@papi-ai/server 0.7.56 → 0.7.58

package/dist/index.js

@@ -8081,7 +8081,9 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-1. ORIENT FIRST. At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+
+1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
 2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
@@ -8425,6 +8427,21 @@ function computeCycleEffort(cycleTaskRows, cycleReports) {
 function velocityPoints(v) {
   return v.deliveredPoints ?? v.effortPoints;
 }
+function resolveCompletedCycleDates(existingStart, earliestActivity, now) {
+  const startDate = existingStart || earliestActivity || now;
+  const startMs = Date.parse(startDate);
+  const endMs = Date.parse(now);
+  const known = Number.isFinite(startMs) && Number.isFinite(endMs) && startMs < endMs;
+  return { startDate, endDate: known ? now : null };
+}
+function earliestCycleActivity(reports) {
+  let earliest;
+  for (const r of reports) {
+    const ts = r.startedAt || r.createdAt || r.date;
+    if (ts && (!earliest || Date.parse(ts) < Date.parse(earliest))) earliest = ts;
+  }
+  return earliest;
+}
 function computeSnapshotsFromBuildReports(reports, tasks) {
   const reportsByCycle = /* @__PURE__ */ new Map();
   for (const r of reports) {
@@ -8826,7 +8843,7 @@ PRE-BUILD VERIFICATION
 [List 2-5 specific file paths the builder should read BEFORE implementing to check if the functionality already exists. Derive these from FILES LIKELY TOUCHED \u2014 pick the files most likely to already contain the target functionality. ALSO mandate a docs sweep, not just file-existence (task-2161): name any docs the builder should check via doc_search or the docs index \u2014 a design/research/status:final doc or a prior task may already cover the work. If >80% of the scope is already implemented, the builder should report "already built" instead of re-implementing. Include this section for EVERY task \u2014 it prevents wasted build slots on already-shipped code.]
 
 FILES LIKELY TOUCHED
-[files]
+[files \u2014 real paths only. TEST FILE LOCATIONS (task-2606): PAPI tests are NOT co-located next to source in a src/**/__tests__/ folder. Use the actual layout: server tests \u2192 packages/server/tests/<name>.test.ts; adapter-pg tests \u2192 packages/adapter-pg/src/__tests__/<name>.test.ts; dashboard/root tests \u2192 tests/<area>/<name>.test.ts. Do NOT invent packages/server/src/**/__tests__/ paths \u2014 they do not exist.]
 
 EFFORT
 [XS/S/M/L/XL]
@@ -9286,7 +9303,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
@@ -9983,7 +10007,7 @@ REFERENCE DOCS
 [Optional \u2014 paths to docs/ files with background context. Omit if not needed.]
 
 FILES LIKELY TOUCHED
-[files]
+[files \u2014 real paths only. TEST FILE LOCATIONS (task-2606): PAPI tests are NOT co-located next to source in a src/**/__tests__/ folder. Use the actual layout: server tests \u2192 packages/server/tests/<name>.test.ts; adapter-pg tests \u2192 packages/adapter-pg/src/__tests__/<name>.test.ts; dashboard/root tests \u2192 tests/<area>/<name>.test.ts. Do NOT invent packages/server/src/**/__tests__/ paths \u2014 they do not exist.]
 
 EFFORT
 [XS/S/M/L/XL]`;
@@ -10699,6 +10723,10 @@ function extractSearchTerms(title, notes) {
   }
   return terms.slice(0, 8);
 }
+function isDiscoveryTask(task) {
+  if (task.taskType === "discovery") return true;
+  return /^\s*\[auto-triaged\]/i.test(task.title);
+}
 function grepForTerm(projectRoot, term) {
   try {
     const result = execSync2(
@@ -10732,19 +10760,24 @@ function scanCodebaseForTasks(projectRoot, tasks) {
       }
     }
     if (matches.length > 0) {
-      results.push({ taskId: task.id, terms, matches });
+      results.push({ taskId: task.id, terms, matches, premiseUnverified: isDiscoveryTask(task) });
     }
     if (Date.now() - startTime > 5e3) break;
   }
   if (results.length === 0) return "";
   const elapsed = Date.now() - startTime;
   console.error(`[codebase-scan] scanned ${tasks.length} tasks in ${elapsed}ms \u2014 ${results.length} with matches`);
+  const flaggedCount = results.filter((r) => r.premiseUnverified).length;
+  const flagNote = flaggedCount > 0 ? ` \u2014 ${flaggedCount} discovery/auto-triaged task(s) flagged PREMISE-UNVERIFIED (verify before scheduling)` : "";
   const lines = [
-    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms):`,
+    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms)${flagNote}:`,
     ""
   ];
   for (const result of results) {
     lines.push(`**${result.taskId}:**`);
+    if (result.premiseUnverified) {
+      lines.push(`  \u26A0 PREMISE-UNVERIFIED: discovery/auto-triaged task whose premise references code already present in the repo \u2014 verify the premise still holds; it may already be resolved.`);
+    }
     for (const match of result.matches.slice(0, 3)) {
       const fileList = match.files.slice(0, 3).join(", ");
       const moreCount = match.files.length > 3 ? ` (+${match.files.length - 3} more)` : "";
@@ -12628,7 +12661,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
   t = startTimer();
   try {
     const scanTasks = await adapter2.queryBoard({ status: ["Backlog", "In Cycle", "Ready"], compact: true });
-    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes }));
+    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes, taskType: task.taskType }));
     const scanResult = scanCodebaseForTasks(config2.projectRoot, candidates);
     if (scanResult) context.codebaseScan = scanResult;
   } catch (err) {
@@ -18815,6 +18848,7 @@ init_telemetry();
 import { writeFile as writeFile3, readFile as readFile5 } from "fs/promises";
 import { join as join10 } from "path";
 import { execFileSync as execFileSync4 } from "child_process";
+import { isSensitiveChangelogLine } from "@papi-ai/shared";
 init_git();
 var INITIAL_RELEASE_NOTES = `# Changelog
 
@@ -18826,7 +18860,9 @@ All notable changes to this project are documented in this file.
 `;
 function generateChangelogSection(version, commits) {
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const filtered = commits.filter((c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c));
+  const filtered = commits.filter(
+    (c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c) && !isSensitiveChangelogLine(c)
+  );
   const commitList = filtered.map((c) => `- ${c}`).join("\n");
   return `## ${version} \u2014 ${date}
 
@@ -19056,20 +19092,11 @@ To override, pass force=true (emits a telemetry warning).`
         existing = (await adapter2.readCycles()).find((c) => c.number === currentCycle);
       } catch {
       }
-      const completedCycle = {
-        id: `cycle-${currentCycle}`,
-        number: currentCycle,
-        status: "complete",
-        startDate: existing?.startDate ?? (/* @__PURE__ */ new Date()).toISOString(),
-        endDate: (/* @__PURE__ */ new Date()).toISOString(),
-        goals: existing?.goals ?? [],
-        boardHealth: existing?.boardHealth ?? "",
-        taskIds: existing?.taskIds ?? []
-      };
       let snapshot;
+      let cycleReports = [];
       if (adapter2.getBuildReportsSince) {
         try {
-          const cycleReports = (await adapter2.getBuildReportsSince(currentCycle)).filter((r) => r.cycle === currentCycle);
+          cycleReports = (await adapter2.getBuildReportsSince(currentCycle)).filter((r) => r.cycle === currentCycle);
           const cycleTasks = (await adapter2.queryBoard({ cycleSince: currentCycle, compact: true })).filter((t) => t.cycle === currentCycle);
           [snapshot] = computeSnapshotsFromBuildReports(cycleReports, cycleTasks);
         } catch (err) {
@@ -19078,6 +19105,22 @@ To override, pass force=true (emits a telemetry warning).`
           );
         }
       }
+      const releaseNow = (/* @__PURE__ */ new Date()).toISOString();
+      const { startDate: resolvedStart, endDate: resolvedEnd } = resolveCompletedCycleDates(
+        existing?.startDate,
+        earliestCycleActivity(cycleReports),
+        releaseNow
+      );
+      const completedCycle = {
+        id: `cycle-${currentCycle}`,
+        number: currentCycle,
+        status: "complete",
+        startDate: resolvedStart,
+        endDate: resolvedEnd ?? void 0,
+        goals: existing?.goals ?? [],
+        boardHealth: existing?.boardHealth ?? "",
+        taskIds: existing?.taskIds ?? []
+      };
       if (typeof adapter2.commitRelease === "function") {
         try {
           await adapter2.commitRelease({ cycle: completedCycle, snapshot: snapshot ?? null });
@@ -25782,6 +25825,50 @@ function countStalledP1(warnings) {
   const matches = stallLine.match(/task-\d+/g);
   return matches ? matches.length : 0;
 }
+function truncateTaskTitle(title, max = 55) {
+  const t = (title ?? "").trim();
+  if (!t) return "untitled";
+  if (t.length <= max) return t;
+  return t.slice(0, max - 1).trimEnd() + "\u2026";
+}
+async function resolveCarryForwardRefs(carryForward, tasks, adapter2) {
+  const refs = /* @__PURE__ */ new Map();
+  const ids = carryForward?.match(/\btask-\d+\b/g);
+  if (!ids) return refs;
+  const unique = [...new Set(ids)];
+  const byId = new Map(tasks.filter((t) => t.displayId).map((t) => [t.displayId, t]));
+  const missing = [];
+  for (const id of unique) {
+    const t = byId.get(id);
+    if (t) refs.set(id, { title: t.title, status: t.status });
+    else missing.push(id);
+  }
+  if (missing.length > 0 && adapter2?.getTasks) {
+    try {
+      const fetched = await adapter2.getTasks(missing);
+      for (const t of fetched) {
+        if (t.displayId) refs.set(t.displayId, { title: t.title, status: t.status });
+      }
+    } catch {
+    }
+  }
+  return refs;
+}
+function annotateTaskRefs(text, refs) {
+  if (!text || refs.size === 0) return text;
+  const RESOLVED = /* @__PURE__ */ new Set(["Done", "Cancelled"]);
+  return text.replace(/\btask-\d+\b(?!\s*[(—–-])/g, (id, offset, full) => {
+    const ref = refs.get(id);
+    if (!ref) return id;
+    const rest = full.slice(offset + id.length);
+    if (/^\s*[(—–-]/.test(rest)) return id;
+    const resolved = ref.status && RESOLVED.has(ref.status);
+    const titlePart = ref.title ? ` \u2014 ${truncateTaskTitle(ref.title)}` : "";
+    const statusPart = resolved ? ` [\u2713 ${ref.status}]` : "";
+    if (!titlePart && !statusPart) return id;
+    return `${id}${titlePart}${statusPart}`;
+  });
+}
 function formatSynthesisParagraph(opts) {
   const parts = [];
   parts.push(
@@ -25801,7 +25888,7 @@ function formatSynthesisParagraph(opts) {
   parts.push(`Next: ${cleanMode}`);
   return parts.join(" ");
 }
-function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoot, environment = "unknown", subAgents = [], projectName, teamSummary, clientName) {
+function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoot, environment = "unknown", subAgents = [], projectName, teamSummary, clientName, taskRefs = /* @__PURE__ */ new Map()) {
   const lines = [];
   const cycleIsComplete = health.latestCycleStatus === "complete";
   const tagSuffix = latestTag ? ` \u2014 ${latestTag}` : "";
@@ -25944,7 +26031,7 @@ function formatOrientSummary(health, buildInfo, hierarchy, latestTag, projectRoo
   const hasCarryForward = health.carryForward !== "None found" && !health.carryForward.startsWith("No carry-forward");
   if (hasCarryForward) {
     lines.push("## Carry-Forward");
-    lines.push(health.carryForward);
+    lines.push(annotateTaskRefs(health.carryForward, taskRefs));
     lines.push("");
   }
   const hasMetrics = health.metricsSection !== "Could not read methodology metrics." && !health.metricsSection.includes("undefined");
@@ -26233,7 +26320,7 @@ async function handleOrient(adapter2, config2, args = {}, clientName) {
           (t) => t.createdCycle != null && currentCycle - t.createdCycle >= 3
         );
         if (stalledP1.length === 0) return void 0;
-        const ids = stalledP1.map((t) => `${t.displayId} (${currentCycle - (t.createdCycle ?? currentCycle)}+ cycles)`).join(", ");
+        const ids = stalledP1.map((t) => `${t.displayId} \u2014 ${truncateTaskTitle(t.title)} (${currentCycle - (t.createdCycle ?? currentCycle)}+ cycles)`).join(", ");
         return `\u26A0\uFE0F P1 tasks stalled 3+ cycles: ${ids}`;
       }),
       // task-1917 (C280): Owner Action Queue surface. Counts the user's open
@@ -26251,10 +26338,12 @@ async function handleOrient(adapter2, config2, args = {}, clientName) {
           let dueSuffix = "";
           if (adapter2.countDueOwnerActions) {
             const due = await adapter2.countDueOwnerActions(userId, projectId);
-            const parts = [];
-            if (due.dueToday > 0) parts.push(`${due.dueToday} due today`);
-            if (due.overdue > 0) parts.push(`${due.overdue} overdue`);
-            if (parts.length > 0) dueSuffix = ` (${parts.join(", ")})`;
+            if (due.urgent > 0) {
+              const detail = [];
+              if (due.overdue > 0) detail.push(`${due.overdue} overdue`);
+              if (due.dueToday > 0) detail.push(`${due.dueToday} due today`);
+              dueSuffix = detail.length > 0 ? ` (${due.urgent} need you now \u2014 ${detail.join(", ")})` : ` (${due.urgent} need you now)`;
+            }
           }
           return `\u26A0\uFE0F ${count} action${count === 1 ? "" : "s"} waiting on you${dueSuffix} \u2014 open /hub to triage the Owner Action Queue.`;
         } catch {
@@ -26657,7 +26746,8 @@ ${section}`;
     ]);
     const teamSummary = [teamSummaryLine, releaseHistoryLine].filter(Boolean).join("\n") || void 0;
     const deepHint = deepHousekeeping ? "" : "\n\n*Tip: pass `full: true` for Research Signals + version-drift, or `deep_housekeeping: true` to also check orphaned branches, merged-but-In-Progress tasks, unrecorded commits, unregistered docs, and stale skill forks (implies `full`).*";
-    return textResponse(projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment, subAgents, projectName, teamSummary, clientName) + unblockNote + deferredGateNote + feedbackResolvedNote + alertsNote + ttfvNote + reconciliationNote + mergedInProgressNote + unrecordedNote + unregisteredDocsNote + staleSkillsNote + researchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + deepHint + enrichmentFilesSection);
+    const carryForwardRefs = await resolveCarryForwardRefs(healthResult.carryForward, allTasks, adapter2);
+    return textResponse(projectBannerNote + formatOrientSummary(healthResult, buildInfo, hierarchy, latestTag, config2.projectRoot, environment, subAgents, projectName, teamSummary, clientName, carryForwardRefs) + unblockNote + deferredGateNote + feedbackResolvedNote + alertsNote + ttfvNote + reconciliationNote + mergedInProgressNote + unrecordedNote + unregisteredDocsNote + staleSkillsNote + researchSignalsNote + recsNote + pendingReviewNote + patternsNote + unactionedIssuesNote + skillProposalsNote + sessionGuidanceNote + versionNote + enrichmentNote + deliveryShapeNote + preBuildCheckNote + deepHint + enrichmentFilesSection);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     const isKnownFriendly = /^(Orient failed|Project not found|No project|Setup required)/i.test(message);
@@ -29143,6 +29233,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 var BEARER_PREFIX = "papi_";
 var BEARER_REGEX = /^(papi_|papi_oauth_)[a-f0-9]{64}$/;
 var RESOURCE_METADATA_URL = process.env["PAPI_RESOURCE_METADATA_URL"] ?? "https://getpapi.ai/.well-known/oauth-protected-resource";
+var GLAMA_MAINTAINER_EMAIL = process.env["GLAMA_MAINTAINER_EMAIL"] ?? "cathal@getpapi.ai";
 var DASHBOARD_ORIGIN = process.env["PAPI_DASHBOARD_URL"] ?? "https://getpapi.ai";
 var MCP_RESOURCE_URL = process.env["NEXT_PUBLIC_MCP_URL"] ?? "https://mcp.getpapi.ai";
 var FRIENDLY_GET_HTML = `<!doctype html>
@@ -29288,6 +29379,20 @@ function startHttpTransport(opts) {
       );
       return;
     }
+    if (req.method === "GET" && req.url === "/.well-known/glama.json") {
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "public, max-age=3600",
+        ...cors
+      });
+      res.end(
+        JSON.stringify({
+          $schema: "https://glama.ai/mcp/schemas/connector.json",
+          maintainers: [{ email: GLAMA_MAINTAINER_EMAIL }]
+        })
+      );
+      return;
+    }
     if (req.method === "GET" && req.url === "/.well-known/oauth-authorization-server") {
       res.writeHead(302, {
         Location: `${DASHBOARD_ORIGIN}/.well-known/oauth-authorization-server`,

package/dist/prompts.js

@@ -69,7 +69,7 @@ PRE-BUILD VERIFICATION
 [List 2-5 specific file paths the builder should read BEFORE implementing to check if the functionality already exists. Derive these from FILES LIKELY TOUCHED \u2014 pick the files most likely to already contain the target functionality. ALSO mandate a docs sweep, not just file-existence (task-2161): name any docs the builder should check via doc_search or the docs index \u2014 a design/research/status:final doc or a prior task may already cover the work. If >80% of the scope is already implemented, the builder should report "already built" instead of re-implementing. Include this section for EVERY task \u2014 it prevents wasted build slots on already-shipped code.]
 
 FILES LIKELY TOUCHED
-[files]
+[files \u2014 real paths only. TEST FILE LOCATIONS (task-2606): PAPI tests are NOT co-located next to source in a src/**/__tests__/ folder. Use the actual layout: server tests \u2192 packages/server/tests/<name>.test.ts; adapter-pg tests \u2192 packages/adapter-pg/src/__tests__/<name>.test.ts; dashboard/root tests \u2192 tests/<area>/<name>.test.ts. Do NOT invent packages/server/src/**/__tests__/ paths \u2014 they do not exist.]
 
 EFFORT
 [XS/S/M/L/XL]
@@ -529,7 +529,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
@@ -1226,7 +1233,7 @@ REFERENCE DOCS
 [Optional \u2014 paths to docs/ files with background context. Omit if not needed.]
 
 FILES LIKELY TOUCHED
-[files]
+[files \u2014 real paths only. TEST FILE LOCATIONS (task-2606): PAPI tests are NOT co-located next to source in a src/**/__tests__/ folder. Use the actual layout: server tests \u2192 packages/server/tests/<name>.test.ts; adapter-pg tests \u2192 packages/adapter-pg/src/__tests__/<name>.test.ts; dashboard/root tests \u2192 tests/<area>/<name>.test.ts. Do NOT invent packages/server/src/**/__tests__/ paths \u2014 they do not exist.]
 
 EFFORT
 [XS/S/M/L/XL]`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.56",
+  "version": "0.7.58",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",