@papi-ai/server 0.7.105 → 0.7.108

package/dist/backfill-cycle-metrics.js

@@ -12,6 +12,10 @@ var __export = (target, all) => {
 function isSelfHostedDeployment(value) {
   return value === "1" || value?.toLowerCase() === "true";
 }
+function isFossilSupabaseReference(value) {
+  if (!value) return false;
+  return value.includes(".pooler.supabase.com") || value.includes(DECOMMISSIONED_SUPABASE_PROJECT_REF);
+}
 function optionalBoolean(value, fallback) {
   if (value == null || value.trim() === "") return fallback;
   return isSelfHostedDeployment(value);
@@ -94,10 +98,11 @@ function calculateCycleMetrics(reports, currentCycle, window = 5) {
   }
   return { accuracy, velocity, unparsedEffortCount };
 }
-var CAPABILITY_REGISTRY, CAPABILITY_KEYS, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, WAB_WINDOW_DAYS, WAB_WEEK_MS, EFFORT_SCALE;
+var DECOMMISSIONED_SUPABASE_PROJECT_REF, CAPABILITY_REGISTRY, CAPABILITY_KEYS, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, WAB_WINDOW_DAYS, WAB_WEEK_MS, EFFORT_SCALE;
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
+    DECOMMISSIONED_SUPABASE_PROJECT_REF = "guewgygcpcmrcoppihzx";
     CAPABILITY_REGISTRY = [
       // task-3384: the PLAN step. The landing page has advertised these three since
       // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
@@ -1908,11 +1913,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config) {
         this.endpoint = config.endpoint.replace(/\/$/, "");
         this.apiKey = config.apiKey;
         this.projectId = config.projectId ?? "";
+        this.papiDir = config.papiDir ?? null;
         this.onAuthRejected = config.onAuthRejected;
       }
       /**
@@ -1988,6 +1995,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -2620,7 +2628,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -2707,7 +2715,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -2849,6 +2859,11 @@ var PLACEHOLDER_PATTERNS = [
 ];
 function validateDatabaseUrl(connectionString) {
   const lower = connectionString.toLowerCase().trim();
+  if (isFossilSupabaseReference(connectionString)) {
+    throw new Error(
+      "This config points at PAPI's old hosted database, which was migrated.\nRegenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+    );
+  }
   if (PLACEHOLDER_PATTERNS.some((p) => lower.includes(p.toLowerCase()))) {
     throw new Error(
       "DATABASE_URL contains a placeholder value and is not configured.\nReplace it with your actual Supabase connection string in .mcp.json.\nIf you don't have one yet, contact the PAPI admin for access."
@@ -2863,10 +2878,12 @@ Check your .mcp.json configuration.`
   }
 }
 var _connectionStatus = "offline";
+var _lastAdapterType = null;
 var _pathIdentityChecked = false;
 async function createAdapter(optionsOrType, maybePapiDir) {
   const options = typeof optionsOrType === "string" ? { adapterType: optionsOrType, papiDir: maybePapiDir } : optionsOrType;
   const { adapterType, papiDir, papiEndpoint } = options;
+  _lastAdapterType = adapterType;
   switch (adapterType) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");
@@ -2966,6 +2983,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -2997,12 +3015,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -3023,25 +3041,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -3060,11 +3059,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId }, projectId);
+      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter.setProjectPapiDir) {
+        await adapter.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter.getProjectInfo && adapter.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -3103,7 +3120,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter.probeConnection();
       if (!connected) {

package/dist/index.js

@@ -14,6 +14,10 @@ import { randomUUID } from "crypto";
 function isSelfHostedDeployment(value) {
   return value === "1" || value?.toLowerCase() === "true";
 }
+function isFossilSupabaseReference(value) {
+  if (!value) return false;
+  return value.includes(".pooler.supabase.com") || value.includes(DECOMMISSIONED_SUPABASE_PROJECT_REF);
+}
 function isCapabilityEnabled(caps, key) {
   const stored = caps?.[key];
   if (stored != null) return stored !== false;
@@ -788,10 +792,11 @@ function parsePhaseBlock(block) {
   if (isNaN(order)) return null;
   return { id, slug, label, description, status, order };
 }
-var CAPABILITY_REGISTRY, CAPABILITY_KEYS, ASSIGNABLE_CONTRIBUTOR_ROLES, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, PROPOSAL_EVENT_TYPES, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, NONE_LEAD_RE, CONTRAST_LEAD_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
+var DECOMMISSIONED_SUPABASE_PROJECT_REF, CAPABILITY_REGISTRY, CAPABILITY_KEYS, ASSIGNABLE_CONTRIBUTOR_ROLES, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, PROPOSAL_EVENT_TYPES, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, NONE_LEAD_RE, CONTRAST_LEAD_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
+    DECOMMISSIONED_SUPABASE_PROJECT_REF = "guewgygcpcmrcoppihzx";
     CAPABILITY_REGISTRY = [
       // task-3384: the PLAN step. The landing page has advertised these three since
       // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
@@ -2744,11 +2749,13 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      papiDir;
       onAuthRejected;
       constructor(config2) {
         this.endpoint = config2.endpoint.replace(/\/$/, "");
         this.apiKey = config2.apiKey;
         this.projectId = config2.projectId ?? "";
+        this.papiDir = config2.papiDir ?? null;
         this.onAuthRejected = config2.onAuthRejected;
       }
       /**
@@ -2824,6 +2831,7 @@ var init_proxy_adapter = __esm({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
           projectId,
+          papiDir: this.papiDir,
           onAuthRejected: this.onAuthRejected
         }));
       }
@@ -3456,7 +3464,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        const raw = await this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", [this.papiDir]);
         if (!raw) return null;
         return {
           name: raw.name,
@@ -3543,7 +3551,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         };
       }
       async listUserProjects() {
-        const body = await this.postRoute("project-list", {});
+        const body = await this.postRoute("project-list", {
+          ...this.papiDir ? { papiDir: this.papiDir } : {}
+        });
         return body.projects ?? [];
       }
       async createUserProject(input) {
@@ -7170,6 +7180,11 @@ var PLACEHOLDER_PATTERNS = [
 ];
 function validateDatabaseUrl(connectionString) {
   const lower = connectionString.toLowerCase().trim();
+  if (isFossilSupabaseReference(connectionString)) {
+    throw new Error(
+      "This config points at PAPI's old hosted database, which was migrated.\nRegenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+    );
+  }
   if (PLACEHOLDER_PATTERNS.some((p) => lower.includes(p.toLowerCase()))) {
     throw new Error(
       "DATABASE_URL contains a placeholder value and is not configured.\nReplace it with your actual Supabase connection string in .mcp.json.\nIf you don't have one yet, contact the PAPI admin for access."
@@ -7184,6 +7199,10 @@ Check your .mcp.json configuration.`
   }
 }
 var _connectionStatus = "offline";
+var _lastAdapterType = null;
+function getLastAdapterType() {
+  return _lastAdapterType;
+}
 var _pathIdentityChecked = false;
 function getConnectionStatus() {
   return _connectionStatus;
@@ -7191,6 +7210,7 @@ function getConnectionStatus() {
 async function createAdapter(optionsOrType, maybePapiDir) {
   const options = typeof optionsOrType === "string" ? { adapterType: optionsOrType, papiDir: maybePapiDir } : optionsOrType;
   const { adapterType, papiDir, papiEndpoint } = options;
+  _lastAdapterType = adapterType;
   switch (adapterType) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");
@@ -7290,6 +7310,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         );
       }
       const pgAdapter = new PgAdapter(config2);
+      let projectCreated = false;
       try {
         const existing = await pgAdapter.getProject(projectId);
         if (!existing) {
@@ -7321,12 +7342,12 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               id: projectId,
               slug,
               name: slug,
-              papi_dir: papiDir,
               user_id: userId,
               root_commit_hash: rootHash ?? void 0,
               repo_url: originUrl ?? void 0,
               resolution_method: rootHash ? "root_hash" : "manual"
             });
+            projectCreated = true;
           }
         } else {
           if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
@@ -7347,25 +7368,6 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
               );
             }
           }
-          if (!_pathIdentityChecked) {
-            _pathIdentityChecked = true;
-            const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
-            const projectName = existing.name ?? existing.slug ?? projectId;
-            const result = assertWorkspaceMatch({
-              storedPapiDir: existing.papi_dir,
-              projectName,
-              workspacePath: cwd
-            });
-            if (result && (result.action === "backfill" || result.action === "migrate")) {
-              try {
-                await pgAdapter.updateProject(projectId, { papi_dir: result.newPapiDir });
-              } catch (err) {
-                console.error(
-                  `[papi] Failed to persist papi_dir update: ${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-          }
           if (existing.user_id) {
             const configuredUserId = process.env["PAPI_USER_ID"] ?? detectUserId();
             if (configuredUserId && existing.user_id !== configuredUserId) {
@@ -7384,11 +7386,29 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId }, projectId);
+      const adapter2 = new PgPapiAdapter({ ...config2, userId: resolveUserId, papiDir }, projectId);
       try {
         await adapter2.initRls();
       } catch {
       }
+      if (projectCreated && papiDir && adapter2.setProjectPapiDir) {
+        await adapter2.setProjectPapiDir(papiDir);
+      }
+      if (!_pathIdentityChecked && adapter2.getProjectInfo && adapter2.setProjectPapiDir) {
+        _pathIdentityChecked = true;
+        const info = await adapter2.getProjectInfo();
+        if (info) {
+          const cwd = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
+          const result = assertWorkspaceMatch({
+            storedPapiDir: info.papi_dir,
+            projectName: info.name || info.slug || projectId,
+            workspacePath: cwd
+          });
+          if (result && (result.action === "backfill" || result.action === "migrate")) {
+            await adapter2.setProjectPapiDir(result.newPapiDir);
+          }
+        }
+      }
       const connected = await adapter2.probeConnection();
       if (connected) {
         _connectionStatus = "connected";
@@ -7427,7 +7447,8 @@ Already have an account? Make sure PAPI_DATA_API_KEY is set in your .mcp.json en
       const adapter2 = new ProxyPapiAdapter2({
         endpoint: dataEndpoint,
         apiKey: dataApiKey,
-        projectId: projectId || void 0
+        projectId: projectId || void 0,
+        papiDir
       });
       const connected = await adapter2.probeConnection();
       if (!connected) {
@@ -7556,21 +7577,27 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+0a. MCHAT REALITY. Most hosts load MCP tools at CONVERSATION START \u2014 tools added or authenticated mid-chat are invisible in that chat. If the user says PAPI "is not working" or "failed to connect" but your tool list has no papi tools, do NOT retry the install or re-run OAuth: the link almost certainly succeeded already. Tell them plainly: "PAPI connected fine \u2014 tools only load in a NEW conversation. Start a fresh chat and run \`papi\` there." Never claim the connection failed when you simply cannot see the tools.
+
+0b. ONE CHAT, ONE PROJECT. Each conversation binds to ONE PAPI project at a time. If the user has several projects, orient names which one is connected \u2014 confirm it matches the repo the user is working in before writing anything. Wrong project? Run \`project_switch\` (or pass \`project="<slug>"\` per call), and say a fresh conversation is the cleanest switch.
+
+1. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
 
-1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+2. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
-2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
+3. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
-3. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
+4. STATUS DISCIPLINE. Check a task's status before acting. "In Review" = already built \u2014 never re-build it; submit a review instead. "In Progress" = a build started \u2014 check the existing branch before writing new code. "Backlog" = not started, but check for an existing feature branch first.
 
-4. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
+5. STAY IN SCOPE. Build exactly what the BUILD HANDOFF specifies. Mechanical steps (branch creation, commits, status updates) are automatic \u2014 only "what to build" needs the user's confirmation.
 
-5. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
+6. VERIFY BEFORE DONE. Test the change and confirm it works before reporting a task complete. Report failures honestly, with the output.
 
-6. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
+7. NAME THE PROJECT WHEN YOU KNOW IT. If you know which repo this session is working in, pass \`project="<slug>"\` on the call rather than relying on whatever the connection defaults to. An account with more than one project cannot be resolved from a connection with no project bound \u2014 PAPI will stop and ask which one rather than guess, and answering costs a round trip. If PAPI asks, put the list to the user, then re-call with their choice; run \`project_switch\` to make it stick.
 
-PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.`;
+PAPI reads and writes all project state through these tools \u2014 they are the source of truth, not local files.
+
+DATA HANDLING: PAPI stores structured project metadata only (never your source code), runs no AI calls from its servers \u2014 https://getpapi.ai/trust states exactly who can read what.`;
 
 // src/lib/response.ts
 function textResponse(text, usage) {
@@ -12398,6 +12425,19 @@ ${cleanContent}`;
       `task-3670 self-heal: ${repairedCycles.length} task(s) had lost cycle membership and were re-assigned (${repairedCycles.join(", ")})`
     );
   }
+  let health;
+  try {
+    health = await adapter2.getCycleHealth?.();
+  } catch (err) {
+    verifyWarnings.push(
+      `task-3733: could not re-verify the cycle row after write (${err instanceof Error ? err.message : String(err)}) \u2014 cycle membership was written and repaired, but this final check could not confirm it.`
+    );
+  }
+  if (health && health.totalCycles !== newCycleNumber) {
+    throw new Error(
+      `Plan apply committed, but the cycle row for Cycle ${newCycleNumber} did not take: getCycleHealth() reports the caller's current cycle as ${health.totalCycles}. Task assignments were written and repaired, but the cycle entity itself is stale \u2014 investigate the planWriteBack cycle upsert before trusting this apply.`
+    );
+  }
   const allWarnings = [...result.warnings, ...verifyWarnings, ...earlyCreateWarnings];
   const handoffCount = data.cycleHandoffs?.length ?? 0;
   const correctionCount = data.boardCorrections?.length ?? 0;
@@ -12805,6 +12845,13 @@ async function resolveCallerLatestCycle(adapter2, callerUserId) {
   }
   return newest;
 }
+function unownedCycleNumbers(cycles) {
+  const unowned = /* @__PURE__ */ new Set();
+  for (const c of cycles) {
+    if (c.userId == null) unowned.add(c.number);
+  }
+  return unowned;
+}
 async function validateAndPrepare(adapter2, force, callerUserId, adapterType) {
   let mode;
   let cycleNumber;
@@ -12829,23 +12876,37 @@ Run \`release\` first, or pass \`force: true\` to bypass this block.`
       );
     }
     if (!force) {
+      const callerCycleNumbers = callerUserId ? (await adapter2.readCycles()).filter((c) => c.userId === callerUserId).map((c) => c.number) : null;
       const inReviewTasks = await adapter2.queryBoard({
         status: ["In Review"],
         compact: true
       });
-      const staleTasks = inReviewTasks.filter(
-        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2
+      const staleMine = inReviewTasks.filter(
+        (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && (callerCycleNumbers === null || callerCycleNumbers.includes(t.cycle))
       );
-      if (staleTasks.length > 0) {
-        const taskList = staleTasks.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
+      if (staleMine.length > 0) {
+        const taskList = staleMine.map((t) => `- ${t.id} (Cycle ${t.cycle}): ${t.title}`).join("\n");
         throw new Error(
-          `Stale reviews detected \u2014 ${staleTasks.length} task(s) have been In Review for 2+ cycles:
+          `Stale reviews detected \u2014 ${staleMine.length} task(s) have been In Review for 2+ cycles:
 
 ${taskList}
 
 Run \`review_submit\` to clear them, or pass \`force: true\` to bypass this block.`
         );
       }
+      if (callerCycleNumbers !== null) {
+        const unowned = unownedCycleNumbers(await adapter2.readCycles());
+        const staleTheirs = inReviewTasks.filter(
+          (t) => t.cycle !== void 0 && t.cycle <= cycleNumber - 2 && !callerCycleNumbers.includes(t.cycle) && // A task in a cycle with no known owner is unowned legacy data —
+          // do not attribute it to a teammate either.
+          !unowned.has(t.cycle)
+        );
+        if (staleTheirs.length > 0) {
+          strategyReviewWarning += `> \u2139\uFE0F ${staleTheirs.length} task(s) are In Review from other members' cycles (2+ cycles stale). They do not block your planning \u2014 but the review queue may need attention.
+
+`;
+        }
+      }
     }
     const autoCompleted = await assertSingleActiveCycle(adapter2, { autoComplete: force === true, userId: callerUserId ?? void 0 });
     for (const note of autoCompleted) {
@@ -22064,60 +22125,87 @@ Releasing to a non-base branch (e.g. dev) is unaffected.` + resolutionNote
         }
         const releaseRole = callerRole === "release_manager" ? "release manager" : "editor";
         tracker.mark("contributor-pr-reconciliation");
+        const closeContributorCycle = (cycleOverride) => closeCycleState(
+          config2,
+          adapter2,
+          version,
+          cycleOverride ?? cycleToClose ?? void 0,
+          {
+            force: force ?? false,
+            skipVersion: skipVersion ?? false,
+            callerUserId: gate.callerUserId
+          }
+        );
+        let reconciled = null;
         try {
-          const reconciled = await reconcileContributorReleasePrs(config2, adapter2, gate.callerUserId, cycleToClose);
-          if (reconciled.merged.length > 0) {
-            const latest = reconciled.merged[0];
-            let caps2 = {};
-            try {
-              const info = adapter2.getProjectInfo ? await adapter2.getProjectInfo() : null;
-              caps2 = info?.capabilities ?? {};
-            } catch {
-              caps2 = {};
-            }
-            await recordReadinessVerified(tracker);
-            await recordQualityGate(tracker, evaluateReleaseGate(caps2, config2.gateCommand, gateResult), caps2);
-            await completeRelease(tracker, {
-              cycleClosed: latest.cycle,
-              version,
-              caps: caps2,
-              branchMerges: latest.branch ? [{ branch: latest.branch, prUrl: latest.prUrl }] : [],
-              changelogEmitted: false
-            });
-            const localHandoff = isHostedTransport() ? `
+          reconciled = await reconcileContributorReleasePrs(config2, adapter2, gate.callerUserId, cycleToClose);
+        } catch (err) {
+          console.error(`[release] contributor PR reconciliation failed (non-blocking): ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (reconciled?.merged.length) {
+          const latest = reconciled.merged[0];
+          let caps2 = {};
+          try {
+            const info = adapter2.getProjectInfo ? await adapter2.getProjectInfo() : null;
+            caps2 = info?.capabilities ?? {};
+          } catch {
+            caps2 = {};
+          }
+          let closed;
+          try {
+            closed = await closeContributorCycle(latest.cycle);
+          } catch (err) {
+            return errorResponse(err instanceof Error ? err.message : String(err));
+          }
+          await recordReadinessVerified(tracker);
+          await recordQualityGate(tracker, evaluateReleaseGate(caps2, config2.gateCommand, gateResult), caps2);
+          await completeRelease(tracker, {
+            cycleClosed: closed.resolvedCycleNum > 0 ? closed.resolvedCycleNum : latest.cycle,
+            version,
+            caps: caps2,
+            branchMerges: latest.branch ? [{ branch: latest.branch, prUrl: latest.prUrl }] : [],
+            changelogEmitted: false
+          });
+          const localHandoff = isHostedTransport() ? `
 ${buildHostedGitDirective({
-              version,
-              branch,
-              skipVersion: skipVersion ?? false,
-              harnessCanBuild: detectHarness(clientName).build,
-              harnessKnown: detectHarness(clientName).known,
-              harnessLabel: detectHarness(clientName).label,
-              changelogSection: null
-            })}` : "";
-            return textResponse(
-              `## Release ${version} \u2014 contributor PR merged
+            version,
+            branch,
+            skipVersion: skipVersion ?? false,
+            harnessCanBuild: detectHarness(clientName).build,
+            harnessKnown: detectHarness(clientName).known,
+            harnessLabel: detectHarness(clientName).label,
+            changelogSection: null
+          })}` : "";
+          const cycleLabel = closed.resolvedCycleNum > 0 ? `Cycle ${closed.resolvedCycleNum}` : latest.cycle ? `Cycle ${latest.cycle}` : "The contributor cycle";
+          return textResponse(
+            `## Release ${version} \u2014 contributor PR merged
 
 PAPI detected that ${latest.prUrl} was merged on GitHub and reconciled the contributor release. GitHub granted the merge permission; your PAPI **${releaseRole}** role granted the release workflow.
 
-${latest.cycle ? `Cycle ${latest.cycle}` : "The contributor cycle"} remains **complete**, and the release is now recorded as **released** in PAPI.` + localHandoff + `
+${cycleLabel} remains **complete**, and the release is now recorded as **released** in PAPI.` + localHandoff + `
 
 Next: run \`plan\` to start your next cycle.`
-            );
+          );
+        }
+        if (reconciled?.open.length) {
+          const openCycle = cycleToClose !== null ? reconciled.open.find((pr) => pr.cycle === cycleToClose)?.cycle ?? null : reconciled.open[0].cycle;
+          if (openCycle !== null && openCycle !== void 0) {
+            try {
+              await closeContributorCycle(openCycle);
+            } catch (err) {
+              return errorResponse(err instanceof Error ? err.message : String(err));
+            }
           }
-          if (reconciled.open.length > 0) {
-            const prLines = reconciled.open.map((p) => `- ${p.prUrl}`).join("\n");
-            return textResponse(
-              `## Release ${version} \u2014 contributor PR awaiting merge
+          const prLines = reconciled.open.map((p) => `- ${p.prUrl}`).join("\n");
+          return textResponse(
+            `## Release ${version} \u2014 contributor PR awaiting merge
 
 ${prLines}
 
 Your PAPI **${releaseRole}** role allowed this release PR. Merge permission is controlled separately by GitHub: if GitHub lets you merge, review and merge it there; otherwise a repository maintainer must merge it.
 
 After it is merged, run \`release\` again so PAPI can detect the merge and finish the release record.`
-            );
-          }
-        } catch (err) {
-          console.error(`[release] contributor PR reconciliation failed (non-blocking): ${err instanceof Error ? err.message : String(err)}`);
+          );
         }
         if (isHostedTransport()) {
           return errorResponse(
@@ -23056,7 +23144,7 @@ function getUnresolvedDeps(task, allTasks) {
   const taskStatusMap = new Map(allTasks.map((t) => [t.id, t.status]));
   return deps.filter((depId) => {
     const status = taskStatusMap.get(depId);
-    return status !== "Done";
+    return status !== "Done" && status !== "Cancelled" && status !== "Archived";
   });
 }
 function resolveDepCycleBranch(cycleBranches, cycleNumber, upstreamModule, dependentModule) {
@@ -29879,6 +29967,30 @@ async function handleReviewClaim(adapter2, config2, args) {
 import { randomUUID as randomUUID12 } from "crypto";
 import { access as access2, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
 import path6 from "path";
+init_dist();
+var FOSSIL_CONFIG_MESSAGE = [
+  "This config points at PAPI's old hosted database, which was migrated.",
+  "Regenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+].join("\n");
+function extractPapiOwnedConfigText(existingConfig, agent) {
+  if (agent === "codex") {
+    const match = existingConfig.match(/\[mcp_servers\.papi\][\s\S]*?(?=\n\[|$)/);
+    return match ? match[0] : existingConfig;
+  }
+  if (agent === "hermes") {
+    const match = existingConfig.match(/^[ \t]*papi[ \t]*:[\s\S]*?(?=\n[ \t]{0,2}\S[^\n]*:[ \t]*$|$)/m);
+    return match ? match[0] : existingConfig;
+  }
+  try {
+    const parsed = JSON.parse(existingConfig);
+    const container = parsed.mcpServers ?? parsed.servers ?? parsed.mcp;
+    const papiEntry = container?.papi;
+    const env = papiEntry?.env ?? papiEntry?.environment;
+    if (env) return JSON.stringify(env);
+  } catch {
+  }
+  return existingConfig;
+}
 var initTool = {
   name: "init",
   description: "Write the MCP config file that connects this project to PAPI. Generates .mcp.json, or the equivalent for whichever MCP client you use \u2014 Claude Code, Cursor, VS Code, Windsurf, OpenCode, Amazon Q, Kilo Code, Gemini CLI, Codex CLI, or Hermes Agent. Config-only \u2014 does not create any project data. Run this first, then run `setup` to create your PAPI project.",
@@ -30155,6 +30267,11 @@ async function handleInit(config2, args) {
     await access2(mcpJsonPath);
     existingConfig = await readFile5(mcpJsonPath, "utf-8");
   } catch {
+  }
+  if (existingConfig && isFossilSupabaseReference(extractPapiOwnedConfigText(existingConfig, agent))) {
+    return errorResponse(`${FOSSIL_CONFIG_MESSAGE}
+
+Path: ${mcpJsonPath}`);
   }
   if (existingConfig && !force) {
     const hasPapiServer = (() => {
@@ -30308,6 +30425,9 @@ ${writeNote}
 ` + formatFilesToWriteSection(collector)
     );
   }
+  if (isDatabaseUser && isFossilSupabaseReference(process.env.DATABASE_URL)) {
+    return errorResponse(FOSSIL_CONFIG_MESSAGE);
+  }
   if (isDatabaseUser) {
     const projectId = randomUUID12();
     const envVars = {
@@ -30346,7 +30466,7 @@ ${writeNote}
       "",
       "## Next Steps",
       "",
-      ...process.env.DATABASE_URL ? ["1. **Restart your MCP client** to pick up the new config."] : [`1. **Set your DATABASE_URL** \u2014 replace \`<YOUR_DATABASE_URL>\` in \`${target.displayPath}\` with your Supabase **session pooler** connection string (port **5432**, not 6543 \u2014 the transaction pooler wedges on interrupted calls).`],
+      ...process.env.DATABASE_URL ? ["1. **Restart your MCP client** to pick up the new config."] : [`1. **Set your DATABASE_URL** \u2014 replace \`<YOUR_DATABASE_URL>\` in \`${target.displayPath}\` with the connection string for the self-hosted Postgres/Auth stack you are running (production resolves this over the internal-only VPS tunnel \u2014 see \`infra/vps/self-host-runbook.md\`). This is not a managed Supabase pooler string.`],
       ...process.env.PAPI_USER_ID ? [] : ["2. **Set your PAPI_USER_ID** \u2014 replace `<YOUR_ACCOUNT_UUID>` with your account UUID (getpapi.ai \u2192 Settings \u2192 Account). Release and reviews use it to recognise you as the owner."],
       `${process.env.PAPI_USER_ID ? "2" : "3"}. **Run \`setup\`** \u2014 this scaffolds your project with a Product Brief, Active Decisions, and CLAUDE.md.`
     ].join("\n");
@@ -30394,6 +30514,9 @@ function formatWorkspaceModeLine(result) {
 }
 
 // src/services/health.ts
+function formatDegradedConnectionLabel() {
+  return getLastAdapterType() === "proxy" ? "connection degraded \u2014 data may be stale. Regenerate your config at https://getpapi.ai if this persists." : "connection degraded \u2014 data may be stale. Check DATABASE_URL in .mcp.json";
+}
 function computeZoomOutWarning(cycleNumber, lastZoomOutCycle) {
   if (cycleNumber <= 0) return "";
   const baseline = lastZoomOutCycle > 0 ? lastZoomOutCycle : 1;
@@ -31501,7 +31624,7 @@ function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoo
   lines.push("");
   if (health.connectionStatus !== "offline") {
     const statusIcon = health.connectionStatus === "connected" ? "\u2713" : "\u26A0\uFE0F";
-    const statusLabel = health.connectionStatus === "connected" ? "Supabase connected" : "Supabase degraded \u2014 data may be stale. Check DATABASE_URL in .mcp.json";
+    const statusLabel = health.connectionStatus === "connected" ? "connected" : formatDegradedConnectionLabel();
     lines.push(`**Connection:** ${statusIcon} ${statusLabel}`);
     lines.push("");
   }
@@ -32105,10 +32228,18 @@ async function handleOrient(rawAdapter, config2, args = {}, clientName, serverVe
         const handshake = buildHandshakeResult(proxyVersion);
         return handshake.mismatch && handshake.warning ? handshake.warning : void 0;
       }),
-      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles
+      // P1 stall warning: P1 High tasks in Backlog that haven't moved in 3+ cycles.
+      // task-3736: the read is scoped to the CALLER (unassigned-or-mine, the same
+      // predicate task-3397 pinned). Unscoped, a teammate's Backlog P1s were aged
+      // against the CALLER's cycle count — a member at cycle 372 reading a
+      // teammate's cycle-5 task as "367+ cycles" stalled. Cycle identity is
+      // (project_id, user_id, number) since task-3335; cross-member cycle-age
+      // arithmetic is meaningless. The caller's own unclaimed pool P1s still
+      // count — unclaimed work is everyone's to claim, and its createdCycle is
+      // the cycle that planned it.
       tracked("p1-stall", async () => {
         const p1BacklogTasks = await adapter2.queryBoard({ status: ["Backlog"], priority: ["P1 High"] });
-        const stalledP1 = p1BacklogTasks.filter(
+        const stalledP1 = scopeTasksToCaller(p1BacklogTasks, callerUserId).filter(
           (t) => t.createdCycle != null && currentCycle2 - t.createdCycle >= 3
         );
         if (stalledP1.length === 0) return void 0;
@@ -36285,8 +36416,11 @@ function startHttpTransport(opts) {
     const installClient = typeof clientHeader === "string" && KNOWN_INSTALL_CLIENTS.has(clientHeader) ? clientHeader : "direct";
     const projectIdHeader = req.headers["x-papi-project-id"];
     const projectId = typeof projectIdHeader === "string" && projectIdHeader.length > 0 ? projectIdHeader : void 0;
-    if (req.method !== "POST" && req.method !== "GET") {
-      sendError(res, { status: 405, body: { error: "Method not allowed" } });
+    if (req.method !== "POST") {
+      sendError(res, {
+        status: 405,
+        body: { error: "method_not_allowed", reason: "server does not support server-initiated SSE; use POST" }
+      });
       return;
     }
     const chunks = [];
@@ -36567,6 +36701,12 @@ async function dispatchRequest(args) {
   }
 }
 
+// src/lib/version-check.ts
+init_dist();
+function shouldCheckForUpdate(version, selfHostFlag) {
+  return version !== "unknown" && !isSelfHostedDeployment(selfHostFlag);
+}
+
 // src/index.ts
 init_dist();
 var __dirname = dirname7(fileURLToPath5(import.meta.url));
@@ -36711,7 +36851,7 @@ If you already have an account, check that both **PAPI_PROJECT_ID** and **PAPI_D
     }));
   }
 }
-if (pkgVersion !== "unknown") {
+if (shouldCheckForUpdate(pkgVersion, process.env["PAPI_SELF_HOST"])) {
   (async () => {
     try {
       const controller = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.105",
+  "version": "0.7.108",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",