProjectInfo && adapter2.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter2.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter2.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter2.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -7427,7 +7432,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter2 = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter2.probeConnection();
       if (!connected) {
@@ -7556,21 +7562,27 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+0a. MCHAT REALITY. Most hosts load MCP tools at CONVERSATION START \u2014 tools added or authenticated mid-chat are invisible in that chat. If the user says PAPI "is not working" or "failed to connect" but your tool list has no papi tools, do NOT retry the install or re-run OAuth: the link almost certainly succeeded already. Tell them plainly: "PAPI connected fine \u2014 tools only load in a NEW conversation. Start a fresh chat and run \`papi\` there." Never claim the connection failed when you simply cannot see the tools.
+
+0b. ONE CHAT, ONE PROJECT. Each conversation binds to ONE PAPI project at a time. If the user has several projects, orient names which one is connected \u2014 confirm it matches the repo the user is working in before writing anything. Wrong project? Run \`project_switch\` (or pass \`project="<slug>"\` per call), and say a fresh conversation is the cleanest switch.
+
+1. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
 
-1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+2. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
-2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
+3. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
-3. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
+4. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
 
-4. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
+5. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
 
-5. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
+6. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
 
-6. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
+7. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
 
-PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.`;
+PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.
+
+DATA HANDLING: PAPI stores structured project metadata only (never your source code), runs no AI calls from its servers \u2014 https://getpapi.ai/trust states exactly who can read what.`;
 
 // src/lib/response.ts
 function textResponse(text, usage) {
@@ -12805,6 +12817,13 @@ async function resolveCallerLatestCycle(adapter2, callerUserId) {
   }
   return newest;
 }
+function unownedCycleNumbers(cycles) {
+  const unowned = /* @__PURE__ */ new Set();
+  for (const c of cycles) {
+    if (c.userId == null) unowned.add(c.number);
+  }
+  return unowned;
+}
 async function validateAndPrepare(adapter2, force, callerUserId, adapterType) {
   let mode;
   let cycleNumber;
@@ -12829,23 +12848,37 @@ Run \`release\` first, or pass \`force: true\` to bypass this block.`
       );
     }
     if (!force) {
+      const callerCycleNumbers = callerUserId ? (await adapter2.readCycles()).filter((c) => c.userId === callerUserId).map((c) => c.number) : null;
       const inReviewTasks = await adapter2.queryBoard({
         status: ["In Review"],
         compact: true
       });
-      const staleTasks = inReviewTasks.filter(
-        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2
+      const staleMine = inReviewTasks.filter(
+        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && (callerCycleNumbers === null || callerCycleNumbers.includes(t.cycle))
       );
-      if (staleTasks.length > 0) {
-        const taskList = staleTasks.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
+      if (staleMine.length > 0) {
+        const taskList = staleMine.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
         throw new Error(
-          `Stale reviews detected \u2014 ${staleTasks.length} task(s) have been In Review for 2+ cycles:
+          `Stale reviews detected \u2014 ${staleMine.length} task(s) have been In Review for 2+ cycles:
 
 ${taskList}
 
 Run \`review_submit\` to clear them, or pass \`force: true\` to bypass this block.`
         );
       }
+      if (callerCycleNumbers !== null) {
+        const unowned = unownedCycleNumbers(await adapter2.readCycles());
+        const staleTheirs = inReviewTasks.filter(
+          (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && !callerCycleNumbers.includes(t.cycle) && // A task in a cycle with no known owner is unowned legacy data —
+          // do not attribute it to a teammate either.
+          !unowned.has(t.cycle)
+        );
+        if (staleTheirs.length > 0) {
+          strategyReviewWarning += `> \u2139\uFE0F ${staleTheirs.length} task(s) are In Review from other members' cycles (2+ cycles stale). They do not block your planning \u2014 but the review queue may need attention.
+
+`;
+        }
+      }
     }
     const autoCompleted = await assertSingleActiveCycle(adapter2, { autoComplete: force === true, userId: callerUserId ?? void 0 });
     for (const note of autoCompleted) {
@@ -32105,10 +32138,18 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
         const handshake = buildHandshakeResult(proxyVersion);
         return handshake.mismatch && handshake.warning ? handshake.warning : void 0;
       }),
-      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles
+      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles.
+      // task-3736: the read is scoped to the CALLER (unassigned-or-mine, the same
+      // predicate task-3397 pinned). Unscoped, a teammate's Backlog P1s were aged
+      // against the CALLER's cycle count — a member at cycle 372 reading a
+      // teammate's cycle-5 task as "367+ cycles" stalled. Cycle identity is
+      // (project_id, user_id, number) since task-3335; cross-member cycle-age
+      // arithmetic is meaningless. The caller's own unclaimed pool P1s still
+      // count — unclaimed work is everyone's to claim, and its createdCycle is
+      // the cycle that planned it.
       tracked("p1-stall", async () => {
         const p1BacklogTasks = await adapter2.queryBoard({ status: ["Backlog"], priority: ["P1 High"] });
-        const stalledP1 = p1BacklogTasks.filter(
+        const stalledP1 = scopeTasksToCaller(p1BacklogTasks, callerUserId).filter(
           (t) => t.createdCycle != null && currentCycle2 - t.createdCycle >= 3
         );
         if (stalledP1.length === 0) return void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.105",
+  "version": "0.7.106",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",