@papi-ai/server 0.7.76 → 0.7.78

package/dist/backfill-cycle-metrics.js

@@ -560,11 +560,13 @@ function ensureTagAtHead(cwd, tag, message) {
     message: `tag "${tag}" already exists but points at ${target ? target.slice(0, 7) : "an unknown commit"}, not the current HEAD (${head ? head.slice(0, 7) : "unknown"}). If it is left over from an aborted release, delete it and re-run release: \`git tag -d ${tag}\` (and \`git push origin :refs/tags/${tag}\` if it was pushed). Otherwise use a different version.`
   };
 }
-function getLatestTag(cwd) {
+function getLatestTag(cwd, timeoutMs) {
   try {
     return execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
       cwd,
-      encoding: "utf-8"
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      ...timeoutMs != null ? { timeout: timeoutMs } : {}
     }).trim() || null;
   } catch {
     return null;
@@ -806,20 +808,26 @@ function findTaskCommitsOnBase(cwd, preferredBase, displayIds) {
   try {
     raw = execFileSync(
       "git",
-      ["log", base, "--format=%h%x01%s", "-n", "1000"],
+      ["log", base, "--format=%h%x01%s%x01%b%x02", "-n", "1000"],
       { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
     );
   } catch {
     return out;
   }
-  const commits = raw.split("\n").map((line) => {
-    const idx = line.indexOf("
");
-    if (idx === -1) return null;
-    return { hash: line.slice(0, idx).trim(), subject: line.slice(idx + 1).trim() };
-  }).filter((c) => c !== null && c.hash !== "");
+  const commits = raw.split("").map((record) => {
+    const parts = record.split("
");
+    if (parts.length < 2) return null;
+    return {
+      hash: parts[0].trim(),
+      subject: parts[1].trim(),
+      body: (parts[2] ?? "").trim()
+    };
+  }).filter(
+    (c) => c !== null && c.hash !== ""
+  );
   for (const displayId of displayIds) {
     const re = new RegExp(`(^|[^\\w-])${escapeRegexLiteral(displayId)}([^\\w-]|$)`);
-    const hit = commits.find((c) => re.test(c.subject));
+    const hit = commits.find((c) => re.test(c.subject)) ?? commits.find((c) => re.test(c.body));
     if (!hit) continue;
     const prMatch = hit.subject.match(/#(\d+)/);
     out.set(displayId, {
@@ -1236,6 +1244,14 @@ var init_proxy_adapter = __esm({
       // (1) local-only
       "close",
       "initRls",
+      // task-3207 (C357): commitBuildComplete, commitReviewSubmit, commitRelease have no
+      // edge case handler and no ALLOWED_METHODS entry — forwarding them 403s at the edge
+      // with no try/catch at the call site, crashing build_execute/review_submit/release
+      // completion for every hosted user. Restores the intended graceful degradation
+      // (separate appendBuildReport + updateTaskStatus calls) until they're atomically wired.
+      "commitBuildComplete",
+      "commitReviewSubmit",
+      "commitRelease",
       // (2) not-yet-wired hosted gaps — shrink as data-proxy handlers land (task-2390).
       // getToolCallCount + updatePhaseStatus are ABSENT: they now have edge handlers and
       // are served through the forwarder (getToolCallCount = SUP-2026-026 handler #1).
@@ -1281,10 +1297,39 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      onAuthRejected;
       constructor(config) {
         this.endpoint = config.endpoint.replace(/\/$/, "");
         this.apiKey = config.apiKey;
         this.projectId = config.projectId ?? "";
+        this.onAuthRejected = config.onAuthRejected;
+      }
+      /**
+       * task-1773: bearer-only auth probe. Hits the USER-scoped `project-list` route
+       * (no projectId needed), so it answers exactly one question: does the proxy
+       * still accept this bearer?
+       *
+       * Returns the HTTP status, or 0 when the call could not be made at all
+       * (network error / timeout). Callers MUST treat 0 — and any status that is
+       * neither 2xx nor 401 — as "no signal", never as a rejection: a proxy outage
+       * must not masquerade as a revoked token and force every user to re-auth.
+       */
+      async probeBearerStatus() {
+        try {
+          const response = await fetch(`${this.endpoint}/project-list`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Authorization": `Bearer ${this.apiKey}`
+            },
+            body: "{}",
+            signal: AbortSignal.timeout(5e3)
+          });
+          if (response.status === 401) this.onAuthRejected?.();
+          return response.status;
+        } catch {
+          return 0;
+        }
       }
       /** Resolved project ID — available after ensureProject() completes. */
       getProjectId() {
@@ -1301,7 +1346,8 @@ var init_proxy_adapter = __esm({
         return wrapWithForwarding(new _ProxyPapiAdapter({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
-          projectId
+          projectId,
+          onAuthRejected: this.onAuthRejected
         }));
       }
       /**
@@ -1388,6 +1434,7 @@ var init_proxy_adapter = __esm({
             message = errorBody;
           }
           if (response.status === 401) {
+            this.onAuthRejected?.();
             throw new Error(
               `Auth: Invalid API key \u2014 PAPI_DATA_API_KEY was rejected by the proxy.
 This usually means the key was revoked or replaced. Mint a fresh key in the Connect panel on your PAPI dashboard (https://getpapi.ai/hub), then update PAPI_DATA_API_KEY in your .mcp.json.
@@ -1966,6 +2013,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
           } catch {
             message = errorBody;
           }
+          if (response.status === 401) this.onAuthRejected?.();
           throw new Error(`Proxy error (${response.status}) on ${route}: ${message}`);
         }
         const body = await response.json();
@@ -2020,7 +2068,7 @@ import { pathToFileURL } from "url";
 import path2 from "path";
 import { execSync } from "child_process";
 
-// ../adapter-md/dist/index.js
+// ../../../../../Users/cathaloullivan/Ai-App-Projects/PapiUI/packages/adapter-md/dist/index.js
 import { readFile, writeFile, access } from "fs/promises";
 import { randomUUID as randomUUID6 } from "crypto";
 import { join } from "path";
@@ -2282,9 +2330,12 @@ function parsePlanningLog(content, activeDecisionsContent, cycleLogContent) {
 var VALID_EFFORT_SIZES = /* @__PURE__ */ new Set(["XS", "S", "M", "L", "XL"]);
 var SECTION_HEADERS = [
   "SCOPE (DO THIS)",
+  "WHY NOT SIMPLER",
   "SCOPE BOUNDARY (DO NOT DO THIS)",
   "ACCEPTANCE CRITERIA",
+  "PRE-MORTEM",
   "SECURITY CONSIDERATIONS",
+  "DEPLOY VERIFICATION",
   "PRE-BUILD VERIFICATION",
   "FILES LIKELY TOUCHED",
   "EFFORT"
@@ -2323,7 +2374,7 @@ function parseBulletsOnly(text) {
   return text.split("\n").filter((l) => /^\s*-\s/.test(l)).map((l) => l.replace(/^\s*-\s*/, "").trim()).filter((l) => l.length > 0);
 }
 function parseChecklist(text) {
-  return text.split("\n").map((l) => l.replace(/^\s*\[[ x]]\s*/, "").trim()).filter((l) => l.length > 0);
+  return text.split("\n").map((l) => l.replace(/^\s*(?:[-*+]\s*)?(?:\[[ xX]\]\s*)?/, "").trim()).filter((l) => l.length > 0);
 }
 function parseBuildHandoff(markdown) {
   if (typeof markdown !== "string" || !markdown.trim()) return null;
@@ -2943,6 +2994,67 @@ var ACCURACY_HEADER = "| Cycle | Reports | Match Rate | MAE | Bias |";
 var ACCURACY_SEPARATOR = "|--------|---------|------------|-----|------|";
 var VELOCITY_HEADER = "| Cycle | Completed | Partial | Failed | Effort Points |";
 var VELOCITY_SEPARATOR = "|--------|-----------|---------|--------|---------------|";
+var EFFORT_SCALE = {
+  XS: 1,
+  S: 2,
+  M: 3,
+  L: 4,
+  XL: 5
+};
+function effortOrdinal(effort) {
+  if (typeof effort !== "string") return void 0;
+  const normalized = effort.trim().toUpperCase();
+  return EFFORT_SCALE[normalized];
+}
+function isUnparsedEffort(effort) {
+  if (typeof effort !== "string" || effort.trim().length === 0) return false;
+  return effortOrdinal(effort) === void 0;
+}
+function calculateCycleMetrics(reports, currentCycle, window = 5) {
+  const recentReports = reports.filter(
+    (r) => r.cycle > currentCycle - window && r.cycle <= currentCycle
+  );
+  const unparsedEffortCount = recentReports.filter(
+    (r) => isUnparsedEffort(r.actualEffort) || isUnparsedEffort(r.estimatedEffort)
+  ).length;
+  const perCycle = /* @__PURE__ */ new Map();
+  for (const r of recentReports) {
+    const group = perCycle.get(r.cycle) ?? [];
+    group.push(r);
+    perCycle.set(r.cycle, group);
+  }
+  const accuracy = [];
+  const velocity = [];
+  const sortedCycles = [...perCycle.keys()].sort((a, b) => a - b);
+  for (const cycle of sortedCycles) {
+    const reps = perCycle.get(cycle);
+    const deltas = [];
+    for (const r of reps) {
+      const actual = effortOrdinal(r.actualEffort);
+      const estimated = effortOrdinal(r.estimatedEffort);
+      if (actual !== void 0 && estimated !== void 0) {
+        deltas.push(actual - estimated);
+      }
+    }
+    if (deltas.length > 0) {
+      accuracy.push({
+        cycle,
+        reports: deltas.length,
+        matchRate: Math.round(deltas.filter((d) => d === 0).length / deltas.length * 100),
+        mae: Math.round(deltas.reduce((s, d) => s + Math.abs(d), 0) / deltas.length * 10) / 10,
+        bias: Math.round(deltas.reduce((s, d) => s + d, 0) / deltas.length * 10) / 10
+      });
+    }
+    velocity.push({
+      cycle,
+      completed: reps.filter((r) => r.completed === "Yes").length,
+      partial: reps.filter((r) => r.completed === "Partial").length,
+      failed: reps.filter((r) => r.completed === "No").length,
+      effortPoints: reps.reduce((s, r) => s + (effortOrdinal(r.actualEffort) ?? 0), 0)
+    });
+  }
+  return { accuracy, velocity, unparsedEffortCount };
+}
 function serializeAccuracyRow(a) {
   return `| ${a.cycle} | ${a.reports} | ${a.matchRate}% | ${a.mae} | ${a.bias >= 0 ? "+" : ""}${a.bias} |`;
 }
@@ -4367,6 +4479,7 @@ async function createAdapter(optionsOrType, maybePapiDir) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");
       let projectId = process.env["PAPI_PROJECT_ID"];
+      const projectIdWasPreSupplied = Boolean(projectId);
       const projectRoot = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
       let rootHash = null;
       let originUrl = null;
@@ -4430,6 +4543,26 @@ async function createAdapter(optionsOrType, maybePapiDir) {
       }
       const config = papiEndpoint ? { connectionString: papiEndpoint } : configFromEnv();
       validateDatabaseUrl(config.connectionString);
+      if (projectIdWasPreSupplied) {
+        const ownershipProbe = new PgAdapter(config);
+        try {
+          const owned = await ownershipProbe.findProjectById(projectId, resolveUserId);
+          if (!owned) {
+            throw new Error(
+              `PAPI_PROJECT_ID ${projectId} does not belong to you.
+
+The project exists under a different owner, or does not exist at all. PAPI refuses to attach to a project you do not own \u2014 writing to it would put your cycles, tasks and Active Decisions into somebody else's project.
+
+Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the project from your git remote), then reconnect.`
+            );
+          }
+        } finally {
+          try {
+            await ownershipProbe.close();
+          } catch {
+          }
+        }
+      }
       const { ensureSchema } = await import("@papi-ai/adapter-pg");
       try {
         await ensureSchema(config);
@@ -4726,13 +4859,14 @@ function computeSnapshotsFromBuildReports(reports, tasks) {
     const cycleReports = reportsByCycle.get(sn) ?? [];
     const cycleTaskRows = tasksByCycle.get(sn);
     const withEffort = cycleReports.filter((r) => r.estimatedEffort && r.actualEffort);
-    const accurate = withEffort.filter((r) => r.estimatedEffort === r.actualEffort).length;
-    const matchRate = withEffort.length > 0 ? Math.round(accurate / withEffort.length * 100) : 0;
+    const [computedAccuracy] = calculateCycleMetrics(withEffort, sn, 1).accuracy;
     const { completed, total, plannedPoints, deliveredPoints } = computeCycleEffort(cycleTaskRows, cycleReports);
     snapshots.push({
       cycle: sn,
       date: (/* @__PURE__ */ new Date()).toISOString(),
-      accuracy: [{ cycle: sn, reports: cycleReports.length, matchRate, mae: 0, bias: 0 }],
+      // No report in this cycle carried BOTH an estimate and an actual, so there
+      // is genuinely nothing to measure. Zeros here mean "no data", not "no bias".
+      accuracy: [computedAccuracy ?? { cycle: sn, reports: 0, matchRate: 0, mae: 0, bias: 0 }],
       velocity: [{
         cycle: sn,
         completed,