@papi-ai/server 0.7.64 → 0.7.66

package/dist/backfill-cycle-metrics.js

@@ -1785,6 +1785,12 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       markFeedbackNotified(ids, userId) {
         return this.invoke("markFeedbackNotified", [ids, userId]);
       }
+      // task-2438: the caller's own bug/idea reports. The data-proxy ignores the
+      // client-supplied userId and scopes to the bearer-validated caller, so a user
+      // can only ever read their OWN reports (same pattern as getUnnotifiedResolvedFeedback).
+      listMyBugReports(userId) {
+        return this.invoke("listMyBugReports", [userId]);
+      }
       // --- Doc Registry ---
       registerDoc(entry) {
         return this.invoke("registerDoc", [entry]);

package/dist/index.js

@@ -1902,6 +1902,12 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       markFeedbackNotified(ids, userId) {
         return this.invoke("markFeedbackNotified", [ids, userId]);
       }
+      // task-2438: the caller's own bug/idea reports. The data-proxy ignores the
+      // client-supplied userId and scopes to the bearer-validated caller, so a user
+      // can only ever read their OWN reports (same pattern as getUnnotifiedResolvedFeedback).
+      listMyBugReports(userId) {
+        return this.invoke("listMyBugReports", [userId]);
+      }
       // --- Doc Registry ---
       registerDoc(entry) {
         return this.invoke("registerDoc", [entry]);
@@ -19255,12 +19261,21 @@ ${command}
 \`\`\`
 PAPI never runs this command itself (AD-58) \u2014 you run it in your own environment. Turn the "Post-release deploy" capability off in the dashboard, or unset PAPI_DEPLOY, to stop this reminder.`;
 }
+function buildPapiMetaFramingDirective(caps, inner) {
+  if (!isCapabilityEnabled(caps, "papiMetaFraming")) return null;
+  return inner;
+}
 
 // src/services/build.ts
 import { randomUUID as randomUUID11 } from "crypto";
 import { readdirSync as readdirSync5, existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, mkdirSync as mkdirSync2 } from "fs";
 import { join as join11 } from "path";
 
+// src/lib/db-only-notices.ts
+var DB_ONLY_START_NOTICE = "No git repo detected \u2014 running this cycle in your project database only. Your work stays in the working tree; run `git init` (and add a remote) to enable branches, commits and PR review.";
+var DB_ONLY_COMPLETE_NOTICE = "No git repo \u2014 build recorded in your project database only (no commit or PR). Run `git init` (and add a remote) to enable git-backed commits and PR review.";
+var DB_ONLY_RELEASE_NOTICE = "No git repo detected \u2014 this release closed the cycle in your project database only. No tag, branch merge, or CHANGELOG was created. Run `git init` (and add a remote) to enable git-backed releases (tags, merges and changelog).";
+
 // src/lib/harness-capability.ts
 var HARNESS_REGISTRY = {
   // Local stdio CLI agents — PAPI runs git on the user's machine. Confirmed in telemetry.
@@ -20419,6 +20434,38 @@ Run \`project_switch <slug>\` to switch the active PAPI project, or verify your
     if (gateDecision.action === "block") {
       return errorResponse(gateDecision.message);
     }
+    if (!isGitAvailable() || !isGitRepo(config2.projectRoot)) {
+      tracker.mark("db-only-close-cycle");
+      let closed;
+      try {
+        closed = await closeCycleState(config2, adapter2, version, void 0, {
+          force: force ?? false,
+          callerUserId: gate.callerUserId
+        });
+      } catch (err) {
+        return errorResponse(err instanceof Error ? err.message : String(err));
+      }
+      await completeRelease(tracker, {
+        cycleClosed: closed.resolvedCycleNum > 0 ? closed.resolvedCycleNum : null,
+        version,
+        caps,
+        branchMerges: [],
+        changelogEmitted: false
+      });
+      const cyclePart = closed.resolvedCycleNum > 0 ? `Cycle ${closed.resolvedCycleNum}` : "The cycle";
+      const warningsBlock = closed.warnings.length > 0 ? `
+\u26A0\uFE0F Warnings: ${closed.warnings.join("; ")}
+` : "";
+      return textResponse(
+        `## Release ${version} \u2014 cycle closed (database only)
+
+${cyclePart} is now marked **complete** in PAPI, so \`orient\` will no longer flag "Release has not been run."
+` + warningsBlock + `
+${DB_ONLY_RELEASE_NOTICE}
+
+Next: cycle closed! Run \`plan\` to start your next cycle.`
+      );
+    }
     tracker.mark("create-release");
     const result = await createRelease(config2, branch, version, adapter2, void 0, {
       force: force ?? false,
@@ -21100,8 +21147,12 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
     throw err;
   }
   const branchLines = [];
+  const startCaps = adapter2.getProjectInfo ? (await adapter2.getProjectInfo().catch(() => null))?.capabilities ?? {} : {};
+  const autoBranchEnabled = isCapabilityEnabled(startCaps, "autoBranch");
   if (options.light) {
     branchLines.push("Light mode: skipping branch creation \u2014 working on current branch.");
+  } else if (!autoBranchEnabled) {
+    branchLines.push("Auto branch: skipped (Auto branch capability off) \u2014 working on current branch.");
   } else if (!hasLocalWorkspace()) {
     const cycleHealth = await adapter2.getCycleHealth().catch(() => null);
     const hosted = hostedStartSteps(clientName, taskId, task.module, cycleHealth?.totalCycles ?? 0, config2.baseBranch);
@@ -21272,6 +21323,12 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
         }
       }
     }
+  } else {
+    if (!isGitAvailable() || !isGitRepo(config2.projectRoot)) {
+      branchLines.push(DB_ONLY_START_NOTICE);
+    } else {
+      branchLines.push("Auto-commit off (PAPI_AUTO_COMMIT=false) \u2014 skipping branch creation; working on the current branch.");
+    }
   }
   if (task.status !== "In Progress") {
     await adapter2.updateTaskStatus(taskId, "In Progress");
@@ -21408,6 +21465,9 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
   if (!task) {
     throw new Error(`Task "${taskId}" not found on the Cycle Board.`);
   }
+  const completeCaps = adapter2.getProjectInfo ? (await adapter2.getProjectInfo().catch(() => null))?.capabilities ?? {} : {};
+  const autoCommitEnabled = isCapabilityEnabled(completeCaps, "autoCommit");
+  const autoPushEnabled = isCapabilityEnabled(completeCaps, "autoPush");
   assertDeployVerification(config2, input, { deployingNow: options.light === true });
   const [healthResult, priorCount] = await Promise.all([
     adapter2.getCycleHealth().catch(() => ({ totalCycles: 0 })),
@@ -21682,11 +21742,16 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
     }
   }
   const statusNote = input.completed === "yes" ? options.light ? `Task "${task.title}" (${taskId}) marked Done (light mode \u2014 no review needed).` : `Task "${task.title}" (${taskId}) marked In Review \u2014 ready for your sign-off via \`review_submit\`.` : `Task "${task.title}" (${taskId}) status unchanged (completed: ${input.completed}).`;
+  const dbOnlyMode = hasLocalWorkspace() && (!isGitAvailable() || !isGitRepo(config2.projectRoot));
   let commitLine;
-  if (config2.autoCommit) {
-    commitLine = autoCommit(config2, taskId, task.title, task.buildHandoff?.filesLikelyTouched);
-  } else {
+  if (!autoCommitEnabled) {
+    commitLine = "Auto-commit: skipped (Auto commit capability off).";
+  } else if (!config2.autoCommit) {
     commitLine = "Auto-commit: skipped (PAPI_AUTO_COMMIT=false).";
+  } else if (dbOnlyMode) {
+    commitLine = DB_ONLY_COMPLETE_NOTICE;
+  } else {
+    commitLine = autoCommit(config2, taskId, task.title, task.buildHandoff?.filesLikelyTouched);
   }
   if (isGitAvailable() && isGitRepo(config2.projectRoot)) {
     const sha = getHeadCommitSha(config2.projectRoot);
@@ -21709,6 +21774,9 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
   let prLines = [];
   if (options.light) {
     prLines.push("Light mode: skipping push and PR creation.");
+  } else if (!autoPushEnabled) {
+    prLines.push("Auto push & PR: skipped (Auto push & PR capability off).");
+  } else if (dbOnlyMode) {
   } else if (config2.autoCommit && input.completed === "yes") {
     prLines = pushAndCreatePR(config2, taskId, task.title, clientName, task.module, cycleNumber);
   }
@@ -21830,8 +21898,10 @@ var OWNER_NAME = process.env["PAPI_OWNER"] ?? "cathalos92";
 var MODULE_INSTRUCTIONS = {
   Dashboard: `**\u26A0\uFE0F MANDATORY \u2014 Dashboard Module Rules (skip = rework)**
 
-**STEP 0 \u2014 Dispatch the design agent for the visual layer (do NOT hand-write UI in the main build context).**
-Any \`.tsx\` that renders visible UI must be built by the \`frontend-design-engineer\` subagent (dispatch via the Task tool), not inline here. It works in an isolated window loaded only with brand canon (DESIGN.md / PRODUCT.md / brand-book), runs design-critique before and after, builds via the \`frontend-design\` / \`impeccable\` skills, self-checks the falsifiable anti-slop blocklist, and verifies in-browser at populated / empty / mobile states. You remain responsible for data, routes, types, and tests \u2014 hand the visual layer to the agent and integrate the report it returns. Components hand-written in this context produce generic output that fails review. (If \`.claude/agents/frontend-design-engineer.md\` is absent \u2014 e.g. a fresh external install \u2014 run STEPs 1-4 below yourself.)
+**STEP 0 \u2014 If the frontend-design pack is installed, dispatch the design agent for the visual layer (otherwise build it yourself, STEPs 1-4).**
+This step is conditional \u2014 PAPI does NOT ship the design pack on a hosted/remote connection, so do not assume the agent exists. Check for \`.claude/agents/frontend-design-engineer.md\`:
+- **Present:** any \`.tsx\` that renders visible UI should be built by the \`frontend-design-engineer\` subagent (dispatch via the Task tool), not inline here. It works in an isolated window loaded with your project's own brand canon (your DESIGN.md / PRODUCT.md), runs design-critique before and after, builds via the \`frontend-design\` / \`impeccable\` skills, self-checks the falsifiable anti-slop blocklist, and verifies in-browser at populated / empty / mobile states. You remain responsible for data, routes, types, and tests \u2014 hand the visual layer to the agent and integrate the report it returns.
+- **Absent (default on a hosted PAPI harness, and on any project where you haven't opted in):** the pack is opt-in, not required. Install it by running \`setup\` locally on a frontend project (it detects the stack and installs the agent + design-critique skill + guard hook), or copy it from the PAPI server package under \`design-assets/\`. Until then, do NOT dispatch an agent you don't have \u2014 follow STEPs 1-4 below yourself using the generally-available \`frontend-design\` / \`impeccable\` skills.
 
 **STEP 1 \u2014 BEFORE writing any code:**
 If you use the \`impeccable\` skill (recommended for dashboard work), it reads two root files for design context: **PRODUCT.md** (strategic \u2014 brand, users, product purpose, design principles) and **DESIGN.md** (visual tokens \u2014 palette, typography, elevation, components). Run \`impeccable init\` to create them if they don't exist yet. Every visual decision must align with these files; if your output contradicts them, it is wrong. (The legacy \`.impeccable.md\` is no longer read by the skill.)
@@ -21906,6 +21976,7 @@ import { readdirSync as readdirSync6, existsSync as existsSync8, readFileSync as
 import { join as join12, relative } from "path";
 import { homedir as homedir3 } from "os";
 import { randomUUID as randomUUID12 } from "crypto";
+import { docDeletionBlockMessage } from "@papi-ai/shared";
 var docRegisterTool = {
   name: "doc_register",
   description: "Register or update a document in the doc registry. Called after finalising a research/planning doc, or when build_execute detects unregistered docs. Stores metadata and structured summary \u2014 not full content. Re-registering an existing doc updates its summary, tags, actions, type, and status (upsert). Visibility and owner are not changed on re-register.",
@@ -22300,6 +22371,67 @@ ${userNotes}` : referenceLine;
 - ${remainingNote}`
   );
 }
+var docDeleteTool = {
+  name: "doc_delete",
+  description: "Permanently delete a registered doc. Guarded: ALLOWED only for the doc's creator or the project owner, and only when nothing depends on it \u2014 a delete is BLOCKED if another doc supersedes it, or a task references it (doc_ref) or a linked action. The guard never cascade-deletes dependents; resolve the dependency first. Identify the doc by `doc_path` (preferred) or `doc_id`.",
+  annotations: { title: "Delete Doc", readOnlyHint: false, destructiveHint: true, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      doc_path: { type: "string", description: 'Path of the doc to delete (e.g. "docs/research/funding-landscape.md"). Either this or doc_id is required.' },
+      doc_id: { type: "string", description: "UUID of the doc to delete. Either this or doc_path is required." }
+    },
+    required: []
+  }
+};
+async function handleDocDelete(adapter2, config2, args) {
+  if (!adapter2.deleteDoc) {
+    return errorResponse("Doc deletion not available \u2014 requires the pg adapter.");
+  }
+  const docPath = args.doc_path?.trim();
+  const docId = args.doc_id?.trim();
+  if (!docPath && !docId) {
+    return errorResponse("Either doc_path or doc_id is required.");
+  }
+  const gate = await resolveOwnerGate(adapter2, config2);
+  const requesterUserId = gate.enforced ? gate.callerUserId : gate.ownerUserId ?? gate.callerUserId;
+  const result = await adapter2.deleteDoc(docId ?? docPath, requesterUserId);
+  if (!result.deleted) {
+    const reason = result.reason ?? "not_authorized";
+    return errorResponse(`Delete blocked \u2014 ${docDeletionBlockMessage(reason)}`);
+  }
+  return textResponse(`**Deleted:** ${docId ?? docPath}`);
+}
+var docReorderTool = {
+  name: "doc_reorder",
+  description: "Persist the display order of docs within this project. Pass `doc_ids` as the full desired sequence of doc UUIDs \u2014 each doc's position is saved so the dashboard renders them in that order. Ids not in this project are ignored.",
+  annotations: { title: "Reorder Docs", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      doc_ids: {
+        type: "array",
+        items: { type: "string" },
+        description: "Ordered list of doc UUIDs \u2014 index 0 renders first."
+      }
+    },
+    required: ["doc_ids"]
+  }
+};
+async function handleDocReorder(adapter2, args) {
+  if (!adapter2.reorderDocs) {
+    return errorResponse("Doc reorder not available \u2014 requires the pg adapter.");
+  }
+  const docIds = args.doc_ids;
+  if (!Array.isArray(docIds) || docIds.some((id) => typeof id !== "string")) {
+    return errorResponse("doc_ids is required and must be an array of doc UUID strings.");
+  }
+  if (docIds.length === 0) {
+    return errorResponse("doc_ids must contain at least one doc UUID.");
+  }
+  await adapter2.reorderDocs(docIds);
+  return textResponse(`**Reordered ${docIds.length} doc(s).** New order persisted.`);
+}
 
 // src/tools/build.ts
 init_git();
@@ -22723,7 +22855,8 @@ If this build fixes any of these, pass their UUIDs in \`fixed_issues\` on comple
       formatModelRecommendation(result.task.buildHandoff?.effort ?? result.task.complexity)
     ) ?? "";
     const gestaltNote = buildGestaltPreBuildDirective(caps) ?? "";
-    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
+    const buildDisciplineSection = buildPapiMetaFramingDirective(caps, buildDisciplineNote) ?? "";
+    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineSection + chainInstruction + phaseNote + filesToWriteSection);
   } catch (err) {
     if (isNoHandoffError(err)) {
       const lines = [
@@ -23461,6 +23594,43 @@ This ${type} is visible to PAPI maintainers.${followUpLine}${autoRouteLine}`
   const truncateWarning = notesTruncated ? ` (notes truncated to ${MAX_NOTES_LENGTH} chars)` : "";
   return textResponse(`\u{1F41B} ${task.id}: "${task.title}" \u2014 ${severityLabel} bug added to backlog${overrideNote}${branchNote}. Will be picked up by next plan.${truncateWarning}`);
 }
+var bugListTool = {
+  name: "bug_list",
+  description: "List the upstream bug/idea reports YOU filed to the PAPI maintainers (via the `bug` tool with report=true or an auto-routed PAPI bug), newest first. Read-only. Shows each report's id, kind (bug/idea), triage status, description, and when it was filed. Scoped to your own submissions only \u2014 never another user's. Requires a database adapter (pg or hosted proxy); the local md adapter has no upstream store. Does not call the Anthropic API.",
+  annotations: { title: "List My Bug Reports", readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      limit: {
+        type: "integer",
+        description: "Optional maximum number of reports to return. Omit to return all. Reserved for future pagination \u2014 current behaviour returns all your reports newest-first regardless of value."
+      }
+    },
+    required: []
+  }
+};
+async function handleBugList(adapter2, config2) {
+  if (!adapter2.listMyBugReports) {
+    return errorResponse(
+      "Listing your bug reports requires a database adapter (pg or hosted proxy). The md adapter has no upstream report store."
+    );
+  }
+  const reports = await adapter2.listMyBugReports(config2.userId);
+  if (reports.length === 0) {
+    return textResponse("You haven't filed any bug or idea reports yet. Use the `bug` tool to report a PAPI bug or suggest an idea.");
+  }
+  const lines = reports.map((r) => {
+    const kind = r.type === "idea" ? "\u{1F4A1} idea" : "\u{1F41B} bug";
+    const when = r.createdAt.slice(0, 10);
+    return `- \`${r.id}\` \xB7 ${kind} \xB7 ${r.status} \xB7 ${when}
+  ${r.description}`;
+  });
+  return textResponse(
+    `**Your reports (${reports.length}, newest first)**
+
+${lines.join("\n")}`
+  );
+}
 
 // src/tools/ad-hoc.ts
 init_git();
@@ -28640,6 +28810,7 @@ async function handleDiscoveredIssueResolve(adapter2, args) {
 import path6 from "path";
 
 // src/services/entitlements.ts
+import { evaluateContributorGate } from "@papi-ai/shared";
 var FREE_PROJECT_CAP = 3;
 var PAID_TIERS = /* @__PURE__ */ new Set(["pro", "team"]);
 var PRICING_URL = "https://getpapi.ai/pricing";
@@ -28672,11 +28843,9 @@ async function enforceProjectCap(adapter2, target) {
   if (projects.length >= FREE_PROJECT_CAP) return projectCapMessage(projects.length);
   return null;
 }
-async function enforceContributorGate(adapter2) {
+async function resolveContributorUpsell(adapter2) {
   const tier = await resolveTier(adapter2);
-  if (tier === null) return null;
-  if (tier === "team") return null;
-  return contributorTeamMessage(tier);
+  return evaluateContributorGate(tier).upsell ?? null;
 }
 function projectCapMessage(currentCount) {
   return `**You're on the Free plan (${currentCount} of ${FREE_PROJECT_CAP} projects).**
@@ -28685,11 +28854,6 @@ Free covers up to ${FREE_PROJECT_CAP} projects. To run more, upgrade to Pro for
 
 Your existing projects are untouched, and you can keep working in any of them.`;
 }
-function contributorTeamMessage(tier) {
-  return `**Adding people to a project is a Team feature.**
-
-You're on the ${tier} plan. Shared projects, roles, and the Quality Gate come with Team. Read-only viewer seats are free, so you only pay for who is actually building: ${PRICING_URL}`;
-}
 
 // src/tools/project.ts
 function workspacePapiDir(config2) {
@@ -28883,17 +29047,19 @@ function requireEmail(args) {
 async function handleContributorAdd(adapter2, config2, args) {
   const denied = await denyUnlessOwner(adapter2, config2);
   if (denied) return errorResponse(denied);
-  const tierDenied = await enforceContributorGate(adapter2);
-  if (tierDenied) return errorResponse(tierDenied);
   const email = requireEmail(args);
   if (!email) return errorResponse('A valid email is required. Example: contributor_add email="wes@example.com"');
   try {
     const entry = await adapter2.addContributorByEmail(email);
     const name = entry.displayName ? ` (${entry.displayName})` : "";
+    const upsell = await resolveContributorUpsell(adapter2);
+    const upsellSuffix = upsell ? `
+
+${upsell}` : "";
     return textResponse(
       `\u2705 Added **${entry.email ?? email}**${name} as a contributor.
 
-They now have contributors-tier visibility on this project. Roles and invites land with MU-2 \u2014 today membership is the whole model.`
+They now have contributors-tier visibility on this project. Roles and invites land with MU-2 \u2014 today membership is the whole model.` + upsellSuffix
     );
   } catch (err) {
     return errorResponse(err instanceof Error ? err.message : String(err));
@@ -29636,6 +29802,7 @@ var PAPI_TOOLS = [
   buildCancelTool,
   ideaTool,
   bugTool,
+  bugListTool,
   adHocTool,
   boardReconcileTool,
   releaseTool,
@@ -29651,6 +29818,8 @@ var PAPI_TOOLS = [
   docSearchTool,
   docScanTool,
   docActionPromoteTool,
+  docDeleteTool,
+  docReorderTool,
   getSiblingAdsTool,
   handoffGenerateTool,
   scopeBriefTool,
@@ -29816,6 +29985,8 @@ function createServer(adapter2, config2) {
           return handleIdea(adapter2, config2, safeArgs);
         case "bug":
           return handleBug(adapter2, config2, safeArgs);
+        case "bug_list":
+          return handleBugList(adapter2, config2);
         case "ad_hoc":
           return handleAdHoc(adapter2, config2, safeArgs);
         case "board_reconcile":
@@ -29847,6 +30018,10 @@ function createServer(adapter2, config2) {
           return handleDocScan(adapter2, config2, safeArgs);
         case "doc_action_promote":
           return handleDocActionPromote(adapter2, safeArgs);
+        case "doc_delete":
+          return handleDocDelete(adapter2, config2, safeArgs);
+        case "doc_reorder":
+          return handleDocReorder(adapter2, safeArgs);
         case "get_sibling_ads":
           return handleGetSiblingAds(adapter2, safeArgs);
         case "handoff_generate":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.64",
+  "version": "0.7.66",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",