@papi-ai/server 0.7.67 → 0.7.69

package/dist/index.js

@@ -5210,6 +5210,7 @@ function loadConfig() {
   const baseBranch = process.env.PAPI_BASE_BRANCH ?? "main";
   const autoPR = process.env.PAPI_AUTO_PR !== "false";
   const lightMode = process.env.PAPI_LIGHT_MODE === "true";
+  const autoWorktree = process.env.PAPI_AUTO_WORKTREE === "true";
   const projectOwner = process.env.PAPI_OWNER ?? "Cathal";
   const skipProjectSpecificRules = process.env.PAPI_SKIP_PROJECT_RULES === "true";
   const userId = process.env.PAPI_USER_ID || void 0;
@@ -5283,8 +5284,13 @@ Already have an account? Make sure PAPI_USER_ID is set in your .mcp.json env con
     baseBranch,
     autoPR,
     adapterType,
+    // Local stdio boot: the server runs on the user's machine, so the client
+    // shares its filesystem. The HTTP transport overrides this to false per
+    // request (task-2906).
+    localFilesystem: true,
     papiEndpoint,
     lightMode,
+    autoWorktree,
     projectOwner,
     skipProjectSpecificRules,
     userId,
@@ -9475,11 +9481,16 @@ function buildPlanUserMessage(ctx) {
         ""
       );
     }
-    if (ctx.buildPatterns) {
-      parts.push("### Build Patterns", "", ctx.buildPatterns, "");
+    const enrichment = [];
+    const addEnrichment = (label, ...lines) => {
+      enrichment.push({ label, block: lines.join("\n") });
+    };
+    if (ctx.strategyRecommendations) {
+      addEnrichment("Strategy Recommendations (Pending)", "### Strategy Recommendations (Pending)", "", ctx.strategyRecommendations, "");
     }
     if (ctx.learningPatterns) {
-      parts.push(
+      addEnrichment(
+        "Recurring Learning Patterns",
         "### Recurring Learning Patterns (cross-cycle)",
         "",
         "Tags from cycle learnings (surprises, issues, dead-ends, estimation misses) that keep recurring. Treat a module/theme that recurs across many cycles as a signal: size its tasks up and write a sharper pre-mortem.",
@@ -9489,7 +9500,8 @@ function buildPlanUserMessage(ctx) {
       );
     }
     if (ctx.decisionScorePatterns) {
-      parts.push(
+      addEnrichment(
+        "Decision Risk Scores",
         "### Decision Risk Scores (high-risk + movement)",
         "",
         "Per-decision risk scores (effort+risk+reversibility+scaleCost+lockIn, /25; lower = safer). Decisions flagged \u26A0 high-risk (>15/25) or whose score moved since the last scoring. When a task depends on or advances a \u26A0 high-risk or \u2191 riskier decision, name that decision in the BUILD HANDOFF pre-mortem and lean toward the larger estimate. Do NOT re-score decisions here \u2014 this is read-only input.",
@@ -9498,38 +9510,39 @@ function buildPlanUserMessage(ctx) {
         ""
       );
     }
+    if (ctx.estimationCalibration) {
+      addEnrichment("Estimation Calibration", "### Estimation Calibration (Historical)", "", ctx.estimationCalibration, "");
+    }
     if (ctx.reviewPatterns) {
-      parts.push("### Review Patterns", "", ctx.reviewPatterns, "");
+      addEnrichment("Review Patterns", "### Review Patterns", "", ctx.reviewPatterns, "");
     }
     if (ctx.methodologyMetrics) {
-      parts.push("### Methodology Trends", "", ctx.methodologyMetrics, "");
-    }
-    if (ctx.estimationCalibration) {
-      parts.push("### Estimation Calibration (Historical)", "", ctx.estimationCalibration, "");
+      addEnrichment("Methodology Trends", "### Methodology Trends", "", ctx.methodologyMetrics, "");
     }
     if (ctx.horizonContext) {
-      parts.push("### Forward Horizon", "", ctx.horizonContext, "");
+      addEnrichment("Forward Horizon", "### Forward Horizon", "", ctx.horizonContext, "");
     }
-    if (ctx.strategyRecommendations) {
-      parts.push("### Strategy Recommendations (Pending)", "", ctx.strategyRecommendations, "");
-    }
-    if (ctx.dogfoodEntries) {
-      parts.push("### Dogfood Observations (Recent)", "", ctx.dogfoodEntries, "");
+    if (ctx.buildPatterns) {
+      addEnrichment("Build Patterns", "### Build Patterns", "", ctx.buildPatterns, "");
     }
     if (ctx.taskComments) {
-      parts.push("### Task Discussion Threads", "", ctx.taskComments, "");
+      addEnrichment("Task Discussion Threads", "### Task Discussion Threads", "", ctx.taskComments, "");
     }
     if (ctx.recentReviews) {
-      parts.push("### Human Reviews", "", ctx.recentReviews, "");
+      addEnrichment("Human Reviews", "### Human Reviews", "", ctx.recentReviews, "");
+    }
+    if (ctx.dogfoodEntries) {
+      addEnrichment("Dogfood Observations", "### Dogfood Observations (Recent)", "", ctx.dogfoodEntries, "");
     }
     if (ctx.discoveryCanvas) {
-      parts.push("### Discovery Canvas", "", ctx.discoveryCanvas, "");
+      addEnrichment("Discovery Canvas", "### Discovery Canvas", "", ctx.discoveryCanvas, "");
     }
     if (ctx.registeredDocs) {
-      parts.push("### Relevant Research Docs", "", ctx.registeredDocs, "");
+      addEnrichment("Relevant Research Docs", "### Relevant Research Docs", "", ctx.registeredDocs, "");
     }
     if (ctx.unactionedDocs) {
-      parts.push(
+      addEnrichment(
+        "Unactioned Research",
         "### Unactioned Research (soft-warn)",
         "",
         "These registered docs still have pending actions. Before adding net-new tasks, consider whether one of these unactioned items should be promoted into this cycle via `doc_action_promote`. Surface this in your plan output so the user can decide.",
@@ -9539,7 +9552,31 @@ function buildPlanUserMessage(ctx) {
       );
     }
     if (ctx.carryForwardStaleness) {
-      parts.push("### Carry-Forward Staleness", "", ctx.carryForwardStaleness, "");
+      addEnrichment("Carry-Forward Staleness", "### Carry-Forward Staleness", "", ctx.carryForwardStaleness, "");
+    }
+    const contextBudget = Number(process.env.PAPI_PLAN_CONTEXT_BUDGET) || 9e4;
+    const coreBytes = Buffer.byteLength(parts.join("\n"), "utf-8");
+    let enrichmentSpent = 0;
+    const elidedLabels = [];
+    for (const { label, block } of enrichment) {
+      const cost = Buffer.byteLength(`
+${block}`, "utf-8");
+      if (coreBytes + enrichmentSpent + cost > contextBudget) {
+        elidedLabels.push(label);
+        continue;
+      }
+      parts.push(block);
+      enrichmentSpent += cost;
+    }
+    if (elidedLabels.length > 0) {
+      parts.push(
+        "### Context Budget \u2014 enrichment sections trimmed",
+        "",
+        `${elidedLabels.length} non-essential context section(s) were omitted to keep this plan payload under ${Math.round(contextBudget / 1024)} KB \u2014 a mature board otherwise overflows the client's tool-result ceiling and the plan output is spilled to a file. Trimmed (lowest-value first): ${elidedLabels.join(", ")}.`,
+        "",
+        "These are cross-cycle analytics/enrichment, NOT task-selection inputs \u2014 the Board, Active Decisions, Product Brief, Full Notes, and Recent Build Reports above are complete and untrimmed. Plan normally. If you specifically need one of the trimmed sections, raise `PAPI_PLAN_CONTEXT_BUDGET` in the MCP server env and re-run.",
+        ""
+      );
     }
   }
   return parts.join("\n");
@@ -9928,6 +9965,19 @@ function buildReviewUserMessage(ctx) {
   } else {
     parts.push("(Showing build reports and cycle log entries since last strategy review.)");
   }
+  if (ctx.earnedPushback) {
+    parts.push(
+      "",
+      "---",
+      "",
+      "## \u26A0\uFE0F EARNED ADVERSARIAL PUSHBACK",
+      "",
+      "This section appears ONLY because concrete signals crossed a threshold this window. Address each item in your review with a clearly-labelled pushback callout: verify the claim against the actual build reports / code / decisions before accepting it, and push back proportionally to the stakes. If verification shows a signal is benign, say so and move on. Do NOT manufacture additional pushback beyond what these signals support.",
+      "",
+      ctx.earnedPushback,
+      ""
+    );
+  }
   parts.push(
     "",
     "---",
@@ -12794,11 +12844,24 @@ Run \`strategy_review\` first, or pass \`force: true\` to bypass this gate.`
   }
   return { mode, cycleNumber, strategyReviewWarning };
 }
+function assertApplyPayloadNonEmpty(data, cycleNumber) {
+  const handoffCount = data.cycleHandoffs?.length ?? 0;
+  const taskIdCount = data.cycleTaskIds?.length ?? 0;
+  const newTaskCount = data.newTasks?.length ?? 0;
+  if (handoffCount + taskIdCount + newTaskCount === 0) {
+    throw new Error(
+      `Plan apply rejected: trimmed/partial apply payload \u2014 nothing persisted. The parsed plan for Cycle ${cycleNumber + 1} assigns NO tasks to the cycle (cycleHandoffs, cycleTaskIds and newTasks are all empty). Writing it would create a cycle row with zero task membership and no handoffs \u2014 the phantom-empty-cycle failure mode that renders an empty Team view. The most likely cause is a truncated apply JSON: the prepare payload overflowed the client tool-result ceiling (see task-2905/2906). Re-run the plan and resend the COMPLETE structured output \u2014 ensure the JSON after the <!-- PAPI_STRUCTURED_OUTPUT --> marker includes the full cycleHandoffs array (or cycleTaskIds when using skip_handoffs).`
+    );
+  }
+}
 async function processLlmOutput(adapter2, config2, rawOutput, mode, cycleNumber, contextHashes, planRunMeta) {
   const applyStartMs = Date.now();
   const applyScope = await resolvePlanScope(adapter2, config2);
   await assertSingleActiveCycle(adapter2, { allowNumber: cycleNumber + 1, userId: applyScope.callerUserId ?? void 0 });
   const { displayText, data } = parseStructuredOutput(rawOutput);
+  if (data) {
+    assertApplyPayloadNonEmpty(data, cycleNumber);
+  }
   let resolvedDisplayText = displayText;
   let autoCommitNote = "";
   let priorityLockNote = "";
@@ -13276,7 +13339,15 @@ function buildSubagentDispatchPrompt(input) {
 - "pass" = no blocking issues; "warn" = minor/non-blocking nits; "fail" = blocking issues that should send the build back. \`file\`/\`line\` are optional per finding. Empty \`findings\` is valid when clean.` : `- Read the system prompt and context exactly as the main agent would.
 - Produce the full structured output the system prompt requires (Part 1 markdown + Part 2 JSON after \`<!-- PAPI_STRUCTURED_OUTPUT -->\`, or whatever the system prompt specifies).
 - Return ONLY that output \u2014 no preamble, no commentary, no closing summary. The dispatching agent will pass your reply verbatim to the apply call.`;
-  const contextBlock = isReview ? `<review_rubric>
+  const contextBlock = input.contextFilePath ? isReview ? `The review rubric and the full build-under-review context have been written to a local file:
+
+${input.contextFilePath}
+
+Read that file IN FULL (it contains the rubric and the build report + diff) before you start. Do not skip it \u2014 it is your only source of context.` : `The system prompt and full planning context have been written to a local file:
+
+${input.contextFilePath}
+
+Read that file IN FULL before you produce anything \u2014 it contains the system prompt and all context you need. Do not skip it; it is your only source of context.` : isReview ? `<review_rubric>
 ${systemPrompt}
 </review_rubric>
 
@@ -13682,6 +13753,15 @@ function clearPrepareSpill(projectId, callerKey) {
   } catch {
   }
 }
+function contextPath(projectId, callerKey) {
+  const id = createHash2("sha256").update(`${projectId ?? "no-project"}|${callerKey ?? DEFAULT_CALLER_KEY3}`).digest("hex").slice(0, 16);
+  return join3(tmpdir(), `papi-plan-context-${id}.md`);
+}
+function savePrepareContextFile(projectId, callerKey, content) {
+  const path7 = contextPath(projectId, callerKey);
+  writeFileSync2(path7, content, { mode: 384 });
+  return path7;
+}
 
 // src/tools/plan.ts
 var planPrepareCache = new PerCallerCache();
@@ -13690,6 +13770,7 @@ var planTool = {
   description: 'Run once per cycle to select tasks and generate BUILD HANDOFFs. Call after setup (first time) or after completing all builds AND running release for the previous cycle. Returns prioritised task recommendations with detailed implementation specs. NEVER call when unbuilt cycle tasks exist \u2014 build and release first. First call returns a planning prompt for you to execute (prepare phase). Then call again with mode "apply" and your output to write results. Use skip_handoffs=true for large backlogs \u2014 handoffs are then generated separately via `handoff_generate`.',
   annotations: { title: "Plan Cycle", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
     properties: {
       mode: {
@@ -13760,7 +13841,16 @@ var planTool = {
         description: 'Apply-mode confirmation guard for planner-initiated cancellations (task-1727). When false (default), any boardCorrection with status="Cancelled" is SKIPPED and listed in the response so the user can confirm before destructive writes. Set true to apply the cancellations. board_edit-direct cancellations are unaffected \u2014 this guard is plan-only.'
       }
     },
-    required: []
+    required: [],
+    // task-2802: mirror resolveLlmResponse — llm_response and llm_response_file are
+    // mutually exclusive, and an apply call must carry exactly one of them.
+    not: { required: ["llm_response", "llm_response_file"] },
+    allOf: [
+      {
+        if: { properties: { mode: { const: "apply" } }, required: ["mode"] },
+        then: { anyOf: [{ required: ["llm_response"] }, { required: ["llm_response_file"] }] }
+      }
+    ]
   }
 };
 function formatPlanResult(result) {
@@ -13929,6 +14019,27 @@ async function handlePlan(adapter2, config2, args) {
       } else {
         dispatch = "inline";
       }
+      const modeLabel = result.mode === "bootstrap" ? "Bootstrap" : "Full";
+      const header = result.strategyReviewWarning ? `${result.strategyReviewWarning}
+` : "";
+      let contextFilePath;
+      if (config2.localFilesystem) {
+        const contextDoc = `### System Prompt
+
+${result.systemPrompt}
+
+---
+
+### Context
+
+${result.userMessage}
+`;
+        try {
+          contextFilePath = savePrepareContextFile(adapter2.getProjectId?.(), callerKey, contextDoc);
+        } catch {
+          contextFilePath = void 0;
+        }
+      }
       if (dispatch === "subagent") {
         const dispatchPrompt = buildSubagentDispatchPrompt({
           tool: "plan",
@@ -13937,16 +14048,34 @@ async function handlePlan(adapter2, config2, args) {
           strategyReviewWarning: result.strategyReviewWarning,
           systemPrompt: result.systemPrompt,
           userMessage: result.userMessage,
-          contextBytes: result.contextBytes
+          contextBytes: result.contextBytes,
+          contextFilePath
         });
-        const header2 = result.strategyReviewWarning ? `${result.strategyReviewWarning}
+        const dispatchHeader = result.strategyReviewWarning ? `${result.strategyReviewWarning}
 
 ` : "";
-        return { ...textResponse(`${header2}${dispatchPrompt}`), _contextBytes: result.contextBytes };
+        return { ...textResponse(`${dispatchHeader}${dispatchPrompt}`), _contextBytes: result.contextBytes };
+      }
+      if (contextFilePath) {
+        const kb = result.contextBytes !== void 0 ? ` (~${(result.contextBytes / 1024).toFixed(0)} KB)` : "";
+        const pathResponse = textResponse(
+          `${header}## PAPI Cycle Plan \u2014 Prepare Phase (${modeLabel} Mode, Cycle ${result.cycleNumber + 1})
+
+The full planning brief \u2014 system prompt + all context${kb} \u2014 has been written to a local file to keep it off the tool-result channel (it overflows the client ceiling on a mature board):
+
+\`${contextFilePath}\`
+
+**Do this:**
+1. **Read that file in full** \u2014 it is the system prompt and the entire planning context.
+2. Produce the complete plan output in TWO parts: Part 1 markdown with BUILD HANDOFF blocks, then after \`<!-- PAPI_STRUCTURED_OUTPUT -->\` a Part 2 JSON block.
+3. **Write your output to a local file**, then call \`plan\` again with:
+   - \`mode\`: "apply"
+   - \`llm_response_file\`: the absolute path to YOUR output file
+   - \`cycle_number\`: ${result.cycleNumber + 1}
+   - \`strategy_review_warning\`: "${result.strategyReviewWarning.replace(/"/g, '\\"')}"`
+        );
+        return { ...pathResponse, _contextBytes: result.contextBytes };
       }
-      const modeLabel = result.mode === "bootstrap" ? "Bootstrap" : "Full";
-      const header = result.strategyReviewWarning ? `${result.strategyReviewWarning}
-` : "";
       const response = textResponse(
         `${header}## PAPI Cycle Plan \u2014 Prepare Phase (${modeLabel} Mode, Cycle ${result.cycleNumber + 1})
 
@@ -14564,6 +14693,55 @@ function generateValueReport(snapshots) {
   return lines.join("\n");
 }
 
+// src/lib/earned-pushback.ts
+var SIGNAL_MIN_COUNT = 3;
+var EFFORT_RANK = { XS: 0, S: 1, M: 2, L: 3, XL: 4 };
+function rankEffort(size2) {
+  if (!size2) return void 0;
+  return EFFORT_RANK[size2];
+}
+function computeEarnedPushback(inputs) {
+  const { reports, log: log2, doneTaskIds } = inputs;
+  const drifted = reports.filter(
+    (r) => r.scopeAccuracy && r.scopeAccuracy !== "accurate" || !!r.scopeDriftSignal
+  );
+  const crept = reports.filter((r) => {
+    const actual = rankEffort(r.actualEffort);
+    const estimated = rankEffort(r.estimatedEffort);
+    return actual !== void 0 && estimated !== void 0 && actual > estimated;
+  });
+  const staleness = computeCarryForwardStaleness(log2, doneTaskIds);
+  const driftFires = drifted.length >= SIGNAL_MIN_COUNT;
+  const creepFires = crept.length >= SIGNAL_MIN_COUNT;
+  const deferralFires = staleness !== void 0;
+  if (!driftFires && !creepFires && !deferralFires) return void 0;
+  const sections = [
+    "The following signals crossed a threshold this window and warrant adversarial scrutiny. For each, verify the claim against the actual reports/code before accepting it, and push back proportionally to the stakes \u2014 do NOT wave it through, and do NOT invent pushback beyond what these signals support."
+  ];
+  if (driftFires) {
+    const named = drifted.slice(0, 8).map((r) => {
+      const why = r.scopeDriftSignal ? `files diverged from handoff` : `scope ${r.scopeAccuracy}`;
+      return `  - **${r.displayId ?? r.taskId}** (${r.taskName}) \u2014 ${why}`;
+    }).join("\n");
+    sections.push(
+      `**Scope drift (${drifted.length} build${drifted.length === 1 ? "" : "s"}):** handoff scope did not match what was actually built. Verify whether the plan or the execution was wrong, and whether an Active Decision or planning heuristic needs to change.
+${named}`
+    );
+  }
+  if (creepFires) {
+    const named = crept.slice(0, 8).map((r) => `  - **${r.displayId ?? r.taskId}** (${r.taskName}) \u2014 estimated ${r.estimatedEffort}, actual ${r.actualEffort}`).join("\n");
+    sections.push(
+      `**Scope creep (${crept.length} task${crept.length === 1 ? "" : "s"}):** actual effort exceeded the estimate. Check whether these were under-scoped at plan time or grew mid-build, and whether cycle sizing is drifting.
+${named}`
+    );
+  }
+  if (deferralFires) {
+    sections.push(`**Repeat deferral (3+ consecutive cycles):**
+${staleness}`);
+  }
+  return sections.join("\n\n");
+}
+
 // src/services/strategy.ts
 var STRATEGY_DUPE_COVERAGE_THRESHOLD = 0.6;
 function taskStatusLabel(task) {
@@ -15071,10 +15249,10 @@ ${unregistered.slice(0, 10).map((f) => `- ${f}`).join("\n")}`;
   try {
     const comments = await adapter2.getRecentTaskComments?.(50);
     if (comments && comments.length > 0) {
-      const doneTaskIds = new Set(recentDoneTasks.map((t) => t.id));
+      const doneTaskIds2 = new Set(recentDoneTasks.map((t) => t.id));
       const inReviewTasks = activeTasks.filter((t) => t.status === "In Review");
       const reviewWindowTaskIds = /* @__PURE__ */ new Set([
-        ...doneTaskIds,
+        ...doneTaskIds2,
         ...inReviewTasks.map((t) => t.id)
       ]);
       const filtered = comments.filter((c) => reviewWindowTaskIds.has(c.taskId));
@@ -15104,7 +15282,7 @@ ${unregistered.slice(0, 10).map((f) => `- ${f}`).join("\n")}`;
   try {
     if (docsWithPendingActions && docsWithPendingActions.length > 0) {
       const STALE_THRESHOLD = 20;
-      const doneTaskIds = new Set(recentDoneTasks.map((t) => t.displayId ?? t.id));
+      const doneTaskIds2 = new Set(recentDoneTasks.map((t) => t.displayId ?? t.id));
       const completed = [];
       const deferred = [];
       const stale = [];
@@ -15114,7 +15292,7 @@ ${unregistered.slice(0, 10).map((f) => `- ${f}`).join("\n")}`;
         const ageInCycles = cycleNumber - (doc.cycleCreated ?? cycleNumber);
         for (const action of pendingActions) {
           const line = `  - **${doc.title}** (C${doc.cycleCreated ?? "?"}): ${action.description}${action.linkedTaskId ? ` [\u2192${action.linkedTaskId}]` : ""}`;
-          if (action.linkedTaskId && doneTaskIds.has(action.linkedTaskId)) {
+          if (action.linkedTaskId && doneTaskIds2.has(action.linkedTaskId)) {
             completed.push(line);
           } else if (ageInCycles > STALE_THRESHOLD) {
             stale.push(line);
@@ -15161,6 +15339,10 @@ ${lines.join("\n")}`;
     { label: "taskComments", hasData: taskCommentsText !== void 0 },
     { label: "docActionStaleness", hasData: docActionStalenessText !== void 0 }
   ]);
+  const doneTaskIds = new Set(
+    recentDoneTasks.map((t) => t.displayId ?? t.id).filter((id) => !!id)
+  );
+  const earnedPushback = computeEarnedPushback({ reports, log: recentLog, doneTaskIds });
   const context = {
     sessionNumber: cycleNumber,
     lastReviewCycle: lastReviewCycleNum,
@@ -15169,6 +15351,7 @@ ${lines.join("\n")}`;
     allBuildReports: buildReportsText,
     sessionLog: formatCycleLog(recentLog),
     board: smartBoard,
+    earnedPushback,
     humanReviews: formatReviews(reviews),
     buildPatterns: buildPatternsText,
     reviewPatterns: reviewPatternsText,
@@ -16644,6 +16827,7 @@ var boardViewTool = {
   description: 'View the Board. To find a SPECIFIC task or subset, FILTER FIRST \u2014 do not dump the whole board: pass task_id for one task (full detail), query="<text>" for a title/notes substring match, or cycle=<n> for one cycle. Combine with status/phase. By default shows active tasks only (excludes Done/Cancelled), sorted by priority, limited to 50; titles are truncated in the table (single-task lookup shows the full title). Use status="all" to see everything, mode="summary" for counts only. Does not call the Anthropic API.',
   annotations: { title: "View Board", readOnlyHint: true, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
     properties: {
       task_id: {
@@ -16668,10 +16852,14 @@ var boardViewTool = {
       },
       limit: {
         type: "number",
+        minimum: 1,
+        default: 50,
         description: "Max tasks to return (default: 50)."
       },
       offset: {
         type: "number",
+        minimum: 0,
+        default: 0,
         description: "Skip first N tasks for pagination (default: 0)."
       },
       mode: {
@@ -16688,6 +16876,7 @@ var boardDeprioritiseTool = {
   description: `Remove a task from the current cycle. Four actions: "backlog" (not now, maybe later \u2014 preserves handoff), "defer" (valid but premature \u2014 hidden from planner), "block" (waiting on external dependency \u2014 visible on board but skipped by planner), "cancel" (don't want this \u2014 permanently closed with reason). When a user rejects a task, ALWAYS ask which action they want. Does not call the Anthropic API.`,
   annotations: { title: "Deprioritise Task", readOnlyHint: false, destructiveHint: true, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
     properties: {
       task_id: {
@@ -16725,7 +16914,21 @@ var boardDeprioritiseTool = {
         description: 'Optional new phase (only applies to "backlog" and "defer" actions).'
       }
     },
-    required: ["task_id"]
+    required: ["task_id"],
+    // task-2802: mirror the handler's guards so the agent sees the dependency up
+    // front. handleBoardDeprioritise requires `reason` for both block and cancel,
+    // and requires `blocker_ref` whenever `blocker_type` is set. Keyed on explicit
+    // values — an omitted action defaults to "backlog" and triggers neither.
+    allOf: [
+      {
+        if: { properties: { action: { enum: ["block", "cancel"] } }, required: ["action"] },
+        then: { required: ["reason"] }
+      },
+      {
+        if: { required: ["blocker_type"] },
+        then: { required: ["blocker_ref"] }
+      }
+    ]
   }
 };
 var boardArchiveTool = {
@@ -16752,7 +16955,15 @@ var boardEditTool = {
   description: "Edit fields on an existing task. Supports title, priority, complexity, module, epic, phase, notes (with notes_mode for append/replace/clear), status, maturity, and cycle (number or null). Pass task_id plus any fields to update. Does not call the Anthropic API.",
   annotations: { title: "Edit Task", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
+    // task-2802: shared effort-size enum referenced by estimated_effort/actual_effort.
+    $defs: {
+      effortSize: {
+        type: "string",
+        enum: ["XS", "S", "M", "L", "XL"]
+      }
+    },
     properties: {
       task_id: {
         type: "string",
@@ -16808,13 +17019,11 @@ var boardEditTool = {
         description: "Cycle assignment. Pass a cycle number to assign, or null to remove from any cycle. Validated against existing cycles. Replaces the prior workaround of editing cycle_tasks.cycle directly via SQL."
       },
       estimated_effort: {
-        type: "string",
-        enum: ["XS", "S", "M", "L", "XL"],
+        $ref: "#/$defs/effortSize",
         description: "task-2182: correct the estimated effort on this task's LATEST build report (fixes a mis-recorded estimate). Updates the build_reports row, not the task \u2014 feeds the next estimation-accuracy recompute."
       },
       actual_effort: {
-        type: "string",
-        enum: ["XS", "S", "M", "L", "XL"],
+        $ref: "#/$defs/effortSize",
         description: "task-2182: correct the actual effort on this task's LATEST build report (fixes a mis-recorded actual)."
       }
     },
@@ -17246,6 +17455,9 @@ var PROJECT_BUNDLE_REL = join6(".agents", "skills", "papi-cycle");
 function bundleDestRel(rel) {
   return rel === "AGENTS.md" ? "AGENTS.md" : join6(PROJECT_BUNDLE_REL, rel);
 }
+function claudeSkillDestRel(rel) {
+  return rel === "AGENTS.md" ? void 0 : join6(".claude", "skills", rel);
+}
 function resolveBundleDir() {
   let dir = dirname(fileURLToPath(import.meta.url));
   for (let i = 0; i < 5; i++) {
@@ -17274,10 +17486,13 @@ function readBundleFiles(bundleDir = resolveBundleDir()) {
 function planBundleInstall(projectRoot, projectName, opts = {}) {
   const out = {};
   for (const f of readBundleFiles()) {
-    const dest = join6(projectRoot, bundleDestRel(f.rel));
-    if (opts.skipExisting && existsSync4(dest) && statSync4(dest).isFile()) continue;
     const content = f.rel === "AGENTS.md" ? f.content.replace(/\{\{project_name\}\}/g, projectName) : f.content;
-    out[dest] = content;
+    for (const rel of [bundleDestRel(f.rel), claudeSkillDestRel(f.rel)]) {
+      if (!rel) continue;
+      const dest = join6(projectRoot, rel);
+      if (opts.skipExisting && existsSync4(dest) && statSync4(dest).isFile()) continue;
+      out[dest] = content;
+    }
   }
   return out;
 }
@@ -17565,7 +17780,7 @@ var CLAUDE_MD_ENRICHMENT_SENTINEL_T1 = "<!-- PAPI_ENRICHMENT_TIER_1 -->";
 var CLAUDE_MD_ENRICHMENT_SENTINEL_T2 = "<!-- PAPI_ENRICHMENT_TIER_2 -->";
 var CLAUDE_MD_STUB = `# {{project_name}}
 
-This project is managed with **PAPI**. The agent harness \u2014 session workflow, the plan \u2192 build \u2192 review cycle, branching, and conventions \u2014 lives in **\`AGENTS.md\`** (always loaded) plus lazy-loaded phase skills under \`.agents/skills/papi-cycle/\`.
+This project is managed with **PAPI**. The agent harness \u2014 session workflow, the plan \u2192 build \u2192 review cycle, branching, and conventions \u2014 lives in **\`AGENTS.md\`** (always loaded) plus lazy-loaded phase skills under \`.agents/skills/papi-cycle/\` (Claude Code loads the same phase skills natively from \`.claude/skills/papi-*\`).
 
 **At session start: read \`AGENTS.md\`, then run \`orient\`.** Phase mechanics (planning, building, strategy, ideas) load on demand from the skills bundle. Add project-specific notes below this line \u2014 they will not be overwritten.
 
@@ -20618,6 +20833,32 @@ async function ownsLocalWorkspace(adapter2, cwd) {
   return storedOwner === remoteOwner;
 }
 
+// src/lib/worktree-collision.ts
+var WORKTREE_DIR = ".claude/worktrees";
+function detectWorktreeCollision(input) {
+  const target = input.targetBranch.trim();
+  if (!target) return null;
+  const conflicts = input.inProgress.filter((b2) => {
+    const branch = b2.branch?.trim();
+    return !!branch && branch !== target && b2.taskId !== input.taskId;
+  });
+  if (conflicts.length === 0) return null;
+  const worktreePath = `${WORKTREE_DIR}/${input.taskId}`;
+  const worktreeCommand = `git worktree add ${worktreePath} ${target}`;
+  const others = conflicts.map((c) => `${c.taskId} (on '${c.branch.trim()}')`).join(", ");
+  const isAre = conflicts.length === 1 ? "is" : "are";
+  const warning = `\u26A0\uFE0F  Concurrent build detected: ${others} ${isAre} In Progress on a different branch, but this build targets '${target}'. Switching HEAD on the shared checkout would revert that session's working tree (the task-2346 data-loss incident). Isolate this build into its own worktree instead of switching branches here.`;
+  const setupHint = `Then run \`npm run worktree:setup\` inside ${worktreePath} \u2014 node_modules only exists in the main worktree, so the symlink step is required before tsup/builds work there (task-1419).`;
+  return {
+    warning,
+    worktreeCommand,
+    setupHint,
+    worktreePath,
+    auto: input.autoWorktree,
+    conflicts
+  };
+}
+
 // src/services/build.ts
 init_git();
 
@@ -21221,7 +21462,46 @@ async function startBuild(adapter2, config2, taskId, options = {}, clientName) {
     }
     taskBranchMap.set(taskId, featureBranch);
     const currentBranch = getCurrentBranch(config2.projectRoot);
-    if (currentBranch === featureBranch) {
+    let isolatedIntoWorktree = false;
+    if (currentBranch !== featureBranch) {
+      const otherInProgress = allTasks.filter((t) => t.status === "In Progress" && t.id !== taskId && t.displayId !== taskId).map((t) => ({
+        taskId: t.displayId || t.id,
+        branch: (t.branchName ?? taskBranchMap.get(t.id) ?? taskBranchMap.get(t.displayId) ?? "").trim()
+      })).filter((t) => t.branch.length > 0);
+      const collision = detectWorktreeCollision({
+        taskId,
+        targetBranch: featureBranch,
+        inProgress: otherInProgress,
+        autoWorktree: config2.autoWorktree
+      });
+      if (collision) {
+        branchLines.push(collision.warning);
+        if (collision.auto) {
+          try {
+            const { execFileSync: execFileSync7 } = await import("child_process");
+            const baseForWorktree = resolveBaseBranch(config2.projectRoot, config2.baseBranch);
+            const wtArgs = branchExists(config2.projectRoot, featureBranch) ? ["worktree", "add", collision.worktreePath, featureBranch] : ["worktree", "add", "-b", featureBranch, collision.worktreePath, baseForWorktree];
+            execFileSync7("git", wtArgs, { cwd: config2.projectRoot, encoding: "utf-8" });
+            isolatedIntoWorktree = true;
+            branchLines.push(
+              `Auto-isolated (PAPI_AUTO_WORKTREE): created worktree at ${collision.worktreePath} on '${featureBranch}'. The shared checkout stays on '${currentBranch}' \u2014 continue this build from inside the worktree.`
+            );
+            branchLines.push(collision.setupHint);
+          } catch (err) {
+            branchLines.push(
+              `Auto-worktree attempt failed (${err instanceof Error ? err.message : String(err)}) \u2014 isolate manually instead:`
+            );
+            branchLines.push(`  ${collision.worktreeCommand}`);
+            branchLines.push(collision.setupHint);
+          }
+        } else {
+          branchLines.push(`  ${collision.worktreeCommand}`);
+          branchLines.push(collision.setupHint);
+        }
+      }
+    }
+    if (isolatedIntoWorktree) {
+    } else if (currentBranch === featureBranch) {
       branchLines.push(`Already on branch '${featureBranch}'.`);
       if (useSharedBranch) {
         branchLines.push(`Reusing shared cycle branch for ${task.complexity} ${task.module} task.`);
@@ -22561,7 +22841,17 @@ var buildExecuteTool = {
   description: "Start or complete a build task. Call with just task_id to start (returns BUILD HANDOFF, creates feature branch, marks In Progress). After implementing the task, you MUST call build_execute again with all report fields (completed, effort, estimated_effort, surprises, discovered_issues, architecture_notes) to finish \u2014 do not wait for user confirmation between start and complete. Never call on tasks that are already In Review or Done. Does not call the Anthropic API. Set light=true to skip branch/PR creation (commits to current branch). Set PAPI_LIGHT_MODE=true in env to default all builds to light mode.",
   annotations: { title: "Run Build", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
+    // task-2802: JSON Schema 2020-12. Shared effort-size enum lives in $defs and is
+    // referenced from effort/estimated_effort so the two stay in lockstep; the
+    // start-vs-complete contract is expressed as a conditional (see allOf below).
+    $defs: {
+      effortSize: {
+        type: "string",
+        enum: ["XS", "S", "M", "L", "XL"]
+      }
+    },
     properties: {
       task_id: {
         type: "string",
@@ -22581,13 +22871,11 @@ var buildExecuteTool = {
         description: `task-2833: set true to assert every acceptance criterion in the task's BUILD HANDOFF was met. Required to record a completed:"yes" build when the handoff lists acceptance criteria \u2014 without it, build_execute returns the criteria checklist and does NOT mark the task Done (the report is not discarded; re-send with acceptance_confirmed:true). Tasks with no acceptance criteria, and completed:"partial"/"no", are unaffected.`
       },
       effort: {
-        type: "string",
-        enum: ["XS", "S", "M", "L", "XL"],
+        $ref: "#/$defs/effortSize",
         description: "Actual effort: XS, S, M, L, or XL. Required for complete."
       },
       estimated_effort: {
-        type: "string",
-        enum: ["XS", "S", "M", "L", "XL"],
+        $ref: "#/$defs/effortSize",
         description: "Estimated effort from the BUILD HANDOFF. Required for complete."
       },
       model: {
@@ -22631,6 +22919,8 @@ var buildExecuteTool = {
       },
       corrections_count: {
         type: "integer",
+        minimum: 0,
+        default: 0,
         description: "Number of times the user corrected or redirected the build during implementation. Captures informal pushback that bypasses review_submit. Default 0."
       },
       dead_ends: {
@@ -22681,7 +22971,29 @@ var buildExecuteTool = {
         }
       }
     },
-    required: ["task_id"]
+    required: ["task_id"],
+    // task-2802: a COMPLETE call is any call carrying report data (mirrors the
+    // handler's isCompleteCall at build.ts). When any of the six report fields is
+    // present, all six are required — exactly what completeBuild enforces, so this
+    // never rejects a call the handler would accept; it just steers the agent to
+    // send the full report in one shot instead of round-tripping on a missing field.
+    allOf: [
+      {
+        if: {
+          anyOf: [
+            { required: ["completed"] },
+            { required: ["effort"] },
+            { required: ["estimated_effort"] },
+            { required: ["surprises"] },
+            { required: ["discovered_issues"] },
+            { required: ["architecture_notes"] }
+          ]
+        },
+        then: {
+          required: ["completed", "effort", "estimated_effort", "surprises", "discovered_issues", "architecture_notes"]
+        }
+      }
+    ]
   }
 };
 var buildCancelTool = {
@@ -23456,12 +23768,460 @@ Re-submit with \`notes: "... Reference: <path>"\` to link one, or ignore if none
   return textResponse(`${result.message}${overrideNote}`);
 }
 
+// src/services/import.ts
+import { randomUUID as randomUUID13 } from "crypto";
+var IMPLEMENTED_SOURCES = ["csv", "markdown", "linear"];
+var MAX_TITLE_LEN = 200;
+var MAX_NOTES_LEN = 2e3;
+function sanitiseText(value, maxLen, keepNewlines = false) {
+  let str;
+  if (typeof value === "string") str = value;
+  else if (typeof value === "number" || typeof value === "boolean") str = String(value);
+  else if (value == null) str = "";
+  else {
+    try {
+      str = String(value);
+    } catch {
+      str = "";
+    }
+  }
+  if (keepNewlines) {
+    str = str.replace(/[\x00-\x08\x0B-\x1F\x7F-\x9F]/g, " ");
+    str = str.replace(/[ \t]+/g, " ").replace(/\n{3,}/g, "\n\n");
+  } else {
+    str = str.replace(/[\x00-\x1F\x7F-\x9F]/g, " ");
+    str = str.replace(/\s+/g, " ");
+  }
+  str = str.trim();
+  if (str.length > maxLen) str = str.slice(0, maxLen).trim();
+  return str;
+}
+function mapPriorityString(value) {
+  const v = String(value ?? "").trim().toLowerCase();
+  if (/\b(p0|urgent|critical|highest|blocker)\b/.test(v)) return "P0 Critical";
+  if (/\b(p1|high)\b/.test(v)) return "P1 High";
+  if (/\b(p3|low|lowest|minor)\b/.test(v)) return "P3 Low";
+  return "P2 Medium";
+}
+function mapPriorityNumber(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  switch (n) {
+    case 1:
+      return "P0 Critical";
+    case 2:
+      return "P1 High";
+    case 4:
+      return "P3 Low";
+    case 3:
+    case 0:
+    default:
+      return "P2 Medium";
+  }
+}
+function mapStatusString(value) {
+  const v = String(value ?? "").trim().toLowerCase();
+  if (/\b(done|complete|completed|closed|merged|shipped|resolved)\b/.test(v)) return "Done";
+  if (/\b(cancel|cancelled|canceled|wont.?fix|duplicate|abandoned)\b/.test(v)) return "Cancelled";
+  if (/\b(in.?review|review|qa|verifying)\b/.test(v)) return "In Review";
+  if (/\b(in.?progress|started|doing|active|wip)\b/.test(v)) return "In Progress";
+  if (/\b(blocked|waiting|on.?hold)\b/.test(v)) return "Blocked";
+  return "Backlog";
+}
+function estimateToComplexity(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n) || n <= 0) return "Small";
+  if (n <= 1) return "XS";
+  if (n <= 2) return "Small";
+  if (n <= 3) return "Medium";
+  if (n <= 5) return "Large";
+  return "XL";
+}
+function mapComplexityField(value) {
+  const v = String(value ?? "").trim();
+  if (v !== "" && /^\d+(\.\d+)?$/.test(v)) return estimateToComplexity(v);
+  return normalizeComplexity(v);
+}
+function parseCsv(text) {
+  const rows = [];
+  let field = "";
+  let row = [];
+  let inQuotes = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inQuotes) {
+      if (c === '"') {
+        if (text[i + 1] === '"') {
+          field += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        field += c;
+      }
+      continue;
+    }
+    if (c === '"') {
+      inQuotes = true;
+    } else if (c === ",") {
+      row.push(field);
+      field = "";
+    } else if (c === "\n" || c === "\r") {
+      if (c === "\r" && text[i + 1] === "\n") i++;
+      row.push(field);
+      field = "";
+      if (row.some((f) => f.trim() !== "")) rows.push(row);
+      row = [];
+    } else {
+      field += c;
+    }
+  }
+  if (field !== "" || row.length > 0) {
+    row.push(field);
+    if (row.some((f) => f.trim() !== "")) rows.push(row);
+  }
+  return rows;
+}
+function findColumn(header, candidates) {
+  const lower = header.map((h) => h.trim().toLowerCase());
+  for (const cand of candidates) {
+    const idx = lower.indexOf(cand);
+    if (idx !== -1) return idx;
+  }
+  return -1;
+}
+var csvNormaliser = ({ raw }) => {
+  if (!raw || !raw.trim()) return [];
+  const rows = parseCsv(raw);
+  if (rows.length < 2) return [];
+  const header = rows[0];
+  const titleCol = findColumn(header, ["title", "name", "task", "summary", "subject"]);
+  if (titleCol === -1) {
+    throw new Error(
+      "CSV import: no recognisable title column. Expected a header row with one of: title, name, task, summary, subject."
+    );
+  }
+  const notesCol = findColumn(header, ["notes", "description", "details", "body"]);
+  const statusCol = findColumn(header, ["status", "state"]);
+  const priorityCol = findColumn(header, ["priority", "importance"]);
+  const complexityCol = findColumn(header, ["complexity", "estimate", "size", "points", "effort"]);
+  const idCol = findColumn(header, ["id", "key", "identifier", "ref"]);
+  const out = [];
+  for (let r = 1; r < rows.length; r++) {
+    const cells = rows[r];
+    const title = sanitiseText(cells[titleCol], MAX_TITLE_LEN);
+    if (!title) continue;
+    out.push({
+      title,
+      notes: notesCol === -1 ? "" : sanitiseText(cells[notesCol], MAX_NOTES_LEN, true),
+      status: statusCol === -1 ? "Backlog" : mapStatusString(cells[statusCol]),
+      priority: priorityCol === -1 ? "P2 Medium" : mapPriorityString(cells[priorityCol]),
+      complexity: complexityCol === -1 ? "Small" : mapComplexityField(cells[complexityCol]),
+      sourceId: idCol === -1 ? void 0 : sanitiseText(cells[idCol], 80) || void 0
+    });
+  }
+  return out;
+};
+var markdownNormaliser = ({ raw }) => {
+  if (!raw || !raw.trim()) return [];
+  const lines = raw.split(/\r?\n/);
+  const tableHeaderIdx = lines.findIndex(
+    (l, i) => /\|/.test(l) && lines[i + 1] !== void 0 && /^\s*\|?[\s:|-]+\|?\s*$/.test(lines[i + 1]) && /-/.test(lines[i + 1])
+  );
+  if (tableHeaderIdx !== -1) {
+    const splitRow = (l) => l.replace(/^\s*\|/, "").replace(/\|\s*$/, "").split("|").map((c) => c.trim());
+    const header = splitRow(lines[tableHeaderIdx]);
+    const titleCol = findColumn(header, ["title", "name", "task", "summary", "subject"]);
+    if (titleCol === -1) {
+      throw new Error(
+        "Markdown table import: no recognisable title column. Expected a header cell of: title, name, task, summary, subject."
+      );
+    }
+    const notesCol = findColumn(header, ["notes", "description", "details", "body"]);
+    const statusCol = findColumn(header, ["status", "state"]);
+    const priorityCol = findColumn(header, ["priority", "importance"]);
+    const complexityCol = findColumn(header, ["complexity", "estimate", "size", "points", "effort"]);
+    const idCol = findColumn(header, ["id", "key", "identifier", "ref"]);
+    const out2 = [];
+    for (let i = tableHeaderIdx + 2; i < lines.length; i++) {
+      const l = lines[i];
+      if (!/\|/.test(l) || l.trim() === "") break;
+      const cells = splitRow(l);
+      const title = sanitiseText(cells[titleCol], MAX_TITLE_LEN);
+      if (!title) continue;
+      out2.push({
+        title,
+        notes: notesCol === -1 ? "" : sanitiseText(cells[notesCol], MAX_NOTES_LEN, true),
+        status: statusCol === -1 ? "Backlog" : mapStatusString(cells[statusCol]),
+        priority: priorityCol === -1 ? "P2 Medium" : mapPriorityString(cells[priorityCol]),
+        complexity: complexityCol === -1 ? "Small" : mapComplexityField(cells[complexityCol]),
+        sourceId: idCol === -1 ? void 0 : sanitiseText(cells[idCol], 80) || void 0
+      });
+    }
+    return out2;
+  }
+  const out = [];
+  const checklistRe = /^\s*(?:[-*+]|\d+\.)\s+(?:\[( |x|X)\]\s+)?(.*\S)\s*$/;
+  for (const line of lines) {
+    const m = line.match(checklistRe);
+    if (!m) continue;
+    const checked = m[1];
+    const title = sanitiseText(m[2], MAX_TITLE_LEN);
+    if (!title) continue;
+    out.push({
+      title,
+      notes: "",
+      status: checked && checked.toLowerCase() === "x" ? "Done" : "Backlog",
+      priority: "P2 Medium",
+      complexity: "Small"
+    });
+  }
+  return out;
+};
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+var linearNormaliser = ({ rows }) => {
+  if (!rows || rows.length === 0) return [];
+  const out = [];
+  for (const row of rows) {
+    if (!isRecord(row)) continue;
+    const issue = row;
+    const title = sanitiseText(issue.title, MAX_TITLE_LEN);
+    if (!title) continue;
+    const stateName = isRecord(issue.state) ? issue.state.name ?? issue.state.type : issue.state;
+    const identifier = sanitiseText(issue.identifier, 80) || sanitiseText(issue.id, 80) || void 0;
+    const url = sanitiseText(issue.url, 300);
+    const description = sanitiseText(issue.description, MAX_NOTES_LEN, true);
+    const notesParts = [];
+    if (description) notesParts.push(description);
+    if (url) notesParts.push(`Reference: ${url}`);
+    out.push({
+      title,
+      notes: sanitiseText(notesParts.join("\n"), MAX_NOTES_LEN, true),
+      status: mapStatusString(stateName),
+      priority: mapPriorityNumber(issue.priority),
+      complexity: issue.estimate == null ? "Small" : estimateToComplexity(issue.estimate),
+      sourceId: identifier
+    });
+  }
+  return out;
+};
+function notImplemented(source) {
+  return () => {
+    throw new Error(
+      `Import source "${source}" is not implemented yet. Shipped sources: ${IMPLEMENTED_SOURCES.join(", ")}. To add "${source}", implement a normaliser in packages/server/src/services/import.ts (see the "EXTENDING THE IMPORTER" header comment) \u2014 the host reads "${source}" via its own MCP tool and passes rows here; PAPI never connects to it directly.`
+    );
+  };
+}
+var SOURCE_NORMALISERS = {
+  csv: csvNormaliser,
+  markdown: markdownNormaliser,
+  linear: linearNormaliser,
+  // Extension points — build these by replacing notImplemented() with a real normaliser.
+  trello: notImplemented("trello"),
+  todoist: notImplemented("todoist"),
+  notion: notImplemented("notion")
+};
+function importMarker(source, sourceId) {
+  return `[papi-import:${source}:${sourceId}]`;
+}
+function dedupTitleKey(title) {
+  return title.toLowerCase().replace(/[^a-z0-9\s]/g, "").replace(/\s+/g, " ").trim();
+}
+async function importBacklog(adapter2, input) {
+  const normaliser = SOURCE_NORMALISERS[input.source];
+  if (!normaliser) {
+    throw new Error(
+      `Unknown import source "${input.source}". Valid sources: ${Object.keys(SOURCE_NORMALISERS).join(", ")}.`
+    );
+  }
+  const normalised = normaliser({ raw: input.raw, rows: input.rows });
+  const existing = await adapter2.queryBoard({});
+  const existingTitleKeys = /* @__PURE__ */ new Set();
+  const existingMarkers = /* @__PURE__ */ new Set();
+  for (const t of existing) {
+    existingTitleKeys.add(dedupTitleKey(t.title));
+    const notes = t.notes ?? "";
+    const markerMatches = notes.match(/\[papi-import:[^\]]+\]/g);
+    if (markerMatches) for (const mk of markerMatches) existingMarkers.add(mk);
+  }
+  const health = await adapter2.getCycleHealth();
+  warnIfEmpty("getCycleHealth (import)", health);
+  const createdCycle = health.totalCycles;
+  const targetModule = input.module && input.module.trim() || "Core";
+  const createdTasks = [];
+  const skippedTitles = [];
+  const seenThisBatch = /* @__PURE__ */ new Set();
+  for (const task of normalised) {
+    const titleKey = dedupTitleKey(task.title);
+    const marker = task.sourceId ? importMarker(input.source, task.sourceId) : null;
+    const isDup = marker !== null && existingMarkers.has(marker) || existingTitleKeys.has(titleKey) || seenThisBatch.has(marker ?? titleKey);
+    if (isDup) {
+      skippedTitles.push(task.title);
+      continue;
+    }
+    seenThisBatch.add(marker ?? titleKey);
+    if (input.dryRun) {
+      createdTasks.push({ id: "(dry-run)", title: task.title });
+      continue;
+    }
+    const notes = marker ? `${task.notes ? `${task.notes}
+
+` : ""}${marker}`.trim() : task.notes;
+    const created = await adapter2.createTask({
+      uuid: randomUUID13(),
+      displayId: "",
+      title: task.title,
+      status: task.status,
+      priority: task.priority,
+      complexity: task.complexity,
+      module: targetModule,
+      epic: "Platform",
+      phase: "Unscoped",
+      owner: "TBD",
+      reviewed: false,
+      createdCycle,
+      notes,
+      taskType: "task",
+      maturity: "raw",
+      source: `import:${input.source}`
+    });
+    createdTasks.push({ id: created.id, title: created.title });
+    existingTitleKeys.add(titleKey);
+    if (marker) existingMarkers.add(marker);
+  }
+  return {
+    source: input.source,
+    normalised: normalised.length,
+    imported: input.dryRun ? 0 : createdTasks.length,
+    skipped: skippedTitles.length,
+    skippedTitles,
+    createdTasks,
+    dryRun: input.dryRun === true
+  };
+}
+
+// src/tools/import.ts
+var ALL_SOURCES = ["csv", "markdown", "linear", "trello", "todoist", "notion"];
+var backlogImportTool = {
+  name: "backlog_import",
+  annotations: { title: "Import Backlog", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
+  description: `Import an existing backlog from another tool into PAPI as Backlog tasks, removing the "start from an empty board" wall. PAPI never connects to the source tool \u2014 YOU (the host) read the export and pass it here. Flat-file sources (csv, markdown) take a \`raw\` string; structured sources (linear) take a \`rows\` array you read via that tool's MCP. Import is one-way and idempotent: re-running the same import does NOT create duplicates. Shipped sources: ${IMPLEMENTED_SOURCES.join(", ")}. trello/todoist/notion are reserved but not implemented yet. Does not call the Anthropic API.`,
+  inputSchema: {
+    type: "object",
+    properties: {
+      source: {
+        type: "string",
+        enum: ALL_SOURCES,
+        description: "The tool the backlog came from. csv/markdown read a `raw` string; linear reads a `rows` array of issues. trello/todoist/notion are reserved extension points (not implemented yet)."
+      },
+      raw: {
+        type: "string",
+        description: "Raw export text for flat-file sources. CSV: a header row + data rows (title/name column required; optional notes/description, status/state, priority, complexity/estimate, id). Markdown: a checklist (`- [ ] Task`) or a GitHub-style table."
+      },
+      rows: {
+        type: "array",
+        description: "Pre-read rows for structured sources. For linear: an array of issues you read via the Linear MCP, each like { identifier, title, description, state: { name }, priority (0-4), estimate, url }.",
+        items: { type: "object" }
+      },
+      module: {
+        type: "string",
+        description: 'Module to file imported tasks under (default "Core").'
+      },
+      dry_run: {
+        type: "boolean",
+        description: "When true, normalise and dedup-check without writing anything. Use this to preview what would be imported. Default: false."
+      },
+      project: {
+        type: "string",
+        description: "Project id (UUID) or slug to import into, overriding the session project for THIS call only. Must be a project on your account \u2014 fails closed otherwise."
+      }
+    },
+    required: ["source"]
+  }
+};
+function diagnostic(lastStep, error, hint) {
+  return errorResponse(JSON.stringify({ tool: "backlog_import", lastStep, error, hint }, null, 2));
+}
+function formatResult(result, overrideNote) {
+  const lines = [];
+  const verb = result.dryRun ? "Would import" : "Imported";
+  lines.push(
+    `${verb} ${result.dryRun ? result.normalised - result.skipped : result.imported} task(s) from ${result.source}${overrideNote}.`
+  );
+  lines.push(`  normalised: ${result.normalised} \xB7 ${result.dryRun ? "would-write" : "written"}: ${result.dryRun ? result.normalised - result.skipped : result.imported} \xB7 skipped (duplicates): ${result.skipped}`);
+  if (result.createdTasks.length > 0 && !result.dryRun) {
+    const preview = result.createdTasks.slice(0, 10).map((t) => `  - ${t.id}: ${t.title}`);
+    lines.push("Created:");
+    lines.push(...preview);
+    if (result.createdTasks.length > 10) lines.push(`  \u2026and ${result.createdTasks.length - 10} more`);
+  }
+  if (result.skipped > 0) {
+    const dupPreview = result.skippedTitles.slice(0, 5).map((t) => `  - ${t}`);
+    lines.push(`Skipped ${result.skipped} duplicate(s) (already on the board or repeated in this import):`);
+    lines.push(...dupPreview);
+    if (result.skippedTitles.length > 5) lines.push(`  \u2026and ${result.skippedTitles.length - 5} more`);
+  }
+  if (!result.dryRun && result.imported > 0) {
+    lines.push("\nRun `plan` to triage and scope the imported backlog into a cycle.");
+  }
+  return lines.join("\n");
+}
+async function handleBacklogImport(adapter2, args) {
+  const source = args.source?.trim();
+  if (!source) {
+    return errorResponse(`source is required \u2014 one of: ${ALL_SOURCES.join(", ")}.`);
+  }
+  if (!ALL_SOURCES.includes(source)) {
+    return errorResponse(`Unknown source "${source}". Valid: ${ALL_SOURCES.join(", ")}.`);
+  }
+  const raw = args.raw;
+  const rawRows = args.rows;
+  const rows = Array.isArray(rawRows) ? rawRows : void 0;
+  const isFlatFile = source === "csv" || source === "markdown";
+  if (isFlatFile && (!raw || !raw.trim())) {
+    return errorResponse(`Source "${source}" needs a \`raw\` string (the exported ${source} text).`);
+  }
+  if (!isFlatFile && IMPLEMENTED_SOURCES.includes(source) && (!rows || rows.length === 0)) {
+    return errorResponse(`Source "${source}" needs a \`rows\` array of issues you read via that tool's MCP.`);
+  }
+  let target = adapter2;
+  let overrideNote = "";
+  try {
+    ({ adapter: target, overrideNote } = await resolvePerCallProjectAdapter(adapter2, args));
+  } catch (err) {
+    if (err instanceof ProjectResolutionError) return errorResponse(err.message);
+    throw err;
+  }
+  try {
+    const result = await importBacklog(target, {
+      source,
+      raw,
+      rows,
+      module: args.module,
+      dryRun: args.dry_run === true
+    });
+    return textResponse(formatResult(result, overrideNote));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/not implemented yet|no recognisable title column/i.test(message)) {
+      return errorResponse(message);
+    }
+    return diagnostic(
+      "importBacklog",
+      message,
+      "Check the export shape matches the source (csv/markdown need `raw`; linear needs `rows`). Re-run with dry_run:true to preview."
+    );
+  }
+}
+
 // src/tools/bug.ts
 import os from "os";
 init_git();
 
 // src/services/bug.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function resolveCurrentPhase2(phases) {
   if (phases.length === 0) return "Unscoped";
   const inProgress = phases.find((p) => p.status === "In Progress");
@@ -23487,7 +24247,7 @@ async function captureBug(adapter2, input) {
   warnIfEmpty("getCycleHealth (bug)", health);
   const phase = input.phase || resolveCurrentPhase2(phases);
   return adapter2.createTask({
-    uuid: randomUUID13(),
+    uuid: randomUUID14(),
     displayId: "",
     title: input.text,
     status: "Backlog",
@@ -23741,7 +24501,7 @@ ${lines.join("\n")}`
 init_git();
 
 // src/services/ad-hoc.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 function resolveAdHocCycle(cycle, latest, latestComplete) {
   if (cycle === void 0) return null;
   if (typeof cycle === "number") return cycle;
@@ -23781,7 +24541,7 @@ async function recordAdHoc(adapter2, input) {
   } else {
     const phase = resolveCurrentPhase(phases);
     task = await adapter2.createTask({
-      uuid: randomUUID14(),
+      uuid: randomUUID15(),
       displayId: "",
       title: input.title,
       status: landInReview ? "In Review" : "Done",
@@ -23800,7 +24560,7 @@ async function recordAdHoc(adapter2, input) {
     });
   }
   const report = {
-    uuid: randomUUID14(),
+    uuid: randomUUID15(),
     createdAt: now.toISOString(),
     taskId: task.id,
     taskName: task.title ?? task.displayId ?? "untitled",
@@ -23954,13 +24714,38 @@ async function handleAdHoc(adapter2, config2, args) {
   const promoNote = result.task.cycle != null ? ` Promoted into Cycle ${result.task.cycle} as injected work${result.task.status === "In Review" ? " (In Review \u2014 will release with the cycle)" : ""}.` : "";
   if (holdArg) {
     const branch = `feat/${result.task.id}`;
+    let collisionBlock = "";
+    try {
+      const board = await adapter2.queryBoard({ status: ["In Progress"] });
+      const otherInProgress = board.filter((t) => t.id !== result.task.id && t.displayId !== result.task.id).map((t) => ({ taskId: t.displayId || t.id, branch: (t.branchName ?? "").trim() })).filter((t) => t.branch.length > 0);
+      const collision = detectWorktreeCollision({
+        taskId: result.task.id,
+        targetBranch: branch,
+        inProgress: otherInProgress,
+        // Held work never runs git server-side — treat as suggest-only.
+        autoWorktree: false
+      });
+      if (collision) {
+        collisionBlock = `
+> ${collision.warning}
+> Instead of \`git switch -c\`, isolate into a worktree:
+> \`\`\`
+> git worktree add -b ${branch} ${collision.worktreePath}
+> cd ${collision.worktreePath} && npm run worktree:setup
+> \`\`\`
+> ${collision.setupHint}
+
+`;
+      }
+    } catch {
+    }
     return textResponse(
       `**${result.task.id}:** "${result.task.title}" held for review (${effortRaw}, ${priorityRaw}, ${typeLabel}, ${taskModule}).${truncateWarning}${promoNote} Build report attached.
 
 ## Held for the next cycle \u2014 branch + commit, do NOT merge
 The task is recorded **In Review** and pinned to **Cycle ${result.task.cycle}**, so the planner won't re-plan it and it rides that cycle's review \u2192 release bundled with planned work.
 
-1. Create a branch and commit your code there (never \`main\`):
+` + collisionBlock + `1. Create a branch and commit your code there (never \`main\`):
    \`\`\`
    git switch -c ${branch}
    git add -- <your changed files>
@@ -24568,7 +25353,7 @@ import { join as join15 } from "path";
 init_git();
 
 // src/services/review.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 function isValidVerdict(stage, verdict) {
   if (stage === "handoff-review") {
     return verdict === "approve" || verdict === "request-changes" || verdict === "reject";
@@ -24625,7 +25410,7 @@ async function submitReview(adapter2, input) {
   }
   const date = (/* @__PURE__ */ new Date()).toISOString();
   const review = {
-    uuid: randomUUID15(),
+    uuid: randomUUID16(),
     taskId: input.taskId,
     stage: input.stage,
     reviewer: input.reviewer,
@@ -24840,6 +25625,7 @@ var reviewSubmitTool = {
   description: "Record a review verdict on a completed build (build-acceptance) or task plan (handoff-review). ALWAYS ask the human for their verdict before calling \u2014 never auto-submit without human input. Accept moves the task to Done, request-changes sends it back for rework, reject discards the build. Updates task status based on the verdict. On handoff-review with suggested changes, returns a prompt to revise the BUILD HANDOFF.\n\nDO NOT use this tool as a substitute for review_list. If you need to see what is pending review, call review_list first. If review_list is unavailable in your tool set, STOP and tell the human their MCP integration is incomplete rather than guessing at the next pending task. (SUP-2026-010.)",
   annotations: { title: "Submit Review", readOnlyHint: false, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
     properties: {
       task_id: {
@@ -24906,7 +25692,21 @@ var reviewSubmitTool = {
         required: ["verdict", "summary", "findings"]
       }
     },
-    required: ["task_id", "stage", "verdict", "comments"]
+    required: ["task_id", "stage", "verdict", "comments"],
+    // task-2802: mirror isValidVerdict — the legal verdict set is stage-dependent.
+    // handoff-review takes approve/request-changes/reject; build-acceptance takes
+    // accept/request-changes/reject. The flat enum above lists the union; these
+    // conditionals narrow it per stage so the agent can't pair an impossible verdict.
+    allOf: [
+      {
+        if: { properties: { stage: { const: "handoff-review" } }, required: ["stage"] },
+        then: { properties: { verdict: { enum: ["approve", "request-changes", "reject"] } } }
+      },
+      {
+        if: { properties: { stage: { const: "build-acceptance" } }, required: ["stage"] },
+        then: { properties: { verdict: { enum: ["accept", "request-changes", "reject"] } } }
+      }
+    ]
   }
 };
 function formatReviewList(pendingBuilds) {
@@ -25525,7 +26325,7 @@ async function handleReviewClaim(adapter2, config2, args) {
 }
 
 // src/tools/init.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { access as access3, readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
 import path5 from "path";
 var initTool = {
@@ -25958,7 +26758,7 @@ ${writeNote}
     );
   }
   if (isDatabaseUser) {
-    const projectId = randomUUID16();
+    const projectId = randomUUID17();
     const envVars = {
       PAPI_PROJECT_DIR: projectRoot,
       PAPI_ADAPTER: "pg",
@@ -26761,6 +27561,7 @@ var orientTool = {
   description: "Session orientation \u2014 run this FIRST at session start before any other tool. Single call that replaces build_list + health. Returns: cycle number, task counts by status, in-progress/in-review tasks, strategy review cadence, velocity snapshot, recommended next action, and a release reminder when all cycle tasks are Done but release has not run. Read-only, does not modify any files. PAPI detects build capability from the connecting harness (clientInfo); pass `environment` only to override that detection for git-dependent recommendations (build_execute, release, review_submit).",
   annotations: { title: "Orient Session", readOnlyHint: true, destructiveHint: false, openWorldHint: false },
   inputSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
     type: "object",
     properties: {
       environment: {
@@ -29906,6 +30707,7 @@ var PAPI_TOOLS = [
   buildExecuteTool,
   buildCancelTool,
   ideaTool,
+  backlogImportTool,
   bugTool,
   bugListTool,
   adHocTool,
@@ -30088,6 +30890,8 @@ function createServer(adapter2, config2) {
           return handleBuildCancel(adapter2, safeArgs);
         case "idea":
           return handleIdea(adapter2, config2, safeArgs);
+        case "backlog_import":
+          return handleBacklogImport(adapter2, safeArgs);
         case "bug":
           return handleBug(adapter2, config2, safeArgs);
         case "bug_list":
@@ -30664,7 +31468,11 @@ async function dispatchRequest(args) {
   const requestConfig = {
     ...baseConfig,
     adapterType: "proxy",
-    projectId: effectiveProjectId
+    projectId: effectiveProjectId,
+    // Remote transport: the client cannot read files this server writes, so
+    // prepare must keep returning inline blobs (2905's budget bounds them),
+    // never a server-side file path (task-2906).
+    localFilesystem: false
   };
   const server2 = createServer(adapter2, requestConfig);
   const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });