@lumoai/cli 1.22.0 → 1.23.0

package/assets/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lumo
-description: 'Use the Lumo CLI to load task context, manage session bindings, and run tasks / projects / milestones / sprints / docs / memory from the terminal. Activate when: the user mentions a Lumo task identifier (LUM-42 etc.), asks to load task background/context, wants to bind/check/detach a Claude Code session''s task, is about to start work on a task, or wants to create/update/list/show/comment on tasks, projects, milestones, sprints, documents, artifacts, Figma links, or memory. Triggers on: "LUM-", "task context", "load context", "session start", "session attach", "session status", "session detach", "which task", "what task am I on", "work on LUM", "session wrap", "wrap up session", "进度评论", "卡住检测", "fragment usage vote", "mark used fragments", "which fragments did I use", "--used", "上下文使用投票", "标记用过的记忆", "create task", "new task", "file a task", "list tasks", "my tasks", "show task", "view task", "comment on task", "update task", "change task status", "rename task", "reassign task", "mark task as done", "lumo next", "next task", "what should I work on", "推荐下一个任务", "list projects", "what projects", "milestone", "里程碑", "list/create/update/delete/show milestone", "set milestone", "attach/unbind milestone", "tasks in milestone", "search milestones", "find milestone", "milestone health", "at-risk", "overdue", "archive/unarchive milestone", "归档里程碑", "milestone summary", "里程碑复盘", "reorder/move milestone", "排序里程碑", "milestone add/remove", "挂任务到里程碑", "auth login", "log in", "logout", "sign out", "switch account", "whoami", "who am I", "current workspace", "登录", "切换账号", "create/update/list/show/delete doc", "write doc", "写文档", "新建文档", "修改文档", "查看文档", "bind/unbind doc", "把文档关联到任务", "doc scope", "personal/workspace doc", "tag", "add/remove tag", "标签", "share/unshare doc", "分享文档", "doc share-list", "viewer/editor/manager", "doc tree", "doc move", "move/reparent doc", "移动文档", "sprint", "冲刺", "迭代", "create/list/show/update/delete sprint", "start/close sprint", "开始/关闭冲刺", "add to sprint", "active sprints", "sprint summary", "冲刺总结", "把任务挂到冲刺", "sprint health", "sprint risk", "is this sprint at risk", "冲刺风险", "冲刺健康度", "sprint blockers", "冲刺阻塞", "lumo update", "upgrade lumo", "升级 lumo", "new lumo version", "lumo setup", "install lumo skill/hooks", "wire up lumo", "set up lumo", "安装 lumo", "配置 lumo", "task artifact", "artifact add/list/show/update/rm", "spec artifact", "record/attach spec", "attach plan", "记录 spec", "查看 artifact", figma, attach figma, figma link, 关联 figma, 设计稿, figma design, "memory", "记忆", "remember", "record a memory", "记一条", "promote memory", "promote to project", "沉淀", "task/project memory", "retrieval", "取全文", "拉全文", "task slack show", "看 thread", "show slack thread", "task web show", "web 正文", "task figma context", "figma metadata", "task comments list", "list comments", "看评论", "task pr show", "查看 PR", "show pr", "PR 详情", "import google doc", "sync google doc", "google drive", "doc import-gdoc", "doc sync", "导入/同步 google 文档", "mark blocked", "blocked tag", "标记 blocked", "stuck", "repeatedly failing", "worktree", "git worktree", "并行 worktree", "scaffold worktree", "新建 worktree", "node_modules 软链", "worktree 隔离", "lumo worktree add/rm/list", "task criteria", "criteria set", "criteria list", "acceptance criteria", "验收标准", "验收合约", "draft criteria", "草拟验收", "definition of done", "task lineage", "lineage", "causal trail", "审计", "因果链", "成本归因", "trace context", "--signal", "usage signal health", "auto usage audit", "自动使用审计", "signal-health".'
+description: 'Use the Lumo CLI to load task context, manage session bindings, and run tasks / projects / milestones / sprints / docs / memory from the terminal. Activate when: the user mentions a Lumo task identifier (LUM-42 etc.), asks to load task background/context, wants to bind/check/detach a Claude Code session''s task, is about to start work on a task, or wants to create/update/list/show/comment on tasks, projects, milestones, sprints, documents, artifacts, Figma links, or memory. Triggers on: "LUM-", "task context", "load context", "session start", "session attach", "session status", "session detach", "which task", "what task am I on", "work on LUM", "session wrap", "wrap up session", "进度评论", "卡住检测", "fragment usage vote", "mark used fragments", "which fragments did I use", "--used", "上下文使用投票", "标记用过的记忆", "create task", "new task", "file a task", "list tasks", "my tasks", "show task", "view task", "comment on task", "update task", "change task status", "rename task", "reassign task", "mark task as done", "lumo next", "next task", "what should I work on", "推荐下一个任务", "list projects", "what projects", "milestone", "里程碑", "list/create/update/delete/show milestone", "set milestone", "attach/unbind milestone", "tasks in milestone", "search milestones", "find milestone", "milestone health", "at-risk", "overdue", "archive/unarchive milestone", "归档里程碑", "milestone summary", "里程碑复盘", "reorder/move milestone", "排序里程碑", "milestone add/remove", "挂任务到里程碑", "auth login", "log in", "logout", "sign out", "switch account", "whoami", "who am I", "current workspace", "登录", "切换账号", "create/update/list/show/delete doc", "write doc", "写文档", "新建文档", "修改文档", "查看文档", "bind/unbind doc", "把文档关联到任务", "doc scope", "personal/workspace doc", "tag", "add/remove tag", "标签", "share/unshare doc", "分享文档", "doc share-list", "viewer/editor/manager", "doc tree", "doc move", "move/reparent doc", "移动文档", "sprint", "冲刺", "迭代", "create/list/show/update/delete sprint", "start/close sprint", "开始/关闭冲刺", "add to sprint", "active sprints", "sprint summary", "冲刺总结", "把任务挂到冲刺", "sprint health", "sprint risk", "is this sprint at risk", "冲刺风险", "冲刺健康度", "sprint blockers", "冲刺阻塞", "lumo update", "upgrade lumo", "升级 lumo", "new lumo version", "lumo setup", "install lumo skill/hooks", "wire up lumo", "set up lumo", "安装 lumo", "配置 lumo", "task artifact", "artifact add/list/show/update/rm", "spec artifact", "record/attach spec", "attach plan", "记录 spec", "查看 artifact", figma, attach figma, figma link, 关联 figma, 设计稿, figma design, "memory", "记忆", "remember", "record a memory", "记一条", "promote memory", "promote to project", "沉淀", "task/project memory", "retrieval", "取全文", "拉全文", "task slack show", "看 thread", "show slack thread", "task web show", "web 正文", "task figma context", "figma metadata", "task comments list", "list comments", "看评论", "task pr show", "查看 PR", "show pr", "PR 详情", "task deps", "dependency", "dependencies", "依赖", "依赖边", "blocked by", "blocker", "confirm dependency", "dismiss dependency", "确认依赖", "忽略依赖", "import google doc", "sync google doc", "google drive", "doc import-gdoc", "doc sync", "导入/同步 google 文档", "mark blocked", "blocked tag", "标记 blocked", "stuck", "repeatedly failing", "worktree", "git worktree", "并行 worktree", "scaffold worktree", "新建 worktree", "node_modules 软链", "worktree 隔离", "lumo worktree add/rm/list", "task criteria", "criteria set", "criteria list", "acceptance criteria", "验收标准", "验收合约", "draft criteria", "草拟验收", "definition of done", "task lineage", "lineage", "causal trail", "审计", "因果链", "成本归因", "trace context", "--signal", "usage signal health", "auto usage audit", "自动使用审计", "signal-health".'
 ---
 
 ## Prerequisites
@@ -61,6 +61,15 @@ The command catalog below is a **map**: it lists every command grouped by domain
 - `lumo task show <id>` — print one task's detail
 - `lumo task comment <id> <body>` — leave a comment
 
+**Task dependencies**
+
+- `lumo task deps list <id>` — list dependency edges in both directions, grouped CONFIRMED / SUGGESTED(待确认) / DISMISSED; each row shows a short edge id `[xxxxxxxx]`, the other task, and detected evidence (`shared_files(N 个共享文件: …)` / `task_mention(…)`); SUGGESTED rows include a copy-pasteable confirm hint
+- `lumo task deps add <id> --blocked-by <LUM-N>` — declare a manual hard dependency (created CONFIRMED, source MANUAL; if a SUGGESTED/DISMISSED edge already exists in the same direction, it is confirmed in place rather than creating a new row)
+- `lumo task deps confirm <id> <edge> [--reverse]` — confirm a detected candidate; `<edge>` is a short edge-id prefix (≥6 chars) or the other task's identifier (case-insensitive); `--reverse` flips the direction when the detector guessed it backwards
+- `lumo task deps dismiss <id> <edge>` — dismiss a candidate (never re-suggested)
+- `lumo task deps rm <id> <edge> --yes` — delete an edge (refuses without `--yes`)
+- On an ambiguous/unknown `<edge>` selector the CLI prints all candidates with short ids and exits 1 — retry with one of them
+
 **Acceptance criteria（验收合约）** — see [criteria.md](references/criteria.md)
 
 - `lumo task criteria set <task> --file <criteria.json> [--human]` — submit the whole contract: default = initial agent draft (AGENT_DRAFT, locked once submitted); `--human` = a HUMAN_EDIT revision transcribed from the conversation (desired final list; items with `id` keep/update, missing ones are deleted)

package/assets/skill/references/sessions.md

@@ -35,6 +35,46 @@ When the session is bound, session-start may inject a **"🆕 待核对：上次
 
 Attribution requires the CC session id to reach the server: `lumo task update <id> --status done` automatically sends `CLAUDE_CODE_SESSION_ID` (via an `X-Lumo-Session-Id` header) so the resulting Layer 2 memories are attributed to the session. Marking a task done from the **web UI** leaves them unattributed (they won't surface for review) — that's expected.
 
+### Blocker alert injected at `session attach` / session-start
+
+When the bound task has live blockers or SUGGESTED dependency candidates, the attach output and session-start hook context inject a dependency warning block. The warning is built by `buildBlockerWarningSectionForTask` and is **omitted entirely** (empty string) when nothing is actionable — no output appears when there are no live blockers and no SUGGESTED candidates.
+
+**Trigger conditions (OR — either or both may appear):**
+1. At least one CONFIRMED "blocked by" edge where the blocking task's status is not DONE.
+2. At least one SUGGESTED (unconfirmed) dependency candidate on the task.
+
+**Output form A — live blockers exist (with or without SUGGESTED candidates):**
+
+Starts with the `## ⚠ 依赖告警` header, followed by one line per live blocker, then the advice line. If there are also SUGGESTED candidates the candidate-hint line is appended after the advice line.
+
+```
+## ⚠ 依赖告警
+
+- 本任务被 LUM-9「Fix auth token expiry」阻塞(状态 IN_PROGRESS)。
+- 本任务被 LUM-15「Upgrade Postgres driver」阻塞(状态 IN_REVIEW,PR #42 未 merge)。
+
+建议先等 blocker 合并再开工,避免白跑 run;如边已过时,用 `lumo task deps rm/dismiss` 清理。
+检测到 3 条候选依赖待确认:运行 `lumo task deps list LUM-42`。
+```
+
+**Output form B — NO live blockers, but SUGGESTED candidates exist:**
+
+Output is **only** the hint line — no `## ⚠ 依赖告警` header, no advice line. Design rationale: 纯候选是提示不是告警,不戴 ⚠ 头,避免稀释真告警。
+
+```
+检测到 3 条候选依赖待确认:运行 `lumo task deps list LUM-42`。
+```
+
+- Each blocker line shows: identifier, title, current status. If the blocking task has an open pull request, a `,PR #N` note is appended (no space after the comma) — `,PR #N (draft) 未 merge` for draft PRs.
+- The guidance line ("建议先等 blocker 合并…") appears only when there is at least one live blocker (form A).
+- The function never throws — if it fails it silently returns an empty string, leaving the session start unaffected.
+
+**Agent guidance — watch for EITHER the `## ⚠ 依赖告警` header (form A) OR the standalone hint line (form B):**
+- **Form A — live blockers:** Evaluate whether to wait. If the blocking task's work overlaps with yours (same files, same API surface), starting immediately risks rework. Read the blocker's status and open PR note before deciding.
+- **Stale or wrong edge?** Run `lumo task deps list <LUM-N>` to inspect the full edge list, then `lumo task deps rm <LUM-N> <edge> --yes` (if manually added and now obsolete) or `lumo task deps dismiss <LUM-N> <edge>` (if a false positive from detection).
+- **Candidate hint present (form A or B)?** Run `lumo task deps list <LUM-N>` and review each SUGGESTED edge — confirm real ones, dismiss false positives. Leaving SUGGESTED edges unreviewed means repeated hints every session.
+- Do **not** blindly start work on a task whose live blocker is still IN_PROGRESS or IN_REVIEW unless the user explicitly decides to proceed in parallel.
+
 ### `lumo session attach <identifier>` — bind the current session to a task
 
 Use this whenever the user mentions a task ID. The command is the only way to bind a session to a task.

package/assets/skill/references/tasks.md

@@ -203,3 +203,133 @@ lumo task comment LUM-42 "Reproduced the redirect bug on staging — Safari only
 ```
 
 The CLI does not support @-mention chip syntax. If the user wants to ping someone, they should comment from the web UI.
+
+---
+
+## Task Dependencies (`lumo task deps …`)
+
+### `lumo task deps list <LUM-N>` — show all dependency edges
+
+Prints the task's dependency edges grouped into three sections: **CONFIRMED**, **SUGGESTED(待确认)**, and **DISMISSED**. Each row includes a short 8-character edge id in square brackets, the direction (`blocked by` / `blocks`), the other task's identifier and title, the other task's current status, the source (`MANUAL` or `DETECTED`), and inline evidence for detected edges.
+
+```bash
+lumo task deps list LUM-42
+```
+
+Example output:
+
+```
+Dependencies for LUM-42 (3)
+
+CONFIRMED
+  [a1b2c3d4] blocked by LUM-9「Fix auth token expiry」 IN_PROGRESS · MANUAL
+
+SUGGESTED(待确认)
+  [e5f6a7b8] blocks LUM-55「Migrate DB schema」 TODO · shared_files(4 个共享文件: src/db/schema.ts, src/db/migrate.ts, ...)
+      确认: lumo task deps confirm LUM-42 e5f6a7b8(方向反了加 --reverse;误报: dismiss)
+  [c9d0e1f2] blocked by LUM-38「Add OAuth scopes」 IN_REVIEW · task_mention(description)
+      确认: lumo task deps confirm LUM-42 c9d0e1f2(方向反了加 --reverse;误报: dismiss)
+
+DISMISSED
+  [b3c4d5e6] blocks LUM-12 · 已忽略
+```
+
+CONFIRMED and SUGGESTED rows show the other task's identifier, title, current status, and source/evidence. DISMISSED rows render as `[shortId] <direction> <identifier> · 已忽略` only — no title, status, or source.
+
+When there are no edges at all the output is:
+```
+Dependencies for LUM-42: 无依赖边。
+```
+
+**Evidence fields by detection signal:**
+- `shared_files` — `shared_files(N 个共享文件: path1, path2, …)` — number of shared write-touched files in the 14-day window, plus up to 5 sample paths.
+- `task_mention` — `task_mention(description)` or `task_mention(comment)` — the surface where the mention appeared.
+
+CONFIRMED rows also show `source`: `MANUAL` (user-declared via `deps add`) or `DETECTED` (auto-found then confirmed via `deps confirm`).
+
+### `lumo task deps add <LUM-N> --blocked-by <LUM-M>` — declare a manual hard dependency
+
+Asserts that LUM-N is blocked by LUM-M. The edge is created as CONFIRMED + MANUAL, meaning it is immediately in effect (no confirmation step required).
+
+```bash
+lumo task deps add LUM-42 --blocked-by LUM-9
+```
+
+Both `<LUM-N>` and `--blocked-by` are required. The command errors on usage if either is missing.
+
+**Service semantics (read before using):**
+- **Self-edge** → 400 ("A task cannot depend on itself").
+- **CONFIRMED edge in the same direction already exists** → 409 ("Dependency already exists").
+- **CONFIRMED edge in the reverse direction already exists** → the cycle guard fires and returns 409 ("Dependency would create a cycle").
+- **Pair has a SUGGESTED or DISMISSED edge** in the same direction → `add` confirms it in place, preserving the original DETECTED source (so the edge transitions to CONFIRMED while keeping its auto-detected provenance). No new row is created.
+- **Cycle guard** — the service runs a DFS over all CONFIRMED BLOCKS edges in the workspace before writing. If adding the edge would create a cycle → 409 ("Dependency would create a cycle").
+
+### `lumo task deps confirm <LUM-N> <edge> [--reverse]` — confirm a detected candidate
+
+Promotes a SUGGESTED edge to CONFIRMED. `<edge>` is a selector for the specific edge on LUM-N's edge list.
+
+```bash
+lumo task deps confirm LUM-42 e5f6a7b8           # confirm as detected direction
+lumo task deps confirm LUM-42 LUM-55              # selector by other task's identifier
+lumo task deps confirm LUM-42 e5f6a7b8 --reverse  # flip direction before confirming
+```
+
+**Edge selector semantics** (shared by `confirm`, `dismiss`, `rm`):
+- **Other task's identifier** (e.g., `LUM-55`) — case-insensitive exact match against the edge's other-task identifier. Resolves unambiguously when there is exactly one edge to that task.
+- **Edge-id prefix** — at least 6 characters of the short id (e.g., `e5f6a7`). Must match exactly one edge.
+- If zero or more than one edge matches → prints all candidate edges with short ids and exits 1. Retry with a more specific selector.
+
+**`--reverse` semantics:**
+- The detector's direction heuristic is best-effort. If the suggested direction is backwards (e.g., the detector says "LUM-42 blocks LUM-55" but actually LUM-55 blocks LUM-42), confirm with `--reverse` to flip before writing.
+- The service checks that the reversed pair does not already have an edge (→ 409), and re-runs the cycle guard with the flipped direction.
+
+### `lumo task deps dismiss <LUM-N> <edge>` — dismiss a candidate (immune to re-detection)
+
+Marks the edge DISMISSED. The row is kept in the database — this is the key difference from `rm`. Because the row exists (in either direction), the detection service will never re-suggest this pair.
+
+```bash
+lumo task deps dismiss LUM-42 e5f6a7b8
+lumo task deps dismiss LUM-42 LUM-38
+```
+
+Output: `Dismissed: [e5f6a7b8] LUM-38「Add OAuth scopes」(不再建议)`
+
+Use `dismiss` for false positives. Use `rm` only when you want the pair to be eligible for re-detection in the future (the detection service can re-suggest pairs with no existing row).
+
+### `lumo task deps rm <LUM-N> <edge> --yes` — delete an edge
+
+Hard-deletes the edge row. **Requires `--yes`** — the CLI refuses without it (no interactive prompt exists).
+
+```bash
+lumo task deps rm LUM-42 a1b2c3d4 --yes
+```
+
+Output: `Removed [a1b2c3d4] from LUM-42`
+
+**`rm` vs `dismiss`:** deleting removes the immunity — the detection service may re-suggest this pair the next time a shared-files sweep or task-mention event fires. Prefer `dismiss` for detection false positives; use `rm` to remove an incorrectly-declared MANUAL edge that you want fully erased.
+
+---
+
+### Detection red lines
+
+- The detection service **never creates CONFIRMED edges automatically**. All auto-detected candidates are SUGGESTED; a human must `confirm` or `add` for an edge to become CONFIRMED.
+- **Dismiss is pair-wise immunity**: once any edge exists between task A and task B (in either direction, regardless of status including DISMISSED), the detection service will not create a new candidate for that pair.
+- **`rm` lifts the immunity**: after deleting the only edge between A and B, the detector may re-suggest them on the next event or sweep.
+
+---
+
+### Detection signals
+
+**Signal 1 — `task_mention`**: fires when a task's description is updated or a comment is created. If the updated HTML contains @-mentions of other tasks, the mentioning task is recorded as depending on the mentioned task (direction heuristic: mentioner blocked by mentioned). Triggers immediately on write events; no cron needed.
+
+**Signal 2 — `shared_files`**: hourly cron sweep. Looks at write-tool hook events (file edits, creates, etc.) in the past 14 days. For every pair of open (non-DONE) tasks that share **≥ 3 written files**, a SUGGESTED edge is created. Direction heuristic: older task blocks newer task. Parent–child task pairs are skipped (they share files by design). Edges are not created across different workspaces.
+
+---
+
+### When to suggest `task deps` commands
+
+- **After `session attach` output shows a blocker warning or candidate-count hint** → run `lumo task deps list <LUM-N>` to review the full edge list, then `confirm` or `dismiss` each SUGGESTED candidate.
+- **User says "X needs to wait for Y" or "LUM-42 is blocked by LUM-9"** → run `lumo task deps add LUM-42 --blocked-by LUM-9`.
+- **Agent sees a `## ⚠ 依赖告警` block (form A — live blockers) at session-start** → evaluate whether to wait for the blocker to merge before starting work; if the edge is stale or wrong, clean it with `deps rm` or `deps dismiss`.
+- **Agent sees only a standalone hint line `检测到 N 条候选依赖待确认…` (form B — no live blockers)** → no immediate blocker, but run `lumo task deps list <LUM-N>` to review and confirm/dismiss SUGGESTED candidates. See [sessions.md](sessions.md) for the full alert format.
+- **User reports a false positive dependency suggestion** → `lumo task deps dismiss <LUM-N> <edge>` to permanently suppress it for this pair.

package/dist/cli/src/commands/session-attach.js

@@ -112,7 +112,12 @@ async function sessionAttach(identifier, options = {}) {
     }
     console.log(`Attached session ${sessionId} to ${body.taskIdentifier} "${(0, sanitize_1.sanitizeField)(body.taskTitle)}"`);
     console.log(`Re-tagged ${body.retaggedEventCount} previously-untagged event${body.retaggedEventCount === 1 ? '' : 's'} in this session.`);
-    // Contract first: it's what the upcoming work is judged against (LUM-342).
+    // 告警先于 contract/memory:与 hook 注入顺序一致,短且可操作的信息优先。
+    if (body.blockerWarningSection) {
+        console.log('');
+        console.log((0, sanitize_1.sanitizeField)(body.blockerWarningSection));
+    }
+    // Contract next: it's what the upcoming work is judged against (LUM-342).
     if (body.criteriaSection) {
         console.log('');
         console.log((0, sanitize_1.sanitizeField)(body.criteriaSection));

package/dist/cli/src/commands/task-deps.js

@@ -0,0 +1,285 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEdgeSelector = resolveEdgeSelector;
+exports.formatDepsList = formatDepsList;
+exports.taskDepsList = taskDepsList;
+exports.taskDepsAdd = taskDepsAdd;
+exports.taskDepsConfirm = taskDepsConfirm;
+exports.taskDepsDismiss = taskDepsDismiss;
+exports.taskDepsRm = taskDepsRm;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/** 短 id = 前 8 位，展示与 selector 都用它。 */
+const shortId = (id) => id.slice(0, 8);
+/**
+ * Resolve a user-supplied edge selector against the task's edge list. Accepts
+ * either the other task's identifier (case-insensitive, exact) or an edge-id
+ * prefix of at least 6 chars. Returns null when nothing (or more than one
+ * edge) matches — callers print the candidate list and bail.
+ */
+function resolveEdgeSelector(edges, selector) {
+    const s = selector.trim();
+    const byIdent = edges.filter(e => e.other.identifier.toUpperCase() === s.toUpperCase());
+    if (byIdent.length === 1)
+        return byIdent[0] ?? null;
+    const byPrefix = edges.filter(e => e.id.startsWith(s));
+    if (s.length >= 6 && byPrefix.length === 1)
+        return byPrefix[0] ?? null;
+    return null;
+}
+/**
+ * Render the dependency edges of a task grouped by status. SUGGESTED rows get
+ * a copy-pasteable confirm hint with the short edge id; detected evidence
+ * (shared files / task mention) is summarized inline.
+ */
+function formatDepsList(identifier, edges) {
+    if (edges.length === 0)
+        return `Dependencies for ${identifier}: 无依赖边。`;
+    const lines = [
+        `Dependencies for ${identifier} (${edges.length})`,
+        '',
+    ];
+    const dirLabel = (e) => e.direction === 'BLOCKED_BY' ? 'blocked by' : 'blocks';
+    const evidence = (e) => {
+        if (e.reason === 'shared_files')
+            return ` · shared_files(${e.detail?.count ?? '?'} 个共享文件${e.detail?.sample?.length ? ': ' + e.detail.sample.join(', ') : ''})`;
+        if (e.reason === 'task_mention')
+            return ` · task_mention(${e.detail?.surface ?? ''})`;
+        return '';
+    };
+    const section = (title, rows, render) => {
+        if (rows.length === 0)
+            return;
+        lines.push(title);
+        for (const e of rows)
+            lines.push(...render(e));
+        lines.push('');
+    };
+    const confirmed = edges.filter(e => e.status === 'CONFIRMED');
+    const suggested = edges.filter(e => e.status === 'SUGGESTED');
+    const dismissed = edges.filter(e => e.status === 'DISMISSED');
+    section('CONFIRMED', confirmed, e => [
+        `  [${shortId(e.id)}] ${dirLabel(e)} ${e.other.identifier}「${e.other.title}」 ${e.other.status} · ${e.source}${evidence(e)}`,
+    ]);
+    section('SUGGESTED(待确认)', suggested, e => [
+        `  [${shortId(e.id)}] ${dirLabel(e)} ${e.other.identifier}「${e.other.title}」 ${e.other.status}${evidence(e)}`,
+        `      确认: lumo task deps confirm ${identifier} ${shortId(e.id)}(方向反了加 --reverse;误报: dismiss)`,
+    ]);
+    section('DISMISSED', dismissed, e => [
+        `  [${shortId(e.id)}] ${dirLabel(e)} ${e.other.identifier} · 已忽略`,
+    ]);
+    return lines.join('\n').trimEnd();
+}
+function getCtx() {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    return {
+        apiUrl,
+        base: (0, api_1.trimTrailingSlash)(apiUrl),
+        token: creds.token,
+        workspaceSlug: creds.workspaceSlug,
+    };
+}
+/** Resolve LUM-N → DB id (the dependencies endpoints take the DB id). */
+async function resolveTask(ctx, identifier) {
+    let res;
+    try {
+        res = await fetch(`${ctx.base}/api/tasks/resolve/${encodeURIComponent(identifier)}`, { headers: { Authorization: `Bearer ${ctx.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${ctx.apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} not found in workspace ${ctx.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: resolve failed (HTTP ${res.status})`);
+        return 1;
+    }
+    return (await res.json());
+}
+/** Best-effort `{ error }` body extraction for non-2xx responses. */
+async function readErrorMessage(res) {
+    try {
+        const body = (await res.json());
+        return typeof body.error === 'string' ? body.error : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function depsFetch(ctx, path, init, label) {
+    let res;
+    try {
+        res = await fetch(`${ctx.base}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${ctx.token}`,
+                ...(init.body ? { 'Content-Type': 'application/json' } : {}),
+            },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${ctx.apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        const serverMsg = await readErrorMessage(res);
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: ${label} failed (HTTP ${res.status})`);
+        return 1;
+    }
+    return res;
+}
+async function fetchDeps(ctx, taskDbId) {
+    const res = await depsFetch(ctx, `/api/tasks/${encodeURIComponent(taskDbId)}/dependencies`, {}, 'dependencies list');
+    if (typeof res === 'number')
+        return res;
+    const { dependencies } = (await res.json());
+    return dependencies ?? [];
+}
+/** Selector miss: print all candidates with short ids so the user can retry. */
+function printSelectorCandidates(edges, selector) {
+    console.error(`Error: no unique dependency edge matches "${selector}". Candidates:`);
+    if (edges.length === 0) {
+        console.error('  (无依赖边)');
+        return;
+    }
+    for (const e of edges) {
+        console.error((0, sanitize_1.sanitizeField)(`  [${shortId(e.id)}] ${e.status} ${e.other.identifier}「${e.other.title}」`));
+    }
+}
+/**
+ * Shared front half of confirm/dismiss/rm: resolve the task, fetch its edge
+ * list, and resolve the selector. Returns the task + edge on success, or an
+ * exit code after printing the candidate list.
+ */
+async function resolveTaskAndEdge(identifier, selector) {
+    const ctx = getCtx();
+    if (typeof ctx === 'number')
+        return ctx;
+    const task = await resolveTask(ctx, identifier);
+    if (typeof task === 'number')
+        return task;
+    const edges = await fetchDeps(ctx, task.id);
+    if (typeof edges === 'number')
+        return edges;
+    const edge = resolveEdgeSelector(edges, selector);
+    if (!edge) {
+        printSelectorCandidates(edges, selector);
+        return 1;
+    }
+    return { ctx, task, edge };
+}
+// ---------------------------------------------------------------------------
+// Command actions
+// ---------------------------------------------------------------------------
+/** `lumo task deps list <LUM-N>` */
+async function taskDepsList(identifier) {
+    if (!identifier) {
+        console.error('Error: usage: lumo task deps list <LUM-42>');
+        return 1;
+    }
+    const ctx = getCtx();
+    if (typeof ctx === 'number')
+        return ctx;
+    const task = await resolveTask(ctx, identifier);
+    if (typeof task === 'number')
+        return task;
+    const edges = await fetchDeps(ctx, task.id);
+    if (typeof edges === 'number')
+        return edges;
+    // Whole-block sanitization (session-attach style): edge titles, reasons and
+    // sample paths are server-controlled free text.
+    console.log((0, sanitize_1.sanitizeField)(formatDepsList(task.identifier, edges)));
+}
+/** `lumo task deps add <LUM-N> --blocked-by <LUM-M>` */
+async function taskDepsAdd(identifier, opts) {
+    if (!identifier || !opts.blockedBy) {
+        console.error('Error: usage: lumo task deps add <LUM-42> --blocked-by <LUM-9>');
+        return 1;
+    }
+    const ctx = getCtx();
+    if (typeof ctx === 'number')
+        return ctx;
+    const task = await resolveTask(ctx, identifier);
+    if (typeof task === 'number')
+        return task;
+    const res = await depsFetch(ctx, `/api/tasks/${encodeURIComponent(task.id)}/dependencies`, { method: 'POST', body: JSON.stringify({ blockedBy: opts.blockedBy }) }, 'dependency add');
+    if (typeof res === 'number')
+        return res;
+    console.log(`Added: ${task.identifier} blocked by ${opts.blockedBy}`);
+}
+/** `lumo task deps confirm <LUM-N> <edge> [--reverse]` */
+async function taskDepsConfirm(identifier, selector, opts) {
+    if (!identifier || !selector) {
+        console.error('Error: usage: lumo task deps confirm <LUM-42> <edge> [--reverse]');
+        return 1;
+    }
+    const resolved = await resolveTaskAndEdge(identifier, selector);
+    if (typeof resolved === 'number')
+        return resolved;
+    const { ctx, task, edge } = resolved;
+    const res = await depsFetch(ctx, `/api/tasks/${encodeURIComponent(task.id)}/dependencies/${encodeURIComponent(edge.id)}`, {
+        method: 'PATCH',
+        body: JSON.stringify({
+            action: 'confirm',
+            reverse: opts.reverse ?? false,
+        }),
+    }, 'dependency confirm');
+    if (typeof res === 'number')
+        return res;
+    console.log((0, sanitize_1.sanitizeField)(`Confirmed: [${shortId(edge.id)}] ${task.identifier} ${edge.direction === 'BLOCKED_BY' ? 'blocked by' : 'blocks'} ${edge.other.identifier}「${edge.other.title}」${opts.reverse ? ' (reversed)' : ''}`));
+}
+/** `lumo task deps dismiss <LUM-N> <edge>` */
+async function taskDepsDismiss(identifier, selector) {
+    if (!identifier || !selector) {
+        console.error('Error: usage: lumo task deps dismiss <LUM-42> <edge>');
+        return 1;
+    }
+    const resolved = await resolveTaskAndEdge(identifier, selector);
+    if (typeof resolved === 'number')
+        return resolved;
+    const { ctx, task, edge } = resolved;
+    const res = await depsFetch(ctx, `/api/tasks/${encodeURIComponent(task.id)}/dependencies/${encodeURIComponent(edge.id)}`, { method: 'PATCH', body: JSON.stringify({ action: 'dismiss' }) }, 'dependency dismiss');
+    if (typeof res === 'number')
+        return res;
+    console.log((0, sanitize_1.sanitizeField)(`Dismissed: [${shortId(edge.id)}] ${edge.other.identifier}「${edge.other.title}」(不再建议)`));
+}
+/** `lumo task deps rm <LUM-N> <edge> --yes` */
+async function taskDepsRm(identifier, selector, opts) {
+    if (!identifier || !selector) {
+        console.error('Error: usage: lumo task deps rm <LUM-42> <edge> --yes');
+        return 1;
+    }
+    if (!opts.yes) {
+        console.error('Error: refusing to delete without --yes. Re-run with --yes to confirm.');
+        return 1;
+    }
+    const resolved = await resolveTaskAndEdge(identifier, selector);
+    if (typeof resolved === 'number')
+        return resolved;
+    const { ctx, task, edge } = resolved;
+    const res = await depsFetch(ctx, `/api/tasks/${encodeURIComponent(task.id)}/dependencies/${encodeURIComponent(edge.id)}`, { method: 'DELETE' }, 'dependency delete');
+    if (typeof res === 'number')
+        return res;
+    console.log(`Removed [${shortId(edge.id)}] from ${task.identifier}`);
+}

package/dist/cli/src/index.js

@@ -74,6 +74,7 @@ const task_slack_show_1 = require("./commands/task-slack-show");
 const task_web_show_1 = require("./commands/task-web-show");
 const task_figma_context_1 = require("./commands/task-figma-context");
 const task_comment_list_1 = require("./commands/task-comment-list");
+const task_deps_1 = require("./commands/task-deps");
 const task_pr_show_1 = require("./commands/task-pr-show");
 const task_lineage_1 = require("./commands/task-lineage");
 const project_list_1 = require("./commands/project-list");
@@ -307,6 +308,32 @@ taskComments
     .command('list <identifier>')
     .description('List the full task comment thread')
     .action(wrap(id => (0, task_comment_list_1.taskCommentList)(id)));
+const taskDeps = task
+    .command('deps')
+    .description('Task dependency edges — detected candidates + confirmed blockers');
+taskDeps
+    .command('list <identifier>')
+    .description('List dependency edges (both directions)')
+    .action(wrap(id => (0, task_deps_1.taskDepsList)(id)));
+taskDeps
+    .command('add <identifier>')
+    .requiredOption('--blocked-by <blocker>', 'blocker task (LUM-N)')
+    .description('Declare a manual hard dependency (CONFIRMED)')
+    .action(wrap((id, opts) => (0, task_deps_1.taskDepsAdd)(id, opts)));
+taskDeps
+    .command('confirm <identifier> <edge>')
+    .option('--reverse', 'flip direction when confirming')
+    .description('Confirm a detected candidate edge')
+    .action(wrap((id, edge, opts) => (0, task_deps_1.taskDepsConfirm)(id, edge, opts)));
+taskDeps
+    .command('dismiss <identifier> <edge>')
+    .description('Dismiss a candidate (never re-suggested)')
+    .action(wrap((id, edge) => (0, task_deps_1.taskDepsDismiss)(id, edge)));
+taskDeps
+    .command('rm <identifier> <edge>')
+    .option('--yes', 'skip confirmation')
+    .description('Delete a dependency edge')
+    .action(wrap((id, edge, opts) => (0, task_deps_1.taskDepsRm)(id, edge, opts)));
 const taskPr = task.command('pr').description('Inspect linked PRs');
 taskPr
     .command('show <identifier> <number>')

package/dist/cli/src/lib/hook-runner.js

@@ -107,15 +107,19 @@ function formatHookStdoutLines(path, responseBody, now = new Date()) {
     else if (tb && tb.bound === false) {
         lines.push(unboundPromptLine(sessionId));
     }
-    // Recovery card + memory + linked resources + PR-review todos share one
-    // additionalContext block so Claude Code injects a single coherent context
-    // payload at session start. The card slots in first so it's the first thing
-    // the model reads.
+    // Recovery card + blocker warning + memory + linked resources + PR-review
+    // todos share one additionalContext block so Claude Code injects a single
+    // coherent context payload at session start. The card slots in first so it's
+    // the first thing the model reads; the dependency blocker warning (LUM-172)
+    // comes right after so it stays prominent, ahead of the memory section.
     const card = renderRecoveryCard(body.previousSession, tb?.taskIdentifier ?? '', now);
     const envelope = sessionContextEnvelope([
         card,
-        // Acceptance contract right after the recovery card: it's what the
-        // session's work is judged against (LUM-342).
+        // Blocker warning right after the card: it can preempt the session's
+        // work entirely (wait for the blocker instead of starting) — LUM-172.
+        body.blockerWarningSection,
+        // Acceptance contract next: it's what the session's work is judged
+        // against (LUM-342).
         body.criteriaSection,
         body.memorySection,
         body.linkedResourcesSection,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",