@papi-ai/server 0.7.65 → 0.7.67

package/dist/backfill-cycle-metrics.js

@@ -1785,6 +1785,12 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       markFeedbackNotified(ids, userId) {
         return this.invoke("markFeedbackNotified", [ids, userId]);
       }
+      // task-2438: the caller's own bug/idea reports. The data-proxy ignores the
+      // client-supplied userId and scopes to the bearer-validated caller, so a user
+      // can only ever read their OWN reports (same pattern as getUnnotifiedResolvedFeedback).
+      listMyBugReports(userId) {
+        return this.invoke("listMyBugReports", [userId]);
+      }
       // --- Doc Registry ---
       registerDoc(entry) {
         return this.invoke("registerDoc", [entry]);

package/dist/index.js

@@ -1902,6 +1902,12 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       markFeedbackNotified(ids, userId) {
         return this.invoke("markFeedbackNotified", [ids, userId]);
       }
+      // task-2438: the caller's own bug/idea reports. The data-proxy ignores the
+      // client-supplied userId and scopes to the bearer-validated caller, so a user
+      // can only ever read their OWN reports (same pattern as getUnnotifiedResolvedFeedback).
+      listMyBugReports(userId) {
+        return this.invoke("listMyBugReports", [userId]);
+      }
       // --- Doc Registry ---
       registerDoc(entry) {
         return this.invoke("registerDoc", [entry]);
@@ -4334,9 +4340,9 @@ __export(doctor_exports, {
   __testing: () => __testing,
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function redact(name, value) {
   if (!value) return "(empty)";
   if (SECRET_VARS.has(name)) {
@@ -4347,14 +4353,14 @@ function redact(name, value) {
 }
 function findMcpJson() {
   const candidates = [
-    join20(process.cwd(), ".mcp.json"),
-    join20(homedir4(), ".claude", ".mcp.json"),
-    join20(homedir4(), ".mcp.json")
+    join21(process.cwd(), ".mcp.json"),
+    join21(homedir4(), ".claude", ".mcp.json"),
+    join21(homedir4(), ".mcp.json")
   ];
   for (const path7 of candidates) {
-    if (!existsSync11(path7)) continue;
+    if (!existsSync12(path7)) continue;
     try {
-      const raw = readFileSync13(path7, "utf-8");
+      const raw = readFileSync14(path7, "utf-8");
       const parsed = JSON.parse(raw);
       const papiEntry = parsed.papi ?? parsed.mcpServers?.papi;
       if (!papiEntry) continue;
@@ -4632,17 +4638,17 @@ __export(reset_exports, {
   removePapiEntry: () => removePapiEntry,
   runReset: () => runReset
 });
-import { existsSync as existsSync12, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import { createInterface } from "readline/promises";
 function findResetTarget() {
   for (const path7 of CANDIDATE_PATHS()) {
-    if (!existsSync12(path7)) continue;
+    if (!existsSync13(path7)) continue;
     let raw;
     let parsed;
     try {
-      raw = readFileSync14(path7, "utf-8");
+      raw = readFileSync15(path7, "utf-8");
       parsed = JSON.parse(raw);
     } catch {
       continue;
@@ -4713,7 +4719,7 @@ async function runReset(args = []) {
     }
   }
   try {
-    writeFileSync6(target.path, removePapiEntry(target), "utf-8");
+    writeFileSync7(target.path, removePapiEntry(target), "utf-8");
     process.stdout.write(`
 \u2713 Removed papi entry from ${target.path}
 `);
@@ -4730,9 +4736,9 @@ var init_reset = __esm({
   "src/cli/reset.ts"() {
     "use strict";
     CANDIDATE_PATHS = () => [
-      join21(process.cwd(), ".mcp.json"),
-      join21(homedir5(), ".claude", ".mcp.json"),
-      join21(homedir5(), ".mcp.json")
+      join22(process.cwd(), ".mcp.json"),
+      join22(homedir5(), ".claude", ".mcp.json"),
+      join22(homedir5(), ".mcp.json")
     ];
   }
 });
@@ -4743,9 +4749,9 @@ __export(audit_exports, {
   __testing: () => __testing2,
   runAudit: () => runAudit
 });
-import { existsSync as existsSync13, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync16, readdirSync as readdirSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function safeListDirs(dir) {
   try {
     return readdirSync7(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort((a, b2) => a.localeCompare(b2));
@@ -4761,10 +4767,10 @@ function safeListFiles(dir, ext) {
   }
 }
 function readMcp(projectPath) {
-  const path7 = join22(projectPath, ".mcp.json");
-  if (!existsSync13(path7)) return { servers: [] };
+  const path7 = join23(projectPath, ".mcp.json");
+  if (!existsSync14(path7)) return { servers: [] };
   try {
-    const parsed = JSON.parse(readFileSync15(path7, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(path7, "utf-8"));
     const mcpServers = parsed.mcpServers ?? {};
     const servers = Object.keys(mcpServers);
     if (parsed.papi && !servers.includes("papi")) servers.push("papi");
@@ -4796,18 +4802,18 @@ function auditProjectSync(projectPath, name) {
     path: projectPath,
     papiProjectId,
     mcpServers: servers,
-    skills: safeListDirs(join22(projectPath, ".claude", "skills")),
-    agentSkills: safeListDirs(join22(projectPath, ".agents", "skills")),
-    agents: safeListFiles(join22(projectPath, ".claude", "agents"), ".md"),
-    hooks: safeListFiles(join22(projectPath, ".claude", "hooks"), ".sh")
+    skills: safeListDirs(join23(projectPath, ".claude", "skills")),
+    agentSkills: safeListDirs(join23(projectPath, ".agents", "skills")),
+    agents: safeListFiles(join23(projectPath, ".claude", "agents"), ".md"),
+    hooks: safeListFiles(join23(projectPath, ".claude", "hooks"), ".sh")
   };
 }
 function discoverProjects() {
   const out = [];
   for (const root of PROJECT_ROOTS) {
     for (const name of safeListDirs(root)) {
-      const path7 = join22(root, name);
-      if (existsSync13(join22(path7, ".mcp.json")) || existsSync13(join22(path7, ".claude"))) {
+      const path7 = join23(root, name);
+      if (existsSync14(join23(path7, ".mcp.json")) || existsSync14(join23(path7, ".claude"))) {
         out.push({ name, path: path7 });
       }
     }
@@ -4818,9 +4824,9 @@ function readGlobalSkills() {
   return safeListDirs(GLOBAL_SKILLS_DIR);
 }
 function readGlobalMcpServers() {
-  if (!existsSync13(GLOBAL_CLAUDE_JSON)) return [];
+  if (!existsSync14(GLOBAL_CLAUDE_JSON)) return [];
   try {
-    const parsed = JSON.parse(readFileSync15(GLOBAL_CLAUDE_JSON, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(GLOBAL_CLAUDE_JSON, "utf-8"));
     const servers = parsed.mcpServers ?? {};
     return Object.keys(servers).sort((a, b2) => a.localeCompare(b2));
   } catch {
@@ -4972,9 +4978,9 @@ var PROJECT_ROOTS, GLOBAL_SKILLS_DIR, GLOBAL_CLAUDE_JSON, IDLE_WINDOW_DAYS, GLOB
 var init_audit = __esm({
   "src/cli/audit.ts"() {
     "use strict";
-    PROJECT_ROOTS = [join22(homedir6(), "Ai-App-Projects"), join22(homedir6(), "android-projects")];
-    GLOBAL_SKILLS_DIR = join22(homedir6(), ".claude", "skills");
-    GLOBAL_CLAUDE_JSON = join22(homedir6(), ".claude.json");
+    PROJECT_ROOTS = [join23(homedir6(), "Ai-App-Projects"), join23(homedir6(), "android-projects")];
+    GLOBAL_SKILLS_DIR = join23(homedir6(), ".claude", "skills");
+    GLOBAL_CLAUDE_JSON = join23(homedir6(), ".claude.json");
     IDLE_WINDOW_DAYS = 30;
     GLOBALIZE_THRESHOLD = 3;
     __testing2 = { readMcp, computeFlags, formatReport: formatReport2, discoverProjects, auditProjectSync };
@@ -4986,8 +4992,8 @@ var setup_exports = {};
 __export(setup_exports, {
   runSetup: () => runSetup
 });
-import { existsSync as existsSync14, readFileSync as readFileSync16, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync8 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync8, chmodSync as chmodSync2, statSync as statSync8 } from "fs";
+import { join as join24 } from "path";
 function baseUrl() {
   const fromEnv = process.env["PAPI_HOST"] ?? process.env["PAPI_BASE_URL"];
   if (fromEnv) return fromEnv.replace(/\/$/, "");
@@ -5019,11 +5025,11 @@ function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function writeMcpJson(opts) {
-  const path7 = join23(process.cwd(), ".mcp.json");
+  const path7 = join24(process.cwd(), ".mcp.json");
   let parsed = {};
-  if (existsSync14(path7)) {
+  if (existsSync15(path7)) {
     try {
-      parsed = JSON.parse(readFileSync16(path7, "utf-8"));
+      parsed = JSON.parse(readFileSync17(path7, "utf-8"));
     } catch {
       throw new Error(`.mcp.json at ${path7} is not valid JSON. Fix it or remove it before re-running setup.`);
     }
@@ -5044,7 +5050,7 @@ function writeMcpJson(opts) {
   }
   mcpServers.papi = papiEntry;
   parsed.mcpServers = mcpServers;
-  writeFileSync7(path7, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+  writeFileSync8(path7, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
   try {
     const mode = statSync8(path7).mode & 511;
     if (mode !== 384) chmodSync2(path7, 384);
@@ -5154,8 +5160,8 @@ var init_setup = __esm({
 });
 
 // src/index.ts
-import { readFileSync as readFileSync17 } from "fs";
-import { dirname as dirname6, join as join24, basename as basename2 } from "path";
+import { readFileSync as readFileSync18 } from "fs";
+import { dirname as dirname6, join as join25, basename as basename2 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
@@ -8193,9 +8199,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
 }
 
 // src/server.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { access as access4, readdir as readdir4, readFile as readFile9 } from "fs/promises";
-import { join as join19, dirname as dirname5 } from "path";
+import { join as join20, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import {
@@ -19255,12 +19261,21 @@ ${command}
 \`\`\`
 PAPI never runs this command itself (AD-58) \u2014 you run it in your own environment. Turn the "Post-release deploy" capability off in the dashboard, or unset PAPI_DEPLOY, to stop this reminder.`;
 }
+function buildPapiMetaFramingDirective(caps, inner) {
+  if (!isCapabilityEnabled(caps, "papiMetaFraming")) return null;
+  return inner;
+}
 
 // src/services/build.ts
 import { randomUUID as randomUUID11 } from "crypto";
 import { readdirSync as readdirSync5, existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, mkdirSync as mkdirSync2 } from "fs";
 import { join as join11 } from "path";
 
+// src/lib/db-only-notices.ts
+var DB_ONLY_START_NOTICE = "No git repo detected \u2014 running this cycle in your project database only. Your work stays in the working tree; run `git init` (and add a remote) to enable branches, commits and PR review.";
+var DB_ONLY_COMPLETE_NOTICE = "No git repo \u2014 build recorded in your project database only (no commit or PR). Run `git init` (and add a remote) to enable git-backed commits and PR review.";
+var DB_ONLY_RELEASE_NOTICE = "No git repo detected \u2014 this release closed the cycle in your project database only. No tag, branch merge, or CHANGELOG was created. Run `git init` (and add a remote) to enable git-backed releases (tags, merges and changelog).";
+
 // src/lib/harness-capability.ts
 var HARNESS_REGISTRY = {
   // Local stdio CLI agents — PAPI runs git on the user's machine. Confirmed in telemetry.
@@ -20419,6 +20434,38 @@ Run \`project_switch <slug>\` to switch the active PAPI project, or verify your
     if (gateDecision.action === "block") {
       return errorResponse(gateDecision.message);
     }
+    if (!isGitAvailable() || !isGitRepo(config2.projectRoot)) {
+      tracker.mark("db-only-close-cycle");
+      let closed;
+      try {
+        closed = await closeCycleState(config2, adapter2, version, void 0, {
+          force: force ?? false,
+          callerUserId: gate.callerUserId
+        });
+      } catch (err) {
+        return errorResponse(err instanceof Error ? err.message : String(err));
+      }
+      await completeRelease(tracker, {
+        cycleClosed: closed.resolvedCycleNum > 0 ? closed.resolvedCycleNum : null,
+        version,
+        caps,
+        branchMerges: [],
+        changelogEmitted: false
+      });
+      const cyclePart = closed.resolvedCycleNum > 0 ? `Cycle ${closed.resolvedCycleNum}` : "The cycle";
+      const warningsBlock = closed.warnings.length > 0 ? `
+\u26A0\uFE0F Warnings: ${closed.warnings.join("; ")}
+` : "";
+      return textResponse(
+        `## Release ${version} \u2014 cycle closed (database only)
+
+${cyclePart} is now marked **complete** in PAPI, so \`orient\` will no longer flag "Release has not been run."
+` + warningsBlock + `
+${DB_ONLY_RELEASE_NOTICE}
+
+Next: cycle closed! Run \`plan\` to start your next cycle.`
+      );
+    }
     tracker.mark("create-release");
     const result = await createRelease(config2, branch, version, adapter2, void 0, {
       force: force ?? false,
@@ -21100,8 +21147,12 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
     throw err;
   }
   const branchLines = [];
+  const startCaps = adapter2.getProjectInfo ? (await adapter2.getProjectInfo().catch(() => null))?.capabilities ?? {} : {};
+  const autoBranchEnabled = isCapabilityEnabled(startCaps, "autoBranch");
   if (options.light) {
     branchLines.push("Light mode: skipping branch creation \u2014 working on current branch.");
+  } else if (!autoBranchEnabled) {
+    branchLines.push("Auto branch: skipped (Auto branch capability off) \u2014 working on current branch.");
   } else if (!hasLocalWorkspace()) {
     const cycleHealth = await adapter2.getCycleHealth().catch(() => null);
     const hosted = hostedStartSteps(clientName, taskId, task.module, cycleHealth?.totalCycles ?? 0, config2.baseBranch);
@@ -21272,6 +21323,12 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
         }
       }
     }
+  } else {
+    if (!isGitAvailable() || !isGitRepo(config2.projectRoot)) {
+      branchLines.push(DB_ONLY_START_NOTICE);
+    } else {
+      branchLines.push("Auto-commit off (PAPI_AUTO_COMMIT=false) \u2014 skipping branch creation; working on the current branch.");
+    }
   }
   if (task.status !== "In Progress") {
     await adapter2.updateTaskStatus(taskId, "In Progress");
@@ -21408,6 +21465,9 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
   if (!task) {
     throw new Error(`Task "${taskId}" not found on the Cycle Board.`);
   }
+  const completeCaps = adapter2.getProjectInfo ? (await adapter2.getProjectInfo().catch(() => null))?.capabilities ?? {} : {};
+  const autoCommitEnabled = isCapabilityEnabled(completeCaps, "autoCommit");
+  const autoPushEnabled = isCapabilityEnabled(completeCaps, "autoPush");
   assertDeployVerification(config2, input, { deployingNow: options.light === true });
   const [healthResult, priorCount] = await Promise.all([
     adapter2.getCycleHealth().catch(() => ({ totalCycles: 0 })),
@@ -21682,11 +21742,16 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
     }
   }
   const statusNote = input.completed === "yes" ? options.light ? `Task "${task.title}" (${taskId}) marked Done (light mode \u2014 no review needed).` : `Task "${task.title}" (${taskId}) marked In Review \u2014 ready for your sign-off via \`review_submit\`.` : `Task "${task.title}" (${taskId}) status unchanged (completed: ${input.completed}).`;
+  const dbOnlyMode = hasLocalWorkspace() && (!isGitAvailable() || !isGitRepo(config2.projectRoot));
   let commitLine;
-  if (config2.autoCommit) {
-    commitLine = autoCommit(config2, taskId, task.title, task.buildHandoff?.filesLikelyTouched);
-  } else {
+  if (!autoCommitEnabled) {
+    commitLine = "Auto-commit: skipped (Auto commit capability off).";
+  } else if (!config2.autoCommit) {
     commitLine = "Auto-commit: skipped (PAPI_AUTO_COMMIT=false).";
+  } else if (dbOnlyMode) {
+    commitLine = DB_ONLY_COMPLETE_NOTICE;
+  } else {
+    commitLine = autoCommit(config2, taskId, task.title, task.buildHandoff?.filesLikelyTouched);
   }
   if (isGitAvailable() && isGitRepo(config2.projectRoot)) {
     const sha = getHeadCommitSha(config2.projectRoot);
@@ -21709,6 +21774,9 @@ async function completeBuild(adapter2, config2, taskId, input, options = {}, cli
   let prLines = [];
   if (options.light) {
     prLines.push("Light mode: skipping push and PR creation.");
+  } else if (!autoPushEnabled) {
+    prLines.push("Auto push & PR: skipped (Auto push & PR capability off).");
+  } else if (dbOnlyMode) {
   } else if (config2.autoCommit && input.completed === "yes") {
     prLines = pushAndCreatePR(config2, taskId, task.title, clientName, task.module, cycleNumber);
   }
@@ -21830,8 +21898,10 @@ var OWNER_NAME = process.env["PAPI_OWNER"] ?? "cathalos92";
 var MODULE_INSTRUCTIONS = {
   Dashboard: `**\u26A0\uFE0F MANDATORY \u2014 Dashboard Module Rules (skip = rework)**
 
-**STEP 0 \u2014 Dispatch the design agent for the visual layer (do NOT hand-write UI in the main build context).**
-Any \`.tsx\` that renders visible UI must be built by the \`frontend-design-engineer\` subagent (dispatch via the Task tool), not inline here. It works in an isolated window loaded only with brand canon (DESIGN.md / PRODUCT.md / brand-book), runs design-critique before and after, builds via the \`frontend-design\` / \`impeccable\` skills, self-checks the falsifiable anti-slop blocklist, and verifies in-browser at populated / empty / mobile states. You remain responsible for data, routes, types, and tests \u2014 hand the visual layer to the agent and integrate the report it returns. Components hand-written in this context produce generic output that fails review. (If \`.claude/agents/frontend-design-engineer.md\` is absent \u2014 e.g. a fresh external install \u2014 run STEPs 1-4 below yourself.)
+**STEP 0 \u2014 If the frontend-design pack is installed, dispatch the design agent for the visual layer (otherwise build it yourself, STEPs 1-4).**
+This step is conditional \u2014 PAPI does NOT ship the design pack on a hosted/remote connection, so do not assume the agent exists. Check for \`.claude/agents/frontend-design-engineer.md\`:
+- **Present:** any \`.tsx\` that renders visible UI should be built by the \`frontend-design-engineer\` subagent (dispatch via the Task tool), not inline here. It works in an isolated window loaded with your project's own brand canon (your DESIGN.md / PRODUCT.md), runs design-critique before and after, builds via the \`frontend-design\` / \`impeccable\` skills, self-checks the falsifiable anti-slop blocklist, and verifies in-browser at populated / empty / mobile states. You remain responsible for data, routes, types, and tests \u2014 hand the visual layer to the agent and integrate the report it returns.
+- **Absent (default on a hosted PAPI harness, and on any project where you haven't opted in):** the pack is opt-in, not required. Install it by running \`setup\` locally on a frontend project (it detects the stack and installs the agent + design-critique skill + guard hook), or copy it from the PAPI server package under \`design-assets/\`. Until then, do NOT dispatch an agent you don't have \u2014 follow STEPs 1-4 below yourself using the generally-available \`frontend-design\` / \`impeccable\` skills.
 
 **STEP 1 \u2014 BEFORE writing any code:**
 If you use the \`impeccable\` skill (recommended for dashboard work), it reads two root files for design context: **PRODUCT.md** (strategic \u2014 brand, users, product purpose, design principles) and **DESIGN.md** (visual tokens \u2014 palette, typography, elevation, components). Run \`impeccable init\` to create them if they don't exist yet. Every visual decision must align with these files; if your output contradicts them, it is wrong. (The legacy \`.impeccable.md\` is no longer read by the skill.)
@@ -21906,6 +21976,7 @@ import { readdirSync as readdirSync6, existsSync as existsSync8, readFileSync as
 import { join as join12, relative } from "path";
 import { homedir as homedir3 } from "os";
 import { randomUUID as randomUUID12 } from "crypto";
+import { docDeletionBlockMessage } from "@papi-ai/shared";
 var docRegisterTool = {
   name: "doc_register",
   description: "Register or update a document in the doc registry. Called after finalising a research/planning doc, or when build_execute detects unregistered docs. Stores metadata and structured summary \u2014 not full content. Re-registering an existing doc updates its summary, tags, actions, type, and status (upsert). Visibility and owner are not changed on re-register.",
@@ -22300,9 +22371,161 @@ ${userNotes}` : referenceLine;
 - ${remainingNote}`
   );
 }
+var docDeleteTool = {
+  name: "doc_delete",
+  description: "Permanently delete a registered doc. Guarded: ALLOWED only for the doc's creator or the project owner, and only when nothing depends on it \u2014 a delete is BLOCKED if another doc supersedes it, or a task references it (doc_ref) or a linked action. The guard never cascade-deletes dependents; resolve the dependency first. Identify the doc by `doc_path` (preferred) or `doc_id`.",
+  annotations: { title: "Delete Doc", readOnlyHint: false, destructiveHint: true, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      doc_path: { type: "string", description: 'Path of the doc to delete (e.g. "docs/research/funding-landscape.md"). Either this or doc_id is required.' },
+      doc_id: { type: "string", description: "UUID of the doc to delete. Either this or doc_path is required." }
+    },
+    required: []
+  }
+};
+async function handleDocDelete(adapter2, config2, args) {
+  if (!adapter2.deleteDoc) {
+    return errorResponse("Doc deletion not available \u2014 requires the pg adapter.");
+  }
+  const docPath = args.doc_path?.trim();
+  const docId = args.doc_id?.trim();
+  if (!docPath && !docId) {
+    return errorResponse("Either doc_path or doc_id is required.");
+  }
+  const gate = await resolveOwnerGate(adapter2, config2);
+  const requesterUserId = gate.enforced ? gate.callerUserId : gate.ownerUserId ?? gate.callerUserId;
+  const result = await adapter2.deleteDoc(docId ?? docPath, requesterUserId);
+  if (!result.deleted) {
+    const reason = result.reason ?? "not_authorized";
+    return errorResponse(`Delete blocked \u2014 ${docDeletionBlockMessage(reason)}`);
+  }
+  return textResponse(`**Deleted:** ${docId ?? docPath}`);
+}
+var docReorderTool = {
+  name: "doc_reorder",
+  description: "Persist the display order of docs within this project. Pass `doc_ids` as the full desired sequence of doc UUIDs \u2014 each doc's position is saved so the dashboard renders them in that order. Ids not in this project are ignored.",
+  annotations: { title: "Reorder Docs", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      doc_ids: {
+        type: "array",
+        items: { type: "string" },
+        description: "Ordered list of doc UUIDs \u2014 index 0 renders first."
+      }
+    },
+    required: ["doc_ids"]
+  }
+};
+async function handleDocReorder(adapter2, args) {
+  if (!adapter2.reorderDocs) {
+    return errorResponse("Doc reorder not available \u2014 requires the pg adapter.");
+  }
+  const docIds = args.doc_ids;
+  if (!Array.isArray(docIds) || docIds.some((id) => typeof id !== "string")) {
+    return errorResponse("doc_ids is required and must be an array of doc UUID strings.");
+  }
+  if (docIds.length === 0) {
+    return errorResponse("doc_ids must contain at least one doc UUID.");
+  }
+  await adapter2.reorderDocs(docIds);
+  return textResponse(`**Reordered ${docIds.length} doc(s).** New order persisted.`);
+}
 
 // src/tools/build.ts
 init_git();
+
+// src/lib/build-checkpoint.ts
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join13 } from "path";
+var BUILD_CHECKPOINT_VERSION = 1;
+function cwdHash(cwd) {
+  return createHash4("sha256").update(realpathOrSelf(cwd)).digest("hex").slice(0, 12);
+}
+function safeTaskId(taskId) {
+  return taskId.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function checkpointDir(cwd) {
+  return join13(cwd, ".papi", "state");
+}
+function checkpointPath(cwd, taskId) {
+  return join13(checkpointDir(cwd), `build-${safeTaskId(taskId)}.${cwdHash(cwd)}.json`);
+}
+function writeBuildCheckpoint(input) {
+  try {
+    const dir = checkpointDir(input.cwd);
+    if (!existsSync9(dir)) {
+      mkdirSync3(dir, { recursive: true });
+    }
+    const checkpoint = {
+      version: BUILD_CHECKPOINT_VERSION,
+      taskId: input.taskId,
+      branch: input.branch,
+      step: input.step,
+      lastCommitSha: input.lastCommitSha,
+      modifiedFiles: input.modifiedFiles,
+      cwd: realpathOrSelf(input.cwd),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writeFileSync4(checkpointPath(input.cwd, input.taskId), JSON.stringify(checkpoint, null, 2) + "\n", "utf-8");
+  } catch {
+  }
+}
+function readBuildCheckpoint(key) {
+  try {
+    const path7 = checkpointPath(key.cwd, key.taskId);
+    if (!existsSync9(path7)) return null;
+    const parsed = JSON.parse(readFileSync8(path7, "utf-8"));
+    if (!parsed || parsed.version !== BUILD_CHECKPOINT_VERSION || parsed.taskId !== key.taskId) {
+      return null;
+    }
+    return {
+      version: BUILD_CHECKPOINT_VERSION,
+      taskId: parsed.taskId,
+      branch: parsed.branch ?? null,
+      step: "branch_ready",
+      lastCommitSha: parsed.lastCommitSha ?? null,
+      modifiedFiles: Array.isArray(parsed.modifiedFiles) ? parsed.modifiedFiles : [],
+      cwd: typeof parsed.cwd === "string" ? parsed.cwd : realpathOrSelf(key.cwd),
+      updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : ""
+    };
+  } catch {
+    return null;
+  }
+}
+function clearBuildCheckpoint(key) {
+  try {
+    const path7 = checkpointPath(key.cwd, key.taskId);
+    if (existsSync9(path7)) {
+      unlinkSync3(path7);
+    }
+  } catch {
+  }
+}
+function formatResumeNote(cp) {
+  const files = cp.modifiedFiles.filter((f) => f && f.trim());
+  const fileList = files.length > 0 ? files.slice(0, 12).map((f) => `  - ${f}`).join("\n") + (files.length > 12 ? `
+  - \u2026+${files.length - 12} more` : "") : "  _(none recorded)_";
+  const lines = [
+    "> **\u21BB Resuming from checkpoint** \u2014 this task is already In Progress; you are NOT starting clean.",
+    `> - Branch: \`${cp.branch ?? "unknown"}\``,
+    "> - Last step: branch ready",
+    `> - Last commit: ${cp.lastCommitSha ? cp.lastCommitSha.slice(0, 8) : "none"}`,
+    `> - Checkpoint saved: ${cp.updatedAt || "unknown"}`,
+    ">",
+    "> Modified files at last checkpoint:",
+    ...fileList.split("\n").map((l) => `> ${l}`),
+    ">",
+    "> Review the existing branch and changes above before writing new code \u2014 do not re-do work already committed.",
+    "",
+    ""
+  ];
+  return lines.join("\n");
+}
+
+// src/tools/build.ts
 var buildListTool = {
   name: "build_list",
   description: "List cycle tasks that have BUILD HANDOFFs ready for execution. Shows task ID, title, status, priority, and complexity. In Progress tasks appear first, then Backlog. Does not call the Anthropic API.",
@@ -22640,10 +22863,23 @@ async function handleBuildExecute(adapter2, config2, args, clientName) {
     if (scopeTask) {
       tracker.setStreamScope({ taskId: scopeTask.displayId ?? scopeTask.id, cycle: scopeTask.cycle ?? null });
     }
+    let resumeNote = "";
+    if (scopeTask?.status === "In Progress") {
+      const existing = readBuildCheckpoint({ cwd: config2.projectRoot, taskId });
+      if (existing) resumeNote = formatResumeNote(existing);
+    }
     await tracker.recordStep("started");
     const result = await startBuild(adapter2, config2, taskId, { light }, clientName);
     tracker.setStreamScope({ taskId: result.task.displayId ?? result.task.id, cycle: result.task.cycle ?? null });
     await tracker.recordStep("branch_ready");
+    writeBuildCheckpoint({
+      cwd: config2.projectRoot,
+      taskId,
+      branch: getCurrentBranch(config2.projectRoot),
+      step: "branch_ready",
+      lastCommitSha: getHeadCommitSha(config2.projectRoot),
+      modifiedFiles: getModifiedFiles(config2.projectRoot)
+    });
     tracker.mark("start_decorate_handoff");
     const branchInfo = result.branchLines.length > 0 ? result.branchLines.map((l) => `> ${l}`).join("\n") + "\n\n" : "";
     const phaseNote = result.phaseChanges.length > 0 ? "\n\n" + result.phaseChanges.map((c) => `Phase auto-updated: ${c.phaseId} ${c.oldStatus} \u2192 ${c.newStatus}`).join("\n") : "";
@@ -22723,7 +22959,8 @@ If this build fixes any of these, pass their UUIDs in \`fixed_issues\` on comple
       formatModelRecommendation(result.task.buildHandoff?.effort ?? result.task.complexity)
     ) ?? "";
     const gestaltNote = buildGestaltPreBuildDirective(caps) ?? "";
-    return textResponse(header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineNote + chainInstruction + phaseNote + filesToWriteSection);
+    const buildDisciplineSection = buildPapiMetaFramingDirective(caps, buildDisciplineNote) ?? "";
+    return textResponse(resumeNote + header + serializeBuildHandoff(result.task.buildHandoff) + modelNote + gestaltNote + adSection + moduleInstructions + moduleContext + dogfoodSection + openIssuesSection + verificationNote + buildDisciplineSection + chainInstruction + phaseNote + filesToWriteSection);
   } catch (err) {
     if (isNoHandoffError(err)) {
       const lines = [
@@ -22861,6 +23098,7 @@ Your report was NOT discarded and the task is NOT yet Done \u2014 re-send with \
       preview
     }, { light }, clientName);
     tracker.mark("complete_format");
+    clearBuildCheckpoint({ cwd: config2.projectRoot, taskId });
     tracker.setStreamScope({ taskId: result.task.displayId ?? result.task.id, cycle: result.cycleNumber });
     await tracker.recordStep("report_written");
     if ((result.autoTriagedCount ?? 0) > 0) {
@@ -23461,6 +23699,43 @@ This ${type} is visible to PAPI maintainers.${followUpLine}${autoRouteLine}`
   const truncateWarning = notesTruncated ? ` (notes truncated to ${MAX_NOTES_LENGTH} chars)` : "";
   return textResponse(`\u{1F41B} ${task.id}: "${task.title}" \u2014 ${severityLabel} bug added to backlog${overrideNote}${branchNote}. Will be picked up by next plan.${truncateWarning}`);
 }
+var bugListTool = {
+  name: "bug_list",
+  description: "List the upstream bug/idea reports YOU filed to the PAPI maintainers (via the `bug` tool with report=true or an auto-routed PAPI bug), newest first. Read-only. Shows each report's id, kind (bug/idea), triage status, description, and when it was filed. Scoped to your own submissions only \u2014 never another user's. Requires a database adapter (pg or hosted proxy); the local md adapter has no upstream store. Does not call the Anthropic API.",
+  annotations: { title: "List My Bug Reports", readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+  inputSchema: {
+    type: "object",
+    properties: {
+      limit: {
+        type: "integer",
+        description: "Optional maximum number of reports to return. Omit to return all. Reserved for future pagination \u2014 current behaviour returns all your reports newest-first regardless of value."
+      }
+    },
+    required: []
+  }
+};
+async function handleBugList(adapter2, config2) {
+  if (!adapter2.listMyBugReports) {
+    return errorResponse(
+      "Listing your bug reports requires a database adapter (pg or hosted proxy). The md adapter has no upstream report store."
+    );
+  }
+  const reports = await adapter2.listMyBugReports(config2.userId);
+  if (reports.length === 0) {
+    return textResponse("You haven't filed any bug or idea reports yet. Use the `bug` tool to report a PAPI bug or suggest an idea.");
+  }
+  const lines = reports.map((r) => {
+    const kind = r.type === "idea" ? "\u{1F4A1} idea" : "\u{1F41B} bug";
+    const when = r.createdAt.slice(0, 10);
+    return `- \`${r.id}\` \xB7 ${kind} \xB7 ${r.status} \xB7 ${when}
+  ${r.description}`;
+  });
+  return textResponse(
+    `**Your reports (${reports.length}, newest first)**
+
+${lines.join("\n")}`
+  );
+}
 
 // src/tools/ad-hoc.ts
 init_git();
@@ -23707,13 +23982,13 @@ _To correct: board_edit ${result.task.id} with updated fields._`
 init_git();
 
 // src/services/reconcile.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join14 } from "path";
 function loadDocsIndex(projectRoot) {
   if (!hasLocalWorkspace()) return "";
   try {
-    const indexPath = join13(projectRoot, "docs", "INDEX.md");
-    const raw = readFileSync8(indexPath, "utf8");
+    const indexPath = join14(projectRoot, "docs", "INDEX.md");
+    const raw = readFileSync9(indexPath, "utf8");
     const rows = raw.split("\n").filter((l) => l.startsWith("| ["));
     if (rows.length === 0) return "";
     const entries = rows.map((row) => {
@@ -24288,8 +24563,8 @@ Produce your analysis and structured output above. Present Part 1 to the user an
 }
 
 // src/tools/review.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { join as join15 } from "path";
 init_git();
 
 // src/services/review.ts
@@ -24518,11 +24793,11 @@ ${task.buildReport}` : "### Build Report\n(none recorded)";
 ${diff}
 \`\`\`` : "### Branch diff vs base\n(no diff resolved \u2014 not a git repo, no base ref, or no committed changes)";
   let projectContext = "";
-  const ctxPath = join14(config2.projectRoot, ".agents", "papi-context.md");
-  if (existsSync9(ctxPath)) {
+  const ctxPath = join15(config2.projectRoot, ".agents", "papi-context.md");
+  if (existsSync10(ctxPath)) {
     try {
       projectContext = `### Project context (.agents/papi-context.md)
-${readFileSync9(ctxPath, "utf-8")}
+${readFileSync10(ctxPath, "utf-8")}
 
 `;
     } catch {
@@ -24682,8 +24957,8 @@ function mergeAfterAccept(config2, taskId) {
     };
   }
   const details = [];
-  const papiDir = join14(config2.projectRoot, ".papi");
-  if (existsSync9(papiDir)) {
+  const papiDir = join15(config2.projectRoot, ".papi");
+  if (existsSync10(papiDir)) {
     try {
       const commitResult = stageDirAndCommit(
         config2.projectRoot,
@@ -26265,7 +26540,7 @@ function formatDeferredGateSection(sweep) {
 
 // src/tools/agent-list.ts
 import { readdir as readdir2, readFile as readFile7 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var NO_AGENTS_HINT = "No project sub-agents found in `.claude/agents/`. Add a `*.md` file with `name` + `description` frontmatter \u2014 see the 1926-Census marketing sub-agent for a reference implementation.";
 function parseAgentFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
@@ -26277,7 +26552,7 @@ function parseAgentFrontmatter(content) {
   return { name: nameMatch?.[1].trim(), description };
 }
 async function listAgents(projectRoot) {
-  const agentsDir = join15(projectRoot, ".claude", "agents");
+  const agentsDir = join16(projectRoot, ".claude", "agents");
   let files;
   try {
     files = await readdir2(agentsDir);
@@ -26288,7 +26563,7 @@ async function listAgents(projectRoot) {
   for (const file of files.filter((f) => f.endsWith(".md"))) {
     let content;
     try {
-      content = await readFile7(join15(agentsDir, file), "utf-8");
+      content = await readFile7(join16(agentsDir, file), "utf-8");
     } catch {
       continue;
     }
@@ -26296,7 +26571,7 @@ async function listAgents(projectRoot) {
     agents.push({
       name: meta?.name ?? file.replace(/\.md$/, ""),
       description: meta?.description ?? "",
-      path: join15(".claude", "agents", file)
+      path: join16(".claude", "agents", file)
     });
   }
   agents.sort((a, b2) => a.name.localeCompare(b2.name));
@@ -26437,8 +26712,8 @@ async function verifyProject(adapter2) {
 // src/tools/orient.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync10 } from "fs";
-import { join as join16 } from "path";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "fs";
+import { join as join17 } from "path";
 var execFileAsync2 = promisify2(execFile2);
 var GIT_DEPENDENT_ENVS = /* @__PURE__ */ new Set(["hosted", "api"]);
 var VALID_ENVS = /* @__PURE__ */ new Set(["local-cli", "hosted", "api", "unknown"]);
@@ -26797,8 +27072,8 @@ async function getLatestGitTag(projectRoot) {
 }
 async function checkNpmVersionDrift() {
   try {
-    const pkgPath = join16(new URL(".", import.meta.url).pathname, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+    const pkgPath = join17(new URL(".", import.meta.url).pathname, "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
     const localVersion = pkg.version;
     const packageName = pkg.name;
     const { stdout } = await execFileAsync2("npm", ["view", packageName, "version"], {
@@ -27472,9 +27747,9 @@ function enrichClaudeMd(projectRoot, cycleNumber, adapterType, collector, client
 
 \u{1F4DD} **CLAUDE.md enriched** \u2014 added ${tierNames2.join(" + ")} guidance for cycle ${cycleNumber}+ projects.`;
   }
-  const claudeMdPath = join16(projectRoot, "CLAUDE.md");
-  if (!existsSync10(claudeMdPath)) return "";
-  const content = readFileSync10(claudeMdPath, "utf-8");
+  const claudeMdPath = join17(projectRoot, "CLAUDE.md");
+  if (!existsSync11(claudeMdPath)) return "";
+  const content = readFileSync11(claudeMdPath, "utf-8");
   const additions = [];
   if (cycleNumber >= 6 && !content.includes(CLAUDE_MD_ENRICHMENT_SENTINEL_T1)) {
     additions.push(dedupeEnrichmentBlob(content, CLAUDE_MD_TIER_1));
@@ -27483,7 +27758,7 @@ function enrichClaudeMd(projectRoot, cycleNumber, adapterType, collector, client
     additions.push(dedupeEnrichmentBlob(content, CLAUDE_MD_TIER_2));
   }
   if (additions.length === 0) return "";
-  writeFileSync4(claudeMdPath, content + additions.join(""), "utf-8");
+  writeFileSync5(claudeMdPath, content + additions.join(""), "utf-8");
   const tierNames = [];
   if (additions.some((a) => a.includes(CLAUDE_MD_ENRICHMENT_SENTINEL_T1))) tierNames.push("Established (batch building, strategy reviews, AD lifecycle)");
   if (additions.some((a) => a.includes(CLAUDE_MD_ENRICHMENT_SENTINEL_T2))) tierNames.push("Mature (idea pipeline, doc registry, advanced patterns)");
@@ -28206,11 +28481,11 @@ ${result.userMessage}
 }
 
 // src/tools/scope-brief.ts
-import { readFileSync as readFileSync11, statSync as statSync7 } from "fs";
+import { readFileSync as readFileSync12, statSync as statSync7 } from "fs";
 
 // src/services/scope-brief.ts
-import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync3 } from "fs";
-import { join as join17, dirname as dirname4 } from "path";
+import { writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "fs";
+import { join as join18, dirname as dirname4 } from "path";
 var SCOPE_BRIEF_SYSTEM = `You are a technical scoping tool. You receive a brief-class task (too large to build directly) and decompose it into a structured scope document.
 
 A scope document must:
@@ -28267,14 +28542,14 @@ async function applyScopeBrief(adapter2, input) {
   }
   const slug = input.taskId.replace(/[^a-z0-9-]/g, "-").toLowerCase();
   const relPath = `docs/scopes/${slug}.md`;
-  const absPath = join17(input.projectRoot, relPath);
+  const absPath = join18(input.projectRoot, relPath);
   const docBody = addFrontmatter(docContent, task, input.cycleNumber);
   const collector = new FileWriteCollector();
   if (input.adapterType === "proxy") {
     collector.add({ path: relPath, content: docBody, mode: "overwrite" });
   } else {
-    mkdirSync3(dirname4(absPath), { recursive: true });
-    writeFileSync5(absPath, docBody, "utf-8");
+    mkdirSync4(dirname4(absPath), { recursive: true });
+    writeFileSync6(absPath, docBody, "utf-8");
   }
   const taskCount = countSubTasks(docContent);
   const summary = buildSummary(task, taskCount);
@@ -28445,7 +28720,7 @@ function readLlmResponse(args) {
       if (statSync7(filePath).size > MAX_RESPONSE_FILE_BYTES) {
         throw new Error(`llm_response_file exceeds ${MAX_RESPONSE_FILE_BYTES} bytes`);
       }
-      const body = readFileSync11(filePath, "utf-8");
+      const body = readFileSync12(filePath, "utf-8");
       return body.trim() ? body : null;
     } catch (err) {
       throw new Error(`could not read llm_response_file: ${err instanceof Error ? err.message : String(err)}`);
@@ -28640,6 +28915,7 @@ async function handleDiscoveredIssueResolve(adapter2, args) {
 import path6 from "path";
 
 // src/services/entitlements.ts
+import { evaluateContributorGate } from "@papi-ai/shared";
 var FREE_PROJECT_CAP = 3;
 var PAID_TIERS = /* @__PURE__ */ new Set(["pro", "team"]);
 var PRICING_URL = "https://getpapi.ai/pricing";
@@ -28672,11 +28948,9 @@ async function enforceProjectCap(adapter2, target) {
   if (projects.length >= FREE_PROJECT_CAP) return projectCapMessage(projects.length);
   return null;
 }
-async function enforceContributorGate(adapter2) {
+async function resolveContributorUpsell(adapter2) {
   const tier = await resolveTier(adapter2);
-  if (tier === null) return null;
-  if (tier === "team") return null;
-  return contributorTeamMessage(tier);
+  return evaluateContributorGate(tier).upsell ?? null;
 }
 function projectCapMessage(currentCount) {
   return `**You're on the Free plan (${currentCount} of ${FREE_PROJECT_CAP} projects).**
@@ -28685,11 +28959,6 @@ Free covers up to ${FREE_PROJECT_CAP} projects. To run more, upgrade to Pro for
 
 Your existing projects are untouched, and you can keep working in any of them.`;
 }
-function contributorTeamMessage(tier) {
-  return `**Adding people to a project is a Team feature.**
-
-You're on the ${tier} plan. Shared projects, roles, and the Quality Gate come with Team. Read-only viewer seats are free, so you only pay for who is actually building: ${PRICING_URL}`;
-}
 
 // src/tools/project.ts
 function workspacePapiDir(config2) {
@@ -28883,17 +29152,19 @@ function requireEmail(args) {
 async function handleContributorAdd(adapter2, config2, args) {
   const denied = await denyUnlessOwner(adapter2, config2);
   if (denied) return errorResponse(denied);
-  const tierDenied = await enforceContributorGate(adapter2);
-  if (tierDenied) return errorResponse(tierDenied);
   const email = requireEmail(args);
   if (!email) return errorResponse('A valid email is required. Example: contributor_add email="wes@example.com"');
   try {
     const entry = await adapter2.addContributorByEmail(email);
     const name = entry.displayName ? ` (${entry.displayName})` : "";
+    const upsell = await resolveContributorUpsell(adapter2);
+    const upsellSuffix = upsell ? `
+
+${upsell}` : "";
     return textResponse(
       `\u2705 Added **${entry.email ?? email}**${name} as a contributor.
 
-They now have contributors-tier visibility on this project. Roles and invites land with MU-2 \u2014 today membership is the whole model.`
+They now have contributors-tier visibility on this project. Roles and invites land with MU-2 \u2014 today membership is the whole model.` + upsellSuffix
     );
   } catch (err) {
     return errorResponse(err instanceof Error ? err.message : String(err));
@@ -29158,19 +29429,19 @@ Its build reports, comments, and history moved with it; the cycle assignment was
 
 // src/services/harness-inventory.ts
 import { readdir as readdir3, readFile as readFile8, stat as stat3 } from "fs/promises";
-import { join as join18 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { join as join19 } from "path";
+import { createHash as createHash5 } from "crypto";
 var RECOMMENDED_HOOKS = ["stop-release-check.sh", "claude-md-size-guard.sh"];
 async function computeFingerprint(root) {
   const parts = [];
   for (const sub of [".claude/skills", ".claude/agents", ".claude/hooks"]) {
-    const dir = join18(root, sub);
+    const dir = join19(root, sub);
     try {
       const names = (await readdir3(dir)).sort((a, b2) => a.localeCompare(b2));
       for (const name of names) {
         let mtime = "";
         try {
-          mtime = String(Math.floor((await stat3(join18(dir, name))).mtimeMs));
+          mtime = String(Math.floor((await stat3(join19(dir, name))).mtimeMs));
         } catch {
         }
         parts.push(`${sub}/${name}:${mtime}`);
@@ -29185,11 +29456,11 @@ async function computeFingerprint(root) {
   } catch {
     parts.push("manifest:none");
   }
-  return createHash4("sha256").update(parts.join("|")).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(parts.join("|")).digest("hex").slice(0, 16);
 }
 async function readSkillDescription(skillDir) {
   try {
-    const content = await readFile8(join18(skillDir, "SKILL.md"), "utf-8");
+    const content = await readFile8(join19(skillDir, "SKILL.md"), "utf-8");
     const fm = content.match(/^---\n([\s\S]*?)\n---/);
     if (!fm) return void 0;
     const desc = fm[1].match(/^description:\s*[>|]?\s*\n?([\s\S]*?)(?=\n\w+:|\n---|$)/m);
@@ -29209,17 +29480,17 @@ async function scanInventory(root, toolDefs) {
     version = loadManifest().packageVersion;
   } catch {
   }
-  const skillsDir = join18(root, ".claude", "skills");
+  const skillsDir = join19(root, ".claude", "skills");
   try {
     const dirents = await readdir3(skillsDir, { withFileTypes: true });
     for (const d of dirents.filter((e) => e.isDirectory())) {
       entries.push({
         kind: "skill",
         name: d.name,
-        description: await readSkillDescription(join18(skillsDir, d.name)),
+        description: await readSkillDescription(join19(skillsDir, d.name)),
         version,
         status: stale.has(d.name) ? "stale_fork" : "ok",
-        path: join18(".claude", "skills", d.name)
+        path: join19(".claude", "skills", d.name)
       });
     }
   } catch {
@@ -29235,9 +29506,9 @@ async function scanInventory(root, toolDefs) {
   }
   const present = /* @__PURE__ */ new Set();
   try {
-    for (const f of (await readdir3(join18(root, ".claude", "hooks"))).filter((n) => n.endsWith(".sh"))) {
+    for (const f of (await readdir3(join19(root, ".claude", "hooks"))).filter((n) => n.endsWith(".sh"))) {
       present.add(f);
-      entries.push({ kind: "hook", name: f, status: "ok", path: join18(".claude", "hooks", f) });
+      entries.push({ kind: "hook", name: f, status: "ok", path: join19(".claude", "hooks", f) });
     }
   } catch {
   }
@@ -29636,6 +29907,7 @@ var PAPI_TOOLS = [
   buildCancelTool,
   ideaTool,
   bugTool,
+  bugListTool,
   adHocTool,
   boardReconcileTool,
   releaseTool,
@@ -29651,6 +29923,8 @@ var PAPI_TOOLS = [
   docSearchTool,
   docScanTool,
   docActionPromoteTool,
+  docDeleteTool,
+  docReorderTool,
   getSiblingAdsTool,
   handoffGenerateTool,
   scopeBriefTool,
@@ -29677,7 +29951,7 @@ function createServer(adapter2, config2) {
   const __pkgDir = dirname5(__pkgFilename);
   let serverVersion = "unknown";
   try {
-    const pkg = JSON.parse(readFileSync12(join19(__pkgDir, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync13(join20(__pkgDir, "..", "package.json"), "utf-8"));
     serverVersion = pkg.version ?? "unknown";
   } catch {
   }
@@ -29695,7 +29969,7 @@ function createServer(adapter2, config2) {
   }
   const __filename = fileURLToPath3(import.meta.url);
   const __dirname2 = dirname5(__filename);
-  const skillsDir = join19(__dirname2, "..", "skills");
+  const skillsDir = join20(__dirname2, "..", "skills");
   function parseSkillFrontmatter(content) {
     const match = content.match(/^---\n([\s\S]*?)\n---/);
     if (!match) return null;
@@ -29713,7 +29987,7 @@ function createServer(adapter2, config2) {
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       const prompts = [];
       for (const file of mdFiles) {
-        const content = await readFile9(join19(skillsDir, file), "utf-8");
+        const content = await readFile9(join20(skillsDir, file), "utf-8");
         const meta = parseSkillFrontmatter(content);
         if (meta) {
           prompts.push({ name: meta.name, description: meta.description });
@@ -29729,7 +30003,7 @@ function createServer(adapter2, config2) {
     try {
       const files = await readdir4(skillsDir);
       for (const file of files.filter((f) => f.endsWith(".md"))) {
-        const content = await readFile9(join19(skillsDir, file), "utf-8");
+        const content = await readFile9(join20(skillsDir, file), "utf-8");
         const meta = parseSkillFrontmatter(content);
         if (meta?.name === name) {
           const body = content.replace(/^---\n[\s\S]*?\n---\n*/, "");
@@ -29816,6 +30090,8 @@ function createServer(adapter2, config2) {
           return handleIdea(adapter2, config2, safeArgs);
         case "bug":
           return handleBug(adapter2, config2, safeArgs);
+        case "bug_list":
+          return handleBugList(adapter2, config2);
         case "ad_hoc":
           return handleAdHoc(adapter2, config2, safeArgs);
         case "board_reconcile":
@@ -29847,6 +30123,10 @@ function createServer(adapter2, config2) {
           return handleDocScan(adapter2, config2, safeArgs);
         case "doc_action_promote":
           return handleDocActionPromote(adapter2, safeArgs);
+        case "doc_delete":
+          return handleDocDelete(adapter2, config2, safeArgs);
+        case "doc_reorder":
+          return handleDocReorder(adapter2, safeArgs);
         case "get_sibling_ads":
           return handleGetSiblingAds(adapter2, safeArgs);
         case "handoff_generate":
@@ -30423,7 +30703,7 @@ async function dispatchRequest(args) {
 var __dirname = dirname6(fileURLToPath4(import.meta.url));
 var pkgVersion = "unknown";
 try {
-  const pkg = JSON.parse(readFileSync17(join24(__dirname, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync18(join25(__dirname, "..", "package.json"), "utf-8"));
   pkgVersion = pkg.version;
 } catch {
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.65",
+  "version": "0.7.67",
   "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",