PAPI
InstallGuideHandbookToolsChangelog

Changelog

593releases across 10 months

Every PAPI release, cycle by cycle. Each one pushes back against project drift.

Get started free
allfeaturefixperformance

November 20267 releases

v0.402.222

The new web service gets its own port

  • The web service moves to a port no other site on the server uses, so it can start next to them.
Full detail
  • The web service listens on port 3009 instead of 3003, because another site on the same host already uses 3003. The systemd unit, the Caddy route block and the route installer all use the new port.

v0.402.221

Public pages move to their own web service, with the same look

  • The legal, compare, contact and status pages now come from a lightweight web service, and they look the same as before.
  • Your light or dark choice and your cookie choice are remembered by the server, so pages open in the right theme.
  • The BuiltByIndies badge on the homepage sits between the closing card and the footer.
Full detail
  • Packages/web has server-rendered components that replace shadcn and Radix: dialog, popover, menu, select, tabs, tooltip, toast, chart helper and icon sprite, styled with the design tokens and driven by native elements and htmx.
  • The dark or light choice is kept in a papi-ui-theme cookie as well as localStorage, so server-rendered pages draw in the visitor's theme on the first paint.
  • The cookie banner and Cookie settings button work on server-rendered pages and share one choice with the Next pages in both directions.
  • The footer newsletter form is served by the web service with the same validation, honeypot and rate limit as Next; it answers 503 until the Resend values are set.
  • Server-rendered pages show the Dashboard button to a signed-in visitor, set the first-touch cookie, and record the visit in the web service through an insert-only record_visit database function that the anon key can call.
  • The mobile menu on server-rendered pages is a slide-in Sheet with the same links, the favicon links match Next, and the cache headers on /subprocessors match.
  • /settings/about on the web service has the full dashboard chrome (rail, header, project switcher, account menu, mobile tabs, setup banner, What's new) read with the signed-in user's own session; the owner ops bar comes from an owner-only database function.
  • The web service serves the text routes, the legal pages, the contact form, the compare and alternatives pages and /status (from a public view with only the up flag and the incident flag), with the same Content-Security-Policy as Next. SSR stays off in production until the Caddy block is installed.
  • The BuiltByIndies badge on the homepage moves into the empty space between the closing call-to-action card and the footer line.

v0.402.220

One Actions page for everything waiting on you, a What's new digest, and a CRM of your own

  • Actions now gathers everything that waits on a person across all your projects, grouped as Review, Decide, Unblock, Approve and Direct, with filters for project, person and type.
  • What's new now shows everything you missed since you last looked, remembers that on your account, and links to the community Discord.
  • PAPI users now have their own CRM, for keeping track of the people and companies around their projects.
  • Settings has a connections gallery with a tile for each AI tool, and anyone on a shared project can submit an idea from the board.
Full detail
  • Actions is one page for everything that waits on a person, across all your projects: Review, Decide, Unblock, Approve and Direct, grouped by project or type, with filters for person, type and project. Nav badges land on the first waiting item.
  • The hub opens on an all-projects view with All projects pinned first and an Actions count per project.
  • What's new shows every curated release since the account last saw one (up to three, a count for the rest), remembers that on the account, and links to the Discord.
  • PAPI users now have their own CRM, in the main nav, and every project owner has the Actions queue.
  • Settings has a connections gallery: one tile per AI tool with Connected, Not connected and Connect.
  • A member of a shared project can submit an idea from the board; it lands in Backlog, tagged with who reported it and assigned to them.
  • The task panel stage tabs and the Team stage counts look clickable, and Team's Built with shows the tool's logo.
  • The onboarding invite step now says everyone works on their own plan.
  • The mutation gate compares a client-computed workspace fingerprint with the project's stored root_commit_hash.
  • A remembered project confirmation is keyed by workspace fingerprint, so a second folder on the same key confirms separately.
  • Llms.txt matches the refusing workspace behaviour and documents workspace_fingerprint.
  • Strategy_review actively checks and updates the roadmap, including a project with an empty or stale one.
  • The roadmap now updates after a cycle completes.
  • Board_edit(status: "Done") no longer refuses with WORKFLOW_STATUS_REQUIRED.

v0.402.218

PAPI is now listed on BuiltByIndies

  • The BuiltByIndies badge now appears at the bottom of the homepage.
Full detail
  • The BuiltByIndies badge sits at the bottom of the getpapi.ai homepage footer, exactly as supplied, in the server-rendered HTML. Footer takes an optional bottom slot that only the homepage fills; no other page changes.

v0.402.217

Groundwork for the server-rendered Subprocessors page

  • A checklist now compares the new Subprocessors page with the current one, and a script checks that both it and a neighbouring page respond.
  • Signed-in users without a project are sent to the hub from the new About page, the same as on the current site.
Full detail
  • /subprocessors is ready to be served by the server-rendered web service: a parity checklist against the Next page, every response from the service carries x-papi-served-by: web, and scripts/verify-ssr-route.mjs <base-url> checks /subprocessors and an untouched Next page both return 200. Not enabled in production by this release: the service is started and routed separately, and the remaining parity differences are tracked as separate tasks.
  • /settings/about on the web service sends a signed-in user with no project to /hub (HX-Redirect for htmx requests, fails closed), and scripts/promote.sh checks that route's redirect after installing the Caddy routes.

v0.402.214

Planning a full cycle no longer fails on the hosted connection, and a first server-rendered page is ready

  • A new lightweight web service that serves pages as plain HTML with no JavaScript framework is built and tested; it is not switched on yet.
  • The same sign-in now works across the current dashboard and the new service, so a signed-in person can open Settings > About from either.
  • A plan for a normal seven-task cycle is now about half the size it was, because each task brief is written once instead of twice.
  • Confirming a plan no longer needs the whole plan sent again; the approved preview is enough.
Full detail
  • New server-rendered web service (packages/web, plain node:http, no build step) serves /subprocessors with no script on the page; htmx 2.0.11 vendored and pinned, committed hashed stylesheet with a freshness check, systemd unit and Caddy route file. Not enabled in production by this release: the service is started and routed separately.
  • One auth model across Next and the web service: lib/auth-core.ts (cookies in, identity out) is shared by proxy.ts and packages/web; the service serves /settings/about signed in, redirects signed-out requests to /login, ignores client-sent x-papi-* headers, refuses cross-origin writes, and refuses to start with SKIP_AUTH in production. Dev sign-in module exclusion deferred to #1850.
  • A 7-task plan now applies over the hosted connection in one pass: the planner no longer repeats every BUILD HANDOFF in Part 1, and the confirm call works with only preview_token (the previewed output is held server-side). Payload for a 7-task fixture: 82,943 bytes before, 42,869 after.

v0.402.212

A map of every test, and a clear message when a release has no test record

  • Every test file is now listed in one table with its phase, run time and importance, and a check keeps the table complete.
  • A release that has no recorded full test run now says exactly which record is missing and the one command that creates it.
  • The slow full test run now has a profile showing where the time goes; it is still too slow to finish on the shared test machine.
Full detail
  • Docs/operations/test-inventory.md lists every test file (1088) with phase, measured duration, flake history and class, generated by scripts/test-inventory-table.mjs from a named test:full log; check:test-inventory-table in the pr tier fails when a tracked test file has no row (membership only, never timings).
  • (partial) — scripts/test-cost-profile.mjs gives a rerunnable per-file cost profile for test:full with the CI and local baselines in docs/operations/test-gates.md; one fixture cut in session-message-context. test:full still exceeds the 1200 s cap on the CI runner.
  • (partial) — A release with no full-qualification record fails with the record name and the exact pre-qualify dispatch command (node scripts/full-qualification.mjs explain); record verification is unchanged. The 300 s qualify target is not yet demonstrated.

October 202611 releases

v0.402.211

No false error for contributors, and one test run per release

  • Contributors who open an action no longer see an error about account and contact choices; those fields are simply hidden when you cannot use them.
  • Releases now use one full test run recorded for the exact commit, instead of a full run on every merge.
  • The reason a release check once skipped a merged change is now written down with the evidence.
Full detail
  • A contributor opening an action from /needs-you no longer sees "Could not load account and contact choices": OwnerActionDrawer takes a crmAccess prop (same rule as /api/contacts: owner, active ops delegate, admin) and hides the Account and Contact fields, skips the picker request and leaves contact fields out of the save patch otherwise. The route gate is unchanged.
  • The full suite no longer runs on every merge to main; full-qualification.yml is manual-dispatch and release.yml reuses the papi-qual-<tree> record for the exact commit, or dispatches the workflow once and waits for it.
  • The cause of the Full qualification head mismatch on PR #1879 is documented with evidence in docs/operations/test-gates.md.

v0.402.209

Clearer errors when a review uses a short commit ID

  • Accepting a build now needs the full 40-character commit ID, and a short one is refused straight away with a clear message.
  • Releases that are blocked by a mismatched or missing commit now say exactly which task and why.
Full detail
  • Review_submit refuses a short or malformed reviewed_commit_sha on an accept before anything is written (single and per batch entry), compares it with the recorded build commit by exact 40-hex equality, and correct_commit_sha: true re-records the accept of a Done task with the full SHA (appended row, status unchanged). The release readiness error now names the exact cause of a missing exact-head acceptance.

v0.402.208

A current npm listing and the skills update

  • The npm page for the PAPI server now describes PAPI as working with any MCP client and points at the right links.
  • The skills package is updated for the first time in two weeks, with the new token-waste guards and OpenCode usage reporting.
Full detail
  • @papi-ai/server on npm: README rewritten for any MCP client (hosted install first, npx second), links point at getpapi/papi and getpapi.ai, the false "falls back to local file storage" claim is gone, and the package description no longer shows mojibake (—).
  • @papi-ai/skills 0.2.9: first publish since 0.2.8 (token-waste guard installer, OpenCode usage reporter). The server now depends on it.
  • Publish.yml gains a skills package option, because all re-tags unchanged packages and npm dist-tag add is not covered by OIDC.

v0.402.207

Fewer false stops in reviews, and steadier releases

  • Reviews of tasks that change no screens no longer ask you to confirm a visual check.
  • An interrupted release build no longer blocks the next one.
  • The check that runs after each merge now reports a real result instead of a silent pass.
Full detail
  • Review_submit and review_task decide whether a task is a UI change from its files (handoff and build report), not from words like "dashboard", so docs-only and scripts-only tasks no longer need a visual confirmation.
  • A cancelled VPS artifact build no longer blocks every later build: staging ownership is a sibling marker outside the stage, and an unmarked directory is still refused.
  • The post-merge Full qualification gate can read the merged PR (pull-requests: read) and fails on a lookup error instead of reporting a green skip with no record.
  • The cycle94 edge replay asserts quiescence only after every request it sent (including the other-tenant read) has finished.
  • The dashboard-integrity out-of-memory crash only happens on next dev in focused runs; the compiled gate is unaffected. Slow-file timings recorded, no safe speed-up found.
  • Docs/operations/test-gates.md records the 300 s decision: the target is withdrawn until the server-rendered migration; the local full gate floor is about 580 s.

v0.402.206

Faster checks behind the scenes for the people building PAPI

  • Nothing changes on your screen in this release. The work went into the checks that run before every update ships.
  • A routine version bump no longer reruns the whole test suite, so small fixes reach you sooner.
  • Hundreds of brittle tests now check what the product actually does, which makes future changes safer and quicker to ship.
Full detail
  • Test:changed no longer selects every test when only a workspace package version changes: lockfileAffectsTests also ignores version on workspace link entries (link: true), so a release metadata bump runs only what the diff can affect.
  • Product-code tests that read source files as text were replaced with behavioural tests, kept with a one-line (b) reason, or deleted (non-critical wiring and copy pins), following 's rule. lib/auth.ts exports extractBearerApiKey and validateApiKey for direct tests.
  • The VPS release artifact build prints one line per stage, and the read-only verify no longer lists the archive twice before the preflight repeats the same checks. Measured job: 276 s.
  • (partial, carried forward) — PAPI_TEST_DASHBOARD_HTTP_ONLY=1 runs start-up and then only the dashboard-http phase, for iteration; a passing partial run exits 3. The HTTP lanes stay off; the diagnosis is in docs/operations/test-gates.md.

v0.402.205

Shorter answers from PAPI, and a privacy fix on the dashboard

  • After your first change in a session, the note confirming which project you are writing to shrinks to one line, and the zoom-out review no longer returns 100,000+ characters at once.
  • The duplicate warning when you create a task on the dashboard no longer shows the titles of private tasks you cannot see.
  • A broken context-usage report works again, and the local test run now reports where its time goes.
Full detail
  • Shorter tool responses: a hosted connection shows the full "Project scope receipt" on its first mutation, and again when the project or verification state changes, then a one-line receipt that still names the project and says UNVERIFIED when it is. zoom_out prepare is capped at about 15,000 characters, with section and page requests for the rest.
  • GetContextUtilisation reads tool_call_metrics instead of the dropped v_context_utilisation view, so the Node data API no longer fails with 42P01.
  • The dashboard duplicate check on task creation runs as the caller, so its warning never shows the title of a task the caller cannot see.
  • The cycle94 edge proxy test checks each worker's final resource record in timestamp order instead of the last line of the joined logs.
  • The cycle97 deep-link browser test waits on rendered and recorded state instead of a network response race.
  • The local full gate prints per-phase and per-file timings with peak memory, measured with a monotonic clock. Parallel dashboard test lanes exist behind PAPI_TEST_HTTP_LANES (off by default).

v0.402.204

Groundwork for a faster hosted service, and one list of checks

  • The main server can now answer data requests itself, switched off until it has been proven against the current service.
  • Hosted tool calls can be routed straight to the database, also switched off for now, with a mode that compares both routes first.
  • Local checks and the online checks now run from one shared list, and a new script sets up a test machine in one step.
Full detail
  • Drop Deno 2/6 (partial): the Node server can serve the HTTP data API at /data-api behind PAPI_DATA_API_ENABLED (off by default), authorized by the shared module; the contract suite runs against it with npm run test:contract -- --node. The three project routes still answer 501, and the differences from the edge are listed in the contract test.
  • Remote MCP in-process data access (partial): PAPI_INPROCESS_READS, PAPI_INPROCESS_WRITES and PAPI_INPROCESS_SHADOW_READS (all off by default) let the hosted MCP call the data layer directly, with a shadow mode that compares both paths. Not enabled in production.
  • One gate manifest (scripts/gate-manifest.mjs) now drives both CI and ci:local, with a drift check that fails on any unlisted check.
  • Scripts/provision-test-host.sh sets up a Debian/Ubuntu or macOS test host from the test doctor's requirement list, with pinned, checksum-verified downloads and a dry run.

v0.402.203

Groundwork for a simpler server, and quicker answers when checks fail

  • The access rules that decide who can read and change a project now also exist in the main server's own code, checked case by case against the current service.
  • Every request the hosted service answers is now covered by one shared test of what it returns and what it refuses.
  • When a test machine is missing a tool, the checks stop within seconds and say what to install, and every update ends with a summary of where its time went.
Full detail
  • Drop Deno 1/6: the data-proxy authorization (credential checks, project resolution, roles, write gate, rate limit, CORS) is ported to Node TypeScript in packages/server/src/data-api/, with a 41-case allow/refuse matrix that matches the live edge in every case; not wired into production yet.
  • Drop Deno 3/6: one contract suite (npm run test:contract) runs a success and a refusal case for every HOSTED_SERVED method, with a comparator for running the same requests against a second data API.
  • Research: every CI, local and release gate audited for what it checks, how long it takes and its last real catch (docs/research/ci-release-gate-audit-findings.md).
  • npm run test:doctor lists every tool the test gate needs, and test:full and ci:local stop in seconds, naming the missing tool and its install command.
  • Tooling tests that only matched source text are cut or replaced by tests that run the real scripts; release-critical guards stay.
  • Every VPS install, dry runs included, ends with one timing table of each phase and check and the three slowest steps.

v0.402.202

The queue is now called Actions, and your whole team can see it

  • "Needs you" is now "Actions" everywhere, and every member of a project can see and complete its actions, not only the owner.
  • Builds report which AI model and client did the work, warn when it is missing, and show how often it is recorded for your project.
  • Admin pages show a plain not-available page instead of raw text, and a UI change now needs a person's visual check before it is accepted.
Full detail
  • "Needs you" is now "Actions" across the hub tab, sidebar, page title, empty states, MCP copy and docs; the /needs-you route is unchanged.
  • The project action queue is readable by every member of the project (query project_actions), not only the owner; MCP copy and docs say project action.
  • A new project_action tool completes a project action over MCP, guarded by project membership.
  • Guard hits are logged locally, reported as guard_counts on build completion (new build_reports.guard_counts column), and trended in strategy_review.
  • Hosted builds get a numbered step to write the file-scope marker at start and to clear it at completion, and the build report lists files changed outside the handoff.
  • Build completion shows the project's model and agent coverage, and stores an explicit unknown model when the client does not report one.
  • Build completion warns when the agent is missing; the build template requires agent and model.
  • Review_task adds a design-canon checklist for UI tasks, and a UI accept needs visual_confirmed (per entry in a batch).
  • The usage reporter reads OpenCode token usage; Codex stays Not recorded until a real transcript is verified.
  • The install pages offer the one-command plugin install for Claude Code 2.1.292 and later, and keep the two-line form.
  • Caddy validate no longer leaves root-owned log files that break the next reload.
  • Dev project pages no longer 404 with OWNER_USER_ID set (dev-only, SKIP_AUTH).
  • Browser navigations to owner and admin pages get a not-available page instead of raw JSON.
  • A test pins the dev origin allowlist derived from NEXT_PUBLIC_APP_URL.
  • A test pins the marketing opt-out in the broadcast send path.
  • Refreshed papi-auto vs Hamster gap list.
  • Plugin-free attribution check recorded as not verified.

v0.402.200

Updates recover on their own and reach the server faster

  • An update that failed halfway can simply be run again, even after newer changes were merged.
  • Updates are sent to the server more directly and are about 15% smaller, so they arrive faster and more predictably.
  • The plan to replace the JavaScript frontend with simple server-rendered pages is written up and agreed.
Full detail
  • Release install hardening: a tagged-but-not-live release can be recovered after main moves (rerun from the tagged commit, every proof unchanged, recorded once); the live commit and a fresh activation receipt are checked before the release is recorded; remote activation has its own bound; the artifact download has a total deadline and reports HTTP status and body without retrying 4xx; cancelled or failed CI attempts refuse merged-PR evidence; the artifact workflow uses least-privilege job permissions (fixing the push-gate 403) and no longer rebuilds an already-dispatched commit.
  • The install machine downloads, verifies and uploads the release artifact to the VPS, with the VPS-side GitHub download as a bounded fallback; the transfer receipt records the path used; the artifact is compressed with gzip -6 (239 MB to 205 MB).
  • Research for replacing the Next.js frontend with server-rendered HTML plus HTMX (docs/research/ssr-htmx-migration-findings.md), with Alexander Brandt's decisions recorded.

v0.402.199

Releases go live sooner and recover cleanly from a slow download

  • The release package starts building as soon as a checked change is merged, instead of waiting for a second round of checks.
  • A slow download to the server no longer cuts off an update; it has its own time limit and one retry.
  • A version is only shown as released once it is actually live, and a failed update can simply be run again.
Full detail
  • The VPS downloads and checksum-verifies the release artifact in its own bounded step (per-attempt and total limits, at most two attempts, partial files removed) before activation, which keeps its unchanged 240 s limit; the timing receipt records download time, bytes and attempts.
  • A release is recorded in PAPI only after the VPS activation and live check pass: the version tag is pushed first in a tag-only step, and a failed activation leaves the cycle open for a retry that reconciles exactly once.
  • When a merged PR's tree is identical to main and its CI passed, the release artifact build starts right after the merge and the release's CI check accepts that PR CI instead of waiting for CI on main; CI on main still runs.