@papi-ai/server 0.7.77 → 0.7.79

package/dist/backfill-cycle-metrics.js

@@ -560,11 +560,13 @@ function ensureTagAtHead(cwd, tag, message) {
     message: `tag "${tag}" already exists but points at ${target ? target.slice(0, 7) : "an unknown commit"}, not the current HEAD (${head ? head.slice(0, 7) : "unknown"}). If it is left over from an aborted release, delete it and re-run release: \`git tag -d ${tag}\` (and \`git push origin :refs/tags/${tag}\` if it was pushed). Otherwise use a different version.`
   };
 }
-function getLatestTag(cwd) {
+function getLatestTag(cwd, timeoutMs) {
   try {
     return execFileSync("git", ["describe", "--tags", "--abbrev=0"], {
       cwd,
-      encoding: "utf-8"
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      ...timeoutMs != null ? { timeout: timeoutMs } : {}
     }).trim() || null;
   } catch {
     return null;
@@ -806,20 +808,26 @@ function findTaskCommitsOnBase(cwd, preferredBase, displayIds) {
   try {
     raw = execFileSync(
       "git",
-      ["log", base, "--format=%h%x01%s", "-n", "1000"],
+      ["log", base, "--format=%h%x01%s%x01%b%x02", "-n", "1000"],
       { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
     );
   } catch {
     return out;
   }
-  const commits = raw.split("\n").map((line) => {
-    const idx = line.indexOf("
");
-    if (idx === -1) return null;
-    return { hash: line.slice(0, idx).trim(), subject: line.slice(idx + 1).trim() };
-  }).filter((c) => c !== null && c.hash !== "");
+  const commits = raw.split("").map((record) => {
+    const parts = record.split("
");
+    if (parts.length < 2) return null;
+    return {
+      hash: parts[0].trim(),
+      subject: parts[1].trim(),
+      body: (parts[2] ?? "").trim()
+    };
+  }).filter(
+    (c) => c !== null && c.hash !== ""
+  );
   for (const displayId of displayIds) {
     const re = new RegExp(`(^|[^\\w-])${escapeRegexLiteral(displayId)}([^\\w-]|$)`);
-    const hit = commits.find((c) => re.test(c.subject));
+    const hit = commits.find((c) => re.test(c.subject)) ?? commits.find((c) => re.test(c.body));
     if (!hit) continue;
     const prMatch = hit.subject.match(/#(\d+)/);
     out.set(displayId, {
@@ -1289,10 +1297,39 @@ var init_proxy_adapter = __esm({
       endpoint;
       apiKey;
       projectId;
+      onAuthRejected;
       constructor(config) {
         this.endpoint = config.endpoint.replace(/\/$/, "");
         this.apiKey = config.apiKey;
         this.projectId = config.projectId ?? "";
+        this.onAuthRejected = config.onAuthRejected;
+      }
+      /**
+       * task-1773: bearer-only auth probe. Hits the USER-scoped `project-list` route
+       * (no projectId needed), so it answers exactly one question: does the proxy
+       * still accept this bearer?
+       *
+       * Returns the HTTP status, or 0 when the call could not be made at all
+       * (network error / timeout). Callers MUST treat 0 — and any status that is
+       * neither 2xx nor 401 — as "no signal", never as a rejection: a proxy outage
+       * must not masquerade as a revoked token and force every user to re-auth.
+       */
+      async probeBearerStatus() {
+        try {
+          const response = await fetch(`${this.endpoint}/project-list`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Authorization": `Bearer ${this.apiKey}`
+            },
+            body: "{}",
+            signal: AbortSignal.timeout(5e3)
+          });
+          if (response.status === 401) this.onAuthRejected?.();
+          return response.status;
+        } catch {
+          return 0;
+        }
       }
       /** Resolved project ID — available after ensureProject() completes. */
       getProjectId() {
@@ -1309,7 +1346,8 @@ var init_proxy_adapter = __esm({
         return wrapWithForwarding(new _ProxyPapiAdapter({
           endpoint: this.endpoint,
           apiKey: this.apiKey,
-          projectId
+          projectId,
+          onAuthRejected: this.onAuthRejected
         }));
       }
       /**
@@ -1396,6 +1434,7 @@ var init_proxy_adapter = __esm({
             message = errorBody;
           }
           if (response.status === 401) {
+            this.onAuthRejected?.();
             throw new Error(
               `Auth: Invalid API key \u2014 PAPI_DATA_API_KEY was rejected by the proxy.
 This usually means the key was revoked or replaced. Mint a fresh key in the Connect panel on your PAPI dashboard (https://getpapi.ai/hub), then update PAPI_DATA_API_KEY in your .mcp.json.
@@ -1974,6 +2013,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
           } catch {
             message = errorBody;
           }
+          if (response.status === 401) this.onAuthRejected?.();
           throw new Error(`Proxy error (${response.status}) on ${route}: ${message}`);
         }
         const body = await response.json();
@@ -2290,9 +2330,12 @@ function parsePlanningLog(content, activeDecisionsContent, cycleLogContent) {
 var VALID_EFFORT_SIZES = /* @__PURE__ */ new Set(["XS", "S", "M", "L", "XL"]);
 var SECTION_HEADERS = [
   "SCOPE (DO THIS)",
+  "WHY NOT SIMPLER",
   "SCOPE BOUNDARY (DO NOT DO THIS)",
   "ACCEPTANCE CRITERIA",
+  "PRE-MORTEM",
   "SECURITY CONSIDERATIONS",
+  "DEPLOY VERIFICATION",
   "PRE-BUILD VERIFICATION",
   "FILES LIKELY TOUCHED",
   "EFFORT"
@@ -2331,7 +2374,7 @@ function parseBulletsOnly(text) {
   return text.split("\n").filter((l) => /^\s*-\s/.test(l)).map((l) => l.replace(/^\s*-\s*/, "").trim()).filter((l) => l.length > 0);
 }
 function parseChecklist(text) {
-  return text.split("\n").map((l) => l.replace(/^\s*\[[ x]]\s*/, "").trim()).filter((l) => l.length > 0);
+  return text.split("\n").map((l) => l.replace(/^\s*(?:[-*+]\s*)?(?:\[[ xX]\]\s*)?/, "").trim()).filter((l) => l.length > 0);
 }
 function parseBuildHandoff(markdown) {
   if (typeof markdown !== "string" || !markdown.trim()) return null;
@@ -2959,13 +3002,21 @@ var EFFORT_SCALE = {
   XL: 5
 };
 function effortOrdinal(effort) {
+  if (typeof effort !== "string") return void 0;
   const normalized = effort.trim().toUpperCase();
   return EFFORT_SCALE[normalized];
 }
+function isUnparsedEffort(effort) {
+  if (typeof effort !== "string" || effort.trim().length === 0) return false;
+  return effortOrdinal(effort) === void 0;
+}
 function calculateCycleMetrics(reports, currentCycle, window = 5) {
   const recentReports = reports.filter(
     (r) => r.cycle > currentCycle - window && r.cycle <= currentCycle
   );
+  const unparsedEffortCount = recentReports.filter(
+    (r) => isUnparsedEffort(r.actualEffort) || isUnparsedEffort(r.estimatedEffort)
+  ).length;
   const perCycle = /* @__PURE__ */ new Map();
   for (const r of recentReports) {
     const group = perCycle.get(r.cycle) ?? [];
@@ -3002,7 +3053,7 @@ function calculateCycleMetrics(reports, currentCycle, window = 5) {
       effortPoints: reps.reduce((s, r) => s + (effortOrdinal(r.actualEffort) ?? 0), 0)
     });
   }
-  return { accuracy, velocity };
+  return { accuracy, velocity, unparsedEffortCount };
 }
 function serializeAccuracyRow(a) {
   return `| ${a.cycle} | ${a.reports} | ${a.matchRate}% | ${a.mae} | ${a.bias >= 0 ? "+" : ""}${a.bias} |`;
@@ -4428,6 +4479,7 @@ async function createAdapter(optionsOrType, maybePapiDir) {
     case "pg": {
       const { PgAdapter, PgPapiAdapter, configFromEnv } = await import("@papi-ai/adapter-pg");
       let projectId = process.env["PAPI_PROJECT_ID"];
+      const projectIdWasPreSupplied = Boolean(projectId);
       const projectRoot = options.projectRoot ?? process.env["PAPI_PROJECT_DIR"] ?? process.cwd();
       let rootHash = null;
       let originUrl = null;
@@ -4491,6 +4543,26 @@ async function createAdapter(optionsOrType, maybePapiDir) {
       }
       const config = papiEndpoint ? { connectionString: papiEndpoint } : configFromEnv();
       validateDatabaseUrl(config.connectionString);
+      if (projectIdWasPreSupplied) {
+        const ownershipProbe = new PgAdapter(config);
+        try {
+          const owned = await ownershipProbe.findProjectById(projectId, resolveUserId);
+          if (!owned) {
+            throw new Error(
+              `PAPI_PROJECT_ID ${projectId} does not belong to you.
+
+The project exists under a different owner, or does not exist at all. PAPI refuses to attach to a project you do not own \u2014 writing to it would put your cycles, tasks and Active Decisions into somebody else's project.
+
+Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the project from your git remote), then reconnect.`
+            );
+          }
+        } finally {
+          try {
+            await ownershipProbe.close();
+          } catch {
+          }
+        }
+      }
       const { ensureSchema } = await import("@papi-ai/adapter-pg");
       try {
         await ensureSchema(config);