InstallGuideHandbookToolsChangelog

Changelog

388releases across 7 months

Every PAPI release, cycle by cycle. Each one pushes back against project drift.

Get started free
allfeaturefixperformance

September 202611 releases

v0.7.120

Team view gets real per-member history, and a cleaner repository picker

  • Team view now shows each member's real history: velocity, planned versus delivered accuracy, what's blocked, and the mix of work they're doing, instead of empty placeholders.
  • The repository picker no longer closes the moment you type in its search box.
  • Checking project status fails readably now. A connection or database problem returns a plain message and a next step, not a blank error code.
  • Automatic code review before you accept a build runs on the work that needs it (bigger changes, or anything touching data, auth, or shared infrastructure) and stays out of the way on small low-risk changes.
Full detail
  • Team tab now shows real per-member history — velocity, scope accuracy, blocked count and task mix are read from the last 8 cycles instead of placeholder zeros
  • orient no longer fails with an opaque MCP error -32603 — a database or connection problem returns a readable one-line message and a hint, and any unexpected tool error does the same
  • Non-Claude MCP clients (Codex, Cursor, Windsurf and others) get an inline fallback for strategy review and zoom-out instead of a sub-agent prompt they cannot run
  • The repository picker no longer closes the moment you type in its search box
  • Build reports can now carry the model and token counts your harness reports, feeding cost analytics
  • Automatic code review before an accept now runs for M+ or risk-tier changes (data, auth, migrations, shared infrastructure) rather than on every task
  • review_submit on a hosted connection with no local checkout redirects to an explicit review instead of recording an accept with no diff seen
  • ci-local now matches CI exactly on the version-bump check and can auto-sync the Codex plugin version

v0.7.119

  • Repository picker recovery and task ownership transfers — repository selection now survives OAuth/install continuation, and authorized task return/transfer operations preserve ownership history safely
  • Maintainer release authority — repository maintainers using the PAPI release_manager role may carry approved final releases through the supported GitHub workflow when live repository permissions allow it

v0.7.118

  • Hub Overview tab design pass — Cycle health shown as Velocity / Estimation / Review bars, real build-agent logos in the activity feed, and an aligned single-grammar layout across every section (this is the version the landing page shows)

v0.7.117

  • Cookie consent on every public page — non-essential analytics stay off until you accept, with a "Cookie settings" link in the footer to change your mind
  • CRM: draft an outbound email on each contact, and "Mark as sent" advances the pipeline and schedules the 7-day follow-up; a new "Follow-up due" filter shows what needs a nudge
  • New hub "Overview" tab — a project-scoped mission-control view of health, velocity, the team, decisions and what needs you
  • "Your AI builds. PAPI steers." is now the locked one-line positioning across the landing hero, page title and docs
  • Cycle membership stays in sync — board edits and reconcile now keep the cycle roster and the hub in agreement (P0)
  • After a strategy review, PAPI now prompts a whole-base "what's new" email alongside the Discord post
  • Hosted MCP clients can declare their working directory, so a session pinned to the wrong project surfaces a warning on the write instead of failing silently

v0.401.0-feat-cycle-12-core

  • Create unified Badge component
  • Add dark mode elevation tokens
  • Typography hierarchy pass
  • Establish visual identity and design direction
  • Kill the silent default-project fallback for multi-project accounts — always show the project picker (reverses RECORD-ONLY)
  • "Reset connection" is mislabeled and returns a bare key: relabel to "reset all agent connections" + return the full per-project connector snippet
  • Hosted connection doctor: a remote-user equivalent of npx @papi-ai/server doctor — dashboard surface showing projects, which one the active credential resolves to, and recent connect failures
  • Add Pi coding agent (pi.dev / @earendil-works) as a first-class connect target: connect-UI tab, install-snippets builder, and llms.txt entry
  • Orient: emit local-divergence check instruction on hosted transport instead of no-op
  • MCP initialize accepts a revoked bearer; only the first tools/call 401s — client shows "connected" then every action fails

v0.400.0-codex-cycle-10-record-committed

  • Search and filter across all views
  • Alerts — blocked tasks, strategy review due, stale in-progress items
  • Multi-project support — project switcher and configurable .papi/ directory
  • Master dashboard as default landing page
  • Multi-project UI view with papi-projects.json
  • Migrate inline styles to Tailwind classes
  • Parallel task mutation drops task IDs and Cycle 1 member dashboard remains empty
  • Fast-path to record a cycle whose code is already written and committed — bulk create cycle + handoffs + build reports + mark shipped in one flow

v0.400.0

  • Record build reports atomically on cycle tasks
  • Let contributors append off-the-cuff tasks to an active cycle
  • Clarify readiness copy for cycle-assigned tasks
  • Add controlled comped-plan administration
  • Add plain-language explanations throughout onboarding

v0.399.0

  • Add the canonical strategy decision-history route
  • Send customer receipts for paid Stripe checkouts
  • Include project owners in contributor lists
  • Restore historical hub member metrics
  • Make the WSL full gate safe for clean checkouts
  • Harmonize incremental TypeScript checks
  • Consolidate incremental TypeScript checks
  • Run targeted checks and qualify the full suite twice daily
  • Make the pull-request gate sub-minute
  • Avoid duplicate workspace builds
  • Keep Santa Fe dependency setup warm
  • Make hosted progress steps idempotent

v0.397.0

  • In-Cycle tasks parked in a non-live cycle no longer vanish from the hub and team view — a write guard stops the strand and the read surfaces them
  • Phantom active cycle from a half-finished plan apply no longer traps you — plan absorbs it and re-plans over it, and orient tells you how
  • board_view and orient cycle counts now show the whole cycle's contents, not just your slice, and warn when the two membership records disagree
  • The bound project is now unmissable on every orient, and a write on a session that can't be cross-checked says so
  • On a near-empty board, the AI is told to route a work-dump through idea → plan instead of hand-writing code
  • The install runbook forbids handing over a config with a placeholder still in it — no more silent "connected" that isn't
  • Parallel/batch board_deprioritise calls no longer silently drop tasks — a batch request is rejected loudly instead of half-applying
  • New plan task_ids=[...] — take a chosen set of backlog tasks straight into a cycle with build handoffs, atomically
  • plan only hands a Claude-Code Task() prompt to Claude Code; every other client gets an inline path and a stated fallback
  • A contributor's first cycle no longer pulls the whole project history into the planner context

v0.396.0

  • Site-wide soft 404: auth proxy redirects every unknown path to /login instead of returning HTTP 404
  • Public-page SEO hygiene batch: breadcrumbs, /features double h1, /api/auth/me console error, sitemap fixes
  • Strategy page: make Roadmap and Time-machine (renamed "Decision history") actual tabs beside Brief and Dogfood
  • Strategy page: bring Brief and Dogfood tabs up to the same UI/UX quality as the other tabs
  • Orient scaffolding hardcodes CLAUDE.md regardless of MCP client harness — use the harness-appropriate file
  • Connection banner reads 'Connected' even on a degraded (no-adapter) MCP boot
  • Add durable release-activation logging so a future telemetry/instrumentation blackout can be root-caused
  • Regression: orient's unblock-candidate false positive on recurred at C372 despite (C370) supposedly fixing it
  • Restore the PAPI VPS monitor's deployment-drift check against origin/main

v0.395.8

  • Bearer-token storage: hardening guidance plus evaluate env-indirection / OS-keychain / api_keys expiry
  • BYOK Anthropic key for the dashboard brief-import extraction
  • Dependency-isolation / air-gap position for PAPI — research and AD-16 gate
  • Shared working-directory sessions: a commit lands on whichever branch happens to be checked out, not the session's logical branch
  • Plan apply reports "Cycle 5" but createCycle failure silently wrote tasks into stale cycle
  • A Cancelled prerequisite permanently blocks its dependents — build_execute treats Cancelled as unresolved
  • Task assignee not persisted after claim; team dashboard shows unassigned in-progress task
  • Reject authenticated GET /mcp to avoid hanging clients (stateless server, no server-initiated SSE)
  • Pricing page: Team tier shows "€19 / seat" — change the displayed price to "Custom"
  • Detect legacy database configurations and guide users to regenerate their setup
  • Investigate the Aug 29 telemetry emit blackout — zero /telemetry POSTs attempted while /invoke kept succeeding

August 20267 releases

v0.395.7

  • Identify the source of the mass cycle_tasks.updated_at bulk update (1,918 rows across 28 projects stamped to one timestamp)
  • Make the /trust surface discoverable by an evaluating agent (security.txt, SECURITY.md, llms.txt, README)
  • Surface PAPI's data-handling posture and a /trust link at MCP connect (server initialize + server.json)
  • Board: add team-member filter; scope cycle dropdown to selected member's cycles
  • Orient / Team dashboard use colliding cycle-number counters, causing wrong "next cycle" guidance
  • Fix silent tool_call/milestone telemetry drop on data-proxy /telemetry project-resolver 403 (slug->UUID resolution rejecting external users)
  • Telemetry blackout canary: count OAuth users (union api_keys + oauth_tokens.last_used_at) and ignore pure ping/initialize as 'active work'
  • Hub task attribution: show the model used instead of the person who did the task
  • Plan prepare blocks on stale reviews from other members' parallel cycles — scope the stale-review guard to the caller's cycle sequence
  • Sign-in with a non-existent account dead-ends instead of becoming sign-up — new users cannot self-serve activate
  • Projects.papi_dir is shared single-column state — teammate's workspace mapping clobbers yours (hard-blocks all mutations)

v0.395.6

  • Decide the tradeoff: Supabase session cookie is not httpOnly on the primary web/OAuth-connect auth path
  • Fold /briefs into Strategy as tabs — Project Overview and Cycle Briefs alongside the product brief that already lives at ?tab=brief
  • Decide the fate of per-cycle cost reporting: cost_snapshots has a live MCP reader, no writer, and no live data source exists to give it one
  • Auto-propose an Active Decision when a build report or review contains a durable choice
  • Dashboard hub/team UI bug sweep: next-move overflow, tour button, duplicate stat rows, discoveries CTA, builder attribution, capabilities panel
  • Surface capabilities PATCH failures instead of failing silently
  • Close the remaining Nova/vibe-tycoon gaps: ad_hoc ownership block + name the colliding PR/branch
  • Guard test — decision-gate consumers must resolve superseded ADs via resolveCurrentDecision, never read .superseded directly

v0.395.5

Plan apply, orient and BUILD HANDOFFs get more reliable, and stalled connect attempts get a real reason

  • If you stall at the connect step, you now see a real reason instead of silence.
  • BUILD HANDOFFs now surface the Active Decisions relevant to the files you're touching.
  • Fixed a bug where plan apply could misfile a freshly-planned cycle's tasks onto the wrong cycle.
  • orient and plan now stay within a token budget instead of risking overflow on projects with a lot of history.
Full detail
  • HubLivePulse: attribute agent activity to which runtime did the work, not just that activity happened
  • Doc_register returns an overlap warning against existing active docs so new docs get reconciled, not stacked
  • Surface the relevant Active Decisions inside the BUILD HANDOFF, ranked by relevance to the files the task touches
  • Token budget on orient and plan output with relevance-ranked truncation
  • Rewrite /trust in plain mechanical claims plus an explicit no-SOC-2 admission
  • Owner Action Queue: fix Last Contact display and unlocks_task_id wiring
  • Consolidate the three independent getModelOutcomeStats implementations (admin route, pg adapter, edge function) or add a parity test
  • Orient's unblock-candidate detection matches a task's stale/superseded decision-gate reference instead of its actual current gate
  • Plan apply's "lost cycle membership" self-heal reassigns tasks to a stale prior cycle instead of the cycle being applied
  • Fix cron-path allowlist gap for feedback-triage; migrate 5 external sites off Vercel to VPS
  • Backup ships a known-incomplete artifact when pg_dumpall's papi_alpha grep-filter finds zero matches — warning only, not a hard failure
  • Harden release gate against a stale local base ref
  • Orient reports origin-branch divergence by default
  • Warn on unclaimed build_execute/ad_hoc writes
  • ~190 legacy cycles get a one-time date backfill so full-history views stop reading as zero-duration
  • CI check state now reaches the dashboard as an attention signal

v0.395.4

  • Added the non-owner release_manager contributor role across invitations, membership, cycle work, reviews, releases, hosted writes, migrations, and documentation while preserving owner-only administration.
  • Release authorization now resolves caller identity consistently and verifies recorded task commits before release.
  • Made the Playwright hub gate startup portable and refreshed cycle-mechanics documentation.

v0.395.3

  • OAuth interoperability fixes
  • Codex MCP authorization now preserves the resource audience through token issuance and MCP validation.
  • CIMD metadata resolution keeps SSRF protections while using bounded IPv4-first fallback for unreachable IPv6 answers.
  • OAuth issuer validation and migration rollout behavior remain compatible with existing clients.

v0.395.2

  • Integrated dashboard and release-safety fixes
  • Release checks now catch drift between the server version and its derived skills and plugin metadata before CI or release.
  • Dashboard next-move text is bounded, the established-user tour works, duplicate hub stat strips are removed, and discovery arrows open the owning task.
  • Team task rows now show builder attribution, and the Team page uses a compact capabilities summary with a link to full settings.

v0.395.1

  • Cycle 370 — ad-hoc fix + gate hygiene
  • Weekly feedback-triage cron no longer 401s — its route was missed from the auth allowlist when it shipped
  • Fixed stale version drift (skills manifest, Codex plugin) that was blocking every PR's local CI gate