@lumoai/cli 1.35.0 → 1.37.0

package/dist/cli/src/commands/task-create.js

@@ -38,7 +38,12 @@ async function bindTaskToSprint(base, token, workspaceSlug, sprintRef, task) {
             throw new Error(`sprint lookup failed (HTTP ${sprintRes.status})`);
         }
         const { sprint: full } = (await sprintRes.json());
-        sprint = { id: full.id, number: full.number, name: full.name, teamId: full.teamId };
+        sprint = {
+            id: full.id,
+            number: full.number,
+            name: full.name,
+            teamId: full.teamId,
+        };
     }
     assertSameTeam(task, sprint);
     const bindRes = await fetch(`${base}/api/sprints/${sprint.id}/tasks`, {
@@ -137,14 +142,22 @@ async function taskCreate(title, opts) {
         body.milestoneRef = opts.milestone;
     if (tagIds && tagIds.length > 0)
         body.tagIds = tagIds;
+    if (opts.reworkOf !== undefined)
+        body.reworkOfRef = opts.reworkOf;
+    if (opts.newScope)
+        body.newScope = true;
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+        'Content-Type': 'application/json',
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
     let res;
     try {
         res = await fetch(url, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${creds.token}`,
-                'Content-Type': 'application/json',
-            },
+            headers,
             body: JSON.stringify(body),
         });
     }
@@ -165,7 +178,11 @@ async function taskCreate(title, opts) {
         if (opts.sprint) {
             const workspaceSlug = creds.workspaceSlug ?? '';
             try {
-                const sprint = await bindTaskToSprint(base, creds.token, workspaceSlug, opts.sprint, { id: data.task.id, teamId: data.task.teamId, identifier: data.task.identifier });
+                const sprint = await bindTaskToSprint(base, creds.token, workspaceSlug, opts.sprint, {
+                    id: data.task.id,
+                    teamId: data.task.teamId,
+                    identifier: data.task.identifier,
+                });
                 process.stdout.write(`Sprint: #${sprint.number} "${(0, sanitize_1.sanitizeField)(sprint.name)}"\n`);
             }
             catch (err) {

package/dist/cli/src/commands/task-figma-context.js

@@ -4,6 +4,7 @@ exports.taskFigmaContext = taskFigmaContext;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task figma context <LUM-N> <link-id>`
  *
@@ -58,4 +59,7 @@ async function taskFigmaContext(identifier, linkId) {
         console.log(`syncError: ${(0, sanitize_1.sanitizeField)(metadata.lastSyncError)}`);
     if (note)
         console.log(`\nnote: ${(0, sanitize_1.sanitizeField)(note)}`);
+    // LUM-500: stamp the disclosure funnel. The linkId arg == lineage FIGMA
+    // fragmentId. Fire-and-forget — never blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'FIGMA', fragmentId: linkId });
 }

package/dist/cli/src/commands/task-lineage.js

@@ -68,6 +68,10 @@ async function taskLineage(identifier, opts) {
 function groupThousands(n) {
     return n.toString().replace(/\B(?=(\d{3})+(?!\d))/g, ',');
 }
+/** Integer percentage, 0 when the denominator is 0 (never NaN). */
+function pct(num, den) {
+    return den === 0 ? 0 : Math.round((num / den) * 100);
+}
 const OUTCOME_ORDER = ['MERGED', 'REWORKED', 'REJECTED', 'UNKNOWN'];
 /** "2 MERGED · 1 UNKNOWN", fixed order, zeros omitted. */
 function outcomeSummary(counts) {
@@ -117,7 +121,21 @@ function formatLineageMarkdown(data) {
     const totalsOutcome = outcomeSummary(t.outcomes);
     if (totalsOutcome)
         lines.push(`- Outcomes: ${totalsOutcome}`);
+    const f = t.funnel;
+    const fSavedSuffix = f.tokensSaved != null ? ` · ~${f.tokensSaved} tokens saved` : '';
+    lines.push(`- Disclosure funnel: ${f.impressions} impressions · ` +
+        `${f.index} INDEX (${pct(f.index, f.impressions)}%) · ` +
+        `${f.pulled} pulled (${pct(f.pulled, f.index)}% of INDEX) · ` +
+        `${f.used} used (${pct(f.used, f.impressions)}%)${fSavedSuffix}`);
     lines.push('');
+    if (data.totals.topOperations.length > 0) {
+        lines.push('');
+        lines.push('Top operations by token cost:');
+        for (const op of data.totals.topOperations) {
+            lines.push(`  ${op.tool} — ${op.total.toLocaleString('en-US')} tokens`);
+        }
+        lines.push('  (full breakdown: lumo cost --task <id>)');
+    }
     for (const g of data.groups) {
         lines.push(`## ${(0, sanitize_1.sanitizeField)(g.label)} · ${g.includedAt.slice(0, 10)}`);
         if (g.cost) {
@@ -130,7 +148,12 @@ function formatLineageMarkdown(data) {
         lines.push(`**Fragments** (${g.fragments.length}${summary ? `: ${summary}` : ''}):`);
         lines.push('_✓ used · · abstained · ✗ unused (manual)_');
         for (const f of g.fragments) {
-            lines.push(`- ${usageMarker(f.used)} [${f.outcome}] ${f.fragmentType} — ${(0, sanitize_1.sanitizeField)(f.sourceLabel)}`);
+            const tag = f.disclosure === 'INDEX'
+                ? f.pulled
+                    ? 'INDEX pulled'
+                    : 'INDEX not-pulled'
+                : 'FULL';
+            lines.push(`- ${usageMarker(f.used)} [${f.outcome}] ${f.fragmentType} — ${(0, sanitize_1.sanitizeField)(f.sourceLabel)} · ${tag}`);
         }
         lines.push('');
     }
@@ -141,10 +164,24 @@ function formatSignalHealth(h) {
     lines.push(`- Distribution: used ${h.distribution.used} · null ${h.distribution.abstained} · false ${h.distribution.unused}`);
     lines.push(`- Per-session variance: ${h.perSessionVariance.toFixed(2)} (${h.votedSessions} voted sessions)`);
     if (h.usedMergeRate !== null && h.baseMergeRate !== null) {
-        lines.push(`- Used × outcome: merge-rate(used) ${Math.round(h.usedMergeRate * 100)}% vs base ${Math.round(h.baseMergeRate * 100)}%`);
+        if (h.baseFailedTasks === 0) {
+            // No failure outcomes exist yet, so any rate is non-discriminating by
+            // construction — say so honestly instead of printing a misleading 100%.
+            lines.push('- Used × outcome: no failure outcomes yet — metric cannot discriminate');
+        }
+        else {
+            lines.push(`- Used × outcome: merge-rate(used) ${Math.round(h.usedMergeRate * 100)}% (${h.usedResolvedTasks} resolved, ${h.usedFailedTasks} failed) vs base ${Math.round(h.baseMergeRate * 100)}% (${h.baseResolvedTasks} resolved, ${h.baseFailedTasks} failed)`);
+        }
     }
     else {
         lines.push('- Used × outcome: insufficient resolved tasks');
     }
+    lines.push(`- Spinoffs during in-flight work: ${h.spinoffsDuringInFlight} (recorded, not yet judged)`);
+    const f = h.disclosureFunnel;
+    const fSavedSuffix = f.tokensSaved != null ? ` · ~${f.tokensSaved} tokens saved` : '';
+    lines.push(`- Disclosure funnel: ${f.impressions} impressions · ` +
+        `${f.index} INDEX (${pct(f.index, f.impressions)}%) · ` +
+        `${f.pulled} pulled (${pct(f.pulled, f.index)}% of INDEX) · ` +
+        `${f.used} used (${pct(f.used, f.impressions)}%)${fSavedSuffix}`);
     return lines.join('\n');
 }

package/dist/cli/src/commands/task-slack-show.js

@@ -4,6 +4,7 @@ exports.taskSlackShow = taskSlackShow;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task slack show <LUM-N> <context-id>`
  *
@@ -50,10 +51,14 @@ async function taskSlackShow(identifier, contextId) {
     const messages = snapshot?.messages ?? [];
     if (messages.length === 0) {
         console.log('(no messages in stored snapshot)');
-        return;
     }
-    for (const m of messages) {
-        const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
-        console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+    else {
+        for (const m of messages) {
+            const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
+            console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+        }
     }
+    // LUM-500: stamp the disclosure funnel. The contextId arg == lineage
+    // SLACK_CONTEXT fragmentId. Fire-and-forget — never blocks, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'SLACK_CONTEXT', fragmentId: contextId });
 }

package/dist/cli/src/commands/task-status.js

@@ -104,6 +104,18 @@ function formatTaskStatus(data, extras = {}) {
                 lines.push('      ⚠ pre-edit version — criterion changed since this check; re-run `lumo verify` to re-confirm');
             }
         }
+        // LUM-511 Phase 5: send-back lifecycle (was this criterion's send-back
+        // resolved, and by which PR).
+        const sb = c.sendBackResolution;
+        if (sb) {
+            if (sb.status === 'resolved') {
+                const pr = sb.closingPrNumber ? ` · PR #${sb.closingPrNumber}` : '';
+                lines.push(`      ↳ send-back (r${sb.failedAtRound}) resolved in r${sb.resolvedAtRound}${pr}`);
+            }
+            else {
+                lines.push(`      ↳ send-back (r${sb.failedAtRound}) open`);
+            }
+        }
     }
     if (data.verificationHistory.length > 0) {
         lines.push('');

package/dist/cli/src/commands/task-web-show.js

@@ -4,6 +4,7 @@ exports.taskWebShow = taskWebShow;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task web show <LUM-N> <link-id>`
  *
@@ -58,7 +59,11 @@ async function taskWebShow(identifier, linkId) {
     const { body } = (await res.json());
     if (!body || body.trim().length === 0) {
         console.log('(empty body)');
-        return;
     }
-    console.log((0, sanitize_1.sanitizeField)(body));
+    else {
+        console.log((0, sanitize_1.sanitizeField)(body));
+    }
+    // LUM-500: stamp the disclosure funnel. The linkId arg == lineage WEB_LINK
+    // fragmentId. Fire-and-forget — never blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'WEB_LINK', fragmentId: linkId });
 }

package/dist/cli/src/commands/verdict.js

@@ -25,10 +25,10 @@ function collectCriterion(value, prev = []) {
 /**
  * `lumo verdict [task]` — human + agent acceptance verdicts (LUM-422).
  *
- * Three modes, exactly one required:
- *   --pass / --pass-with-followup  open the browser to the task's verdict bar,
- *       focused on the passing action (a deep link — writes NOTHING; a passing
- *       data row is only ever produced by a human's own click, red line).
+ * Two modes, exactly one required:
+ *   --pass  opens the browser to the task's verdict bar, focused on Pass (a deep
+ *       link — writes NOTHING; a passing data row is only ever produced by a
+ *       human's own click, red line).
  *   --fail --reason <enum> [--note] [--criterion …]  records an AGENT send-back
  *       (verdict hard-coded FAIL server-side) and bounces the task to
  *       IN_PROGRESS. Bearer-authed.
@@ -36,13 +36,9 @@ function collectCriterion(value, prev = []) {
  * Defaults to the session-bound task; an explicit identifier overrides.
  */
 async function verdict(identifier, options = {}) {
-    const modes = [
-        options.pass && 'pass',
-        options.passWithFollowup && 'pass-with-followup',
-        options.fail && 'fail',
-    ].filter(Boolean);
+    const modes = [options.pass && 'pass', options.fail && 'fail'].filter(Boolean);
     if (modes.length === 0) {
-        console.error('Error: choose a verdict mode — --pass, --pass-with-followup, or --fail.');
+        console.error('Error: choose a verdict mode — --pass or --fail.');
         return 1;
     }
     if (modes.length > 1) {
@@ -90,14 +86,14 @@ async function verdict(identifier, options = {}) {
     if (options.fail) {
         return failVerdict(base, headers, taskId, options, creds.workspaceSlug);
     }
-    return passDeepLink(base, headers, taskId, options.passWithFollowup ? 'pass_with_followup' : 'pass', creds.workspaceSlug);
+    return passDeepLink(base, headers, taskId, creds.workspaceSlug);
 }
 /**
- * --pass / --pass-with-followup: open the human's verdict bar pre-focused on the
- * passing action. The CLI never writes the verdict — it only carries the human
- * to the one click that does (red line: no agent-produced passing row).
+ * --pass: open the human's verdict bar pre-focused on Pass. The CLI never writes
+ * the verdict — it only carries the human to the one click that does (red line:
+ * no agent-produced passing row).
  */
-async function passDeepLink(base, headers, taskId, verdictParam, workspaceSlug) {
+async function passDeepLink(base, headers, taskId, workspaceSlug) {
     let res;
     try {
         res = await fetch(`${base}/api/tasks/by-identifier/${encodeURIComponent(taskId)}`, { headers });
@@ -125,9 +121,8 @@ async function passDeepLink(base, headers, taskId, verdictParam, workspaceSlug)
         return 1;
     }
     const sep = task.url.includes('?') ? '&' : '?';
-    const deepLink = `${task.url}${sep}verdict=${verdictParam}`;
-    const label = verdictParam === 'pass_with_followup' ? 'Pass with follow-up' : 'Pass';
-    process.stdout.write(`Opening ${taskId} for a human "${label}" verdict (nothing is recorded until they click):\n` +
+    const deepLink = `${task.url}${sep}verdict=pass`;
+    process.stdout.write(`Opening ${taskId} for a human "Pass" verdict (nothing is recorded until they click):\n` +
         `  ${(0, sanitize_1.sanitizeField)(deepLink)}\n`);
     (0, browser_1.openBrowser)(deepLink);
     return;

package/dist/cli/src/commands/verify.js

@@ -181,6 +181,14 @@ async function verify(identifier, options = {}) {
     }
     const outcome = (await res.json());
     process.stdout.write(`\nRound ${outcome.round}/${outcome.maxRounds} recorded.\n`);
+    if (outcome.bindingAdvisory === 'unbound') {
+        process.stdout.write('⚠ Working unbound — this verify ran from a Claude Code session not attached to the task. ' +
+            'Run `lumo session attach <LUM-N>` to bind (recorded as a boundary crossing).\n');
+    }
+    else if (outcome.bindingAdvisory === 'unconfirmed') {
+        process.stdout.write('⚠ Could not confirm this session is attached to the task. ' +
+            'If you are working with Claude Code, run `lumo session attach <LUM-N>`.\n');
+    }
     if (outcome.allPassed) {
         process.stdout.write(`✓ All MACHINE criteria passed — task is now ${outcome.taskStatus}.\n` +
             `Stop here: human adjudication (and any HUMAN criteria) take over from this point.\n`);

package/dist/cli/src/index.js

@@ -47,6 +47,7 @@ const session_attach_1 = require("./commands/session-attach");
 const session_status_1 = require("./commands/session-status");
 const session_wrap_1 = require("./commands/session-wrap");
 const next_1 = require("./commands/next");
+const cost_1 = require("./commands/cost");
 const verify_1 = require("./commands/verify");
 const verdict_1 = require("./commands/verdict");
 const task_context_1 = require("./commands/task-context");
@@ -66,6 +67,7 @@ const memory_project_list_1 = require("./commands/memory-project-list");
 const memory_project_add_1 = require("./commands/memory-project-add");
 const memory_promote_1 = require("./commands/memory-promote");
 const memory_rm_1 = require("./commands/memory-rm");
+const memory_show_1 = require("./commands/memory-show");
 const task_artifact_add_1 = require("./commands/task-artifact-add");
 const task_criteria_set_1 = require("./commands/task-criteria-set");
 const task_criteria_list_1 = require("./commands/task-criteria-list");
@@ -221,9 +223,8 @@ program
     .action(wrap((task, options) => (0, verify_1.verify)(task, options)));
 program
     .command('verdict [task]')
-    .description('Acceptance verdict (LUM-422). --pass / --pass-with-followup open the browser to the human verdict bar focused on the passing action (a deep link — records nothing; a passing row is only ever a human click). --fail --reason <enum> records an AGENT send-back and bounces the task to IN_PROGRESS. Defaults to the session-bound task.')
+    .description('Acceptance verdict (LUM-422). --pass opens the browser to the human verdict bar focused on Pass (a deep link — records nothing; a passing row is only ever a human click). --fail --reason <enum> records an AGENT send-back and bounces the task to IN_PROGRESS. Defaults to the session-bound task.')
     .option('--pass', 'Open the verdict bar focused on Pass (human one-click; no write)')
-    .option('--pass-with-followup', 'Open the verdict bar focused on Pass with follow-up (human one-click; no write)')
     .option('--fail', 'Record an AGENT send-back (verdict FAIL) — requires --reason')
     .option('--reason <enum>', 'Rejection reason for --fail: CRITERION_UNMET | EVIDENCE_INSUFFICIENT | CHECK_EXECUTION_ERROR | SCOPE_MISMATCH | OTHER (case-insensitive)')
     .option('--note <text>', 'Optional send-back narrative, posted as a task comment')
@@ -234,6 +235,15 @@ program
     .description('Recommend the next task(s) to work on, ranked by priority, active sprint, and due date. Prints top N (default 3); pick one and run `session attach` + `task context`.')
     .option('-n, --count <N>', 'Number of tasks to recommend (default 3)')
     .action(wrap(options => (0, next_1.nextCommand)(options)));
+program
+    .command('cost')
+    .description('Show per-operation (per-tool) token cost. Defaults to a workspace 30-day window; scope with --task / --session')
+    .option('--task <id>', 'Aggregate a single task (e.g. LUM-42)')
+    .option('--session <id>', 'Aggregate a single Claude Code session')
+    .option('--since <date>', 'Workspace window lower bound (ISO date); default last 30 days')
+    .option('--by <dim>', 'Headline grouping: tool | model | member | session (case-insensitive; default tool)')
+    .option('--json', 'Emit the versioned payload as JSON')
+    .action(wrap(options => (0, cost_1.cost)(options)));
 const session = program
     .command('session')
     .description('Manage per-terminal coding-session context');
@@ -247,9 +257,9 @@ session
     .action(wrap(() => (0, session_status_1.sessionStatus)()));
 session
     .command('wrap')
-    .description("Session-end wrap-up: draft a progress comment from this session's turn summaries and post it to the bound task after confirmation.")
-    .option('-y, --yes', 'Post the drafted comment without prompting (agent-friendly)')
-    .option('--dry-run', 'Print the draft but do not post or advance the watermark')
+    .description('Session-end wrap-up: review the memories sedimented this session, vote which injected context fragments were actually used, and optionally flag the bound task blocked.')
+    .option('-y, --yes', 'Keep all memories without prompting (agent-friendly); does not auto-apply the blocked tag')
+    .option('--dry-run', 'Print the section drafts but do not mutate memories/tags or advance watermarks')
     .option('--used <indices>', 'Mark which injected context fragments you actually used (1-based indices, comma/space separated; "none" for all-unused). Omit to skip recording.')
     .action(wrap(options => (0, session_wrap_1.sessionWrap)(options)));
 const task = program
@@ -291,6 +301,8 @@ task
     .option('--tag <name>', 'Attach tag by name (repeatable)', collect, [])
     .option('--tag-id <cuid>', 'Attach tag by id (repeatable)', collect, [])
     .option('--sprint <ref>', 'Sprint number or UUID to add the task to after creation')
+    .option('--rework-of <id>', 'Declare this is rework of an existing task (redirects you to fix it; creates nothing)')
+    .option('--new-scope', 'Declare this is genuinely new work, outside your current task’s scope')
     .action(wrap((title, options) => (0, task_create_1.taskCreate)(title, options)));
 const taskFigma = task
     .command('figma')
@@ -489,6 +501,10 @@ projectMemory
 const memoryCmd = program
     .command('memory')
     .description('Operate on a single memory by id (see `lumo task memory` / `lumo project memory` to list/add)');
+memoryCmd
+    .command('show <memoryId>')
+    .description("Show one memory's full card by id (category + content). Use to pull the body of a memory you saw as a one-line index entry at session start.")
+    .action(wrap((id) => (0, memory_show_1.memoryShow)(id)));
 memoryCmd
     .command('promote <memoryId>')
     .description('Promote a TASK memory to PROJECT scope. Only when the lesson recurs across 2+ tasks.')

package/dist/cli/src/lib/doc-input.js

@@ -81,6 +81,13 @@ async function resolveDocContent(args) {
     }
     if (!args.stdinIsTTY) {
         const text = await args.readStdin();
+        // A non-TTY shell with nothing piped (the common agent/CI case) yields an
+        // empty read. Treat empty/whitespace-only stdin as "no content channel"
+        // so a title-only `doc update` doesn't ship an empty body and trip the
+        // LUM-410 structure guard / blank the document (LUM-505). To clear a body
+        // deliberately, pass an explicit `--content ""` (handled above).
+        if (text.trim().length === 0)
+            return { kind: 'none' };
         return { kind: 'ok', markdown: text };
     }
     return { kind: 'none' };

package/dist/cli/src/lib/hook-runner.js

@@ -12,7 +12,6 @@ const hook_log_1 = require("./hook-log");
 const sanitize_1 = require("./sanitize");
 const agent_1 = require("./agent");
 const git_task_1 = require("./git-task");
-const format_1 = require("./format");
 const transcript_usage_1 = require("./transcript-usage");
 /**
  * Hard timeout for the hook POST. On timeout the request is aborted,
@@ -72,7 +71,11 @@ function readStdin() {
  * The JSON lines conform to Claude Code's hookSpecificOutput envelope so the
  * runtime injects additionalContext into the conversation automatically.
  */
-function formatHookStdoutLines(path, responseBody, now = new Date()) {
+function formatHookStdoutLines(path, responseBody, 
+// Retained for signature stability (callers/tests still pass it). LUM-500
+// removed the only time-dependent rendering (the recovery card), so it is no
+// longer read.
+_now = new Date()) {
     if (path === 'pre-tool-use') {
         if (responseBody == null || typeof responseBody !== 'object')
             return [];
@@ -107,20 +110,27 @@ function formatHookStdoutLines(path, responseBody, now = new Date()) {
     else if (tb && tb.bound === false) {
         lines.push(unboundPromptLine(sessionId));
     }
-    // Recovery card + blocker warning + memory + linked resources + PR-review
-    // todos share one additionalContext block so Claude Code injects a single
-    // coherent context payload at session start. The card slots in first so it's
-    // the first thing the model reads; the dependency blocker warning (LUM-172)
-    // comes right after so it stays prominent, ahead of the memory section.
-    const card = renderRecoveryCard(body.previousSession, tb?.taskIdentifier ?? '', now);
+    // Blocker warning + criteria + progress + memory + linked resources +
+    // PR-review todos share one additionalContext block so Claude Code injects a
+    // single coherent context payload at session start. The dependency blocker
+    // warning (LUM-172) slots in first so it stays prominent — it can preempt the
+    // session's work entirely. Then the progressive-disclosure tiers (LUM-500):
+    // Tier-0 acceptance contract → Tier-1 prior-session progress → Tier-2 memory
+    // index → linked resources.
+    //
+    // LUM-500: the prior-session recovery is now the server-rendered Tier-1
+    // `progressSection`, which REPLACES the CLI-rendered recovery card so progress
+    // isn't injected twice. `body.previousSession` is still sent (it drives the
+    // server's lineage/metrics) but is no longer rendered here.
     const envelope = sessionContextEnvelope([
-        card,
-        // Blocker warning right after the card: it can preempt the session's
-        // work entirely (wait for the blocker instead of starting) — LUM-172.
+        // Blocker warning first: it can preempt the session's work entirely (wait
+        // for the blocker instead of starting) — LUM-172.
         body.blockerWarningSection,
-        // Acceptance contract next: it's what the session's work is judged
-        // against (LUM-342).
+        // Tier-0 acceptance contract: what the session's work is judged against
+        // (LUM-342).
         body.criteriaSection,
+        // Tier-1 prior-session progress (LUM-500), server-rendered.
+        body.progressSection,
         body.memorySection,
         body.linkedResourcesSection,
         body.reviewTodosSection,
@@ -137,37 +147,6 @@ function formatHookStdoutLines(path, responseBody, now = new Date()) {
 function unboundPromptLine(sessionId) {
     return `[Lumo] session_id=${sessionId} | No task bound. Tell me the task you want to work on (e.g. LUM-42), or say "skip".`;
 }
-const MAX_UNRESOLVED = 5;
-/**
- * Render the "resuming previous session" recovery card from the structured previousSession
- * payload. Returns undefined when there's nothing to show (null payload or an
- * empty headline). Free text (headline / unresolved) is sanitized here — it's
- * LLM-generated and routed to Claude Code stdout. unresolved is capped at
- * MAX_UNRESOLVED with a "+M more" pointer to `lumo task context`.
- */
-function renderRecoveryCard(prev, taskIdentifier, now) {
-    if (!prev || typeof prev.headline !== 'string' || prev.headline === '') {
-        return undefined;
-    }
-    const ago = (0, format_1.relativeTime)(new Date(prev.lastActivityAt), now);
-    const dur = (0, format_1.formatDuration)(prev.durationMs);
-    const lines = [
-        `## Resuming previous session (${ago} · ${dur})`,
-        `Last stopped at: ${(0, sanitize_1.sanitizeField)(prev.headline)}`,
-    ];
-    const unresolved = Array.isArray(prev.unresolved) ? prev.unresolved : [];
-    if (unresolved.length > 0) {
-        lines.push('Unfinished:');
-        const shown = unresolved.slice(0, MAX_UNRESOLVED);
-        for (const u of shown)
-            lines.push(`- ${(0, sanitize_1.sanitizeField)(u)}`);
-        const extra = unresolved.length - shown.length;
-        if (extra > 0) {
-            lines.push(`- … (+${extra} more — run \`lumo task context ${taskIdentifier}\` for the full list)`);
-        }
-    }
-    return lines.join('\n');
-}
 /**
  * Wrap any non-empty context parts into a single SessionStart
  * hookSpecificOutput envelope so Claude Code injects one coherent
@@ -204,7 +183,9 @@ function formatSuggestLine(sessionId, match) {
  * detect-and-suggest, never auto-bind). No match falls back to the generic
  * unbound prompt.
  */
-function resolveSessionStartStdout(responseBody, deps, now = new Date()) {
+function resolveSessionStartStdout(responseBody, deps, 
+// Retained for signature stability; no longer read (see formatHookStdoutLines).
+_now = new Date()) {
     if (responseBody == null || typeof responseBody !== 'object')
         return [];
     const body = responseBody;
@@ -213,7 +194,7 @@ function resolveSessionStartStdout(responseBody, deps, now = new Date()) {
     const sessionId = body.sessionId;
     const tb = body.taskBinding;
     if (tb && tb.bound === true) {
-        return formatHookStdoutLines('session-start', responseBody, now);
+        return formatHookStdoutLines('session-start', responseBody);
     }
     if (!tb || tb.bound !== false)
         return [];

package/dist/cli/src/lib/report-pull.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportPull = reportPull;
+const config_1 = require("./config");
+const api_1 = require("./api");
+/**
+ * Fire-and-forget telemetry for progressive disclosure (LUM-500).
+ *
+ * When an agent pulls a fragment's body via a `lumo … show <id>` command, this
+ * reports the pull to the server, which stamps `pulledAt` on the session-start
+ * lineage edge — the middle of the disclosure funnel (saw → pulled → used).
+ *
+ * Contract:
+ * - NO-OP silently when there is no bound session (nothing is sent). The bound
+ *   session id is `CLAUDE_CODE_SESSION_ID` — the same source other commands use
+ *   for `X-Lumo-Session-Id` provenance.
+ * - Fire-and-forget: never blocks the command's main output and never surfaces
+ *   an error. All failures (no creds, network, non-ok) are swallowed. Returns
+ *   void so callers can `await` it without affecting their exit code.
+ *
+ * `fragmentId` must be the DB row id the lineage edge stored — callers are
+ * responsible for passing the id that matches (see each command's wiring).
+ */
+async function reportPull(ref) {
+    try {
+        const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+        if (!sessionId)
+            return;
+        const creds = (0, config_1.readCredentials)();
+        if (!creds)
+            return;
+        const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+        await fetch(`${base}/api/lineage/pulls`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                sessionId,
+                fragmentType: ref.fragmentType,
+                fragmentId: ref.fragmentId,
+            }),
+        });
+    }
+    catch {
+        // fire-and-forget: never surface telemetry failures
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.35.0",
+  "version": "1.37.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",

package/dist/cli/src/commands/wrap/progress-comment-section.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProgressCommentSection = void 0;
-exports.formatProgressBody = formatProgressBody;
-const sanitize_1 = require("../../lib/sanitize");
-const line_prompt_1 = require("../../lib/line-prompt");
-const editor_1 = require("../../lib/editor");
-const progress_comment_api_1 = require("../../lib/progress-comment-api");
-const HEADER = 'Session progress';
-/** Join turn summaries into a bulleted progress comment body under a header. */
-function formatProgressBody(summaries) {
-    return [HEADER, ...summaries.map(s => `- ${s}`)].join('\n');
-}
-/**
- * Wrap-panel section that drafts a progress comment from the session's
- * unposted turnSummaries and posts it after y/e/s confirmation. Holds its own
- * draft + body state between prepare() and run().
- */
-class ProgressCommentSection {
-    deps;
-    title = 'Progress comment';
-    draft = null;
-    body = '';
-    constructor(deps) {
-        this.deps = deps;
-    }
-    async prepare() {
-        this.draft = await (0, progress_comment_api_1.fetchProgressDraft)(this.deps.creds, this.deps.sessionId);
-        if (!this.draft.taskIdentifier || this.draft.summaries.length === 0) {
-            return false;
-        }
-        this.body = formatProgressBody(this.draft.summaries.map(s => s.turnSummary));
-        return true;
-    }
-    async run(opts) {
-        const draft = this.draft;
-        if (!draft || !draft.watermark)
-            return;
-        // Preview: sanitize the server free-text before it hits the terminal.
-        process.stdout.write(`Will post to ${draft.taskIdentifier} "${(0, sanitize_1.sanitizeField)(draft.taskTitle ?? '')}":\n`);
-        process.stdout.write(`${(0, sanitize_1.sanitizeField)(this.body)}\n`);
-        if (opts.dryRun) {
-            process.stdout.write('(dry-run, not posted)\n');
-            return;
-        }
-        if (opts.yes) {
-            await this.post(draft.watermark, this.body);
-            return;
-        }
-        const choice = (await (0, line_prompt_1.promptLine)('[y] post  [e] edit  [s] skip > ')).toLowerCase();
-        if (choice === 's' || choice === '') {
-            process.stdout.write('Skipped.\n');
-            return;
-        }
-        if (choice === 'e') {
-            const edited = (await (0, editor_1.editInEditor)(this.body)).trim();
-            if (edited.length === 0) {
-                process.stdout.write('Empty body — skipped.\n');
-                return;
-            }
-            process.stdout.write(`${(0, sanitize_1.sanitizeField)(edited)}\n`);
-            const confirm = (await (0, line_prompt_1.promptLine)('[y] post  [s] skip > ')).toLowerCase();
-            if (confirm !== 'y') {
-                process.stdout.write('Skipped.\n');
-                return;
-            }
-            await this.post(draft.watermark, edited);
-            return;
-        }
-        if (choice === 'y') {
-            await this.post(draft.watermark, this.body);
-            return;
-        }
-        process.stdout.write('Unrecognized choice — skipped.\n');
-    }
-    async post(watermark, body) {
-        const { commentId } = await (0, progress_comment_api_1.postProgressComment)(this.deps.creds, this.deps.sessionId, { body, watermark });
-        process.stdout.write(`Posted progress comment (comment ${commentId})\n`);
-    }
-}
-exports.ProgressCommentSection = ProgressCommentSection;