@papi-ai/server 0.7.57 → 0.7.59

package/dist/index.js

@@ -8081,7 +8081,9 @@ import {
 // src/universal-frame.ts
 var UNIVERSAL_FRAME = `PAPI gives this project a structured plan \u2192 build \u2192 review cycle, persisted across sessions. Follow it:
 
-1. ORIENT FIRST. At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
+0. NEW HERE? If PAPI has never been set up for this project (no cycles yet, or \`orient\` says the board is empty), call \`setup\` FIRST \u2014 it generates the Product Brief and scaffolds the workflow. Then run \`plan\` to create the first cycle. This is the required first step for a brand-new project; everything below assumes setup has already run.
+
+1. ORIENT FIRST (once set up). At the start of every session, call \`orient\` (or \`papi\`) before anything else \u2014 it returns the current cycle, what's in flight, and the recommended next action. Re-run it after any context compression.
 
 2. THE CYCLE, IN ORDER: \`plan\` (once per cycle) \u2192 \`build_list\` (pick a task) \u2192 \`build_execute <task>\` to start \u2192 implement the task from its BUILD HANDOFF \u2192 \`build_execute\` again to complete with a build report \u2192 \`review_submit\` \u2192 \`release\` when every cycle task is done.
 
@@ -9301,7 +9303,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");
@@ -10714,6 +10723,10 @@ function extractSearchTerms(title, notes) {
   }
   return terms.slice(0, 8);
 }
+function isDiscoveryTask(task) {
+  if (task.taskType === "discovery") return true;
+  return /^\s*\[auto-triaged\]/i.test(task.title);
+}
 function grepForTerm(projectRoot, term) {
   try {
     const result = execSync2(
@@ -10747,19 +10760,24 @@ function scanCodebaseForTasks(projectRoot, tasks) {
       }
     }
     if (matches.length > 0) {
-      results.push({ taskId: task.id, terms, matches });
+      results.push({ taskId: task.id, terms, matches, premiseUnverified: isDiscoveryTask(task) });
     }
     if (Date.now() - startTime > 5e3) break;
   }
   if (results.length === 0) return "";
   const elapsed = Date.now() - startTime;
   console.error(`[codebase-scan] scanned ${tasks.length} tasks in ${elapsed}ms \u2014 ${results.length} with matches`);
+  const flaggedCount = results.filter((r) => r.premiseUnverified).length;
+  const flagNote = flaggedCount > 0 ? ` \u2014 ${flaggedCount} discovery/auto-triaged task(s) flagged PREMISE-UNVERIFIED (verify before scheduling)` : "";
   const lines = [
-    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms):`,
+    `Codebase scan found existing implementations for ${results.length}/${tasks.length} candidate tasks (${elapsed}ms)${flagNote}:`,
     ""
   ];
   for (const result of results) {
     lines.push(`**${result.taskId}:**`);
+    if (result.premiseUnverified) {
+      lines.push(`  \u26A0 PREMISE-UNVERIFIED: discovery/auto-triaged task whose premise references code already present in the repo \u2014 verify the premise still holds; it may already be resolved.`);
+    }
     for (const match of result.matches.slice(0, 3)) {
       const fileList = match.files.slice(0, 3).join(", ");
       const moreCount = match.files.length > 3 ? ` (+${match.files.length - 3} more)` : "";
@@ -12643,7 +12661,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
   t = startTimer();
   try {
     const scanTasks = await adapter2.queryBoard({ status: ["Backlog", "In Cycle", "Ready"], compact: true });
-    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes }));
+    const candidates = scanTasks.filter((task) => task.priority !== "P3 Low" && task.scopeClass !== "brief").slice(0, 15).map((task) => ({ id: task.id, title: task.title, notes: task.notes, taskType: task.taskType }));
     const scanResult = scanCodebaseForTasks(config2.projectRoot, candidates);
     if (scanResult) context.codebaseScan = scanResult;
   } catch (err) {
@@ -18830,6 +18848,7 @@ init_telemetry();
 import { writeFile as writeFile3, readFile as readFile5 } from "fs/promises";
 import { join as join10 } from "path";
 import { execFileSync as execFileSync4 } from "child_process";
+import { isSensitiveChangelogLine } from "@papi-ai/shared";
 init_git();
 var INITIAL_RELEASE_NOTES = `# Changelog
 
@@ -18841,7 +18860,9 @@ All notable changes to this project are documented in this file.
 `;
 function generateChangelogSection(version, commits) {
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const filtered = commits.filter((c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c));
+  const filtered = commits.filter(
+    (c) => !new RegExp(`^[a-f0-9]+ release: ${version}$`).test(c) && !isSensitiveChangelogLine(c)
+  );
   const commitList = filtered.map((c) => `- ${c}`).join("\n");
   return `## ${version} \u2014 ${date}
 
@@ -21842,6 +21863,11 @@ var buildExecuteTool = {
         description: 'IDs of cycle_learnings this build directly resolves or acts on. Use when the BUILD HANDOFF references a prior learning entry (e.g. "addresses learning abc-123"). Links the learning to this task as action_taken=task_created.',
         items: { type: "string" }
       },
+      fixed_issues: {
+        type: "array",
+        description: `cycle_learnings UUIDs of discovered issues this build FIXED. Stamps resolved_at (via the existing discovered_issue_resolve path) so the hub's "What PAPI caught" surface counts them as fixed on the caught\u2192fixed ledger \u2014 triage-and-fix at build time, no separate tool call. Distinct from resolves_learnings, which only LINKS a learning to this task without closing it. Best-effort and idempotent.`,
+        items: { type: "string" }
+      },
       production_verification: {
         type: "object",
         description: "Required when the branch diff touches a trigger surface (install snippets, MCP transport, auth/middleware, OAuth well-known, vercel.json, supabase functions, Dockerfile, Procfile, env declarations). Record exactly what you verified against the live deploy. http_status MUST be 2xx \u2014 non-2xx rejects the build. Server inspects the diff and enforces this, so passing it on non-trigger tasks is harmless but unnecessary.",
@@ -22042,6 +22068,10 @@ async function handleBuildExecute(adapter2, config2, args, clientName) {
   }
   const tracker = new ProgressTracker("start_build").bindStream(adapter2, { stage: "build", taskId });
   try {
+    const scopeTask = await adapter2.getTask(taskId).catch(() => null);
+    if (scopeTask) {
+      tracker.setStreamScope({ taskId: scopeTask.displayId ?? scopeTask.id, cycle: scopeTask.cycle ?? null });
+    }
     await tracker.recordStep("started");
     const result = await startBuild(adapter2, config2, taskId, { light }, clientName);
     tracker.setStreamScope({ taskId: result.task.displayId ?? result.task.id, cycle: result.task.cycle ?? null });
@@ -22154,6 +22184,7 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
   const deadEnds = args.dead_ends;
   const rawBriefImplications = args.brief_implications;
   const resolvesLearnings = Array.isArray(args.resolves_learnings) ? args.resolves_learnings : void 0;
+  const fixedIssues = Array.isArray(args.fixed_issues) ? args.fixed_issues : void 0;
   const rawPreview = args.preview;
   const preview = rawPreview ? {
     urls: Array.isArray(rawPreview.urls) ? rawPreview.urls.filter((u) => typeof u === "string") : void 0,
@@ -22240,6 +22271,16 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
         metadata: { learningsLinkedCount: result.learningsLinkedCount }
       });
     }
+    let fixedResolvedCount = 0;
+    if (fixedIssues && fixedIssues.length > 0 && typeof adapter2.markCycleLearningResolved === "function") {
+      for (const learningId of fixedIssues) {
+        try {
+          await adapter2.markCycleLearningResolved(learningId, clientName);
+          fixedResolvedCount++;
+        } catch {
+        }
+      }
+    }
     await tracker.recordStep("moving-to-review", {
       metadata: { status: result.task.status }
     });
@@ -22265,7 +22306,10 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
         batchRollupNote = "";
       }
     }
-    return textResponse(formatCompleteResult(result) + docsNote + batchRollupNote);
+    const fixedNote = fixedResolvedCount > 0 ? `
+
+\u2705 Marked ${fixedResolvedCount} discovered issue(s) FIXED \u2014 resolved_at stamped, now counted as fixed on the hub's caught\u2192fixed ledger.` : "";
+    return textResponse(formatCompleteResult(result) + fixedNote + docsNote + batchRollupNote);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     if (isBuildPushError(err)) {
@@ -29212,6 +29256,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 var BEARER_PREFIX = "papi_";
 var BEARER_REGEX = /^(papi_|papi_oauth_)[a-f0-9]{64}$/;
 var RESOURCE_METADATA_URL = process.env["PAPI_RESOURCE_METADATA_URL"] ?? "https://getpapi.ai/.well-known/oauth-protected-resource";
+var GLAMA_MAINTAINER_EMAIL = process.env["GLAMA_MAINTAINER_EMAIL"] ?? "cathal@getpapi.ai";
 var DASHBOARD_ORIGIN = process.env["PAPI_DASHBOARD_URL"] ?? "https://getpapi.ai";
 var MCP_RESOURCE_URL = process.env["NEXT_PUBLIC_MCP_URL"] ?? "https://mcp.getpapi.ai";
 var FRIENDLY_GET_HTML = `<!doctype html>
@@ -29357,6 +29402,20 @@ function startHttpTransport(opts) {
       );
       return;
     }
+    if (req.method === "GET" && req.url === "/.well-known/glama.json") {
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "public, max-age=3600",
+        ...cors
+      });
+      res.end(
+        JSON.stringify({
+          $schema: "https://glama.ai/mcp/schemas/connector.json",
+          maintainers: [{ email: GLAMA_MAINTAINER_EMAIL }]
+        })
+      );
+      return;
+    }
     if (req.method === "GET" && req.url === "/.well-known/oauth-authorization-server") {
       res.writeHead(302, {
         Location: `${DASHBOARD_ORIGIN}/.well-known/oauth-authorization-server`,

package/dist/prompts.js

@@ -529,7 +529,14 @@ function buildPlanUserMessage(ctx) {
       parts.push("### Pre-Assigned Tasks", "", ctx.preAssignedTasks, "");
     }
     if (ctx.codebaseScan) {
-      parts.push("### Codebase Scan (existing implementations)", "", ctx.codebaseScan, "");
+      parts.push(
+        "### Codebase Scan (existing implementations)",
+        "",
+        "Any task tagged **PREMISE-UNVERIFIED** is a discovery/auto-triaged item whose premise references code that already exists \u2014 before scheduling it, verify the premise still holds against the live code; if it is already resolved, deprioritise or cancel it rather than spending a build slot re-verifying shipped work.",
+        "",
+        ctx.codebaseScan,
+        ""
+      );
     }
     if (ctx.buildPatterns) {
       parts.push("### Build Patterns", "", ctx.buildPatterns, "");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.57",
-  "description": "PAPI MCP server \u2014 AI-powered sprint planning, build execution, and strategy review for software projects",
+  "version": "0.7.59",
+  "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",
   "type": "module",