@papi-ai/server 0.7.57 → 0.7.58

package/dist/index.js

@@ -8081,7 +8081,9 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-1. ORIENT FIRST. At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+
+1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
 2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
@@ -9301,7 +9303,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
@@ -10714,6 +10723,10 @@ function extractSearchTerms(title, notes) {
   }
   return terms.slice(0, 8);
 }
+function isDiscoveryTask(task) {
+  if (task.taskType === "discovery") return true;
+  return /^\s*\[auto-triaged\]/i.test(task.title);
+}
 function grepForTerm(projectRoot, term) {
   try {
     const result = execSync2(
@@ -10747,19 +10760,24 @@ function scanCodebaseForTasks(projectRoot, tasks) {
       }
     }
     if (matches.length > 0) {
-      results.push({ taskId: task.id, terms, matches });
+      results.push({ taskId: task.id, terms, matches, premiseUnverified: isDiscoveryTask(task) });
     }
     if (Date.now() - startTime > 5e3) break;
   }
   if (results.length === 0) return "";
   const elapsed = Date.now() - startTime;
   console.error(`[codebase-scan] scanned ${tasks.length} tasks in ${elapsed}ms \u2014 ${results.length} with matches`);
+  const flaggedCount = results.filter((r) => r.premiseUnverified).length;
+  const flagNote = flaggedCount > 0 ? ` \u2014 ${flaggedCount} discovery/auto-triaged task(s) flagged PREMISE-UNVERIFIED (verify before scheduling)` : "";
   const lines = [
-    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms):`,
+    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms)${flagNote}:`,
     ""
   ];
   for (const result of results) {
     lines.push(`**${result.taskId}:**`);
+    if (result.premiseUnverified) {
+      lines.push(`  \u26A0 PREMISE-UNVERIFIED: discovery/auto-triaged task whose premise references code already present in the repo \u2014 verify the premise still holds; it may already be resolved.`);
+    }
     for (const match of result.matches.slice(0, 3)) {
       const fileList = match.files.slice(0, 3).join(", ");
       const moreCount = match.files.length > 3 ? ` (+${match.files.length - 3} more)` : "";
@@ -12643,7 +12661,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
   t = startTimer();
   try {
     const scanTasks = await adapter2.queryBoard({ status: ["Backlog", "In Cycle", "Ready"], compact: true });
-    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes }));
+    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes, taskType: task.taskType }));
     const scanResult = scanCodebaseForTasks(config2.projectRoot, candidates);
     if (scanResult) context.codebaseScan = scanResult;
   } catch (err) {
@@ -18830,6 +18848,7 @@ init_telemetry();
 import { writeFile as writeFile3, readFile as readFile5 } from "fs/promises";
 import { join as join10 } from "path";
 import { execFileSync as execFileSync4 } from "child_process";
+import { isSensitiveChangelogLine } from "@papi-ai/shared";
 init_git();
 var INITIAL_RELEASE_NOTES = `# Changelog
 
@@ -18841,7 +18860,9 @@ All notable changes to this project are documented in this file.
 `;
 function generateChangelogSection(version, commits) {
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const filtered = commits.filter((c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c));
+  const filtered = commits.filter(
+    (c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c) && !isSensitiveChangelogLine(c)
+  );
   const commitList = filtered.map((c) => `- ${c}`).join("\n");
   return `## ${version} \u2014 ${date}
 
@@ -29212,6 +29233,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 var BEARER_PREFIX = "papi_";
 var BEARER_REGEX = /^(papi_|papi_oauth_)[a-f0-9]{64}$/;
 var RESOURCE_METADATA_URL = process.env["PAPI_RESOURCE_METADATA_URL"] ?? "https://getpapi.ai/.well-known/oauth-protected-resource";
+var GLAMA_MAINTAINER_EMAIL = process.env["GLAMA_MAINTAINER_EMAIL"] ?? "cathal@getpapi.ai";
 var DASHBOARD_ORIGIN = process.env["PAPI_DASHBOARD_URL"] ?? "https://getpapi.ai";
 var MCP_RESOURCE_URL = process.env["NEXT_PUBLIC_MCP_URL"] ?? "https://mcp.getpapi.ai";
 var FRIENDLY_GET_HTML = `<!doctype html>
@@ -29357,6 +29379,20 @@ function startHttpTransport(opts) {
       );
       return;
     }
+    if (req.method === "GET" && req.url === "/.well-known/glama.json") {
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "public, max-age=3600",
+        ...cors
+      });
+      res.end(
+        JSON.stringify({
+          $schema: "https://glama.ai/mcp/schemas/connector.json",
+          maintainers: [{ email: GLAMA_MAINTAINER_EMAIL }]
+        })
+      );
+      return;
+    }
     if (req.method === "GET" && req.url === "/.well-known/oauth-authorization-server") {
       res.writeHead(302, {
         Location: `${DASHBOARD_ORIGIN}/.well-known/oauth-authorization-server`,

package/dist/prompts.js

@@ -529,7 +529,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.57",
-  "description": "PAPI MCP server \u2014 AI-powered sprint planning, build execution, and strategy review for software projects",
+  "version": "0.7.58",
+  "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",
   "type": "module",