InstallGuideHandbookToolsChangelog

Changelog

388releases across 7 months

Every PAPI release, cycle by cycle. Each one pushes back against project drift.

Get started free
allfeaturefixperformance

August 202618 releases

v0.377.0

  • Dashboard effectiveness totals return undefined
  • Reconcile FAQ guidance with hosted and self-hosted deployment paths

v0.376.0

  • Remove stale Railway references from active deployment surfaces
  • Require prior-version identity verification for plugin rollback

v0.375.0

  • Automate the private plugin distribution release gate
  • Add redacted receipts for disposable-project CRUD qualification

v0.374.0

  • Make focused test execution portable across Windows and WSL
  • Verify PAPI task CRUD in a disposable clean-session project

v0.373.0

  • Prepare the PAPI MCP for Codex marketplace distribution
  • Test-naming convention: security/isolation tests named after the invariant they protect

v0.372.0

  • Audit and remove obsolete Railway and Vercel references after self-hosted cutover
  • Test gate tiers and duration receipts

v0.371.0

  • Implement privacy-safe per-user rate-limit event telemetry and investigation queries.
  • Investigate the current Caddy version and plan a safe upgrade to the latest supported release.
  • Make VPS promotion automatically use the configured PAPI Node 24 runtime.

v0.370.0

  • Correct swap-pressure detection, severity, and alert delivery.
  • Restore per-failure webhook delivery while preserving recovery notifications.

v0.369.1

  • Align package-lock.json with the Anthropic SDK version declared by main, restoring clean npm ci installs for VPS promotion.

v0.369.0

fix
  • Authenticate logical operation proofs
  • Propagate logical rate-limit operations across proxy routes

v0.368.0

featurefix

The cycle that made your work publishable, and hosted releases finish themselves

  • Public sharing goes live. Publish your brief and cycles from the dashboard with consent-gated toggles.
  • Hosted releases now end with exact git steps to finish locally, not vague prose.
  • Cycle updates can point at your own team Discord channel instead of a private one.
  • Fixed color tokens that could render without fallbacks on dashboard surfaces.
Full detail
  • Merge shared cycle branch — core
  • Cycle 365: public surfaces, sharing toggles, and the dead-Supabase cleanup
  • Rate-limit logical PAPI operations
  • Bind Vibe route to approved artifact
  • Add Vibe Tycoon project route

v0.362.0

featurefix

The cycle that made starting a session fast again, and stopped hosted projects hitting dead ends

  • Opening a session is fast again. The first read of your project used to pull the whole board five times over and could time out; it now takes a single pass.
  • Hosted projects no longer hit dead ends on features that work locally. PAPI asks your connection what it genuinely supports instead of guessing.
  • Settings has one Connections tab: your tools, endpoint, keys, linked repo and connection health in one place, with a live status dot in the header.
  • Coming back after time away, PAPI tells you how long you have been gone and names the work waiting for you instead of showing an id.
Full detail
  • Collapse orient's 5 full-board pulls to 1 compact read
  • Build C9 and C13 — the tour is reachable again, and the demo that already existed is now pointed at
  • Rebuild light mode — close the token island, fix the toggle, invert the canon's default
  • Hub restyle round 2 — density, colour reduction, one stage map, no ambient pulse, ledger surfaced
  • Re-entry — say how long they were away, and name the work not its id
  • Connections as one surface — client, endpoint, keys, repo and health
  • Detect orphaned components in ci:local
  • Per-user release notes, rendered from the cycle log
  • Empty and error states name the next action instead of apologising
  • Close the dead data paths — 9 routes, 6 endpoints, 1 table
  • Mount HubMomentumStrip — the lifetime stats had no reader
  • Stop review_submit rolling back an accept whose branch was folded into a cycle branch
  • Stop /api/actions/* returning raw error text, and start logging it
  • Claim the device-flow API key atomically instead of read-then-write
  • Apply the Origin allow-list to /auth/collision and /oauth/revoke-all
  • LPAD truncation made br-/rv- allocation deterministically collide past 999
  • UX-O · Perceived performance — consistent skeletons, optimistic board updates, kill the 30s cache surprise
  • Br- and rv- display_id allocation is read-then-insert, and edge writeReview orders rv-NN lexicographically
  • A migration exists on production that is on no branch in this repo — reconcile or capture it
  • Assignee_id/reviewer_id on task update are not validated against project membership
  • EnsureDocDurable reports a false "NOT durable" for a doc committed on a different branch
  • Make PapiAdapter non-optional — kill the 45 capability-sniff sites that fork behaviour between owner and paying customers
  • Weekly Active Builders cannot be computed from tool_runs — re-key it on build_reports and move the bucketing into @papi-ai/shared
  • ClassifyIcp defaults every unrecognised signup to 'dev' — classify on positive signal, add an 'unknown' bucket

v0.361.0

featurefix
  • Record GOTRUE_DISABLE_SIGNUP=true as config-as-code for the VPS
  • Strip the run-setup card to the command and one signal
  • Collapse onboarding to four steps, referral moves after setup
  • Widen the connect step, cut the chatty copy, split the manual path
  • Actually compress the hub fold, and clear the board chrome
  • Connect step becomes a 2-stepper, and stops narrating
  • Invert the hub fold — the next move becomes the hero
  • Bulk task actions on the board
  • Connect panel: "This is your project / this is your prompt" — project id + connection token first-class under the copy block, one auth story
  • MCPConnectBanner: name setup as the pre-setup next step and poll so it clears without navigation
  • Build_execute reports a successful auto-commit over a PARTIAL commit when the pre-commit hook fails
  • Stop the autostash sweeping a concurrent session's tracked-dirty files
  • Stop the auto-stash eating untracked work, and the review dispatch showing the wrong task's diff
  • Worktree ci:local blocked by Turbopack node_modules symlink-boundary check
  • Worktree:setup accepts a stray/broken node_modules dir instead of symlinking
  • Close two injection gaps found in pre-merge review
  • A build can propose a Decision or a Convention
  • Conventions — per-project build rules that ride every handoff
  • Pair the AD rejection guard with an admission rule
  • Tool descriptions sell the what/why at selection time
  • Orient's missing-.papi/ error is a Promise.all race — an unset-up user gets an arbitrary one of three "not found" messages
  • Secret-filter client-supplied codebase_scan server-side + make hosted "no filesystem scan" messaging match what the agent is then asked to read
  • Setup AD-seed failure handling misblames the LLM: any error reported as "invalid JSON", partial seeds reported as zero
  • Fix stale .impeccable.md pointer in planner prompts — it directs every external user to a file the skill stopped reading
  • Verify-project.test.ts's INTERNAL_IDENTIFIER regex is narrower than its own comment claims — hardcodes 2 tables, only catches 3-digit cycle refs
  • Hosted 403 minting Active Decisions: add allocateActiveDecision + applyActiveDecisionUpdates to proxy-adapter NO_FORWARD
  • Clear the two gates that were red on main

v0.360.0

feature

The cycle that put a second lock on your private work, and proved the first one was the only one holding

  • Your private tasks and docs are now protected by the database itself, not just the app - a second lock behind the first.
  • Project settings pages work again, reachable straight from each project card.
  • Your personal queue is now "Needs You", and the nav says Admin where it used to say Owner.
  • Creating tasks no longer fails on bigger projects.
Full detail
  • Landing V2: simplify the explanation
  • Copy the production database to the VPS for self-host testing
  • Give ADMIN_USER_IDS holders a nav, not just a URL
  • Stop leaking internal identifiers into first-run user copy
  • C360 Core — display_id atomicity, escaped-defect linkage, executable acceptance, adapter-md split

v0.359.0

featurefix
  • Stop the exit-criteria evaluators crashing on a missing project id
  • Rebuild HubSkeleton out of the hub's own classes, measured to zero jump
  • Give the connect step an in-flight state, and finish 3236's sweep
  • Make the hub command an inset value, and put the rule in canon
  • UX-B12 Surface owner actions to non-owner users
  • Make the agent-directed band the one primary action on connect
  • Take the OAuth browser hop off the critical install path
  • Hosted setup merges mcp__papi__* into an existing settings.json
  • Stop the hosted manifest depending on the server's own filesystem
  • Mark the OAuth sign-in as human-only at the command, not 12 lines upstream
  • Sync the shipped skill bundle and the plugin version after the C359 merges
  • Resolve project slugs per-user, and stop one null telemetry row killing /admin
  • One unattributed telemetry row no longer takes down the whole admin page
  • Resolve project slugs per-user, and stop asking for a singular row
  • Stop handing a GitHub token to an npm namesquat
  • Content section — build-in-public drafts per release and review
  • Wire the dead attention panel, cut the duplicate roadsigns, collapse the caught fold
  • AD contradiction surfaces as a decision, never a silent shelve
  • UX-B1 Invite button in the Hub → Team empty state

v0.358.1

fix
  • Scope dashboard slug lookup to accessible projects
  • Cycle 358: integrated release — core, auth, distribution, dashboard
  • Cross-tenant read on horizons/stages, and the unwrapped hosted adapter
  • Close the three auth/data gaps held back from the P2 sweep
  • Give warning its own hue and clear the held contrast failures
  • 26 live P2 defects recovered from the auto-cleared ledger
  • Md_adapter_pings policy named service_role applied to PUBLIC
  • Make burn-watch blindness visible instead of silent
  • Sweep the live defects hiding in auto-cleared discovered-issues
  • Normalise created_at to ISO in the pg adapter
  • Close two ci:local gate failures surfaced by the sweep
  • Sweep 36 live discovered-issues found by full ledger triage

v0.358.0

featurefix
  • Make VPS deployment atomic and rollback-safe
  • Bypass hosted project quotas

v0.357.0

fix

Hosted builds and task claims stop crashing, and the dashboard shows what's actually fixed

  • Claiming or releasing a task no longer fails when connecting through the hosted server.
  • A build no longer crashes partway through completing when connecting via npx.
  • The dashboard's caught-issues view now shows what's actually been fixed, with a found-vs-fixed count for the cycle and all time.
  • Time Machine chart labels no longer overlap or get clipped, at any screen size.
Full detail
  • Cycle 357: Core module
  • Width-aware Time Machine X axis so dates never squash
  • Two live hosted P0s — claimTask/unclaimTask ReferenceError, commit* methods 403ing
  • Cycle 357: Dashboard module
  • The migration gate's 3-state branch was unreachable under bash -e
  • Flag discoveries a shipped task fixed in passing
  • Prompt and validator agree on the handoff shape again
  • Estimation calibration is computed, and hosted users stop being sent to a file they lack
  • Refuse to retag when the local build differs from the published tarball
  • Two gates stop reporting green having checked nothing
  • Pre-commit no longer destroys unstaged work