@papi-ai/server 0.7.61 → 0.7.63

package/design-assets/agents/frontend-design-engineer.md

@@ -88,6 +88,13 @@ Your output is **not done** if ANY of these is true (these are falsifiable — c
 - [ ] Guidance, state, or a next action explained in a sentence of helper text where a visual cue
       (position, size, colour, icon, a signpost, motion-on-change) would carry it — prose used as a
       crutch for missing visual steering.
+- [ ] A label, its value, and its explanation each taking their own line ("The Stacked Caption").
+      Anywhere the three exist, they share ONE line.
+- [ ] A new datum added as a sibling row beside a row it could extend ("The Siblinged Row").
+      Extend the existing row — inline suffix, extra cell, chip on the same baseline — never stack
+      a twin row underneath.
+- [ ] An eyebrow label or an explanatory subtitle above/below a heading ("The Eyebrow Crutch").
+      Labels carry themselves; if a heading needs a subtitle to be understood, the heading is wrong.
 - [ ] More than ~3 sections fully visible above the fold.
 - [ ] Identical-sized cards in a uniform row (flat hierarchy — needs a dominant 2×+ cell).
 - [ ] Monospace on labels, status, timestamps, or nav.

package/design-assets/skills/design-critique/SKILL.md

@@ -108,6 +108,12 @@ Run through every named anti-pattern and flag matches. Common universal ones:
 - Guidance, state, or a next action carried by a sentence of helper text where a visual cue
   (position, size, colour, an icon, a signpost, motion-on-change) would do — prose as a crutch for
   missing visual steering. Prefer showing over telling.
+- A label, its value, and its explanation each taking their own line ("The Stacked Caption") —
+  anywhere the three exist, they share ONE line.
+- A new datum added as a sibling row beside a row it could extend ("The Siblinged Row") — extend
+  the existing row (inline suffix, extra cell, chip on the same baseline), never stack a twin row.
+- An eyebrow label or explanatory subtitle above/below a heading ("The Eyebrow Crutch") — labels
+  carry themselves; a heading that needs a subtitle to be understood is the wrong heading.
 - Identical-sized cards in a uniform row (flat hierarchy).
 - Monospace on labels / status / timestamps / nav.
 - Header, label, and value at the same size+weight.

package/dist/backfill-cycle-metrics.js

@@ -60,6 +60,7 @@ __export(git_exports, {
   isGitAvailable: () => isGitAvailable,
   isGitRepo: () => isGitRepo,
   listGroupedCycleBranches: () => listGroupedCycleBranches,
+  listOpenPullRequests: () => listOpenPullRequests,
   listOrphanFeatBranches: () => listOrphanFeatBranches,
   mergePullRequest: () => mergePullRequest,
   normalizeGitUrl: () => normalizeGitUrl,
@@ -346,6 +347,26 @@ function isGhAvailable() {
     return false;
   }
 }
+function listOpenPullRequests(cwd) {
+  if (!isGhAvailable()) return null;
+  try {
+    const out = execFileSync(
+      "gh",
+      ["pr", "list", "--state", "open", "--limit", "100", "--json", "number,title,author,headRefName,createdAt"],
+      { cwd, encoding: "utf-8" }
+    );
+    const raw = JSON.parse(out);
+    return raw.map((p) => ({
+      number: p.number,
+      title: p.title,
+      author: p.author?.login ?? "unknown",
+      headRefName: p.headRefName,
+      createdAt: p.createdAt
+    }));
+  } catch {
+    return null;
+  }
+}
 function getOriginRepoSlug(cwd) {
   try {
     const url = execFileSync("git", ["remote", "get-url", "origin"], {

package/dist/index.js

@@ -61,6 +61,7 @@ __export(git_exports, {
   isGitAvailable: () => isGitAvailable,
   isGitRepo: () => isGitRepo,
   listGroupedCycleBranches: () => listGroupedCycleBranches,
+  listOpenPullRequests: () => listOpenPullRequests,
   listOrphanFeatBranches: () => listOrphanFeatBranches,
   mergePullRequest: () => mergePullRequest,
   normalizeGitUrl: () => normalizeGitUrl,
@@ -347,6 +348,26 @@ function isGhAvailable() {
     return false;
   }
 }
+function listOpenPullRequests(cwd) {
+  if (!isGhAvailable()) return null;
+  try {
+    const out = execFileSync(
+      "gh",
+      ["pr", "list", "--state", "open", "--limit", "100", "--json", "number,title,author,headRefName,createdAt"],
+      { cwd, encoding: "utf-8" }
+    );
+    const raw = JSON.parse(out);
+    return raw.map((p) => ({
+      number: p.number,
+      title: p.title,
+      author: p.author?.login ?? "unknown",
+      headRefName: p.headRefName,
+      createdAt: p.createdAt
+    }));
+  } catch {
+    return null;
+  }
+}
 function getOriginRepoSlug(cwd) {
   try {
     const url = execFileSync("git", ["remote", "get-url", "origin"], {
@@ -2040,6 +2061,76 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
   }
 });
 
+// src/lib/reap-orphans.ts
+var reap_orphans_exports = {};
+__export(reap_orphans_exports, {
+  formatReapSummary: () => formatReapSummary,
+  isPapiServerCommand: () => isPapiServerCommand,
+  listProcesses: () => listProcesses,
+  reapOrphans: () => reapOrphans,
+  selectReapableOrphans: () => selectReapableOrphans
+});
+import { execFileSync as execFileSync6 } from "child_process";
+function isPapiServerCommand(command) {
+  return /@papi-ai[/\\]server/.test(command);
+}
+function selectReapableOrphans(procs, selfPid) {
+  return procs.filter(
+    (p) => p.pid !== selfPid && p.ppid === 1 && isPapiServerCommand(p.command)
+  );
+}
+function listProcesses() {
+  if (process.platform === "win32") return null;
+  try {
+    const out = execFileSync6("ps", ["-A", "-o", "pid=,ppid=,command="], { encoding: "utf-8" });
+    const procs = [];
+    for (const line of out.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const m = /^(\d+)\s+(\d+)\s+(.*)$/.exec(trimmed);
+      if (!m) continue;
+      procs.push({ pid: Number(m[1]), ppid: Number(m[2]), command: m[3] });
+    }
+    return procs;
+  } catch {
+    return null;
+  }
+}
+function reapOrphans(opts = {}) {
+  const procs = listProcesses();
+  if (procs === null) return { unsupported: true, candidates: [], reaped: [] };
+  const orphans = selectReapableOrphans(procs, process.pid);
+  const candidates = orphans.map((p) => p.pid);
+  const reaped = [];
+  if (!opts.dryRun) {
+    for (const pid of candidates) {
+      try {
+        process.kill(pid, "SIGTERM");
+        reaped.push(pid);
+      } catch {
+      }
+    }
+  }
+  return { unsupported: false, candidates, reaped };
+}
+function formatReapSummary(result, dryRun) {
+  if (result.unsupported) {
+    return "Orphan reaper: unsupported on this platform \u2014 skipped (no processes touched).";
+  }
+  if (result.candidates.length === 0) {
+    return "Orphan reaper: no parentless @papi-ai/server processes found.";
+  }
+  if (dryRun) {
+    return `Orphan reaper: ${result.candidates.length} parentless PAPI server process(es) found: ${result.candidates.join(", ")} (run with --reap-orphans to terminate).`;
+  }
+  return `Orphan reaper: terminated ${result.reaped.length} parentless PAPI server process(es): ${result.reaped.join(", ")}.`;
+}
+var init_reap_orphans = __esm({
+  "src/lib/reap-orphans.ts"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/postgres/src/query.js
 function cachedError(xs) {
   if (originCache.has(xs))
@@ -4506,12 +4597,16 @@ async function runDoctor(cliArgs2 = []) {
   const fixPool = cliArgs2.includes("--fix-pool") || cliArgs2.includes("--terminate-wedged");
   const pool = await diagnosePool({ fix: fixPool });
   process.stdout.write("\n" + formatPoolReport(pool) + "\n");
+  const reap = cliArgs2.includes("--reap-orphans");
+  const reapResult = reapOrphans({ dryRun: !reap });
+  process.stdout.write("\n" + formatReapSummary(reapResult, !reap) + "\n");
   return 0;
 }
 var SECRET_VARS, WEDGED_IDLE_TX_SECONDS, WEDGED_ACTIVE_SECONDS, __testing;
 var init_doctor = __esm({
   "src/cli/doctor.ts"() {
     "use strict";
+    init_reap_orphans();
     SECRET_VARS = /* @__PURE__ */ new Set(["PAPI_DATA_API_KEY", "DATABASE_URL", "PAPI_ENDPOINT"]);
     WEDGED_IDLE_TX_SECONDS = 300;
     WEDGED_ACTIVE_SECONDS = 300;
@@ -5059,7 +5154,7 @@ var init_setup = __esm({
 
 // src/index.ts
 import { readFileSync as readFileSync16 } from "fs";
-import { dirname as dirname6, join as join24 } from "path";
+import { dirname as dirname6, join as join24, basename as basename2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
@@ -12765,6 +12860,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
     const contextBytes2 = Buffer.byteLength(userMessage2, "utf-8");
     console.error(`[plan-perf] contextBytes=${contextBytes2} (handoffs-only)`);
     const planSystemPrompt2 = await getPrompt("plan-system");
+    await recordPlanGenerationActive(tracker, incomingCycle);
     return {
       mode: "full",
       // apply phase treats it the same
@@ -12825,6 +12921,7 @@ async function preparePlan(adapter2, config2, filters, focus, force, handoffsOnl
   } catch {
   }
   const planSystemPrompt = await getPrompt("plan-system");
+  await recordPlanGenerationActive(tracker, incomingCycle);
   return {
     mode,
     cycleNumber,
@@ -12848,6 +12945,15 @@ async function streamPlanStageSteps(tracker, newCycleNumber) {
     await tracker.recordStep(step);
   }
 }
+async function recordPlanGenerationActive(tracker, incomingCycleNumber) {
+  if (!tracker) return;
+  await tracker.recordStep("recommendation", {
+    cycle: incomingCycleNumber,
+    stage: "plan",
+    status: "active",
+    metadata: { phase: "generating" }
+  });
+}
 async function applyPlan(adapter2, config2, rawLlmOutput, mode, cycleNumber, strategyReviewWarning, contextHashes, planRunMeta, tracker) {
   const applyTimer = startTimer();
   console.error(`[plan-perf] applyPlan: start (llm_response=${rawLlmOutput.length} chars)`);
@@ -15929,6 +16035,11 @@ Confidence: ${input.confidence}. Captured mid-conversation via strategy_change c
 }
 
 // src/tools/strategy.ts
+function toDateLabel(value) {
+  if (typeof value === "string") return value.slice(0, 10);
+  const d = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(d.getTime()) ? "" : d.toISOString().slice(0, 10);
+}
 var reviewPrepareCache = new PerCallerCache();
 var strategyReviewTool = {
   name: "strategy_review",
@@ -16230,7 +16341,7 @@ This topic will surface in the next \`strategy_review\`.`
     const lines = topics.map((t, i) => {
       const cycleSuffix = t.sourceCycle != null ? ` (Cycle ${t.sourceCycle})` : "";
       return `${i + 1}. ${t.topic}
-   _source: ${t.source}${cycleSuffix} \xB7 queued ${t.createdAt.slice(0, 10)}_`;
+   _source: ${t.source}${cycleSuffix} \xB7 queued ${toDateLabel(t.createdAt)}_`;
     });
     return textResponse(
       `**Pending Agenda (${topics.length})** \u2014 surfaces at next strategy review
@@ -19716,6 +19827,61 @@ async function completeRelease(tracker, opts) {
   }
   await tracker.recordStep("released", { metadata: { version: opts.version } });
 }
+var OPEN_PR_STALE_DAYS = 21;
+function taskIdFromBranch(headRefName) {
+  const m = /^feat\/(task-\d+)\b/.exec(headRefName);
+  return m ? m[1] : null;
+}
+function classifyOpenPr(pr, cycleNum, inReviewCycleTaskIds, nowMs) {
+  const head = pr.headRefName;
+  const ageDays = (nowMs - Date.parse(pr.createdAt)) / 864e5;
+  if (new RegExp(`^feat/cycle-${cycleNum}-`).test(head)) {
+    return { pr, bucket: "cycle-branch", action: `merge into this release \u2014 \`${head}\` is this cycle's branch and still open` };
+  }
+  const taskId = taskIdFromBranch(head);
+  if (taskId && inReviewCycleTaskIds.has(taskId)) {
+    return { pr, bucket: "held-adhoc-this-cycle", action: `MERGE before closing \u2014 ${taskId} is In Review pinned to Cycle ${cycleNum}` };
+  }
+  if (taskId) {
+    return { pr, bucket: "held-adhoc-other", action: "held adhoc not pinned to this cycle \u2014 defer, or merge if ready" };
+  }
+  if (Number.isFinite(ageDays) && ageDays > OPEN_PR_STALE_DAYS) {
+    return { pr, bucket: "stale", action: `review/close \u2014 open ${Math.round(ageDays)}d with no cycle link` };
+  }
+  return { pr, bucket: "external-other", action: "review manually \u2014 merge, defer, or close" };
+}
+var OPEN_PR_BUCKET_ORDER = [
+  "held-adhoc-this-cycle",
+  "cycle-branch",
+  "external-other",
+  "stale",
+  "held-adhoc-other"
+];
+function buildOpenPrSweepLines(openPrs, cycleNum, inReviewCycleTaskIds, nowMs) {
+  const lines = [];
+  if (openPrs === null) {
+    lines.push("", "**Open-PR sweep:** skipped \u2014 `gh` unavailable. Run `gh pr list` yourself to check for held/external PRs before considering the cycle closed.");
+  } else if (openPrs.length > 0) {
+    const classified = openPrs.map((pr) => classifyOpenPr(pr, cycleNum, inReviewCycleTaskIds, nowMs)).sort((a, b2) => OPEN_PR_BUCKET_ORDER.indexOf(a.bucket) - OPEN_PR_BUCKET_ORDER.indexOf(b2.bucket));
+    lines.push("", `**Open-PR sweep \u2014 ${openPrs.length} open PR(s). Resolve each before considering Cycle ${cycleNum} closed:**`);
+    for (const c of classified) {
+      lines.push(`- #${c.pr.number} \`${c.pr.headRefName}\` by ${c.pr.author} \u2014 [${c.bucket}] ${c.action}`);
+    }
+  }
+  if (inReviewCycleTaskIds.size > 0) {
+    const prByTask = /* @__PURE__ */ new Map();
+    for (const p of openPrs ?? []) {
+      const id = taskIdFromBranch(p.headRefName);
+      if (id) prByTask.set(id, p.number);
+    }
+    const rows = [...inReviewCycleTaskIds].sort().map((id) => {
+      const prNum = prByTask.get(id);
+      return `  - ${id}${prNum ? ` (PR #${prNum})` : " (no open PR found)"}`;
+    });
+    lines.push("", `\u26A0\uFE0F **${inReviewCycleTaskIds.size} task(s) still In Review, pinned to Cycle ${cycleNum} \u2014 their work is NOT merged. Accept/merge or defer before closing:**`, ...rows);
+  }
+  return lines;
+}
 
 // src/tools/release.ts
 init_git();
@@ -20206,6 +20372,20 @@ Run \`project_switch <slug>\` to switch the active PAPI project, or verify your
     if (result.warnings?.length) {
       lines.push("", "\u26A0\uFE0F Warnings: " + result.warnings.join("; "));
     }
+    try {
+      const openPrs = listOpenPullRequests(config2.projectRoot);
+      const closedCycle = result.cycleClosed ?? 0;
+      let inReviewIds = /* @__PURE__ */ new Set();
+      if (closedCycle > 0) {
+        const board = await adapter2.queryBoard();
+        inReviewIds = new Set(
+          board.filter((t) => t.status === "In Review" && t.cycle === closedCycle).map((t) => t.id)
+        );
+      }
+      const sweep = buildOpenPrSweepLines(openPrs, closedCycle, inReviewIds, Date.now());
+      if (sweep.length > 0) lines.push(...sweep);
+    } catch {
+    }
     tracker.mark("surface-discovered-issues");
     try {
       const closedCycle = result.cycleClosed ?? 0;
@@ -20947,8 +21127,8 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
         } else {
           const stashLabel = `papi-autostash/${taskId}-${Math.floor(Date.now() / 1e3)}`;
           try {
-            const { execFileSync: execFileSync6 } = await import("child_process");
-            execFileSync6("git", ["stash", "push", "-u", "-m", stashLabel, "--", ...toStash], {
+            const { execFileSync: execFileSync7 } = await import("child_process");
+            execFileSync7("git", ["stash", "push", "-u", "-m", stashLabel, "--", ...toStash], {
               cwd: config2.projectRoot,
               encoding: "utf-8"
             });
@@ -20974,8 +21154,8 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
       if (hasRemote(config2.projectRoot) && !featureBranchExistsLocally) {
         if (featureBranchOnOrigin) {
           try {
-            const { execFileSync: execFileSync6 } = await import("child_process");
-            execFileSync6("git", ["fetch", "origin", `${featureBranch}:${featureBranch}`], {
+            const { execFileSync: execFileSync7 } = await import("child_process");
+            execFileSync7("git", ["fetch", "origin", `${featureBranch}:${featureBranch}`], {
               cwd: config2.projectRoot,
               encoding: "utf-8",
               timeout: 6e4
@@ -22099,6 +22279,10 @@ var buildExecuteTool = {
         enum: ["yes", "no", "partial"],
         description: "Whether the build was completed. Required for complete."
       },
+      acceptance_confirmed: {
+        type: "boolean",
+        description: `task-2833: set true to assert every acceptance criterion in the task's BUILD HANDOFF was met. Required to record a completed:"yes" build when the handoff lists acceptance criteria \u2014 without it, build_execute returns the criteria checklist and does NOT mark the task Done (the report is not discarded; re-send with acceptance_confirmed:true). Tasks with no acceptance criteria, and completed:"partial"/"no", are unaffected.`
+      },
       effort: {
         type: "string",
         enum: ["XS", "S", "M", "L", "XL"],
@@ -22436,6 +22620,27 @@ ${entries}`;
       }
     } catch {
     }
+    let openIssuesSection = "";
+    try {
+      if (adapter2.getCycleLearnings) {
+        const issues = (await adapter2.getCycleLearnings({ category: "issue", limit: 20 })).filter((l) => !l.resolvedAt && l.id);
+        const taskIds = new Set([result.task.id, result.task.displayId].filter(Boolean));
+        const moduleTag = result.task.module?.trim().toLowerCase();
+        const score = (l) => (taskIds.has(l.taskId) ? 2 : 0) + (moduleTag && l.tags.some((t) => t.toLowerCase() === moduleTag) ? 1 : 0);
+        const top = issues.sort((a, b2) => score(b2) - score(a)).slice(0, 8);
+        if (top.length > 0) {
+          const rows = top.map((l) => `- \`${l.id}\` \xB7 ${l.severity ?? "P3"} \xB7 ${l.summary}`).join("\n");
+          openIssuesSection = `
+
+---
+
+**OPEN DISCOVERED ISSUES** (${top.length} shown):
+${rows}
+If this build fixes any of these, pass their UUIDs in \`fixed_issues\` on complete \u2014 that stamps them FIXED on the caught\u2192fixed ledger. Do not fix out-of-scope issues just to clear the list.`;
+        }
+      }
+    } catch {
+    }
     const moduleInstructions = getModuleInstructions(result.task.module);
     const moduleContext = await getModuleContext(adapter2, result.task);
     const filesToWriteSection = result.filesToWrite ? formatFilesToWriteSection(result.filesToWrite) : "";
@@ -22444,7 +22649,7 @@ ${entries}`;
       formatModelRecommendation(result.task.buildHandoff?.effort ?? result.task.complexity)
     ) ?? "";
     const gestaltNote = buildGestaltPreBuildDirective(caps) ?? "";
-    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
+    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
   } catch (err) {
     if (isNoHandoffError(err)) {
       const lines = [
@@ -22533,6 +22738,25 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
   if (!parsedEstimatedEffort) {
     return errorResponse(`Invalid estimated_effort value "${estimatedEffort}". Must be one of: XS, S, M, L, XL.`);
   }
+  const acceptanceConfirmed = args.acceptance_confirmed === true;
+  if (completed === "yes" && !acceptanceConfirmed) {
+    const gateInfo = adapter2.getProjectInfo ? await adapter2.getProjectInfo().catch(() => null) : null;
+    const gateCaps = gateInfo?.capabilities ?? {};
+    const gateTask = isCapabilityEnabled(gateCaps, "acceptanceGate") ? await adapter2.getTask(taskId).catch(() => null) : null;
+    const criteria = (gateTask?.buildHandoff?.acceptanceCriteria ?? []).filter((c) => c && c.trim());
+    if (criteria.length > 0) {
+      const checklist = criteria.map((c) => `  - [ ] ${c}`).join("\n");
+      return textResponse(
+        `**Acceptance criteria not yet confirmed for ${taskId}.**
+
+This task's BUILD HANDOFF lists ${criteria.length} acceptance criteri${criteria.length === 1 ? "on" : "a"}. Confirm each was met, then re-call \`build_execute\` complete with the SAME report fields plus \`acceptance_confirmed: true\`:
+
+${checklist}
+
+Your report was NOT discarded and the task is NOT yet Done \u2014 re-send with \`acceptance_confirmed: true\` to record completion. If a criterion was NOT met, the task is not complete: finish it, or report \`completed: "partial"\` with what remains in \`surprises\`.`
+      );
+    }
+  }
   const tracker = new ProgressTracker("complete_validate").bindStream(adapter2, { stage: "build", taskId });
   try {
     tracker.mark("complete_build");
@@ -22618,9 +22842,14 @@ async function handleExecuteComplete(adapter2, config2, taskId, args, light = fa
         batchRollupNote = "";
       }
     }
-    const fixedNote = fixedResolvedCount > 0 ? `
+    let fixedNote = "";
+    if (fixedResolvedCount > 0) {
+      fixedNote = `
 
-\u2705 Marked ${fixedResolvedCount} discovered issue(s) FIXED \u2014 resolved_at stamped, now counted as fixed on the hub's caught\u2192fixed ledger.` : "";
+\u2705 Marked ${fixedResolvedCount} discovered issue(s) FIXED \u2014 resolved_at stamped, now counted as fixed on the hub's caught\u2192fixed ledger.`;
+    } else if (discoveredIssues && discoveredIssues.trim() !== "" && !/^none\b/i.test(discoveredIssues.trim())) {
+      fixedNote = "\n\n\u2139\uFE0F This build filed discovered issues but passed no `fixed_issues`. When a future build fixes one, pass its UUID in `fixed_issues` so it counts as FIXED (not just auto-cleared) on the hub ledger.";
+    }
     return textResponse(formatCompleteResult(result) + fixedNote + docsNote + batchRollupNote);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -23088,7 +23317,11 @@ async function handleBug(adapter2, config2, args) {
       type,
       description: text,
       diagnostics,
-      status: "open",
+      // Canonical triage vocabulary (submitted|investigating|fixed|wont_fix).
+      // Was 'open' — a third vocabulary that made the owner triage console
+      // render new upstream reports as un-triaged. Adapters pass status through,
+      // so emitting canonical here keeps hosted + pg writes consistent.
+      status: "submitted",
       notifyRequested,
       contactOk
     });
@@ -24181,6 +24414,13 @@ Re-run build_execute complete with a production_verification field, then re-subm
 
 // src/tools/review.ts
 var REVIEW_DISPATCH_THRESHOLD = 50 * 1024;
+var REVIEW_DISPATCH_CEILING = 40 * 1024;
+var REVIEW_ECHO_CAP = 4e3;
+function trimForEcho(text) {
+  if (text.length <= REVIEW_ECHO_CAP) return text;
+  return `${text.slice(0, REVIEW_ECHO_CAP)}
+\u2026[trimmed ${text.length - REVIEW_ECHO_CAP} chars]`;
+}
 var REVIEW_RUBRIC = [
   "You are reviewing a completed PAPI build for acceptance. Judge:",
   "- Correctness: does the change do what the build report claims, without obvious bugs?",
@@ -24510,6 +24750,7 @@ async function handleReviewSubmit(adapter2, config2, args) {
   const autoDispatchOptIn = args.dispatch !== "inline" && process.env.PAPI_AUTO_DISPATCH !== "false" && isCapabilityEnabled(caps, "prReviewer");
   const autoDispatchEligible = !verdict && autoDispatchOptIn;
   const capabilityAutoReviewEligible = verdict === "accept" && !autoReview && autoDispatchOptIn;
+  let capabilityReviewSkippedNote = "";
   if ((explicitDispatch || autoDispatchEligible || capabilityAutoReviewEligible) && stage === "build-acceptance" && taskId) {
     const dispatch = await buildReviewDispatch(
       adapter2,
@@ -24519,8 +24760,16 @@ async function handleReviewSubmit(adapter2, config2, args) {
     );
     if (!dispatch.ok) {
       if (explicitDispatch) return errorResponse(dispatch.error);
-    } else if (explicitDispatch || capabilityAutoReviewEligible || dispatch.contextBytes > REVIEW_DISPATCH_THRESHOLD) {
+    } else if (explicitDispatch || autoDispatchEligible && dispatch.contextBytes > REVIEW_DISPATCH_THRESHOLD) {
       return textResponse(dispatch.prompt);
+    } else if (capabilityAutoReviewEligible) {
+      if (dispatch.contextBytes <= REVIEW_DISPATCH_CEILING) {
+        return textResponse(dispatch.prompt);
+      }
+      const kb = (dispatch.contextBytes / 1024).toFixed(0);
+      capabilityReviewSkippedNote = `
+
+> \u26A0\uFE0F pr-reviewer auto-review skipped \u2014 the diff/build-report (~${kb} KB) exceeds the ${REVIEW_DISPATCH_CEILING / 1024} KB inline-dispatch ceiling, which would overflow the response and drop the accept (task-2854). Verdict recorded directly. To review the diff explicitly, run \`review_submit ${taskId} build-acceptance accept dispatch:"subagent"\`.`;
     }
   }
   if (explicitDispatch && stage !== "build-acceptance") {
@@ -24680,36 +24929,51 @@ ${overlap}`;
 
 \u2705 Verdict recorded. All cycle tasks are Done, but **auto-release is owner-only** \u2014 your identity does not match this project's owner, so no release was cut. Push your branch and open a PR for the owner to run \`release\`.${resolutionNote}`;
         } else if (cycleTasks.length > 0 && cycleTasks.every((t) => t.status === "Done")) {
-          const baseBranch = resolveBaseBranch(config2.projectRoot, config2.baseBranch);
-          const unmergedCycleBranches = isGitAvailable() && isGitRepo(config2.projectRoot) ? listGroupedCycleBranches(config2.projectRoot, result.currentCycle, baseBranch) : [];
-          if (unmergedCycleBranches.length > 0) {
+          let planRunCount = null;
+          if (typeof adapter2.countPlanRunsForCycle === "function") {
+            try {
+              planRunCount = await adapter2.countPlanRunsForCycle(result.currentCycle);
+            } catch {
+              planRunCount = null;
+            }
+          }
+          if (planRunCount === 0) {
             autoReleaseNote = `
 
 ---
 
+\u26A0\uFE0F **Auto-release skipped** \u2014 Cycle ${result.currentCycle} has **no plan run** (100% injected/adhoc work), so it was never planned. Auto-release only fires for planned cycles, to avoid silently shipping a cycle nobody opened (C340 incident). All tasks are Done \u2014 run \`release\` explicitly to close and ship this cycle.`;
+          } else {
+            const baseBranch = resolveBaseBranch(config2.projectRoot, config2.baseBranch);
+            const unmergedCycleBranches = isGitAvailable() && isGitRepo(config2.projectRoot) ? listGroupedCycleBranches(config2.projectRoot, result.currentCycle, baseBranch) : [];
+            if (unmergedCycleBranches.length > 0) {
+              autoReleaseNote = `
+
+---
+
 \u26A0\uFE0F **Auto-release skipped** \u2014 all tasks are Done but ${unmergedCycleBranches.length} cycle branch(es) not yet merged: \`${unmergedCycleBranches.join("`, `")}\`.
 
 Merge or squash those PRs first, then run \`release\` manually.`;
-          } else {
-            try {
-              const allReviews = await adapter2.getRecentReviews(200);
-              const cycleReviews = allReviews.filter(
-                (r) => r.cycle === result.currentCycle && r.stage === "build-acceptance"
-              );
-              const reviewsWithAutoReview = cycleReviews.filter((r) => r.autoReview);
-              if (reviewsWithAutoReview.length > 0) {
-                const verdictCounts = { pass: 0, warn: 0, fail: 0 };
-                const findingsBySeverity = { error: 0, warning: 0, info: 0 };
-                for (const r of reviewsWithAutoReview) {
-                  if (r.autoReview) {
-                    verdictCounts[r.autoReview.verdict] = (verdictCounts[r.autoReview.verdict] ?? 0) + 1;
-                    for (const f of r.autoReview.findings) {
-                      findingsBySeverity[f.severity] = (findingsBySeverity[f.severity] ?? 0) + 1;
+            } else {
+              try {
+                const allReviews = await adapter2.getRecentReviews(200);
+                const cycleReviews = allReviews.filter(
+                  (r) => r.cycle === result.currentCycle && r.stage === "build-acceptance"
+                );
+                const reviewsWithAutoReview = cycleReviews.filter((r) => r.autoReview);
+                if (reviewsWithAutoReview.length > 0) {
+                  const verdictCounts = { pass: 0, warn: 0, fail: 0 };
+                  const findingsBySeverity = { error: 0, warning: 0, info: 0 };
+                  for (const r of reviewsWithAutoReview) {
+                    if (r.autoReview) {
+                      verdictCounts[r.autoReview.verdict] = (verdictCounts[r.autoReview.verdict] ?? 0) + 1;
+                      for (const f of r.autoReview.findings) {
+                        findingsBySeverity[f.severity] = (findingsBySeverity[f.severity] ?? 0) + 1;
+                      }
                     }
                   }
-                }
-                const totalFindings = findingsBySeverity.error + findingsBySeverity.warning + findingsBySeverity.info;
-                batchSummaryNote = `
+                  const totalFindings = findingsBySeverity.error + findingsBySeverity.warning + findingsBySeverity.info;
+                  batchSummaryNote = `
 
 ---
 
@@ -24717,42 +24981,42 @@ Merge or squash those PRs first, then run \`release\` manually.`;
 
 - Verdicts: ${verdictCounts.pass} pass, ${verdictCounts.warn} warn, ${verdictCounts.fail} fail
 ` + (totalFindings > 0 ? `- Findings: ${findingsBySeverity.error} error${findingsBySeverity.error !== 1 ? "s" : ""}, ${findingsBySeverity.warning} warning${findingsBySeverity.warning !== 1 ? "s" : ""}, ${findingsBySeverity.info} info` : "- No findings logged");
+                }
+              } catch {
               }
-            } catch {
-            }
-            const version = `v0.${result.currentCycle}.0`;
-            const autoGate = evaluateReleaseGate(caps, config2.gateCommand, void 0);
-            if (autoGate.action !== "proceed") {
-              autoReleaseNote = `
+              const version = `v0.${result.currentCycle}.0`;
+              const autoGate = evaluateReleaseGate(caps, config2.gateCommand, void 0);
+              if (autoGate.action !== "proceed") {
+                autoReleaseNote = `
 
 ---
 
 \u26A0\uFE0F **Auto-release skipped** \u2014 a release quality gate is configured (\`${config2.gateCommand}\`), and it cannot be run from inside \`review_submit\`.
 
 Run \`release\` manually: PAPI will hand you the gate command, then release once you report it green.`;
-            } else {
-              const releaseTracker = new ProgressTracker("auto-release").bindStream(adapter2, { stage: "release" });
-              await beginRelease(releaseTracker, result.currentCycle);
-              const releaseResult = await createRelease(config2, baseBranch, version, adapter2, result.currentCycle);
-              await recordReadinessVerified(releaseTracker);
-              await recordQualityGate(releaseTracker, autoGate, caps);
-              await tracker.recordStep("auto_release_triggered", { metadata: { version: releaseResult.version } });
-              const autoChangelogDirective = buildChangelogDirective(
-                caps,
-                buildCycleUpdateCurationDirective(releaseResult.version, releaseResult.cycleClosed ?? 0)
-              );
-              const autoDeployDirective = buildDeployHookDirective(caps, config2.deployCommand);
-              await completeRelease(releaseTracker, {
-                cycleClosed: releaseResult.cycleClosed ?? null,
-                version: releaseResult.version,
-                caps,
-                branchMerges: releaseResult.groupedBranchMerges ?? [],
-                changelogEmitted: Boolean(autoChangelogDirective),
-                deployHookEmitted: Boolean(autoDeployDirective)
-              });
-              const pushInfo = releaseResult.pushNotes.join(" ");
-              const groupedMergeNote = releaseResult.groupedBranchMerges?.length ? "\n" + releaseResult.groupedBranchMerges.map((r) => `- Merged shared branch \`${r.branch}\` via PR: ${r.prUrl ?? "n/a"}`).join("\n") : "";
-              autoReleaseNote = `
+              } else {
+                const releaseTracker = new ProgressTracker("auto-release").bindStream(adapter2, { stage: "release" });
+                await beginRelease(releaseTracker, result.currentCycle);
+                const releaseResult = await createRelease(config2, baseBranch, version, adapter2, result.currentCycle);
+                await recordReadinessVerified(releaseTracker);
+                await recordQualityGate(releaseTracker, autoGate, caps);
+                await tracker.recordStep("auto_release_triggered", { metadata: { version: releaseResult.version } });
+                const autoChangelogDirective = buildChangelogDirective(
+                  caps,
+                  buildCycleUpdateCurationDirective(releaseResult.version, releaseResult.cycleClosed ?? 0)
+                );
+                const autoDeployDirective = buildDeployHookDirective(caps, config2.deployCommand);
+                await completeRelease(releaseTracker, {
+                  cycleClosed: releaseResult.cycleClosed ?? null,
+                  version: releaseResult.version,
+                  caps,
+                  branchMerges: releaseResult.groupedBranchMerges ?? [],
+                  changelogEmitted: Boolean(autoChangelogDirective),
+                  deployHookEmitted: Boolean(autoDeployDirective)
+                });
+                const pushInfo = releaseResult.pushNotes.join(" ");
+                const groupedMergeNote = releaseResult.groupedBranchMerges?.length ? "\n" + releaseResult.groupedBranchMerges.map((r) => `- Merged shared branch \`${r.branch}\` via PR: ${r.prUrl ?? "n/a"}`).join("\n") : "";
+                autoReleaseNote = `
 
 ---
 
@@ -24763,13 +25027,14 @@ Run \`release\` manually: PAPI will hand you the gate command, then release once
 - ${releaseResult.tagMessage}
 - ${pushInfo}` + groupedMergeNote + (releaseResult.warnings?.length ? `
 - Warnings: ${releaseResult.warnings.join(", ")}` : "") + // task-2598 (C328): the auto path previously swallowed the curated
-              // cycle-update directive that the manual path emits, so an auto-released
-              // cycle never prompted the Discord post. Same directive, same gate.
-              (autoChangelogDirective ? `
+                // cycle-update directive that the manual path emits, so an auto-released
+                // cycle never prompted the Discord post. Same directive, same gate.
+                (autoChangelogDirective ? `
 ${autoChangelogDirective}` : "") + (autoDeployDirective ? `
 ${autoDeployDirective}` : "") + `
 
 Run \`plan\` to create Cycle ${result.currentCycle + 1}.`;
+              }
             }
           }
         }
@@ -24829,9 +25094,9 @@ Next: address the feedback, then run \`build_execute ${taskId}\` to resubmit.`;
       `**${result.stageLabel}** recorded for ${result.taskId}.
 
 - **Verdict:** ${result.verdict}
-- **Comments:** ${result.comments}
+- **Comments:** ${trimForEcho(result.comments)}
 
-${statusNote}${autoReviewNote}${securityNote}${unblockNote}${docClosureNote}${regenNote}${mergeNote}${overlapNote}${batchSummaryNote}${autoReleaseNote}${nextStepNote}${phaseNote}`
+${statusNote}${capabilityReviewSkippedNote}${autoReviewNote}${securityNote}${unblockNote}${docClosureNote}${regenNote}${mergeNote}${overlapNote}${batchSummaryNote}${autoReleaseNote}${nextStepNote}${phaseNote}`
     );
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -29697,6 +29962,13 @@ function startHttpTransport(opts) {
     const ip = clientIp(req);
     const origin = req.headers.origin;
     const cors = corsHeaders(origin);
+    const pathname = (() => {
+      try {
+        return new URL(req.url ?? "/", "http://internal").pathname;
+      } catch {
+        return req.url ?? "/";
+      }
+    })();
     if (req.method === "OPTIONS") {
       if (Object.keys(cors).length === 0) {
         sendError(res, { status: 403, body: { error: "Origin not allowed" } });
@@ -29711,12 +29983,12 @@ function startHttpTransport(opts) {
       sendError(res, { status: 400, body: { error: "HTTPS required" } });
       return;
     }
-    if (req.method === "GET" && req.url === "/healthz") {
+    if (req.method === "GET" && pathname === "/healthz") {
       res.writeHead(200, { "Content-Type": "text/plain", ...cors });
       res.end("ok");
       return;
     }
-    if (req.method === "GET" && req.url === "/.well-known/oauth-protected-resource") {
+    if (req.method === "GET" && pathname === "/.well-known/oauth-protected-resource") {
       res.writeHead(200, {
         "Content-Type": "application/json",
         "Cache-Control": "public, max-age=3600",
@@ -29732,7 +30004,7 @@ function startHttpTransport(opts) {
       );
       return;
     }
-    if (req.method === "GET" && req.url === "/.well-known/glama.json") {
+    if (req.method === "GET" && pathname === "/.well-known/glama.json") {
       res.writeHead(200, {
         "Content-Type": "application/json",
         "Cache-Control": "public, max-age=3600",
@@ -29746,7 +30018,7 @@ function startHttpTransport(opts) {
       );
       return;
     }
-    if (req.method === "GET" && req.url === "/.well-known/oauth-authorization-server") {
+    if (req.method === "GET" && pathname === "/.well-known/oauth-authorization-server") {
       res.writeHead(302, {
         Location: `${DASHBOARD_ORIGIN}/.well-known/oauth-authorization-server`,
         "Cache-Control": "public, max-age=3600",
@@ -29755,7 +30027,7 @@ function startHttpTransport(opts) {
       res.end();
       return;
     }
-    if (req.url !== "/mcp" && req.url !== "/sse") {
+    if (pathname !== "/mcp" && pathname !== "/sse") {
       sendError(res, { status: 404, body: { error: "Not found" } }, cors);
       return;
     }
@@ -30035,6 +30307,7 @@ Options:
   --yes, -y        Skip confirmation prompts (reset only)
   --idle-mcp       Flag PAPI-idle projects in audit (needs DATABASE_URL; read-only)
   --fix-pool       Terminate this role's confirmed-wedged DB backends (doctor only; guarded)
+  --reap-orphans   Terminate parentless @papi-ai/server processes (doctor only; guarded)
 
 Getting started:
   1. Run "npx @papi-ai/server setup" in any project folder
@@ -30197,6 +30470,21 @@ if (isHttpMode && httpPort !== void 0) {
     process.stderr.write("[papi] Fatal: stdio mode requires an MCP server instance.\n");
     process.exit(1);
   }
+  try {
+    const { reapOrphans: reapOrphans2 } = await Promise.resolve().then(() => (init_reap_orphans(), reap_orphans_exports));
+    const swept = reapOrphans2({});
+    if (swept.reaped.length > 0) {
+      process.stderr.write(`[papi] Reaped ${swept.reaped.length} orphaned server process(es): ${swept.reaped.join(", ")}
+`);
+    }
+  } catch {
+  }
   const transport = new StdioServerTransport();
   await server.connect(transport);
+  const projectName = basename2(config.projectRoot);
+  const projectIdShort = config.projectId ? ` (${config.projectId.slice(0, 8)})` : process.env.PAPI_PROJECT_ID ? ` (${process.env.PAPI_PROJECT_ID.slice(0, 8)})` : "";
+  process.stderr.write(
+    `[papi] Connected \u2014 project: ${projectName}${projectIdShort}, adapter: ${config.adapterType}, v${pkgVersion}
+`
+  );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.61",
+  "version": "0.7.63",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",

package/skills/papi-cycle/AGENTS.md

@@ -38,6 +38,7 @@ When a conversation starts — fresh window, new session, or after context compr
 - **All in-cycle, in-module tasks share `feat/cycle-N-<module>`** regardless of complexity. One branch per module per cycle, merged together. Module-less tasks fall back to a per-task branch.
 - **Dependent tasks (any size):** When a task's BUILD HANDOFF lists a `DEPENDS ON` task from the same cycle, `build_execute` automatically reuses the upstream task's branch so commits stack for a single PR. Do not create a separate branch manually.
 - **Commit per task within grouped branches** — traceable git history.
+- **Integration + gate before release when a cycle fans to more than 4 module branches.** A wide cycle has no single point where all branches are proven together, so a collision between two branches only surfaces at release. When a cycle has more than 4 module branches, before `release`: (1) cut an integration branch off your main branch, (2) merge every cycle module branch into it, (3) run your full local gate/test suite on the integrated result, (4) resolve any cross-branch collisions there, (5) release from the integrated branch. This is a habit, not automation — release does not block on branch count.
 - **Never use `build_execute` with `light=true` on shared branches.** Light mode commits directly to the current branch without creating a PR. When a shared branch is squash-merged, those commits are collapsed — any CLAUDE.md or documentation changes are stripped. Use light mode only on isolated single-task branches where no squash-merge will occur.
 
 ## Plumbing Is Autonomous