@papi-ai/server 0.7.84 → 0.7.98

package/dist/prompts.js

@@ -1,3 +1,6 @@
+// src/lib/carry-forward-shape.ts
+import { splitCarryForward, renderCarryForward } from "@papi-ai/shared";
+
 // src/prompts.ts
 var AD_REJECTION_RULES = `**AD Minting Guard \u2014 REJECT observations dressed as decisions.**
 
@@ -30,7 +33,11 @@ The guard above says what to reject. This says what to propose. Rejecting is not
 
 **Copy variants are NEVER decisions.** A tagline, a headline, a value proposition, a piece of marketing or product wording: swapping one for another constrains no future work, so it fails test (b) outright. Wording changes as often as the market teaches you something, and routing every edit through decision ceremony is what buries the handful of decisions that genuinely constrain the project. Edit the wording where the wording lives. If two variants are being compared against a measurement, that is an experiment, not a decision.
 
-**A decision decaying into a convention is the healthy path, not a failure.** When a live AD stops being arguable \u2014 the alternatives are no longer on the table and nobody would re-litigate it \u2014 say so during housekeeping and propose retiring it into a convention. An AD registry where most entries are settled is one nobody reads.`;
+**A decision decaying into a convention is the healthy path, not a failure.** When a live AD stops being arguable \u2014 the alternatives are no longer on the table and nobody would re-litigate it \u2014 propose demoting it during housekeeping with \`action: "demote"\`. An AD registry where most entries are settled is one nobody reads.
+
+DEMOTION IS THE THIRD TRANSITION, and it is not either of the other two. \`supersede\` replaces a stance with a NEW one; \`delete\` removes something that was never a decision. \`demote\` is for a decision that was RIGHT and still holds \u2014 it keeps riding every build handoff as a convention and simply stops occupying decision surface. Apply test (c) to each live AD: could a competent person argue the other side TODAY, on current evidence? If no, propose \`demote\` and give the one-line reason it is no longer contested.
+
+PROPOSE, NEVER ASSUME. A demotion is a judgement about whether something is still arguable, and the owner is the one who knows. Surface candidates with reasoning and let the human confirm on apply, exactly as board corrections and cancellations are gated. Do not demote in bulk to tidy the registry.`;
 var AD_CONFLICT_SURFACING_RULES = `**A contradiction is NOT a veto \u2014 surface it, never silently shelve it.**
 
 Active Decisions are *active*: they can be superseded, modified, or abandoned. You do NOT have authority to kill a piece of work simply because it cuts against one. That is the user's call, and they can only make it if you show it to them.
@@ -92,7 +99,7 @@ SECURITY CONSIDERATIONS
 [data exposure, secrets handling, auth/access control, dependency risks \u2014 or "None \u2014 no security-relevant changes"]
 
 DEPLOY VERIFICATION
-[Include this section ONLY when FILES LIKELY TOUCHED contains a TRIGGER-SURFACE path. Trigger surfaces (exact set): lib/install-snippets.ts, packages/server/src/transport-http.ts, packages/server/src/index.ts, app/well-known/**, app/api/auth/oauth/**, app/proxy.ts, app/middleware.ts, lib/auth*, next.config.ts, vercel.json, **/railway.toml, **/Dockerfile, **/Procfile, supabase/functions/**, lib/env*.ts. When required, instruct the builder: "Production verification REQUIRED. After deploy, run a curl against the live URL(s) you changed and pass production_verification on build_execute complete with { urls, curl_command, http_status, response_excerpt, verified_at }. http_status MUST be 2xx; build_execute and review_submit reject otherwise. Server inspects the diff against origin/main to enforce this." Omit this section entirely when no trigger surface is touched.]
+[Include this section ONLY when FILES LIKELY TOUCHED contains a TRIGGER-SURFACE path. Trigger surfaces (exact set): lib/install-snippets.ts, packages/server/src/transport-http.ts, packages/server/src/index.ts, app/well-known/**, app/api/auth/oauth/**, app/proxy.ts, app/middleware.ts, lib/auth*, next.config.ts, **/Dockerfile, **/Procfile, supabase/functions/**, lib/env*.ts. When required, instruct the builder: "Production verification REQUIRED. After deploy, run a curl against the live URL(s) you changed and pass production_verification on build_execute complete with { urls, curl_command, http_status, response_excerpt, verified_at }. http_status MUST be 2xx; build_execute and review_submit reject otherwise. Server inspects the diff against origin/main to enforce this." Omit this section entirely when no trigger surface is touched.]
 
 REFERENCE DOCS
 [Optional \u2014 paths to docs/ files that provide background context for this task. Include only when the task originated from research or scoping work and the doc contains context the builder will need beyond what is in this handoff. Omit this section entirely for tasks that don't need supplementary context.]
@@ -300,7 +307,7 @@ var PLAN_FRAGMENT_MARKETING_BRIEF = `
    Add to ACCEPTANCE CRITERIA: "[ ] Message Frame confirmed with Owner before drafting" and "[ ] Final content reviewed by Owner before publishing."`;
 var PLAN_FRAGMENT_OPS_BRIEF = `
    **Ops brief task detection:** When a task's task type is "ops-brief", generate an OPS BRIEF handoff. Inside SCOPE (DO THIS), use these subsections. KEEP the "SCOPE (DO THIS)" header and put these subsections INSIDE it \u2014 the handoff parser only recognises the standard headers (packages/adapter-md build-handoff.ts SECTION_HEADERS) and a handoff with no SCOPE section is rejected outright (task-3050, C357):
-   - SYSTEM: Which system or service this ops task touches \u2014 Vercel, Railway, Supabase, GitHub Actions, DNS, etc.
+   - SYSTEM: Which system or service this ops task touches \u2014 Vercel, Supabase, GitHub Actions, DNS, etc.
    - RISK: What could go wrong \u2014 data loss, downtime, broken deployments. Include estimated blast radius (e.g. "affects all authenticated users").
    - ROLLBACK PLAN: Exact steps to undo the change if something breaks. Must be specific enough to execute under pressure.
    - DONE CONDITION: The specific observable state that confirms the task is complete \u2014 a health check URL, a metric, a log line, a manual verification step.
@@ -328,7 +335,19 @@ var PLAN_FRAGMENT_FORWARD_HORIZON = `
    - **Actionable** \u2014 frame as a decision to make, not a vague warning (e.g. "Decide whether to use WebSockets or SSE for real-time updates before starting Phase 4: Real-Time Features")
    - **Tied to trajectory** \u2014 based on current board state, ADs, and velocity, not generic advice
    If the Forward Horizon context is absent or there are no meaningful decisions to surface, omit this section entirely. Do NOT generate generic advice like "plan ahead" or "consider testing".`;
-function composeFullModeInstructions(flags, ctx) {
+function omitSection(source, startMarker, endMarker) {
+  const start = source.indexOf(startMarker);
+  if (start === -1) return source;
+  const end = source.indexOf(endMarker, start + startMarker.length);
+  if (end === -1) return source;
+  return source.slice(0, start) + source.slice(end);
+}
+var ALL_PLAN_GATES_ON = {
+  planHealthCheck: true,
+  backlogTriage: true,
+  buildOrder: true
+};
+function composeFullModeInstructions(flags, ctx, gates = ALL_PLAN_GATES_ON) {
   const parts = [
     `## FULL MODE
 
@@ -461,7 +480,21 @@ ${AD_ADMISSION_RULES}
   }
   parts.push(`
 **CRITICAL: Review your Part 2 JSON before finishing. Every action from Part 1 must have a corresponding entry in Part 2. If Part 1 mentions corrections, new tasks, AD changes, or handoffs but Part 2 has empty arrays \u2014 you have a persistence bug.**`);
-  return parts.join("\n");
+  let composed = parts.join("\n");
+  if (!gates.planHealthCheck) {
+    composed = omitSection(composed, "1. **Cycle Health Check**", "\n2. **Inbox Triage**");
+  }
+  if (!gates.backlogTriage) {
+    composed = omitSection(composed, "2. **Inbox Triage**", "\n3. **Board Integrity**");
+  }
+  if (!gates.buildOrder) {
+    composed = omitSection(
+      composed,
+      "   **Intra-cycle dependency detection:**",
+      "   **Branch-coherence check (task-1908):**"
+    );
+  }
+  return composed;
 }
 var PLAN_FULL_BASELINE_FLAGS = {
   hasBugTasks: true,
@@ -479,9 +512,11 @@ var PLAN_FULL_INSTRUCTIONS = composeFullModeInstructions(PLAN_FULL_BASELINE_FLAG
   hasDiscoveryCanvas: true,
   hasHorizonContext: true
 });
-function buildPlanFullInstructionsConditional(flags, ctx) {
-  if (!flags || !ctx) return PLAN_FULL_INSTRUCTIONS;
-  return composeFullModeInstructions(flags, ctx);
+function buildPlanFullInstructionsConditional(flags, ctx, gates) {
+  if (!flags || !ctx) {
+    return gates ? composeFullModeInstructions(PLAN_FULL_BASELINE_FLAGS, { hasDiscoveryCanvas: true, hasHorizonContext: true }, gates) : PLAN_FULL_INSTRUCTIONS;
+  }
+  return composeFullModeInstructions(flags, ctx, gates);
 }
 var CYCLE_DENSITY_TARGETS = {
   light: { label: "Light", range: "2-3" },
@@ -522,10 +557,14 @@ function buildPlanUserMessage(ctx) {
   if (ctx.mode === "bootstrap") {
     parts.push(PLAN_BOOTSTRAP_INSTRUCTIONS);
   } else {
-    const instructions = ctx.boardFlags ? buildPlanFullInstructionsConditional(ctx.boardFlags, {
-      hasDiscoveryCanvas: !!ctx.discoveryCanvas,
-      hasHorizonContext: !!ctx.horizonContext
-    }) : PLAN_FULL_INSTRUCTIONS;
+    const instructions = ctx.boardFlags ? buildPlanFullInstructionsConditional(
+      ctx.boardFlags,
+      {
+        hasDiscoveryCanvas: !!ctx.discoveryCanvas,
+        hasHorizonContext: !!ctx.horizonContext
+      },
+      ctx.planGates
+    ) : buildPlanFullInstructionsConditional(void 0, void 0, ctx.planGates);
     parts.push(instructions);
   }
   if (ctx.foundationalTasksGuidance) {
@@ -798,11 +837,31 @@ function coerceToString(value) {
   if (value === null || value === void 0) return "";
   return JSON.stringify(value, null, 2);
 }
+function normalizePlannerPriority(value) {
+  const raw = coerceToString(value).trim();
+  const aliases = {
+    p0: "P0 Critical",
+    "p0 critical": "P0 Critical",
+    p1: "P1 High",
+    "p1 high": "P1 High",
+    p2: "P2 Medium",
+    "p2 medium": "P2 Medium",
+    p3: "P3 Low",
+    "p3 low": "P3 Low"
+  };
+  return aliases[raw.toLowerCase()] ?? raw;
+}
 function coerceCarryForward(value) {
   if (value === null || value === void 0) return { value: null };
   if (typeof value === "string") {
     const trimmed = value.trim();
-    return { value: trimmed.length > 0 ? trimmed : null };
+    if (trimmed.length === 0) return { value: null };
+    if (!splitCarryForward(trimmed).split) {
+      const warning2 = 'cycleLogCarryForward was persisted, but it has neither a "WHAT SHIPS FOR USERS:" nor a "RELEASE MECHANICS:" label \u2014 orient will render it verbatim instead of leading with product signal. Re-run plan apply with both labels in cycleLogCarryForward for this cycle if that split matters here.';
+      console.error(`[plan] ${warning2}`);
+      return { value: trimmed, warning: warning2 };
+    }
+    return { value: trimmed };
   }
   const shape = Array.isArray(value) ? "array" : typeof value;
   const warning = `cycleLogCarryForward was ${shape}, not a string \u2014 DROPPED rather than persisted. Carry-forward is prose that orient parses for the WHAT SHIPS FOR USERS / RELEASE MECHANICS labels; a non-string value cannot carry them. Re-run plan apply with cycleLogCarryForward as a single string (or null) to record one for this cycle.`;
@@ -826,7 +885,7 @@ function coerceStructuredOutput(parsed) {
     tempId: t.tempId !== void 0 && t.tempId !== null ? coerceToString(t.tempId) : void 0,
     title: coerceToString(t.title),
     status: coerceToString(t.status),
-    priority: coerceToString(t.priority),
+    priority: normalizePlannerPriority(t.priority),
     complexity: coerceToString(t.complexity),
     module: coerceToString(t.module),
     epic: coerceToString(t.epic),
@@ -839,7 +898,7 @@ function coerceStructuredOutput(parsed) {
     const updates = typeof c.updates === "object" && c.updates !== null ? c.updates : {};
     const coercedUpdates = {};
     for (const [key, val] of Object.entries(updates)) {
-      coercedUpdates[key] = typeof val === "object" && val !== null ? JSON.stringify(val) : val;
+      coercedUpdates[key] = key === "priority" ? normalizePlannerPriority(val) : typeof val === "object" && val !== null ? JSON.stringify(val) : val;
     }
     return { taskId: coerceToString(c.taskId), updates: coercedUpdates };
   }) : [];
@@ -1017,7 +1076,7 @@ After your natural language output, include this EXACT format on its own line:
   "activeDecisionUpdates": [
     {
       "id": "string \u2014 AD-N (existing) or new AD-N (for new decisions)",
-      "action": "confidence_change | modify | resolve | supersede | new | delete",
+      "action": "confidence_change | modify | resolve | supersede | new | delete | demote",
       "body": "string \u2014 full AD block including ### heading, confidence tag, and body text (empty string for delete)",
       "evidenceRef": "string (optional) \u2014 for DELIBERATE decisions (modify / resolve / delete = validate/modify/invalidate), a pointer to the evidence that justified the change: a doc path (docs/research/foo.md), a build-report id, or a metric name. Builds the decision->outcome ledger. Omit if no concrete evidence.",
       "metricDelta": "object (optional) \u2014 { "metric": string, "before": number, "after": number, "delta": number } \u2014 which metric moved and by how much. Use a REAL metric name from cycle_metrics_snapshots where possible (e.g. scope_accuracy, velocity, est_actual_drift). Omit if no metric moved."
@@ -1269,7 +1328,7 @@ After your natural language output, include this EXACT format on its own line:
   "activeDecisionUpdates": [
     {
       "id": "string \u2014 AD-N (existing) or new AD-N (for new decisions)",
-      "action": "confidence_change | modify | resolve | supersede | new | delete",
+      "action": "confidence_change | modify | resolve | supersede | new | delete | demote",
       "body": "string \u2014 full AD block including ### heading, confidence tag, and body text (empty string for delete)",
       "evidenceRef": "string (optional) \u2014 for DELIBERATE changes (modify / resolve / delete), a pointer to the justifying evidence: a doc path, a build-report id, or a metric name. Builds the decision->outcome ledger. Omit if none.",
       "metricDelta": "object (optional) \u2014 { "metric": string, "before": number, "after": number, "delta": number } \u2014 which metric moved. Prefer a real metric name from cycle_metrics_snapshots. Omit if none."
@@ -1761,6 +1820,7 @@ export {
   buildVisionTasksPrompt,
   coerceCarryForward,
   extractDependencyChain,
+  normalizePlannerPriority,
   parseReviewStructuredOutput,
   parseStrategyChangeOutput,
   parseStructuredOutput

package/dist/statusline.js

@@ -0,0 +1,168 @@
+// src/cli/statusline.ts
+import { createHash } from "crypto";
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { join } from "path";
+import { pathToFileURL } from "url";
+var CACHE_TTL_MS = 3e4;
+var FETCH_TIMEOUT_MS = 3e3;
+function renderPeekLine(c) {
+  const parts = [`PAPI c${c.cycle ?? "?"}`];
+  parts.push(`build ${c.inFlight}`);
+  parts.push(`review ${c.inReview}`);
+  if (c.ownerActions !== null) parts.push(`you ${c.ownerActions}`);
+  return parts.join(" | ");
+}
+function cacheFilePath(endpoint, projectId) {
+  const hash = createHash("sha256").update(`${endpoint}|${projectId ?? ""}`).digest("hex").slice(0, 16);
+  return join(tmpdir(), `papi-statusline-${hash}.json`);
+}
+function readClientCache(path, now = Date.now()) {
+  try {
+    const hit = JSON.parse(readFileSync(path, "utf-8"));
+    if (!hit || typeof hit.expires !== "number" || hit.expires <= now) return void 0;
+    return hit.payload;
+  } catch {
+    return void 0;
+  }
+}
+function writeClientCache(path, payload, now = Date.now()) {
+  try {
+    writeFileSync(path, JSON.stringify({ expires: now + CACHE_TTL_MS, payload }));
+  } catch {
+  }
+}
+function configFromMcpJson(body) {
+  if (!body || typeof body !== "object") return void 0;
+  const servers = body.mcpServers;
+  if (!servers || typeof servers !== "object") return void 0;
+  for (const entry of Object.values(servers)) {
+    if (!entry || typeof entry !== "object") continue;
+    const s = entry;
+    if (typeof s.url !== "string" || !/papi/i.test(s.url)) continue;
+    const auth = s.headers?.["Authorization"];
+    const authString = typeof auth === "string" ? auth : "";
+    const bearer = authString.startsWith("Bearer ") ? authString.slice(7).trim() : "";
+    const projectHeader = s.headers?.["x-papi-project-id"];
+    if (!bearer) continue;
+    return {
+      endpoint: new URL(s.url).origin,
+      bearer,
+      projectId: typeof projectHeader === "string" && projectHeader.length > 0 ? projectHeader : void 0
+    };
+  }
+  return void 0;
+}
+function mergeStatusLine(body, command) {
+  const obj = body && typeof body === "object" ? body : {};
+  if (obj["statusLine"] !== void 0) return null;
+  return { ...obj, statusLine: { type: "command", command } };
+}
+function resolveConfig(argv) {
+  const flag = (name) => {
+    const i = argv.indexOf(name);
+    return i >= 0 && argv[i + 1] ? argv[i + 1] : void 0;
+  };
+  const endpoint = flag("--endpoint") ?? process.env["PAPI_ENDPOINT"];
+  const bearer = flag("--bearer") ?? process.env["PAPI_BEARER"];
+  const projectId = flag("--project") ?? process.env["PAPI_PROJECT_ID"];
+  if (endpoint && bearer) return { endpoint: new URL(endpoint).origin, bearer, projectId };
+  const mcpJsonPath = join(process.cwd(), ".mcp.json");
+  if (existsSync(mcpJsonPath)) {
+    try {
+      return configFromMcpJson(JSON.parse(readFileSync(mcpJsonPath, "utf-8")));
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+async function fetchPeek(config) {
+  const response = await fetch(`${config.endpoint}/peek`, {
+    headers: {
+      Authorization: `Bearer ${config.bearer}`,
+      ...config.projectId ? { "x-papi-project-id": config.projectId } : {}
+    },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!response.ok) throw new Error(`peek returned ${response.status}`);
+  const body = await response.json();
+  return {
+    cycle: typeof body.cycle === "number" ? body.cycle : null,
+    inFlight: typeof body.inFlight === "number" ? body.inFlight : 0,
+    inReview: typeof body.inReview === "number" ? body.inReview : 0,
+    ownerActions: typeof body.ownerActions === "number" ? body.ownerActions : null
+  };
+}
+var RENDER_COMMAND = "npx -y @papi-ai/cli papi-statusline";
+async function install() {
+  const settingsPath = join(homedir(), ".claude", "settings.json");
+  let body = {};
+  if (existsSync(settingsPath)) {
+    try {
+      body = JSON.parse(readFileSync(settingsPath, "utf-8"));
+    } catch (err) {
+      console.error(`papi-statusline: could not parse ${settingsPath}: ${err.message}`);
+      return 1;
+    }
+  }
+  const merged = mergeStatusLine(body, RENDER_COMMAND);
+  if (merged === null) {
+    console.log(
+      `papi-statusline: ${settingsPath} already has a statusLine entry \u2014 left untouched.
+To switch it to PAPI manually, set:
+  "statusLine": { "type": "command", "command": "${RENDER_COMMAND}" }
+
+Any other MCP client with a custom status-bar command can run the same command.`
+    );
+    return 0;
+  }
+  writeFileSync(settingsPath, `${JSON.stringify(merged, null, 2)}
+`);
+  console.log(`papi-statusline: installed into ${settingsPath}. Restart your AI client to see it.`);
+  return 0;
+}
+async function runStatusline(argv, stdin) {
+  if (argv.includes("--install")) return install();
+  void stdin;
+  const config = resolveConfig(argv);
+  if (!config) return 0;
+  const cachePath = cacheFilePath(config.endpoint, config.projectId);
+  const cached = readClientCache(cachePath);
+  if (cached) {
+    process.stdout.write(`${renderPeekLine(cached)}
+`);
+    return 0;
+  }
+  try {
+    const payload = await fetchPeek(config);
+    writeClientCache(cachePath, payload);
+    process.stdout.write(`${renderPeekLine(payload)}
+`);
+  } catch {
+  }
+  return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const chunks = [];
+  process.stdin.on("data", (chunk) => chunks.push(chunk));
+  process.stdin.on("end", () => {
+    void runStatusline(process.argv.slice(2), Buffer.concat(chunks).toString("utf-8")).then((code) => {
+      process.exitCode = code;
+    });
+  });
+  setTimeout(() => {
+    void runStatusline(process.argv.slice(2), Buffer.concat(chunks).toString("utf-8")).then((code) => {
+      process.exitCode = code;
+    });
+  }, 250);
+}
+export {
+  cacheFilePath,
+  configFromMcpJson,
+  mergeStatusLine,
+  readClientCache,
+  renderPeekLine,
+  runStatusline,
+  writeClientCache
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@papi-ai/server",
-  "version": "0.7.84",
-  "description": "PAPI MCP server — AI-powered sprint planning, build execution, and strategy review for software projects",
+  "version": "0.7.98",
+  "description": "PAPI MCP server \u2014 AI-powered sprint planning, build execution, and strategy review for software projects",
   "license": "Elastic-2.0",
   "mcpName": "io.github.getpapi/papi",
   "type": "module",
@@ -49,17 +49,16 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.82.0",
+    "@anthropic-ai/sdk": "^0.91.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@papi-ai/adapter-pg": "^0.2.15",
-    "@papi-ai/shared": "^0.2.4",
-    "@papi-ai/skills": "^0.1.0",
-    "js-yaml": "^4.1.0"
+    "@papi-ai/adapter-pg": "^0.2.16",
+    "@papi-ai/shared": "^0.2.5",
+    "@papi-ai/skills": "^0.1.4"
   },
   "devDependencies": {
     "@papi-ai/adapter-md": "^0.2.0",
-    "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.0.0",
+    "ajv": "^8.20.0",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^4.0.18"