@papi-ai/server 0.7.85 → 0.7.103

package/dist/backfill-cycle-metrics.js

@@ -30,7 +30,6 @@ function resolveDeploymentProfile(env) {
     dataEndpoint: cleanUrl(env.dataEndpoint) ?? (hostedSupabaseUrl ? `${hostedSupabaseUrl}/functions/v1/data-proxy` : void 0) ?? (selfHosted ? void 0 : `${HOSTED_SUPABASE_URL}/functions/v1/data-proxy`),
     providers: {
       vercel: optionalBoolean(env.vercelEnabled, !selfHosted),
-      railway: optionalBoolean(env.railwayEnabled, !selfHosted),
       managedSupabase: optionalBoolean(env.managedSupabaseEnabled, !selfHosted)
     },
     auth: {
@@ -100,6 +99,21 @@ var init_dist = __esm({
   "../shared/dist/index.js"() {
     "use strict";
     CAPABILITY_REGISTRY = [
+      // task-3384: the PLAN step. The landing page has advertised these three since
+      // the v5 control beat (components/marketing/landing/ControlC.tsx) with a code
+      // comment reading "shipping soon, shown now" — the registry had no plan-step
+      // entry at all, so the Planning group rendered empty and was dropped. These
+      // are NOT new behaviour: each one gates a section of the planner instructions
+      // that already runs on every full-mode plan, so ON reproduces today exactly.
+      //
+      // All three default ON. Turning one off removes its step from the planner
+      // prompt, which is the whole mechanism — the planner does what the prompt
+      // tells it to, so an omitted step is genuinely not performed (and the matching
+      // plan-prepare progress checkpoint is not recorded, so the hub does not claim
+      // a step that never ran).
+      { key: "planHealthCheck", label: "Health check", description: "Flags cycle gaps, stale tasks and AD conflicts before planning.", step: "plan" },
+      { key: "backlogTriage", label: "Backlog triage", description: "Cleans up and prioritises unreviewed backlog items during planning.", step: "plan" },
+      { key: "buildOrder", label: "Build order", description: "Detects intra-cycle dependencies and sequences the build.", step: "plan" },
       { key: "prReviewer", label: "Auto code review", description: "Runs a code review of the branch diff before accepting.", step: "review" },
       { key: "securityScan", label: "Security scan", description: "Flags a security pass on risk-tier changes at review time.", step: "review" },
       { key: "changelog", label: "Changelog & cycle update", description: "Curates a cycle-update post when a release ships.", step: "release" },
@@ -154,7 +168,7 @@ var init_dist = __esm({
     CAPABILITY_KEYS = CAPABILITY_REGISTRY.map((c) => c.key);
     HOSTED_APP_URL = "https://getpapi.ai";
     HOSTED_MCP_URL = "https://mcp.getpapi.ai";
-    HOSTED_SUPABASE_URL = "https://guewgygcpcmrcoppihzx.supabase.co";
+    HOSTED_SUPABASE_URL = "https://api.getpapi.ai";
     WAB_WINDOW_DAYS = 7;
     WAB_WEEK_MS = WAB_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
     EFFORT_SCALE = {
@@ -175,6 +189,7 @@ __export(git_exports, {
   checkoutBranch: () => checkoutBranch,
   commitSinglePath: () => commitSinglePath,
   commitStagedOnly: () => commitStagedOnly,
+  computeAheadBehind: () => computeAheadBehind,
   createAndCheckoutBranch: () => createAndCheckoutBranch,
   createPullRequest: () => createPullRequest,
   createTag: () => createTag,
@@ -185,8 +200,10 @@ __export(git_exports, {
   detectUnrecordedCommits: () => detectUnrecordedCommits,
   ensureLatestDevelop: () => ensureLatestDevelop,
   ensureTagAtHead: () => ensureTagAtHead,
+  fetchBaseBranch: () => fetchBaseBranch,
   findContributorReleasePullRequests: () => findContributorReleasePullRequests,
   findTaskCommitsOnBase: () => findTaskCommitsOnBase,
+  getBaseDivergence: () => getBaseDivergence,
   getBranchDiff: () => getBranchDiff,
   getCommitFiles: () => getCommitFiles,
   getCommitsSinceTag: () => getCommitsSinceTag,
@@ -221,6 +238,7 @@ __export(git_exports, {
   hasUnpushedCommits: () => hasUnpushedCommits,
   isBranchContentAlreadyInBase: () => isBranchContentAlreadyInBase,
   isBranchMergedInto: () => isBranchMergedInto,
+  isCommitReachable: () => isCommitReachable,
   isGhAvailable: () => isGhAvailable,
   isGitAvailable: () => isGitAvailable,
   isGitRepo: () => isGitRepo,
@@ -1283,6 +1301,19 @@ function isBranchMergedInto(cwd, branch, baseBranch) {
     return false;
   }
 }
+function isCommitReachable(cwd, commit, baseBranch) {
+  const recordedCommit = commit.trim();
+  if (!recordedCommit) return false;
+  try {
+    execFileSync("git", ["merge-base", "--is-ancestor", recordedCommit, baseBranch], {
+      cwd,
+      stdio: "ignore"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
   const resolveCommit = (ref) => {
     try {
@@ -1309,6 +1340,55 @@ function isBranchContentAlreadyInBase(cwd, branch, baseBranch) {
     return false;
   }
 }
+function fetchBaseBranch(cwd, baseBranch, timeoutMs = GIT_FETCH_TIMEOUT_MS) {
+  if (!isGitAvailable() || !isGitRepo(cwd) || !hasRemote(cwd)) {
+    return { fetched: false, compareRef: baseBranch };
+  }
+  const result = spawnSync("git", ["fetch", "--quiet", "origin", baseBranch], {
+    cwd,
+    encoding: "utf-8",
+    timeout: timeoutMs
+  });
+  if (result.error || result.status !== 0) {
+    const raw = result.error?.message ?? ((result.stderr || "").trim() || `git exited ${result.status}`);
+    const isTimeout = result.signal === "SIGTERM" || /ETIMEDOUT/.test(raw);
+    return {
+      fetched: false,
+      compareRef: baseBranch,
+      warning: isTimeout ? `Fetch from origin timed out after ${Math.round(timeoutMs / 1e3)}s \u2014 comparing against the local '${baseBranch}' ref, which may be stale.` : `Fetch from origin failed \u2014 comparing against the local '${baseBranch}' ref, which may be stale. (${raw})`
+    };
+  }
+  return { fetched: true, compareRef: `origin/${baseBranch}` };
+}
+function computeAheadBehind(cwd, compareRef, ref = "HEAD") {
+  try {
+    const out = execFileSync(
+      "git",
+      ["rev-list", "--left-right", "--count", `${compareRef}...${ref}`],
+      { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }
+    ).trim();
+    const [behindStr, aheadStr] = out.split(/\s+/);
+    const behind = parseInt(behindStr, 10);
+    const ahead = parseInt(aheadStr, 10);
+    if (Number.isNaN(behind) || Number.isNaN(ahead)) return null;
+    return { ahead, behind };
+  } catch {
+    return null;
+  }
+}
+function getBaseDivergence(cwd, preferredBase, opts) {
+  const baseBranch = resolveBaseBranch(cwd, preferredBase);
+  const fetch2 = fetchBaseBranch(cwd, baseBranch, opts?.timeoutMs);
+  const divergence = computeAheadBehind(cwd, fetch2.compareRef, opts?.ref ?? "HEAD");
+  return {
+    baseBranch,
+    compareRef: fetch2.compareRef,
+    fetched: fetch2.fetched,
+    ahead: divergence?.ahead ?? null,
+    behind: divergence?.behind ?? null,
+    warning: fetch2.warning
+  };
+}
 function pickModuleCycleBranch(candidates, cycleNumber, module, memberSlug) {
   if (candidates.length === 0) return void 0;
   const expected = cycleBranchName(cycleNumber, module, memberSlug);
@@ -1413,7 +1493,7 @@ function getRemoteBranchFiles(cwd, branch, baseBranch) {
     return [];
   }
 }
-var AUTO_WRITTEN_PATHS, GIT_NETWORK_TIMEOUT_MS, MERGE_RETRY_DELAY_MS, MERGE_MAX_RETRIES;
+var AUTO_WRITTEN_PATHS, GIT_NETWORK_TIMEOUT_MS, MERGE_RETRY_DELAY_MS, MERGE_MAX_RETRIES, GIT_FETCH_TIMEOUT_MS;
 var init_git = __esm({
   "src/lib/git.ts"() {
     "use strict";
@@ -1421,6 +1501,7 @@ var init_git = __esm({
     GIT_NETWORK_TIMEOUT_MS = 6e4;
     MERGE_RETRY_DELAY_MS = 2e3;
     MERGE_MAX_RETRIES = 3;
+    GIT_FETCH_TIMEOUT_MS = 5e3;
   }
 });
 
@@ -1471,6 +1552,16 @@ __export(proxy_adapter_exports, {
   createProxyAdapter: () => createProxyAdapter,
   wrapWithForwarding: () => wrapWithForwarding
 });
+function formatRateLimitError(route, response, errorBody, displayMessage = errorBody) {
+  let reason;
+  try {
+    const parsed = JSON.parse(errorBody);
+    if (typeof parsed.reason === "string") reason = parsed.reason;
+  } catch {
+  }
+  const retryAfter = response.headers.get("Retry-After");
+  return `Proxy rate limit on ${route}${reason ? ` (${reason})` : ""}${retryAfter ? `; retry after ${retryAfter}s` : ""}: ${displayMessage}`;
+}
 function snakeToCamel(str) {
   return str.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
 }
@@ -1512,7 +1603,7 @@ function wrapWithForwarding(instance) {
   return new Proxy(instance, {
     get(target, prop, receiver) {
       const existing = Reflect.get(target, prop, receiver);
-      if (existing !== void 0) return existing;
+      if (Reflect.has(target, prop)) return existing;
       if (typeof prop !== "string" || prop === "then" || prop.startsWith("_") || NO_FORWARD.has(prop)) {
         return existing;
       }
@@ -1644,8 +1735,14 @@ var init_proxy_adapter = __esm({
       "linkPhasesToStage",
       "listContributors",
       "listConventions",
+      "listDecisionPositions",
+      "upsertDecisionPosition",
+      "proposeDecision",
+      "resolveDecisionState",
+      "getUserEmailsByIds",
       "listMyBugReports",
       "listOwnerActionsForBlockerScan",
+      "listOwnerActionsForOwner",
       "logEntityReferences",
       "markAgendaTopicsAddressed",
       "markCycleLearningResolved",
@@ -1709,6 +1806,12 @@ var init_proxy_adapter = __esm({
       // (1) local-only
       "close",
       "initRls",
+      // task-3667: the exit-criteria evaluators probe adapter.sql to pick their
+      // transport branch (direct SQL vs adapter reads). Forwarding `sql` to the
+      // edge 403'd INSIDE sqlOf — every SQL-backed evaluator then threw
+      // 'evaluator failed' instead of engaging its hosted branch or degrading to
+      // an honest unevaluated reason. `sql` is local-only by definition.
+      "sql",
       // task-3207 (C357): commitBuildComplete, commitReviewSubmit, commitRelease have no
       // edge case handler and no ALLOWED_METHODS entry — forwarding them 403s at the edge
       // with no try/catch at the call site, crashing build_execute/review_submit/release
@@ -1795,6 +1898,15 @@ var init_proxy_adapter = __esm({
         this.projectId = config.projectId ?? "";
         this.onAuthRejected = config.onAuthRejected;
       }
+      /**
+       * Headers shared by every authenticated proxy route.
+       */
+      authenticatedHeaders() {
+        return {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${this.apiKey}`
+        };
+      }
       /**
        * Does the hosted path genuinely serve `name`? (task-3022, C362)
        *
@@ -1833,10 +1945,7 @@ var init_proxy_adapter = __esm({
         try {
           const response = await fetch(`${this.endpoint}/project-list`, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: "{}",
             signal: AbortSignal.timeout(5e3)
           });
@@ -1875,10 +1984,7 @@ var init_proxy_adapter = __esm({
         const url = `${this.endpoint}/ensure-project`;
         const response = await fetch(url, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify({
             ...projectName ? { projectName } : {},
             ...repoUrl ? { repoUrl } : {},
@@ -1898,6 +2004,9 @@ var init_proxy_adapter = __esm({
           } catch {
             message = errorBody;
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError("ensureProject", response, errorBody, message));
+          }
           throw new Error(`Auto-provision failed (${response.status}): ${message}`);
         }
         const body = await response.json();
@@ -1918,10 +2027,7 @@ var init_proxy_adapter = __esm({
         try {
           response = await fetch(url, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: JSON.stringify({
               projectId: this.projectId,
               method,
@@ -1964,6 +2070,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
 (${response.status} on ${method}: ${message})`
             );
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError(method, response, errorBody, message));
+          }
           throw new Error(`Proxy error (${response.status}) on ${method}: ${message}`);
         }
         const body = await response.json();
@@ -2025,10 +2134,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         try {
           const response = await fetch(`${this.endpoint}/invoke`, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "Authorization": `Bearer ${this.apiKey}`
-            },
+            headers: this.authenticatedHeaders(),
             body: JSON.stringify({ projectId, method: "projectExists", args: [] }),
             signal: AbortSignal.timeout(5e3)
           });
@@ -2059,8 +2165,8 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       writeCycleLogEntry(entry) {
         return this.invoke("writeCycleLogEntry", [entry]);
       }
-      updateActiveDecision(id, body, cycleNumber) {
-        return this.invoke("updateActiveDecision", [id, body, cycleNumber]);
+      updateActiveDecision(id, body, cycleNumber, action) {
+        return this.invoke("updateActiveDecision", [id, body, cycleNumber, action]);
       }
       upsertActiveDecision(id, body, title, confidence, cycleNumber) {
         return this.invoke("upsertActiveDecision", [id, body, title, confidence, cycleNumber]);
@@ -2187,7 +2293,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
        * task-2288 (C308): emit a telemetry event via the proxy's /telemetry endpoint
        * using THIS adapter's per-request bearer (this.apiKey) — the same credential
        * invoke() uses. This is the fix for the hosted-transport blackout: on the
-       * multi-tenant Railway pod there is no PAPI_DATA_API_KEY env var, so the
+       * multi-tenant server has no PAPI_DATA_API_KEY env var, so the
        * env-var emitTelemetryEvent path (lib/telemetry.ts) dropped every event since
        * 2026-06-16. Fire-and-forget — never throws, never blocks the tool response.
        * Not routed through invoke() because /telemetry is a distinct endpoint and a
@@ -2203,10 +2309,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
         if (event.projectId) payload["projectId"] = event.projectId;
         fetch(`${this.endpoint}/telemetry`, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify(payload),
           signal: AbortSignal.timeout(5e3)
         }).then((res) => {
@@ -2293,6 +2396,19 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       getLatestDecisionScores() {
         return this.invoke("getLatestDecisionScores");
       }
+      // --- Decision lifecycle — propose / resolve / positions (task-3408, C366) ---
+      proposeDecision(id, decisionType, proposedByUserId, cycleNumber) {
+        return this.invoke("proposeDecision", [id, decisionType, proposedByUserId, cycleNumber]);
+      }
+      resolveDecisionState(id, state, actorUserId, cycleNumber) {
+        return this.invoke("resolveDecisionState", [id, state, actorUserId, cycleNumber]);
+      }
+      listDecisionPositions(decisionId) {
+        return this.invoke("listDecisionPositions", [decisionId]);
+      }
+      upsertDecisionPosition(decisionId, userId, status, comments) {
+        return this.invoke("upsertDecisionPosition", [decisionId, userId, status, comments ?? null]);
+      }
       logEntityReferences(refs) {
         return this.invoke("logEntityReferences", [refs]);
       }
@@ -2488,7 +2604,18 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       }
       // --- Project metadata (path-identity guardrail) ---
       async getProjectInfo() {
-        return this.invoke("getProjectInfo", []);
+        const raw = await this.invoke("getProjectInfo", []);
+        if (!raw) return null;
+        return {
+          name: raw.name,
+          slug: raw.slug,
+          papi_dir: raw.papi_dir ?? raw.papiDir ?? null,
+          repo_url: raw.repo_url ?? raw.repoUrl ?? null,
+          capabilities: raw.capabilities ?? {},
+          discord_channel_id: raw.discord_channel_id ?? raw.discordChannelId ?? null,
+          decision_resolution_mode: raw.decision_resolution_mode ?? raw.decisionResolutionMode ?? "owner",
+          decision_type_resolvers: raw.decision_type_resolvers ?? raw.decisionTypeResolvers ?? {}
+        };
       }
       /**
        * task-2052 (C288): owner-gate identity for the proxy transport. Both sides
@@ -2528,10 +2655,7 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
       async postRoute(route, payload) {
         const response = await fetch(`${this.endpoint}/${route}`, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Authorization": `Bearer ${this.apiKey}`
-          },
+          headers: this.authenticatedHeaders(),
           body: JSON.stringify(payload),
           signal: AbortSignal.timeout(15e3)
         });
@@ -2543,6 +2667,9 @@ Check PAPI_PROJECT_ID in your .mcp.json config. Find your project ID in the PAPI
           } catch {
             message = errorBody;
           }
+          if (response.status === 429) {
+            throw new Error(formatRateLimitError(route, response, errorBody, message));
+          }
           if (response.status === 401) this.onAuthRejected?.();
           throw new Error(`Proxy error (${response.status}) on ${route}: ${message}`);
         }
@@ -2692,7 +2819,6 @@ function serverDeploymentProfile() {
     dataEndpoint: process.env["PAPI_DATA_ENDPOINT"],
     hostedSupabaseUrl: process.env["PAPI_HOSTED_SUPABASE_URL"],
     vercelEnabled: process.env["PAPI_ENABLE_VERCEL"],
-    railwayEnabled: process.env["PAPI_ENABLE_RAILWAY"],
     managedSupabaseEnabled: process.env["PAPI_ENABLE_MANAGED_SUPABASE"]
   });
 }
@@ -2863,16 +2989,21 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
             });
           }
         } else {
-          if (!existing.root_commit_hash && rootHash) {
+          if (!existing.root_commit_hash && rootHash || !existing.repo_url && originUrl) {
             try {
-              await pgAdapter.updateProject(projectId, {
-                root_commit_hash: rootHash,
-                repo_url: originUrl ?? void 0,
-                resolution_method: "root_hash"
-              });
+              const update = {};
+              if (!existing.root_commit_hash && rootHash) {
+                update.root_commit_hash = rootHash;
+                update.resolution_method = "root_hash";
+              }
+              if (!existing.repo_url && originUrl) {
+                update.repo_url = originUrl;
+                if (!update.resolution_method && !existing.resolution_method) update.resolution_method = "repo_url";
+              }
+              await pgAdapter.updateProject(projectId, update);
             } catch (err) {
               console.error(
-                `[papi] \u26A0 Failed to backfill root_commit_hash: ${err instanceof Error ? err.message : String(err)}`
+                `[papi] \u26A0 Failed to backfill project resolution signals: ${err instanceof Error ? err.message : String(err)}`
               );
             }
           }
@@ -2913,7 +3044,7 @@ Fix the PAPI_PROJECT_ID in your .mcp.json (or unset it and let PAPI resolve the
         } catch {
         }
       }
-      const adapter = new PgPapiAdapter(config, projectId);
+      const adapter = new PgPapiAdapter({ ...config, userId: resolveUserId }, projectId);
       try {
         await adapter.initRls();
       } catch {