Changelog
299releases tagged feature
Every PAPI release carrying the feature tag. What shipped, when.
Get started freeJune 20263 releases
- Cycle 282 — README demo + rewrite
- Tag capturing project_id on idea-captured actions
- Cycle 282 — Owner: Owner Action Queue v2 (delegation + richer schema + nudge)
- Move Decisions section labels outside video frame
- Wire real iframe support via /cockpit-embed/* routes
- Full redesign across 8 sections
- Cycle 279 — mcp-server: + 1989 + 1996 [LEAVE IN REVIEW, partial]
- Cycle 279 — distribution-and-packaging: + 1986 + 1982 [LEAVE IN REVIEW]
- Add 'Your code stays on your machine' reassurance copy
- Extract hub state machine to lib/hub-state.ts
- Adopt 'project drift' as canonical positioning term
- Add tsc --noEmit -p packages/server to CI + fix 15 type errors
- Production reachability monitoring — hourly probes, cert-expiry, admin panel, /status
- Deploy-verification contract + completeness-audit CI gate
- Origin allow-list + rate-limit consolidation
- Mobile-grade /hub — condensed layer + RightPanel takeover
May 202615 releases
- @rygel has signed the CLA in cathalos92/papi-ui#895
- Merge shared cycle branch — mcp-server
- Stale-deploy guard — assert /mcp 401 carries WWW-Authenticate
- Consolidate desktop + mobile nav into single source of truth
- Merge shared cycle branch — core
- Add fal.ai cost fetcher stub + provider audit badge
- Per-user project-limit override
- Cycle 276 — Admin burn dashboard (fetchers, page, charts, alerts, tests)
- Sortable user table, activation time windows, daily signup digest cron
- Cycle 275 — Dashboard: SR numbering SSOT + dead-code removal
- CONTRIBUTING.md + local dev quickstart + .nvmrc (Node 20)
- Document BYOK model publicly — FAQ + install guide + landing copy explaining "PAPI never spends your LLM tokens"
- Cross-project config audit CLI (npx @papi-ai/server audit)
- Cycle 274 — Core: planner grounding, prompt dedup, quality rubric, degradation + coherence guards
- Build-in-public OBS overlay + live-data hook
- Build_execute auto-commit no longer silently drops new untracked files
- Resolve WWW-Authenticate-missing P0 — Railway was deploying stale cycle-224 branch
- Exclude remotion/ from root tsconfig so local vercel --prod typechecks
- Promote OAuth as primary install path + auto-default project ID
- C273 security: AD-27 fail-closed + admin client centralization + API surface hardening
- Pin owner project resolution to PAPI_PROJECT_ID (stop wrong-project drift)
- Toolkit surface — per-project harness inventory
- C272 server: sub-agent dispatch + agent_list + harness inventory producer
- Install-snippets default URL expects mcp.getpapi.ai, not Railway
- Exclude bundled @papi-ai/skills payloads from ESLint
- Background doc-gardener for docs/INDEX.md
- CLAUDE.md/AGENTS.md size-enforcement hook
- Two-layer CLAUDE/AGENTS harness for Codex/Cursor/Devin
- Ship papi-cycle AGENTS.md bundle as canonical harness
- @papi-ai/skills single source of truth
- Merge shared cycle branch — server
- Merge shared cycle branch — platform
- Merge shared cycle branch — core
- URL source-of-truth + build-time validation
- Creating file for storing CLA Signatures
- Hosted MCP HTTP transport restored — mcp.getpapi.ai live
- Security(c269): quick fixes from security audit + cadence hook
- Cycle 269 — Server batch (6 tasks) + docs reconcile
- Skills export spike — AGENTS.md + per-phase SKILL.md bundle
- Clarify DATABASE_URL guidance — session pooler (5432) not transaction pooler
- Cap fan-out concurrency to prevent pool saturation
- Bespoke OG image for /manifesto
- Migrate HubFrontDoor to useAuthUser canonical hook
- Surface auto-unblock candidates in orient
- Publish PAPI estimation-accuracy benchmark page
- Auto-resolve pending doc-registry actions on task acceptance
- Foundational project context doc enforced across every PAPI tool
- Merge shared cycle branch — marketing
- Friction-promote skill + post-release hook
- File-scope-guard hook + retire manual-cycle-SQL note
- Owner Pre-Flight Activation Polish
- Bypass cookie auth for /api/cron/* paths in proxy
- Post-OAuth Activation Rollout — 7 tasks
- Merge shared cycle branch — gtm
- Pin OAuth metadata issuer to NEXT_PUBLIC_APP_URL not VERCEL_URL
- Drop .js extension from oauth-tokens import for Next.js turbopack
- Wire OAuth 2.1 server + DCR + Railway 401 + UI copy
- OAuth flow for remote MCP — user pastes one URL, no token handling
- C263: Remote MCP production — multi-tenant HTTP transport
- Install friction sequencing — 5 tasks