@lumoai/cli 1.36.0 → 1.37.0

package/assets/skill/SKILL.md

@@ -27,6 +27,7 @@ The command catalog below is a **map**: it lists every command grouped by domain
 | `task artifact*`, `task figma*`                                                         | [references/artifacts-figma.md](references/artifacts-figma.md) |
 | `task criteria set/list`, drafting the acceptance contract                              | [references/criteria.md](references/criteria.md)               |
 | `verify`, `task status` — machine verification loop, claim-done flow, self-check/resume | [references/verify.md](references/verify.md)                   |
+| `cost` — per-operation (per-tool) token cost read-out; `task lineage` Top-5             | [references/task-context.md](references/task-context.md)       |
 | `project list`, `milestone*`                                                            | [references/milestones.md](references/milestones.md)           |
 | `doc*`                                                                                  | [references/docs.md](references/docs.md)                       |
 | `sprint*`                                                                               | [references/sprints.md](references/sprints.md)                 |
@@ -51,11 +52,11 @@ The command catalog below is a **map**: it lists every command grouped by domain
 - `lumo task figma context <id> <linkId>` — Figma link metadata (v1)
 - `lumo task comments list <id>` — comment thread, capped to the output budget (`--full` prints every comment; read-only; ≠ `task comment`)
 - `lumo task pr show <id> <number>` — synced PR metadata (v1)
-- `lumo task lineage <id>` — show the causal trail: fragments that fed the task + each one's outcome + the run's token/loop cost (read-only audit view); `lumo task lineage <id> --signal` also appends workspace-level usage signal-health (used distribution, per-session variance, used-vs-base merge rate via iteration-taint fold — tasks with a send-back/reopen/PR-close count as the negative class even if later merged; shows negative-class size per side; prints "metric cannot discriminate" when no failure outcomes exist yet)
+- `lumo task lineage <id>` — show the causal trail: fragments that fed the task + each one's outcome (each fragment line shows its disclosure tag: `· INDEX pulled` / `· INDEX not-pulled` / `· FULL`) + the run's token/loop cost (read-only audit view); totals include a single-task disclosure-funnel summary (`- Disclosure funnel: N impressions · M INDEX (X%) · K pulled (Y% of INDEX) · J used (Z%)`) and a per-task **"Top operations by token cost"** Top-5 — the most expensive tools by attributed token cost, with a pointer to the full breakdown via `lumo cost --task <id>`; `lumo task lineage <id> --signal` also appends workspace-level usage signal-health (used distribution, per-session variance, used-vs-base merge rate via iteration-taint fold — tasks with a send-back/reopen/PR-close count as the negative class even if later merged; shows negative-class size per side; prints "metric cannot discriminate" when no failure outcomes exist yet; also prints a raw count of mid-flight `--new-scope` spinoffs (recorded, not yet judged — LUM-511 Phase 3)) and a workspace-wide disclosure funnel in the same shape as the single-task line
 
 **Tasks** — see [tasks.md](references/tasks.md)
 
-- `lumo task create <title> [flags]` — create a task
+- `lumo task create <title> [flags]` — create a task. **Mid-task** (your session is bound to an in-flight task) it requires `--rework-of <id>` (redirects you to fix the existing task — creates nothing) or `--new-scope` (genuinely new, out-of-scope work). On a send-back, fix in place / amend the contract instead of spinning off a new task — see [verify.md](references/verify.md) and [criteria.md](references/criteria.md).
 - `lumo task update <id> [flags]` — patch status/title/priority/assignee/milestone/sprint/tags
 - `lumo task list [flags]` — list tasks assigned to you
 - `lumo next [--count N]` — recommend the next task to work on (read-only)
@@ -79,8 +80,12 @@ The command catalog below is a **map**: it lists every command grouped by domain
 **Verification (machine acceptance loop)** — see [verify.md](references/verify.md)
 
 - `lumo verify [task] [--timeout <seconds>]` — run every MACHINE criterion's checkpointer locally, report one structured PASS/FAIL verdict per criterion to the server, print next actions. Defaults to the session-bound task. Round cap 3: an all-pass round moves the task to IN_REVIEW (agent stops there); a round-3 fail escalates to a human (stop retrying). **Run this before claiming a task is done.**
-- `lumo task status [task] [--json]` — read-only acceptance self-check (no LLM, milliseconds): the contract with each criterion's latest verdict (REVIEW_ADDED provenance visible), verification history, current round, last round's failure reasons, `nextActions` = the unmet criteria (the declarative "what's next" — no separate plan), and any OPEN (undispositioned) boundary crossings (count + per crossing category/severity/detail + a read-only attribution line `↳ by model=…·agent=…·session=…` naming who/what crossed, `unknown` when unresolved — LUM-469; `--json` adds an `openCrossings` field, each entry carrying an `attribution` object) — read-only awareness, disposition stays web + human-only (LUM-448). The crossings check fails closed (LUM-480): if the read errors, the block prints `⚠ Boundary-crossing check failed` instead of staying silent, and `--json` sets `openCrossings: null` (distinct from `[]` = a successful read with zero open — treat `null` as "could not confirm", not "safe"). Defaults to the session-bound task; `--json` emits a versioned payload (`version` field). **Run it first when resuming a task in a new session or after a verification round was rejected.**
-- `lumo verdict [task] --pass | --pass-with-followup | --fail` — acceptance verdicts (LUM-422). `--pass` / `--pass-with-followup` open the browser to the human verdict bar focused on the passing action (a deep link — **records nothing**; a passing data row is only ever a human's own click). `--fail --reason <enum> [--note <text>] [--criterion <id>…]` records an **AGENT send-back** (verifierType=AGENT, verdict hard-coded FAIL) and bounces the task to IN_PROGRESS. Defaults to the session-bound task. **An unresolved send-back (machine/AGENT/human FAIL) blocks the agent/CLI DONE transition with 409** — clear it (re-verify) before `task update --status done`.
+- `lumo task status [task] [--json]` — read-only acceptance self-check (no LLM, milliseconds): the contract with each criterion's latest verdict (REVIEW_ADDED provenance visible), verification history, current round, last round's failure reasons, a per-criterion **send-back lifecycle** line when applicable (`↳ send-back (rN) resolved in rM · PR #K` / `… open` — LUM-511 Phase 5), `nextActions` = the unmet criteria (the declarative "what's next" — no separate plan), and any OPEN (undispositioned) boundary crossings (count + per crossing category/severity/detail + a read-only attribution line `↳ by model=…·agent=…·session=…` naming who/what crossed, `unknown` when unresolved — LUM-469; `--json` adds an `openCrossings` field, each entry carrying an `attribution` object) — read-only awareness, disposition stays web + human-only (LUM-448). The crossings check fails closed (LUM-480): if the read errors, the block prints `⚠ Boundary-crossing check failed` instead of staying silent, and `--json` sets `openCrossings: null` (distinct from `[]` = a successful read with zero open — treat `null` as "could not confirm", not "safe"). Defaults to the session-bound task; `--json` emits a versioned payload (`version` field). **Run it first when resuming a task in a new session or after a verification round was rejected.**
+- `lumo verdict [task] --pass | --fail` — acceptance verdicts (LUM-422). `--pass` opens the browser to the human verdict bar focused on Pass (a deep link — **records nothing**; a passing data row is only ever a human's own click). `--fail --reason <enum> [--note <text>] [--criterion <id>…]` records an **AGENT send-back** (verifierType=AGENT, verdict hard-coded FAIL) and bounces the task to IN_PROGRESS. Defaults to the session-bound task. **An unresolved send-back (machine/AGENT/human FAIL) blocks the agent/CLI DONE transition with 409** — clear it (re-verify) before `task update --status done`.
+
+**Cost (per-operation token read-out)** — see [task-context.md](references/task-context.md)
+
+- `lumo cost [--task <id>|--session <id>|--since <date>] [--by tool|model|member|session] [--json]` — per-operation (per-tool) token cost read-out. Attributes each model step's token delta to the tool(s) it ran (per-step where POST_TOOL_BATCH data exists, per-turn fallback otherwise), output vs cache_read shown separately, plus a per-step coverage line and a "heuristic" note (parallel tools split a step's tokens evenly). Scope is mutually exclusive: `--task` (one task) / `--session` (one Claude Code session) / `--since` (workspace window); default = workspace last-30-days. `--by` only changes which grouping is the headline (the others are still printed when non-trivial). For the per-task Top-5 inline, see `lumo task lineage`.
 
 **Artifacts & Figma** — see [artifacts-figma.md](references/artifacts-figma.md)
 
@@ -120,6 +125,7 @@ The command catalog below is a **map**: it lists every command grouped by domain
 **Memory** — see [memory.md](references/memory.md)
 
 - `lumo task memory add/list` · `lumo project memory add/list` — record/curate Memory (TASK vs PROJECT)
+- `lumo memory show <id>` — show one memory's full card (category + content) by id (progressive disclosure from a one-line index entry)
 - `lumo memory promote <id>` / `lumo memory rm <id> --yes` — TASK→PROJECT / delete
 
 **Sessions** — see [sessions.md](references/sessions.md)

package/assets/skill/references/criteria.md

@@ -49,6 +49,19 @@ across all stages: a criterion that already has verification runs is
 run-free criterion is hard-deleted. Either way, reword rather than delete when
 possible.
 
+### A send-back may mean the contract was wrong — amend it, don't spin off
+
+If a send-back reveals the **contract itself** was wrong or incomplete, the right
+move is to **amend the criteria on this task** (`lumo task criteria set <id>`,
+and with `--human` annotate the reason via `--cause NEW_INFO | SCOPE_CHANGE |
+DRAFT_BLIND_SPOT`) and re-verify — **not** to open a new task. Sharpening the
+contract as understanding grows is expected; that's what the drift trail is
+_for_, not something to avoid. **The line:** amending to reflect reality is
+legitimate; **weakening a criterion you were just FAILed on, purely to make it
+pass, is tampering** — it's audited and counts as a failure either way. Deleting
+a failed criterion doesn't help: the DONE gate still blocks on its standing FAIL
+(the run is soft-deleted, the verdict survives).
+
 ## Scale the contract to the task size
 
 The 3–7 range is calibrated for typical multi-file tasks. The criterion count

package/assets/skill/references/docs.md

@@ -82,7 +82,7 @@ The `Tags:` line is omitted when no tags were attached.
 | `--title <text>`         | string              | New title (cannot be empty).                                                                                                                                                                                                                                          |
 | `--content <text>`       | string              | Replace content (inline).                                                                                                                                                                                                                                             |
 | `--file <path>`          | string              | Replace content from file.                                                                                                                                                                                                                                            |
-| (stdin)                  | —                   | Pipe to replace content.                                                                                                                                                                                                                                              |
+| (stdin)                  | —                   | Pipe to replace content. Empty / whitespace-only stdin (a non-TTY shell with nothing piped — the common agent case) is treated as **no content channel**, not a body clear (LUM-505).                                                                                 |
 | `--scope <scope>`        | enum                | `personal` / `workspace`.                                                                                                                                                                                                                                             |
 | `--project <ref>`        | string              | Project name/slug. `--project ""` clears the filing.                                                                                                                                                                                                                  |
 | `--tag <name>`           | string (repeatable) | **Bulk replace** the tag set by name. Creates tag if missing. Max 20. Mutually exclusive with `--add-tag*` / `--remove-tag*`.                                                                                                                                         |
@@ -93,6 +93,8 @@ The `Tags:` line is omitted when no tags were attached.
 | `--remove-tag-id <cuid>` | string (repeatable) | Detach tag by id. Unknown ids are a no-op (no side effects). Max 20.                                                                                                                                                                                                  |
 | `--allow-shrink`         | boolean             | Let a body update through even when it drops tables/rows/headings versus the stored body (see structure guard below).                                                                                                                                                 |
 
+A **metadata-only update leaves the body untouched** (LUM-505): when no content channel is supplied (`--title`/`--scope`/`--project`/tag flags only), the body is omitted from the PATCH — it does not get blanked and the structure guard cannot fire. To deliberately clear or replace the body you must supply a content channel explicitly (`--content ""` to clear, which then hits the structure guard as a shrink → pair with `--allow-shrink`).
+
 Optimistic concurrency (LUM-409): `--if-revision <n>` only applies the update if the doc body is still at revision `n` (from `doc show`). Mismatch → 409 conflict, nothing written — re-read, rebase, retry. `--if-revision` alone is not an update (still errors "no fields to update"); same for `--allow-shrink`.
 
 **Structure guard (LUM-410), built into the server:** a body update whose new render has **fewer `table` / `tr` / heading elements than the stored body** is rejected with **422** before anything is written — the error names each shrunk category with old→new counts (e.g. `table 1→0, tr 4→0`). This is the `verify-live-doc.ts` reconciliation moved into the write path, so table flattening (LUM-349) and stale-base section loss (#460) fail loudly even when nobody remembers to run the script. When the deletion is intentional (you really are removing a section/table), re-run with `--allow-shrink`. On a 422: don't reach for `--allow-shrink` reflexively — first check whether your edit base is stale (`doc show <doc> --raw`) and rebase. Only markdown-path writes are guarded; web-editor edits and `doc sync` (Google authority) are not.

package/assets/skill/references/memory.md

@@ -26,6 +26,7 @@ lumo project memory add [<project>] --category convention --rule "..." --applies
 # Omitting --agent records the memory as produced by Claude Code.
 
 # Single-memory ops (memoryId from `... memory list` column 1)
+lumo memory show <memoryId>        # show one memory's full card by id
 lumo memory promote <memoryId>     # TASK → PROJECT
 lumo memory rm <memoryId> --yes    # hard delete
 ```
@@ -47,10 +48,29 @@ lumo task memory add LUM-42 --category decision --what "Store doc content as Tip
 lumo project memory add lumo --category procedural --workflow "Regenerate the CLI grammar snapshot" --trigger "any cli/src/commands change" --step "npx tsx scripts/analysis/lum392-cli-friction/emit-grammar.ts" --step "npx jest scripts/analysis/lum392-cli-friction" --agent claude-code
 
 # Curate
+lumo memory show cmpi19iqabc123
 lumo memory promote cmpi19iqabc123
 lumo memory rm cmpi19iqabc123 --yes
 ```
 
+### `lumo memory show <id>` (progressive disclosure)
+
+Fetches one memory's full card by id from the server and prints its category tag
+(`[TRAP]`, `[DECISION]`, `[CONVENTION]`, `[WORKFLOW]`, …) followed by the
+structured `content` body (pretty-printed JSON).
+
+- **Arg**: `<memoryId>` (required) — the id you saw in `... memory list` column 1
+  or as a one-line index entry at session start. Without it the command errors
+  with a usage line and exits 1.
+- **Errors**: not-logged-in (run `lumo auth login`), `401` invalid/revoked key,
+  `404` memory not found in your workspace (cross-workspace ids 404 too), other
+  non-2xx → generic HTTP error; all exit 1.
+
+**When to suggest**: at session start memories arrive as one-line index entries.
+When a specific entry looks relevant to the task at hand, run
+`lumo memory show <id>` to pull its full body before acting on it — read the
+detail on demand instead of carrying every memory's content in context.
+
 ### Reconcile-on-write & deduplication
 
 `memory add` does **not** unconditionally insert a new row. Before writing it:

package/assets/skill/references/task-context.md

@@ -137,15 +137,33 @@ lumo task lineage LUM-42 --signal   # append workspace-level usage signal-health
 
 - **Totals banner** — distinct sessions, fragment count, edge count,
   total tokens (input/output/cache split) and loops, and the outcome
-  distribution.
+  distribution. After the outcome summary, one funnel line is appended:
+  `- Disclosure funnel: N impressions · M INDEX (X%) · K pulled (Y% of INDEX) · J used (Z%)`
+  where impressions = edge count, INDEX% and used% are over impressions,
+  pull% is over INDEX only (FULL fragments have no pull opportunity).
+  Divide-by-zero is guarded (zero impressions or zero INDEX renders `0%`).
+  When per-fragment token weights have been collected (LUM-522), the line also
+  appends `· ~T tokens saved` = Σ(fullTokens − indexTokens) over un-pulled INDEX
+  edges (the token cost the index-only injection avoided); the suffix is omitted
+  cleanly when no edge carries token data yet (older edges predate the columns).
 - **One block per session** — the group's cost shown **once** (token/loop),
   the date it consumed context, then each context fragment as
-  `[OUTCOME] TYPE — <source label>`, plus a per-group outcome summary.
+  `[OUTCOME] TYPE — <source label>`, plus a disclosure annotation suffix:
+  `· INDEX pulled` (INDEX fragment, `pulledAt` is set) /
+  `· INDEX not-pulled` (INDEX fragment, never pulled) /
+  `· FULL` (injected in full at session-start).
+  Per-group outcome summary follows.
 
 Cost is attributed once per session (a session that injected many fragments is
 not double-counted). Fragment ids are canonical — MEMORY fragments survive
 consolidation drift.
 
+**`--signal` workspace funnel:** the workspace-level usage signal-health block
+appended by `--signal` ends with a workspace-wide disclosure funnel in the
+same format: `- Disclosure funnel: N impressions · M INDEX (X%) · K pulled (Y% of INDEX) · J used (Z%)`
+aggregated over all edges in the workspace (not just this task) — including the
+same `· ~T tokens saved` suffix when token data exists (LUM-522).
+
 **Cold start:** a task with no edges prints a friendly note (lineage is captured
 when a session-bound run consumes the task's context), not an error.
 
@@ -154,3 +172,48 @@ use, and what did it cost" for a task / merged PR — CFO / compliance / trust
 narratives.
 
 Entry point is the task identifier only; PR-number lookup is a future addition.
+
+**Top operations by token cost (LUM-523):** the lineage totals also append a
+per-task **"Top operations by token cost"** Top-5 — the most expensive tools by
+attributed token cost (`<tool> — N tokens`), ending with the pointer
+`(full breakdown: lumo cost --task <id>)`. The block is omitted when no
+per-operation cost has been attributed yet.
+
+## `lumo cost`
+
+Per-operation (per-tool) token cost read-out. Where `task lineage` answers
+"what context fed this task and what did the run cost," `lumo cost` answers
+"which _operations_ (tools) burned the tokens." It attributes each model step's
+token delta to the tool(s) that ran in it — **per-step** where the
+`POST_TOOL_BATCH` hook captured the tool list, **per-turn fallback** otherwise
+(a parallel-tool step splits its tokens evenly across the tools, hence the
+"heuristic" note). `output` (generation) and `cache_read` (~95%, structural —
+turns × context) are shown in separate columns.
+
+```bash
+lumo cost --task LUM-42
+lumo cost --session <session-id> --by model
+lumo cost --since 2026-06-01 --by member --json
+```
+
+- **Scope (mutually exclusive)** — `--task <id>` scopes to one task,
+  `--session <id>` to one Claude Code session, `--since <ISO-date>` to a
+  workspace window from that date. With none given, the default is a
+  **workspace last-30-days** window. (If more than one is passed, the CLI
+  picks task > session > since.)
+- **`--by tool|model|member|session`** (default `tool`) — only changes which
+  grouping is the **headline** table; the other groupings are still printed
+  below when non-trivial (member/session tables appear only when there is more
+  than one). Case-insensitive.
+- **`--json`** — emit the versioned payload (`version: 1`, scope, grandTotal,
+  coverage, and `byTool` / `byModel` / `byMember` / `bySession` row arrays)
+  instead of the rendered tables.
+- **Coverage line** — `Per-step attribution: X% of N tool-using turns` tells
+  you how much of the report is precise per-step attribution vs the per-turn
+  fallback. `n/a` when there were no tool-using turns.
+
+**When to suggest:** the user asks where their tokens went _by operation_ —
+"which tools are most expensive," cost attribution by model / teammate /
+session, or a workspace cost window. For the quick per-task Top-5 inline, point
+them at `lumo task lineage <id>` instead; reach for `lumo cost` for the full
+breakdown or any non-task scope.

package/assets/skill/references/verify.md

@@ -217,17 +217,17 @@ is ever agent-produced.**
 
 ```
 lumo verdict --pass
-lumo verdict LUM-42 --pass-with-followup
+lumo verdict LUM-42 --pass
 lumo verdict --fail --reason CRITERION_UNMET --note "the retry path is still missing"
 lumo verdict LUM-42 --fail --reason scope_mismatch --criterion c-abc123
 ```
 
-### --pass / --pass-with-followup — a deep link, never a write
+### --pass — a deep link, never a write
 
-These resolve the task, then open the browser to its verdict bar focused on the
-passing action. **The CLI writes nothing** — PASS / PASS_WITH_FOLLOWUP only ever
-land from a human's own click (Clerk session). Use this to hand a finished task
-to a human for the final pass; it carries them one click from recording it.
+This resolves the task, then opens the browser to its verdict bar focused on
+Pass. **The CLI writes nothing** — PASS only ever lands from a human's own click
+(Clerk session). Use this to hand a finished task to a human for the final pass;
+it carries them one click from recording it.
 
 ### --fail — the AGENT send-back
 
@@ -256,3 +256,42 @@ criteria were never adjudicated, transitions freely — the gate only blocks an
 actual send-back, never an un-adjudicated criterion. When the machine loop has
 left a task IN_REVIEW with no send-back standing, the agent may move it to DONE
 directly; a human-PASS row is a provable manual override, not a required ticket.
+
+## When a defect appears — fix in place, don't spin off a new task
+
+On a send-back **or** a self-review finding: if the issue falls under any
+existing acceptance criterion of **this** task, fix it in place and re-run
+`lumo verify`. **Do not** `lumo task create` for it. New tasks are only for work
+genuinely _outside_ this task's acceptance contract. Creating a task (and PR)
+for in-scope rework launders a first-attempt failure — it bypasses the DONE
+gate's send-back protection and corrupts the flywheel signal.
+
+This is now enforced: when you're mid-task, `lumo task create` refuses the bare
+form and makes you declare intent — `--rework-of <id>` (it redirects you back to
+fix the existing task and creates nothing) or `--new-scope` (genuinely new,
+separate work). If the send-back reveals the **contract itself** was wrong,
+amend it on this task (`lumo task criteria set`) rather than opening a new
+task — see criteria.md.
+
+**Hard rule:** while THIS task has an unresolved send-back (any criterion's
+latest verdict is FAIL — the same condition that blocks DONE), `lumo task create`
+is refused with 409 **even with `--new-scope`**. A standing send-back means the
+task can't be completed yet; resolve it (fix + `lumo verify`, or amend the
+contract) before opening any new work. `--rework-of` still redirects you to it.
+
+## Human-reported defects, once a task is submitted
+
+When someone reports a defect in conversation, your action depends on whether the
+task has **ever entered IN_REVIEW**:
+
+- **Not yet** (still your first working pass) → just fix it and continue. No
+  verdict needed — nothing was claimed complete, so there's nothing to contradict.
+- **Already submitted** (entered IN*REVIEW / DONE / merged) → **do not silently
+  fix and re-pass.** Either record your own send-back (`lumo verdict --fail`,
+  noting it was human-reported — this is \_your* honest concurrence, not a forged
+  human verdict), or ask the reporter to record a human FAIL via the web UI /
+  Slack (the only channel that can attribute it to a human). If the defect is a
+  **new requirement** not covered by any criterion, first transcribe it with
+  `lumo task criteria set --human`, then proceed. You can never write a human
+  _verdict_ — the terminal can't prove a human is behind the command
+  (attribution integrity, not anti-forgery).

package/dist/cli/src/commands/cost.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatOperationCost = formatOperationCost;
+exports.cost = cost;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+/** Deterministic thousands separator (no locale dependency, test-stable). */
+function groupThousands(value) {
+    return Math.round(value)
+        .toString()
+        .replace(/\B(?=(\d{3})+(?!\d))/g, ',');
+}
+function rankTable(title, rows) {
+    if (rows.length === 0)
+        return '';
+    const lines = [
+        title,
+        '  operation              output      cache_read       total',
+    ];
+    for (const r of rows.slice(0, 20)) {
+        lines.push(`  ${r.label.slice(0, 20).padEnd(20)}  ${groupThousands(r.output).padStart(10)}  ${groupThousands(r.cacheRead).padStart(12)}  ${groupThousands(r.total).padStart(12)}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Render an OperationCostResponse as the per-operation cost report. Pure
+ * function (no clock / env / network) so it is deterministic and unit-testable.
+ */
+function formatOperationCost(data, by) {
+    const primary = by === 'model'
+        ? data.byModel
+        : by === 'member'
+            ? data.byMember
+            : by === 'session'
+                ? data.bySession
+                : data.byTool;
+    const pct = data.coverage.perStepPct == null
+        ? 'n/a'
+        : `${Math.round(data.coverage.perStepPct * 100)}%`;
+    const out = [];
+    out.push(`Per-operation cost — ${data.scope.kind} ${data.scope.label}`);
+    out.push(`Total: output ${groupThousands(data.grandTotal.output)} · cache_read ${groupThousands(data.grandTotal.cacheRead)} · all ${groupThousands(data.grandTotal.total)} tokens`);
+    out.push(`Per-step attribution: ${pct} of ${data.coverage.toolTurns} tool-using turns (rest fall back to per-turn split)`);
+    out.push('');
+    out.push(rankTable(`By ${by}:`, primary));
+    if (by !== 'tool')
+        out.push('\n' + rankTable('By tool:', data.byTool));
+    if (by !== 'model')
+        out.push('\n' + rankTable('By model:', data.byModel));
+    if (by !== 'member' && data.byMember.length > 1)
+        out.push('\n' + rankTable('By member:', data.byMember));
+    if (by !== 'session' && data.bySession.length > 1)
+        out.push('\n' + rankTable('By session:', data.bySession));
+    out.push('');
+    out.push('Note: token→tool attribution is heuristic — a model step that fires several tools in parallel splits its tokens evenly across them; cache_read (~95%) is structural (turns × context), shown alongside output (generation).');
+    return out.join('\n');
+}
+async function cost(opts) {
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const byArg = opts.by?.toLowerCase();
+    const by = byArg === 'model' || byArg === 'member' || byArg === 'session'
+        ? byArg
+        : 'tool';
+    const params = new URLSearchParams();
+    if (opts.task)
+        params.set('task', opts.task);
+    else if (opts.session)
+        params.set('session', opts.session);
+    else if (opts.since)
+        params.set('since', opts.since);
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const qs = params.toString();
+    const url = `${(0, api_1.trimTrailingSlash)(apiUrl)}/api/cost${qs ? `?${qs}` : ''}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${opts.task ?? ''} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: server returned HTTP ${res.status}`);
+        return 1;
+    }
+    const data = (await res.json());
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    console.log(formatOperationCost(data, by));
+}

package/dist/cli/src/commands/memory-show.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryShow = memoryShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
+/**
+ * `lumo memory show <memory-id>`
+ *
+ * Progressive disclosure: fetch one memory's full card by id from
+ * `/api/memories/:id`. The agent sees memories as one-line index entries at
+ * session start; this pulls the body of a specific one on demand. Prints the
+ * category tag and the structured content.
+ */
+async function memoryShow(id) {
+    if (!id) {
+        console.error('Error: usage: lumo memory show <memory-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/memories/${encodeURIComponent(id)}`, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: memory ${id} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: memory show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { memory } = (await res.json());
+    console.log((0, sanitize_1.sanitizeField)(`[${memory.category}]`));
+    console.log((0, sanitize_1.sanitizeField)(JSON.stringify(memory.content, null, 2)));
+    // LUM-500: stamp the disclosure funnel. The arg id == lineage MEMORY
+    // fragmentId. Fire-and-forget — never blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'MEMORY', fragmentId: id });
+}

package/dist/cli/src/commands/task-create.js

@@ -38,7 +38,12 @@ async function bindTaskToSprint(base, token, workspaceSlug, sprintRef, task) {
             throw new Error(`sprint lookup failed (HTTP ${sprintRes.status})`);
         }
         const { sprint: full } = (await sprintRes.json());
-        sprint = { id: full.id, number: full.number, name: full.name, teamId: full.teamId };
+        sprint = {
+            id: full.id,
+            number: full.number,
+            name: full.name,
+            teamId: full.teamId,
+        };
     }
     assertSameTeam(task, sprint);
     const bindRes = await fetch(`${base}/api/sprints/${sprint.id}/tasks`, {
@@ -137,14 +142,22 @@ async function taskCreate(title, opts) {
         body.milestoneRef = opts.milestone;
     if (tagIds && tagIds.length > 0)
         body.tagIds = tagIds;
+    if (opts.reworkOf !== undefined)
+        body.reworkOfRef = opts.reworkOf;
+    if (opts.newScope)
+        body.newScope = true;
+    const headers = {
+        Authorization: `Bearer ${creds.token}`,
+        'Content-Type': 'application/json',
+    };
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    if (sessionId)
+        headers['X-Lumo-Session-Id'] = sessionId;
     let res;
     try {
         res = await fetch(url, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${creds.token}`,
-                'Content-Type': 'application/json',
-            },
+            headers,
             body: JSON.stringify(body),
         });
     }
@@ -165,7 +178,11 @@ async function taskCreate(title, opts) {
         if (opts.sprint) {
             const workspaceSlug = creds.workspaceSlug ?? '';
             try {
-                const sprint = await bindTaskToSprint(base, creds.token, workspaceSlug, opts.sprint, { id: data.task.id, teamId: data.task.teamId, identifier: data.task.identifier });
+                const sprint = await bindTaskToSprint(base, creds.token, workspaceSlug, opts.sprint, {
+                    id: data.task.id,
+                    teamId: data.task.teamId,
+                    identifier: data.task.identifier,
+                });
                 process.stdout.write(`Sprint: #${sprint.number} "${(0, sanitize_1.sanitizeField)(sprint.name)}"\n`);
             }
             catch (err) {

package/dist/cli/src/commands/task-figma-context.js

@@ -4,6 +4,7 @@ exports.taskFigmaContext = taskFigmaContext;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task figma context <LUM-N> <link-id>`
  *
@@ -58,4 +59,7 @@ async function taskFigmaContext(identifier, linkId) {
         console.log(`syncError: ${(0, sanitize_1.sanitizeField)(metadata.lastSyncError)}`);
     if (note)
         console.log(`\nnote: ${(0, sanitize_1.sanitizeField)(note)}`);
+    // LUM-500: stamp the disclosure funnel. The linkId arg == lineage FIGMA
+    // fragmentId. Fire-and-forget — never blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'FIGMA', fragmentId: linkId });
 }

package/dist/cli/src/commands/task-lineage.js

@@ -68,6 +68,10 @@ async function taskLineage(identifier, opts) {
 function groupThousands(n) {
     return n.toString().replace(/\B(?=(\d{3})+(?!\d))/g, ',');
 }
+/** Integer percentage, 0 when the denominator is 0 (never NaN). */
+function pct(num, den) {
+    return den === 0 ? 0 : Math.round((num / den) * 100);
+}
 const OUTCOME_ORDER = ['MERGED', 'REWORKED', 'REJECTED', 'UNKNOWN'];
 /** "2 MERGED · 1 UNKNOWN", fixed order, zeros omitted. */
 function outcomeSummary(counts) {
@@ -117,7 +121,21 @@ function formatLineageMarkdown(data) {
     const totalsOutcome = outcomeSummary(t.outcomes);
     if (totalsOutcome)
         lines.push(`- Outcomes: ${totalsOutcome}`);
+    const f = t.funnel;
+    const fSavedSuffix = f.tokensSaved != null ? ` · ~${f.tokensSaved} tokens saved` : '';
+    lines.push(`- Disclosure funnel: ${f.impressions} impressions · ` +
+        `${f.index} INDEX (${pct(f.index, f.impressions)}%) · ` +
+        `${f.pulled} pulled (${pct(f.pulled, f.index)}% of INDEX) · ` +
+        `${f.used} used (${pct(f.used, f.impressions)}%)${fSavedSuffix}`);
     lines.push('');
+    if (data.totals.topOperations.length > 0) {
+        lines.push('');
+        lines.push('Top operations by token cost:');
+        for (const op of data.totals.topOperations) {
+            lines.push(`  ${op.tool} — ${op.total.toLocaleString('en-US')} tokens`);
+        }
+        lines.push('  (full breakdown: lumo cost --task <id>)');
+    }
     for (const g of data.groups) {
         lines.push(`## ${(0, sanitize_1.sanitizeField)(g.label)} · ${g.includedAt.slice(0, 10)}`);
         if (g.cost) {
@@ -130,7 +148,12 @@ function formatLineageMarkdown(data) {
         lines.push(`**Fragments** (${g.fragments.length}${summary ? `: ${summary}` : ''}):`);
         lines.push('_✓ used · · abstained · ✗ unused (manual)_');
         for (const f of g.fragments) {
-            lines.push(`- ${usageMarker(f.used)} [${f.outcome}] ${f.fragmentType} — ${(0, sanitize_1.sanitizeField)(f.sourceLabel)}`);
+            const tag = f.disclosure === 'INDEX'
+                ? f.pulled
+                    ? 'INDEX pulled'
+                    : 'INDEX not-pulled'
+                : 'FULL';
+            lines.push(`- ${usageMarker(f.used)} [${f.outcome}] ${f.fragmentType} — ${(0, sanitize_1.sanitizeField)(f.sourceLabel)} · ${tag}`);
         }
         lines.push('');
     }
@@ -153,5 +176,12 @@ function formatSignalHealth(h) {
     else {
         lines.push('- Used × outcome: insufficient resolved tasks');
     }
+    lines.push(`- Spinoffs during in-flight work: ${h.spinoffsDuringInFlight} (recorded, not yet judged)`);
+    const f = h.disclosureFunnel;
+    const fSavedSuffix = f.tokensSaved != null ? ` · ~${f.tokensSaved} tokens saved` : '';
+    lines.push(`- Disclosure funnel: ${f.impressions} impressions · ` +
+        `${f.index} INDEX (${pct(f.index, f.impressions)}%) · ` +
+        `${f.pulled} pulled (${pct(f.pulled, f.index)}% of INDEX) · ` +
+        `${f.used} used (${pct(f.used, f.impressions)}%)${fSavedSuffix}`);
     return lines.join('\n');
 }

package/dist/cli/src/commands/task-slack-show.js

@@ -4,6 +4,7 @@ exports.taskSlackShow = taskSlackShow;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task slack show <LUM-N> <context-id>`
  *
@@ -50,10 +51,14 @@ async function taskSlackShow(identifier, contextId) {
     const messages = snapshot?.messages ?? [];
     if (messages.length === 0) {
         console.log('(no messages in stored snapshot)');
-        return;
     }
-    for (const m of messages) {
-        const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
-        console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+    else {
+        for (const m of messages) {
+            const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
+            console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+        }
     }
+    // LUM-500: stamp the disclosure funnel. The contextId arg == lineage
+    // SLACK_CONTEXT fragmentId. Fire-and-forget — never blocks, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'SLACK_CONTEXT', fragmentId: contextId });
 }

package/dist/cli/src/commands/task-status.js

@@ -104,6 +104,18 @@ function formatTaskStatus(data, extras = {}) {
                 lines.push('      ⚠ pre-edit version — criterion changed since this check; re-run `lumo verify` to re-confirm');
             }
         }
+        // LUM-511 Phase 5: send-back lifecycle (was this criterion's send-back
+        // resolved, and by which PR).
+        const sb = c.sendBackResolution;
+        if (sb) {
+            if (sb.status === 'resolved') {
+                const pr = sb.closingPrNumber ? ` · PR #${sb.closingPrNumber}` : '';
+                lines.push(`      ↳ send-back (r${sb.failedAtRound}) resolved in r${sb.resolvedAtRound}${pr}`);
+            }
+            else {
+                lines.push(`      ↳ send-back (r${sb.failedAtRound}) open`);
+            }
+        }
     }
     if (data.verificationHistory.length > 0) {
         lines.push('');

package/dist/cli/src/commands/task-web-show.js

@@ -4,6 +4,7 @@ exports.taskWebShow = taskWebShow;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
 /**
  * `lumo task web show <LUM-N> <link-id>`
  *
@@ -58,7 +59,11 @@ async function taskWebShow(identifier, linkId) {
     const { body } = (await res.json());
     if (!body || body.trim().length === 0) {
         console.log('(empty body)');
-        return;
     }
-    console.log((0, sanitize_1.sanitizeField)(body));
+    else {
+        console.log((0, sanitize_1.sanitizeField)(body));
+    }
+    // LUM-500: stamp the disclosure funnel. The linkId arg == lineage WEB_LINK
+    // fragmentId. Fire-and-forget — never blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'WEB_LINK', fragmentId: linkId });
 }

package/dist/cli/src/commands/verdict.js

@@ -25,10 +25,10 @@ function collectCriterion(value, prev = []) {
 /**
  * `lumo verdict [task]` — human + agent acceptance verdicts (LUM-422).
  *
- * Three modes, exactly one required:
- *   --pass / --pass-with-followup  open the browser to the task's verdict bar,
- *       focused on the passing action (a deep link — writes NOTHING; a passing
- *       data row is only ever produced by a human's own click, red line).
+ * Two modes, exactly one required:
+ *   --pass  opens the browser to the task's verdict bar, focused on Pass (a deep
+ *       link — writes NOTHING; a passing data row is only ever produced by a
+ *       human's own click, red line).
  *   --fail --reason <enum> [--note] [--criterion …]  records an AGENT send-back
  *       (verdict hard-coded FAIL server-side) and bounces the task to
  *       IN_PROGRESS. Bearer-authed.
@@ -36,13 +36,9 @@ function collectCriterion(value, prev = []) {
  * Defaults to the session-bound task; an explicit identifier overrides.
  */
 async function verdict(identifier, options = {}) {
-    const modes = [
-        options.pass && 'pass',
-        options.passWithFollowup && 'pass-with-followup',
-        options.fail && 'fail',
-    ].filter(Boolean);
+    const modes = [options.pass && 'pass', options.fail && 'fail'].filter(Boolean);
     if (modes.length === 0) {
-        console.error('Error: choose a verdict mode — --pass, --pass-with-followup, or --fail.');
+        console.error('Error: choose a verdict mode — --pass or --fail.');
         return 1;
     }
     if (modes.length > 1) {
@@ -90,14 +86,14 @@ async function verdict(identifier, options = {}) {
     if (options.fail) {
         return failVerdict(base, headers, taskId, options, creds.workspaceSlug);
     }
-    return passDeepLink(base, headers, taskId, options.passWithFollowup ? 'pass_with_followup' : 'pass', creds.workspaceSlug);
+    return passDeepLink(base, headers, taskId, creds.workspaceSlug);
 }
 /**
- * --pass / --pass-with-followup: open the human's verdict bar pre-focused on the
- * passing action. The CLI never writes the verdict — it only carries the human
- * to the one click that does (red line: no agent-produced passing row).
+ * --pass: open the human's verdict bar pre-focused on Pass. The CLI never writes
+ * the verdict — it only carries the human to the one click that does (red line:
+ * no agent-produced passing row).
  */
-async function passDeepLink(base, headers, taskId, verdictParam, workspaceSlug) {
+async function passDeepLink(base, headers, taskId, workspaceSlug) {
     let res;
     try {
         res = await fetch(`${base}/api/tasks/by-identifier/${encodeURIComponent(taskId)}`, { headers });
@@ -125,9 +121,8 @@ async function passDeepLink(base, headers, taskId, verdictParam, workspaceSlug)
         return 1;
     }
     const sep = task.url.includes('?') ? '&' : '?';
-    const deepLink = `${task.url}${sep}verdict=${verdictParam}`;
-    const label = verdictParam === 'pass_with_followup' ? 'Pass with follow-up' : 'Pass';
-    process.stdout.write(`Opening ${taskId} for a human "${label}" verdict (nothing is recorded until they click):\n` +
+    const deepLink = `${task.url}${sep}verdict=pass`;
+    process.stdout.write(`Opening ${taskId} for a human "Pass" verdict (nothing is recorded until they click):\n` +
         `  ${(0, sanitize_1.sanitizeField)(deepLink)}\n`);
     (0, browser_1.openBrowser)(deepLink);
     return;

package/dist/cli/src/index.js

@@ -47,6 +47,7 @@ const session_attach_1 = require("./commands/session-attach");
 const session_status_1 = require("./commands/session-status");
 const session_wrap_1 = require("./commands/session-wrap");
 const next_1 = require("./commands/next");
+const cost_1 = require("./commands/cost");
 const verify_1 = require("./commands/verify");
 const verdict_1 = require("./commands/verdict");
 const task_context_1 = require("./commands/task-context");
@@ -66,6 +67,7 @@ const memory_project_list_1 = require("./commands/memory-project-list");
 const memory_project_add_1 = require("./commands/memory-project-add");
 const memory_promote_1 = require("./commands/memory-promote");
 const memory_rm_1 = require("./commands/memory-rm");
+const memory_show_1 = require("./commands/memory-show");
 const task_artifact_add_1 = require("./commands/task-artifact-add");
 const task_criteria_set_1 = require("./commands/task-criteria-set");
 const task_criteria_list_1 = require("./commands/task-criteria-list");
@@ -221,9 +223,8 @@ program
     .action(wrap((task, options) => (0, verify_1.verify)(task, options)));
 program
     .command('verdict [task]')
-    .description('Acceptance verdict (LUM-422). --pass / --pass-with-followup open the browser to the human verdict bar focused on the passing action (a deep link — records nothing; a passing row is only ever a human click). --fail --reason <enum> records an AGENT send-back and bounces the task to IN_PROGRESS. Defaults to the session-bound task.')
+    .description('Acceptance verdict (LUM-422). --pass opens the browser to the human verdict bar focused on Pass (a deep link — records nothing; a passing row is only ever a human click). --fail --reason <enum> records an AGENT send-back and bounces the task to IN_PROGRESS. Defaults to the session-bound task.')
     .option('--pass', 'Open the verdict bar focused on Pass (human one-click; no write)')
-    .option('--pass-with-followup', 'Open the verdict bar focused on Pass with follow-up (human one-click; no write)')
     .option('--fail', 'Record an AGENT send-back (verdict FAIL) — requires --reason')
     .option('--reason <enum>', 'Rejection reason for --fail: CRITERION_UNMET | EVIDENCE_INSUFFICIENT | CHECK_EXECUTION_ERROR | SCOPE_MISMATCH | OTHER (case-insensitive)')
     .option('--note <text>', 'Optional send-back narrative, posted as a task comment')
@@ -234,6 +235,15 @@ program
     .description('Recommend the next task(s) to work on, ranked by priority, active sprint, and due date. Prints top N (default 3); pick one and run `session attach` + `task context`.')
     .option('-n, --count <N>', 'Number of tasks to recommend (default 3)')
     .action(wrap(options => (0, next_1.nextCommand)(options)));
+program
+    .command('cost')
+    .description('Show per-operation (per-tool) token cost. Defaults to a workspace 30-day window; scope with --task / --session')
+    .option('--task <id>', 'Aggregate a single task (e.g. LUM-42)')
+    .option('--session <id>', 'Aggregate a single Claude Code session')
+    .option('--since <date>', 'Workspace window lower bound (ISO date); default last 30 days')
+    .option('--by <dim>', 'Headline grouping: tool | model | member | session (case-insensitive; default tool)')
+    .option('--json', 'Emit the versioned payload as JSON')
+    .action(wrap(options => (0, cost_1.cost)(options)));
 const session = program
     .command('session')
     .description('Manage per-terminal coding-session context');
@@ -291,6 +301,8 @@ task
     .option('--tag <name>', 'Attach tag by name (repeatable)', collect, [])
     .option('--tag-id <cuid>', 'Attach tag by id (repeatable)', collect, [])
     .option('--sprint <ref>', 'Sprint number or UUID to add the task to after creation')
+    .option('--rework-of <id>', 'Declare this is rework of an existing task (redirects you to fix it; creates nothing)')
+    .option('--new-scope', 'Declare this is genuinely new work, outside your current task’s scope')
     .action(wrap((title, options) => (0, task_create_1.taskCreate)(title, options)));
 const taskFigma = task
     .command('figma')
@@ -489,6 +501,10 @@ projectMemory
 const memoryCmd = program
     .command('memory')
     .description('Operate on a single memory by id (see `lumo task memory` / `lumo project memory` to list/add)');
+memoryCmd
+    .command('show <memoryId>')
+    .description("Show one memory's full card by id (category + content). Use to pull the body of a memory you saw as a one-line index entry at session start.")
+    .action(wrap((id) => (0, memory_show_1.memoryShow)(id)));
 memoryCmd
     .command('promote <memoryId>')
     .description('Promote a TASK memory to PROJECT scope. Only when the lesson recurs across 2+ tasks.')

package/dist/cli/src/lib/doc-input.js

@@ -81,6 +81,13 @@ async function resolveDocContent(args) {
     }
     if (!args.stdinIsTTY) {
         const text = await args.readStdin();
+        // A non-TTY shell with nothing piped (the common agent/CI case) yields an
+        // empty read. Treat empty/whitespace-only stdin as "no content channel"
+        // so a title-only `doc update` doesn't ship an empty body and trip the
+        // LUM-410 structure guard / blank the document (LUM-505). To clear a body
+        // deliberately, pass an explicit `--content ""` (handled above).
+        if (text.trim().length === 0)
+            return { kind: 'none' };
         return { kind: 'ok', markdown: text };
     }
     return { kind: 'none' };

package/dist/cli/src/lib/hook-runner.js

@@ -12,7 +12,6 @@ const hook_log_1 = require("./hook-log");
 const sanitize_1 = require("./sanitize");
 const agent_1 = require("./agent");
 const git_task_1 = require("./git-task");
-const format_1 = require("./format");
 const transcript_usage_1 = require("./transcript-usage");
 /**
  * Hard timeout for the hook POST. On timeout the request is aborted,
@@ -72,7 +71,11 @@ function readStdin() {
  * The JSON lines conform to Claude Code's hookSpecificOutput envelope so the
  * runtime injects additionalContext into the conversation automatically.
  */
-function formatHookStdoutLines(path, responseBody, now = new Date()) {
+function formatHookStdoutLines(path, responseBody, 
+// Retained for signature stability (callers/tests still pass it). LUM-500
+// removed the only time-dependent rendering (the recovery card), so it is no
+// longer read.
+_now = new Date()) {
     if (path === 'pre-tool-use') {
         if (responseBody == null || typeof responseBody !== 'object')
             return [];
@@ -107,20 +110,27 @@ function formatHookStdoutLines(path, responseBody, now = new Date()) {
     else if (tb && tb.bound === false) {
         lines.push(unboundPromptLine(sessionId));
     }
-    // Recovery card + blocker warning + memory + linked resources + PR-review
-    // todos share one additionalContext block so Claude Code injects a single
-    // coherent context payload at session start. The card slots in first so it's
-    // the first thing the model reads; the dependency blocker warning (LUM-172)
-    // comes right after so it stays prominent, ahead of the memory section.
-    const card = renderRecoveryCard(body.previousSession, tb?.taskIdentifier ?? '', now);
+    // Blocker warning + criteria + progress + memory + linked resources +
+    // PR-review todos share one additionalContext block so Claude Code injects a
+    // single coherent context payload at session start. The dependency blocker
+    // warning (LUM-172) slots in first so it stays prominent — it can preempt the
+    // session's work entirely. Then the progressive-disclosure tiers (LUM-500):
+    // Tier-0 acceptance contract → Tier-1 prior-session progress → Tier-2 memory
+    // index → linked resources.
+    //
+    // LUM-500: the prior-session recovery is now the server-rendered Tier-1
+    // `progressSection`, which REPLACES the CLI-rendered recovery card so progress
+    // isn't injected twice. `body.previousSession` is still sent (it drives the
+    // server's lineage/metrics) but is no longer rendered here.
     const envelope = sessionContextEnvelope([
-        card,
-        // Blocker warning right after the card: it can preempt the session's
-        // work entirely (wait for the blocker instead of starting) — LUM-172.
+        // Blocker warning first: it can preempt the session's work entirely (wait
+        // for the blocker instead of starting) — LUM-172.
         body.blockerWarningSection,
-        // Acceptance contract next: it's what the session's work is judged
-        // against (LUM-342).
+        // Tier-0 acceptance contract: what the session's work is judged against
+        // (LUM-342).
         body.criteriaSection,
+        // Tier-1 prior-session progress (LUM-500), server-rendered.
+        body.progressSection,
         body.memorySection,
         body.linkedResourcesSection,
         body.reviewTodosSection,
@@ -137,37 +147,6 @@ function formatHookStdoutLines(path, responseBody, now = new Date()) {
 function unboundPromptLine(sessionId) {
     return `[Lumo] session_id=${sessionId} | No task bound. Tell me the task you want to work on (e.g. LUM-42), or say "skip".`;
 }
-const MAX_UNRESOLVED = 5;
-/**
- * Render the "resuming previous session" recovery card from the structured previousSession
- * payload. Returns undefined when there's nothing to show (null payload or an
- * empty headline). Free text (headline / unresolved) is sanitized here — it's
- * LLM-generated and routed to Claude Code stdout. unresolved is capped at
- * MAX_UNRESOLVED with a "+M more" pointer to `lumo task context`.
- */
-function renderRecoveryCard(prev, taskIdentifier, now) {
-    if (!prev || typeof prev.headline !== 'string' || prev.headline === '') {
-        return undefined;
-    }
-    const ago = (0, format_1.relativeTime)(new Date(prev.lastActivityAt), now);
-    const dur = (0, format_1.formatDuration)(prev.durationMs);
-    const lines = [
-        `## Resuming previous session (${ago} · ${dur})`,
-        `Last stopped at: ${(0, sanitize_1.sanitizeField)(prev.headline)}`,
-    ];
-    const unresolved = Array.isArray(prev.unresolved) ? prev.unresolved : [];
-    if (unresolved.length > 0) {
-        lines.push('Unfinished:');
-        const shown = unresolved.slice(0, MAX_UNRESOLVED);
-        for (const u of shown)
-            lines.push(`- ${(0, sanitize_1.sanitizeField)(u)}`);
-        const extra = unresolved.length - shown.length;
-        if (extra > 0) {
-            lines.push(`- … (+${extra} more — run \`lumo task context ${taskIdentifier}\` for the full list)`);
-        }
-    }
-    return lines.join('\n');
-}
 /**
  * Wrap any non-empty context parts into a single SessionStart
  * hookSpecificOutput envelope so Claude Code injects one coherent
@@ -204,7 +183,9 @@ function formatSuggestLine(sessionId, match) {
  * detect-and-suggest, never auto-bind). No match falls back to the generic
  * unbound prompt.
  */
-function resolveSessionStartStdout(responseBody, deps, now = new Date()) {
+function resolveSessionStartStdout(responseBody, deps, 
+// Retained for signature stability; no longer read (see formatHookStdoutLines).
+_now = new Date()) {
     if (responseBody == null || typeof responseBody !== 'object')
         return [];
     const body = responseBody;
@@ -213,7 +194,7 @@ function resolveSessionStartStdout(responseBody, deps, now = new Date()) {
     const sessionId = body.sessionId;
     const tb = body.taskBinding;
     if (tb && tb.bound === true) {
-        return formatHookStdoutLines('session-start', responseBody, now);
+        return formatHookStdoutLines('session-start', responseBody);
     }
     if (!tb || tb.bound !== false)
         return [];

package/dist/cli/src/lib/report-pull.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportPull = reportPull;
+const config_1 = require("./config");
+const api_1 = require("./api");
+/**
+ * Fire-and-forget telemetry for progressive disclosure (LUM-500).
+ *
+ * When an agent pulls a fragment's body via a `lumo … show <id>` command, this
+ * reports the pull to the server, which stamps `pulledAt` on the session-start
+ * lineage edge — the middle of the disclosure funnel (saw → pulled → used).
+ *
+ * Contract:
+ * - NO-OP silently when there is no bound session (nothing is sent). The bound
+ *   session id is `CLAUDE_CODE_SESSION_ID` — the same source other commands use
+ *   for `X-Lumo-Session-Id` provenance.
+ * - Fire-and-forget: never blocks the command's main output and never surfaces
+ *   an error. All failures (no creds, network, non-ok) are swallowed. Returns
+ *   void so callers can `await` it without affecting their exit code.
+ *
+ * `fragmentId` must be the DB row id the lineage edge stored — callers are
+ * responsible for passing the id that matches (see each command's wiring).
+ */
+async function reportPull(ref) {
+    try {
+        const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+        if (!sessionId)
+            return;
+        const creds = (0, config_1.readCredentials)();
+        if (!creds)
+            return;
+        const base = (0, api_1.trimTrailingSlash)((0, api_1.resolveAuthedApiUrl)(creds.apiUrl));
+        await fetch(`${base}/api/lineage/pulls`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                sessionId,
+                fragmentType: ref.fragmentType,
+                fragmentId: ref.fragmentId,
+            }),
+        });
+    }
+    catch {
+        // fire-and-forget: never surface telemetry failures
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumoai/cli",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Lumo CLI — manage tasks and sessions from the terminal",
   "license": "MIT",
   "author": "cli@uselumo.ai",