@papi-ai/server 0.7.106 → 0.7.108

package/dist/backfill-cycle-metrics.js

@@ -12,6 +12,10 @@ var __export = (target, all) => {
 function isSelfHostedDeployment(value) {
   return value === "1" || value?.toLowerCase() === "true";
 }
+function isFossilSupabaseReference(value) {
+  if (!value) return false;
+  return value.includes(".pooler.supabase.com") || value.includes(DECOMMISSIONED_SUPABASE_PROJECT_REF);
+}
 function optionalBoolean(value, fallback) {
   if (value == null || value.trim() === "") return fallback;
   return isSelfHostedDeployment(value);
@@ -94,10 +98,11 @@ function calculateCycleMetrics(reports, currentCycle, window = 5) {
   }
   return { accuracy, velocity, unparsedEffortCount };
 }
-var CAPABILITY_REGISTRY, CAPABILITY_KEYS, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, WAB_WINDOW_DAYS, WAB_WEEK_MS, EFFORT_SCALE;
+var DECOMMISSIONED_SUPABASE_PROJECT_REF, CAPABILITY_REGISTRY, CAPABILITY_KEYS, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, WAB_WINDOW_DAYS, WAB_WEEK_MS, EFFORT_SCALE;
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
+    DECOMMISSIONED_SUPABASE_PROJECT_REF = "guewgygcpcmrcoppihzx";
     CAPABILITY_REGISTRY = [
       // task-3384: the PLAN step. The landing page has advertised these three since
       // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
@@ -2854,6 +2859,11 @@ var PLACEHOLDER_PATTERNS = [
 ];
 function validateDatabaseUrl(connectionString) {
   const lower = connectionString.toLowerCase().trim();
+  if (isFossilSupabaseReference(connectionString)) {
+    throw new Error(
+      "This config points at PAPI's old hosted database, which was migrated.\nRegenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+    );
+  }
   if (PLACEHOLDER_PATTERNS.some((p) => lower.includes(p.toLowerCase()))) {
     throw new Error(
       "DATABASE_URL contains a placeholder value and is not configured.\nReplace it with your actual Supabase connection string in .mcp.json.\nIf you don't have one yet, contact the PAPI admin for access."
@@ -2868,10 +2878,12 @@ Check your .mcp.json configuration.`
   }
 }
 var _connectionStatus = "offline";
+var _lastAdapterType = null;
 var _pathIdentityChecked = false;
 async function createAdapter(optionsOrType, maybePapiDir) {
   const options = typeof optionsOrType === "string" ? { adapterType: optionsOrType, papiDir: maybePapiDir } : optionsOrType;
   const { adapterType, papiDir, papiEndpoint } = options;
+  _lastAdapterType = adapterType;
   switch (adapterType) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");

package/dist/index.js

@@ -14,6 +14,10 @@ import { randomUUID } from "crypto";
 function isSelfHostedDeployment(value) {
   return value === "1" || value?.toLowerCase() === "true";
 }
+function isFossilSupabaseReference(value) {
+  if (!value) return false;
+  return value.includes(".pooler.supabase.com") || value.includes(DECOMMISSIONED_SUPABASE_PROJECT_REF);
+}
 function isCapabilityEnabled(caps, key) {
   const stored = caps?.[key];
   if (stored != null) return stored !== false;
@@ -788,10 +792,11 @@ function parsePhaseBlock(block) {
   if (isNaN(order)) return null;
   return { id, slug, label, description, status, order };
 }
-var CAPABILITY_REGISTRY, CAPABILITY_KEYS, ASSIGNABLE_CONTRIBUTOR_ROLES, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, PROPOSAL_EVENT_TYPES, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, NONE_LEAD_RE, CONTRAST_LEAD_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
+var DECOMMISSIONED_SUPABASE_PROJECT_REF, CAPABILITY_REGISTRY, CAPABILITY_KEYS, ASSIGNABLE_CONTRIBUTOR_ROLES, SENSITIVE_CHANGELOG_PATTERNS, CONTRIBUTOR_PRICING_URL, PROPOSAL_EVENT_TYPES, HOSTED_APP_URL, HOSTED_MCP_URL, HOSTED_SUPABASE_URL, SEVERITY_ORDER, NONE_RE, AD_HOC_PLACEHOLDER_RE, NONE_LEAD_RE, CONTRAST_LEAD_RE, MIN_REASON_LENGTH, LOW_SEVERITIES, WAB_WINDOW_DAYS, WAB_DEFAULT_WEEKS, WAB_WEEK_MS, PRODUCT_MARKER, MECHANICS_MARKER, CHECK_VALUE_MAX, VALID_EFFORT_SIZES, SECTION_HEADERS, VALID_EFFORT_SIZES2, EFFORT_SCALE, NONE_PATTERN, NONE_PATTERN2, VALID_STATUSES, PHASES_START, PHASES_END;
 var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
+    DECOMMISSIONED_SUPABASE_PROJECT_REF = "guewgygcpcmrcoppihzx";
     CAPABILITY_REGISTRY = [
       // task-3384: the PLAN step. The landing page has advertised these three since
       // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
@@ -7175,6 +7180,11 @@ var PLACEHOLDER_PATTERNS = [
 ];
 function validateDatabaseUrl(connectionString) {
   const lower = connectionString.toLowerCase().trim();
+  if (isFossilSupabaseReference(connectionString)) {
+    throw new Error(
+      "This config points at PAPI's old hosted database, which was migrated.\nRegenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+    );
+  }
   if (PLACEHOLDER_PATTERNS.some((p) => lower.includes(p.toLowerCase()))) {
     throw new Error(
       "DATABASE_URL contains a placeholder value and is not configured.\nReplace it with your actual Supabase connection string in .mcp.json.\nIf you don't have one yet, contact the PAPI admin for access."
@@ -7189,6 +7199,10 @@ Check your .mcp.json configuration.`
   }
 }
 var _connectionStatus = "offline";
+var _lastAdapterType = null;
+function getLastAdapterType() {
+  return _lastAdapterType;
+}
 var _pathIdentityChecked = false;
 function getConnectionStatus() {
   return _connectionStatus;
@@ -7196,6 +7210,7 @@ function getConnectionStatus() {
 async function createAdapter(optionsOrType, maybePapiDir) {
   const options = typeof optionsOrType === "string" ? { adapterType: optionsOrType, papiDir: maybePapiDir } : optionsOrType;
   const { adapterType, papiDir, papiEndpoint } = options;
+  _lastAdapterType = adapterType;
   switch (adapterType) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");
@@ -12410,6 +12425,19 @@ ${cleanContent}`;
       `task-3670 self-heal: ${repairedCycles.length} task(s) had lost cycle membership and were re-assigned (${repairedCycles.join(", ")})`
     );
   }
+  let health;
+  try {
+    health = await adapter2.getCycleHealth?.();
+  } catch (err) {
+    verifyWarnings.push(
+      `task-3733: could not re-verify the cycle row after write (${err instanceof Error ? err.message : String(err)}) \u2014 cycle membership was written and repaired, but this final check could not confirm it.`
+    );
+  }
+  if (health && health.totalCycles !== newCycleNumber) {
+    throw new Error(
+      `Plan apply committed, but the cycle row for Cycle ${newCycleNumber} did not take: getCycleHealth() reports the caller's current cycle as ${health.totalCycles}. Task assignments were written and repaired, but the cycle entity itself is stale \u2014 investigate the planWriteBack cycle upsert before trusting this apply.`
+    );
+  }
   const allWarnings = [...result.warnings, ...verifyWarnings, ...earlyCreateWarnings];
   const handoffCount = data.cycleHandoffs?.length ?? 0;
   const correctionCount = data.boardCorrections?.length ?? 0;
@@ -22097,60 +22125,87 @@ Releasing to a non-base branch (e.g. dev) is unaffected.` + resolutionNote
         }
         const releaseRole = callerRole === "release_manager" ? "release manager" : "editor";
         tracker.mark("contributor-pr-reconciliation");
+        const closeContributorCycle = (cycleOverride) => closeCycleState(
+          config2,
+          adapter2,
+          version,
+          cycleOverride ?? cycleToClose ?? void 0,
+          {
+            force: force ?? false,
+            skipVersion: skipVersion ?? false,
+            callerUserId: gate.callerUserId
+          }
+        );
+        let reconciled = null;
         try {
-          const reconciled = await reconcileContributorReleasePrs(config2, adapter2, gate.callerUserId, cycleToClose);
-          if (reconciled.merged.length > 0) {
-            const latest = reconciled.merged[0];
-            let caps2 = {};
-            try {
-              const info = adapter2.getProjectInfo ? await adapter2.getProjectInfo() : null;
-              caps2 = info?.capabilities ?? {};
-            } catch {
-              caps2 = {};
-            }
-            await recordReadinessVerified(tracker);
-            await recordQualityGate(tracker, evaluateReleaseGate(caps2, config2.gateCommand, gateResult), caps2);
-            await completeRelease(tracker, {
-              cycleClosed: latest.cycle,
-              version,
-              caps: caps2,
-              branchMerges: latest.branch ? [{ branch: latest.branch, prUrl: latest.prUrl }] : [],
-              changelogEmitted: false
-            });
-            const localHandoff = isHostedTransport() ? `
+          reconciled = await reconcileContributorReleasePrs(config2, adapter2, gate.callerUserId, cycleToClose);
+        } catch (err) {
+          console.error(`[release] contributor PR reconciliation failed (non-blocking): ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (reconciled?.merged.length) {
+          const latest = reconciled.merged[0];
+          let caps2 = {};
+          try {
+            const info = adapter2.getProjectInfo ? await adapter2.getProjectInfo() : null;
+            caps2 = info?.capabilities ?? {};
+          } catch {
+            caps2 = {};
+          }
+          let closed;
+          try {
+            closed = await closeContributorCycle(latest.cycle);
+          } catch (err) {
+            return errorResponse(err instanceof Error ? err.message : String(err));
+          }
+          await recordReadinessVerified(tracker);
+          await recordQualityGate(tracker, evaluateReleaseGate(caps2, config2.gateCommand, gateResult), caps2);
+          await completeRelease(tracker, {
+            cycleClosed: closed.resolvedCycleNum > 0 ? closed.resolvedCycleNum : latest.cycle,
+            version,
+            caps: caps2,
+            branchMerges: latest.branch ? [{ branch: latest.branch, prUrl: latest.prUrl }] : [],
+            changelogEmitted: false
+          });
+          const localHandoff = isHostedTransport() ? `
 ${buildHostedGitDirective({
-              version,
-              branch,
-              skipVersion: skipVersion ?? false,
-              harnessCanBuild: detectHarness(clientName).build,
-              harnessKnown: detectHarness(clientName).known,
-              harnessLabel: detectHarness(clientName).label,
-              changelogSection: null
-            })}` : "";
-            return textResponse(
-              `## Release ${version} \u2014 contributor PR merged
+            version,
+            branch,
+            skipVersion: skipVersion ?? false,
+            harnessCanBuild: detectHarness(clientName).build,
+            harnessKnown: detectHarness(clientName).known,
+            harnessLabel: detectHarness(clientName).label,
+            changelogSection: null
+          })}` : "";
+          const cycleLabel = closed.resolvedCycleNum > 0 ? `Cycle ${closed.resolvedCycleNum}` : latest.cycle ? `Cycle ${latest.cycle}` : "The contributor cycle";
+          return textResponse(
+            `## Release ${version} \u2014 contributor PR merged
 
 PAPI detected that ${latest.prUrl} was merged on GitHub and reconciled the contributor release. GitHub granted the merge permission; your PAPI **${releaseRole}** role granted the release workflow.
 
-${latest.cycle ? `Cycle ${latest.cycle}` : "The contributor cycle"} remains **complete**, and the release is now recorded as **released** in PAPI.` + localHandoff + `
+${cycleLabel} remains **complete**, and the release is now recorded as **released** in PAPI.` + localHandoff + `
 
 Next: run \`plan\` to start your next cycle.`
-            );
+          );
+        }
+        if (reconciled?.open.length) {
+          const openCycle = cycleToClose !== null ? reconciled.open.find((pr) => pr.cycle === cycleToClose)?.cycle ?? null : reconciled.open[0].cycle;
+          if (openCycle !== null && openCycle !== void 0) {
+            try {
+              await closeContributorCycle(openCycle);
+            } catch (err) {
+              return errorResponse(err instanceof Error ? err.message : String(err));
+            }
           }
-          if (reconciled.open.length > 0) {
-            const prLines = reconciled.open.map((p) => `- ${p.prUrl}`).join("\n");
-            return textResponse(
-              `## Release ${version} \u2014 contributor PR awaiting merge
+          const prLines = reconciled.open.map((p) => `- ${p.prUrl}`).join("\n");
+          return textResponse(
+            `## Release ${version} \u2014 contributor PR awaiting merge
 
 ${prLines}
 
 Your PAPI **${releaseRole}** role allowed this release PR. Merge permission is controlled separately by GitHub: if GitHub lets you merge, review and merge it there; otherwise a repository maintainer must merge it.
 
 After it is merged, run \`release\` again so PAPI can detect the merge and finish the release record.`
-            );
-          }
-        } catch (err) {
-          console.error(`[release] contributor PR reconciliation failed (non-blocking): ${err instanceof Error ? err.message : String(err)}`);
+          );
         }
         if (isHostedTransport()) {
           return errorResponse(
@@ -23089,7 +23144,7 @@ function getUnresolvedDeps(task, allTasks) {
   const taskStatusMap = new Map(allTasks.map((t) => [t.id, t.status]));
   return deps.filter((depId) => {
     const status = taskStatusMap.get(depId);
-    return status !== "Done";
+    return status !== "Done" && status !== "Cancelled" && status !== "Archived";
   });
 }
 function resolveDepCycleBranch(cycleBranches, cycleNumber, upstreamModule, dependentModule) {
@@ -29912,6 +29967,30 @@ async function handleReviewClaim(adapter2, config2, args) {
 import { randomUUID as randomUUID12 } from "crypto";
 import { access as access2, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
 import path6 from "path";
+init_dist();
+var FOSSIL_CONFIG_MESSAGE = [
+  "This config points at PAPI's old hosted database, which was migrated.",
+  "Regenerate your config at https://getpapi.ai \u2014 your projects and data are intact."
+].join("\n");
+function extractPapiOwnedConfigText(existingConfig, agent) {
+  if (agent === "codex") {
+    const match = existingConfig.match(/\[mcp_servers\.papi\][\s\S]*?(?=\n\[|$)/);
+    return match ? match[0] : existingConfig;
+  }
+  if (agent === "hermes") {
+    const match = existingConfig.match(/^[ \t]*papi[ \t]*:[\s\S]*?(?=\n[ \t]{0,2}\S[^\n]*:[ \t]*$|$)/m);
+    return match ? match[0] : existingConfig;
+  }
+  try {
+    const parsed = JSON.parse(existingConfig);
+    const container = parsed.mcpServers ?? parsed.servers ?? parsed.mcp;
+    const papiEntry = container?.papi;
+    const env = papiEntry?.env ?? papiEntry?.environment;
+    if (env) return JSON.stringify(env);
+  } catch {
+  }
+  return existingConfig;
+}
 var initTool = {
   name: "init",
   description: "Write the MCP config file that connects this project to PAPI. Generates .mcp.json, or the equivalent for whichever MCP client you use \u2014 Claude Code, Cursor, VS Code, Windsurf, OpenCode, Amazon Q, Kilo Code, Gemini CLI, Codex CLI, or Hermes Agent. Config-only \u2014 does not create any project data. Run this first, then run `setup` to create your PAPI project.",
@@ -30188,6 +30267,11 @@ async function handleInit(config2, args) {
     await access2(mcpJsonPath);
     existingConfig = await readFile5(mcpJsonPath, "utf-8");
   } catch {
+  }
+  if (existingConfig && isFossilSupabaseReference(extractPapiOwnedConfigText(existingConfig, agent))) {
+    return errorResponse(`${FOSSIL_CONFIG_MESSAGE}
+
+Path: ${mcpJsonPath}`);
   }
   if (existingConfig && !force) {
     const hasPapiServer = (() => {
@@ -30341,6 +30425,9 @@ ${writeNote}
 ` + formatFilesToWriteSection(collector)
     );
   }
+  if (isDatabaseUser && isFossilSupabaseReference(process.env.DATABASE_URL)) {
+    return errorResponse(FOSSIL_CONFIG_MESSAGE);
+  }
   if (isDatabaseUser) {
     const projectId = randomUUID12();
     const envVars = {
@@ -30379,7 +30466,7 @@ ${writeNote}
       "",
       "## Next Steps",
       "",
-      ...process.env.DATABASE_URL ? ["1. **Restart your MCP client** to pick up the new config."] : [`1. **Set your DATABASE_URL** \u2014 replace \`<YOUR_DATABASE_URL>\` in \`${target.displayPath}\` with your Supabase **session pooler** connection string (port **5432**, not 6543 \u2014 the transaction pooler wedges on interrupted calls).`],
+      ...process.env.DATABASE_URL ? ["1. **Restart your MCP client** to pick up the new config."] : [`1. **Set your DATABASE_URL** \u2014 replace \`<YOUR_DATABASE_URL>\` in \`${target.displayPath}\` with the connection string for the self-hosted Postgres/Auth stack you are running (production resolves this over the internal-only VPS tunnel \u2014 see \`infra/vps/self-host-runbook.md\`). This is not a managed Supabase pooler string.`],
       ...process.env.PAPI_USER_ID ? [] : ["2. **Set your PAPI_USER_ID** \u2014 replace `<YOUR_ACCOUNT_UUID>` with your account UUID (getpapi.ai \u2192 Settings \u2192 Account). Release and reviews use it to recognise you as the owner."],
       `${process.env.PAPI_USER_ID ? "2" : "3"}. **Run \`setup\`** \u2014 this scaffolds your project with a Product Brief, Active Decisions, and CLAUDE.md.`
     ].join("\n");
@@ -30427,6 +30514,9 @@ function formatWorkspaceModeLine(result) {
 }
 
 // src/services/health.ts
+function formatDegradedConnectionLabel() {
+  return getLastAdapterType() === "proxy" ? "connection degraded \u2014 data may be stale. Regenerate your config at https://getpapi.ai if this persists." : "connection degraded \u2014 data may be stale. Check DATABASE_URL in .mcp.json";
+}
 function computeZoomOutWarning(cycleNumber, lastZoomOutCycle) {
   if (cycleNumber <= 0) return "";
   const baseline = lastZoomOutCycle > 0 ? lastZoomOutCycle : 1;
@@ -31534,7 +31624,7 @@ function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoo
   lines.push("");
   if (health.connectionStatus !== "offline") {
     const statusIcon = health.connectionStatus === "connected" ? "\u2713" : "\u26A0\uFE0F";
-    const statusLabel = health.connectionStatus === "connected" ? "Supabase connected" : "Supabase degraded \u2014 data may be stale. Check DATABASE_URL in .mcp.json";
+    const statusLabel = health.connectionStatus === "connected" ? "connected" : formatDegradedConnectionLabel();
     lines.push(`**Connection:** ${statusIcon} ${statusLabel}`);
     lines.push("");
   }
@@ -36326,8 +36416,11 @@ function startHttpTransport(opts) {
     const installClient = typeof clientHeader === "string" && KNOWN_INSTALL_CLIENTS.has(clientHeader) ? clientHeader : "direct";
     const projectIdHeader = req.headers["x-papi-project-id"];
     const projectId = typeof projectIdHeader === "string" && projectIdHeader.length > 0 ? projectIdHeader : void 0;
-    if (req.method !== "POST" && req.method !== "GET") {
-      sendError(res, { status: 405, body: { error: "Method not allowed" } });
+    if (req.method !== "POST") {
+      sendError(res, {
+        status: 405,
+        body: { error: "method_not_allowed", reason: "server does not support server-initiated SSE; use POST" }
+      });
       return;
     }
     const chunks = [];
@@ -36608,6 +36701,12 @@ async function dispatchRequest(args) {
   }
 }
 
+// src/lib/version-check.ts
+init_dist();
+function shouldCheckForUpdate(version, selfHostFlag) {
+  return version !== "unknown" && !isSelfHostedDeployment(selfHostFlag);
+}
+
 // src/index.ts
 init_dist();
 var __dirname = dirname7(fileURLToPath5(import.meta.url));
@@ -36752,7 +36851,7 @@ If you already have an account, check that both **PAPI_PROJECT_ID** and **PAPI_D
     }));
   }
 }
-if (pkgVersion !== "unknown") {
+if (shouldCheckForUpdate(pkgVersion, process.env["PAPI_SELF_HOST"])) {
   (async () => {
     try {
       const controller = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.106",
+  "version": "0.7.108",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",