@lumoai/cli 1.55.0 → 1.57.0

package/assets/skill/SKILL.md

@@ -74,12 +74,73 @@ The command catalog below is a **map**: it lists every command grouped by domain
 
 - `lumo idea "<statement>" [--context <text>]` — capture a team-level idea into the pool in <10s. Provenance is grabbed opportunistically and never blocks the capture: the current `CLAUDE_CODE_SESSION_ID` (→ sourceSessionId) and the session's bound task (→ sourceTaskId, null when nothing is bound). Prints an **I-prefixed** id (`✓ 想法 LUM-I42 已入池`) — the `I` keeps ideas from colliding with task ids (`LUM-42`) in the same team namespace. Ideas are team-scoped (no project); the workspace's default team owns them. The unprocessed (CAPTURED) pool is what the Phase-2 transformer consumes.
   - **When to suggest**: the user has a stray idea/thought/improvement they want to park without derailing the current task ("记一下这个想法", "capture this idea", "add to the backlog of ideas"). Prefer this over `task create` for un-triaged sparks — an idea is above projects and isn't yet actionable work.
+  - **Example**:
+    ```bash
+    lumo idea "Add a quick-capture keyboard shortcut" --context "raised in standup"
+    ```
+- `lumo idea list` — print the team idea pool **newest-first**, one line per idea: the `LUM-I<n>` id, status (`CAPTURED` | `DEVELOPING` | `PLANNED` | `DROPPED`) and statement. Reads `GET /api/ideas`, which returns the whole pool (every status), not just the unprocessed slice. Empty pool prints `No ideas.`. The same pool is browsable/searchable in web at `/workspace/<slug>/ideas` (sidebar → Ideas), where a PLANNED idea links to the plan run that materialised it and the status filter hides DROPPED by default.
+  - **When to suggest**: the user wants to see what's parked in the idea pool / "看看想法池" / "list the ideas" / triage before running `lumo plan`.
+  - **Example**:
+    ```bash
+    lumo idea list
+    ```
+- `lumo idea update <id> --status <captured|developing|planned|dropped>` — move an idea through its lifecycle (LUM-679). `<id>` is the `LUM-I<n>` id (a bare number also resolves); `--status` is case-insensitive. The four states are `CAPTURED` (pooled) → `DEVELOPING` (in triage / pre-work) → `PLANNED` (consumed by an initiative/plan), with `DROPPED` the terminal discard. Allowed transitions: `CAPTURED↔DEVELOPING`, `DEVELOPING→PLANNED`, and **any non-terminal → DROPPED**; nothing transitions out of `DROPPED`, and `CAPTURED→PLANNED` is not a manual move (only the converter's materialisation lands an idea in PLANNED). An illegal move is rejected with a clear error (400); an unknown id → 404.
+  - **When to suggest**: the user wants to triage the pool by hand — start pre-work on an idea ("开始预研这个想法" → `developing`), or discard one ("废弃/丢掉这个想法" → `dropped`). The status control also lives on the Idea detail page in web.
+  - **Example**:
+    ```bash
+    lumo idea update LUM-I42 --status developing
+    lumo idea update LUM-I42 --status dropped
+    ```
+- `lumo idea slack add/show/rm <idea> ...`, `lumo idea web add/show/rm <idea> ...`, `lumo idea figma add/list/rm/refresh/context <idea> ...` (LUM-681) — attach & inspect evidence (Slack threads, web links, Figma design links) on an idea, mirroring the `task slack/web/figma` source-card commands but hitting `/api/ideas/:id/...`. `<idea>` is the `LUM-I<n>` id. `show`/`context` are Tier-2 retrieval (stored snapshot / fetched body / cached design metadata, no live re-fetch) and stamp the disclosure funnel like their task-side counterparts; `figma refresh` re-fetches metadata for every link on the idea.
+  - **When to suggest**: the user wants to attach supporting evidence (a Slack discussion, a spec doc link, a Figma mock) to an idea before it goes through `lumo plan` — the converter carries this evidence forward into the resulting task/initiative. Prefer attaching to the idea over waiting until after conversion.
+  - **Example**:
+    ```bash
+    lumo idea web add LUM-I42 https://example.com/spec
+    lumo idea web show LUM-I42 wl_1
+    lumo idea web rm LUM-I42 wl_1
+    lumo idea slack add LUM-I42 https://myteam.slack.com/archives/C1/p123
+    lumo idea slack show LUM-I42 ctx_1
+    lumo idea slack rm LUM-I42 ctx_1
+    lumo idea figma add LUM-I42 https://www.figma.com/file/abc/Mock
+    lumo idea figma list LUM-I42
+    lumo idea figma context LUM-I42 cfl_1
+    lumo idea figma refresh LUM-I42
+    lumo idea figma rm LUM-I42 cfl_1
+    ```
+
+- `lumo idea comment <id> <body>` — post a comment on an idea (LUM-680). `<id>` is the `LUM-I<n>` id (a bare number also resolves) or a cuid; the body is plain text — quote it to pass spaces/newlines. Ideas reuse the task Comment model via a polymorphic `ideaId`; the thread is flat (no replies). Posting also records a `COMMENT_ADDED` entry on the idea's activity timeline. Comments/activity also render on the Idea detail slide-over in web.
+- `lumo idea comments list <id> [--full]` — print an idea's comment thread (oldest first), capped to the output budget like `task comments list`; `--full` prints every comment. Empty thread → `(no comments)`.
+  - **When to suggest**: the user wants to discuss or annotate a parked idea ("给这个想法加条评论", "comment on the idea"), or review an idea's discussion/history ("看看这个想法的评论/活动"). For the activity timeline (status changes, statement edits, materialisation) there is no CLI reader — it's shown on the Idea detail slide-over in web.
+  - **Example**:
+    ```bash
+    lumo idea comment LUM-I42 "Let's scope this for next sprint"
+    lumo idea comments list LUM-I42
+    ```
 
 **Plan runs (design-thinking 转换器)**
 
 - `lumo plan [--abandon-active]` — start a converter run that turns the team's captured idea pool + current priority into an executable plan through a 3-gate recoverable state machine (聚类→对齐→成计划). Freezes the input snapshot at start and enforces **one active run per team**: if a run is already active it refuses and points to `lumo plan status`; `--abandon-active` abandons the prior run first, then starts fresh. On success it prints (and opens) the **gate-A** web deep-link (`/workspace/<slug>/plan/<runId>`). The CLI only triggers — **all editing and gate confirmation happen in web**.
 - `lumo plan status` — print the active run's current stage (working segment or the open `*_READY` gate) and the deep-link to act on its next gate; with no active run, prompts to run `lumo plan`.
   - **When to suggest**: the user wants to turn the parked idea pool into a plan / "跑一下转换器" / "start a planning run" / "把想法变成计划"; or asks where an in-flight plan run stands ("plan 到哪一步了", "plan status"). The gate work itself is web-only — the CLI hands off the deep-link.
+  - **Example** — check where the active run stands:
+    ```bash
+    lumo plan status
+    ```
+
+**Initiatives (team-level, LUM-INIT-<n>)**
+
+- `lumo initiative create "<goal>" [--assumption <text>]` — create a team-level Initiative **directly, no plan run required** (`planRunId=null`, status `ACTIVE`). Prints the `LUM-INIT-<n>` id; `--assumption` records the bet (赌注旁注) behind it. A blank goal is rejected (400). Converter-materialised initiatives (from `lumo plan`) live in the same list.
+  - **When to suggest**: the user wants to stand up a strategic initiative directly — "建一个 initiative" / "create an initiative" / "开一个举措" — without running the converter.
+  - **Example**:
+    ```bash
+    lumo initiative create "Ship the initiatives browse surface" --assumption "teams curate initiatives directly"
+    ```
+- `lumo initiative list` — print the team's initiatives newest-first, one line per initiative: the `LUM-INIT-<n>` id, status (`ACTIVE` | `DONE` | `DROPPED`) and goal. Browsable in web at `/workspace/<slug>/initiatives` (sidebar → Initiatives), where each links to its lineage (consumed ideas + attached tasks).
+  - **When to suggest**: the user wants to see the team's initiatives / "看看 initiatives" / "list the initiatives".
+  - **Example**:
+    ```bash
+    lumo initiative list
+    ```
 
 **Task dependencies** — see [task-deps.md](references/task-deps.md)
 
@@ -97,7 +158,7 @@ The command catalog below is a **map**: it lists every command grouped by domain
 
 **Verification (machine acceptance loop)** — see [verify.md](references/verify.md)
 
-- `lumo verify [task] --note "<self-report>" [--timeout <seconds>]` — run every MACHINE criterion's checkpointer locally and report a structured PASS/FAIL verdict per criterion. **`--note` is required** when a round will be posted: a one-line self-report ("我改了 X,因为 Y 可验收") frozen as your task's claim (source AGENT) the moment the round passes into IN_REVIEW, then checked against the diff for faithfulness. No note → no round posted (none burned). Round cap 3: all-pass → task to IN_REVIEW (agent stops); round-3 fail → escalate to human. **Run this before claiming a task is done.**
+- `lumo verify [task] --note "<self-report>" [--timeout <seconds>]` — run every MACHINE criterion's checkpointer locally and report a structured PASS/FAIL verdict per criterion. **`--note` is required** when a round will be posted: a one-line self-report ("我改了 X,因为 Y 可验收") frozen as your task's claim (source AGENT) the moment the round passes into IN_REVIEW, then checked against the diff for faithfulness. No note → no round posted (none burned). The round cap is the workspace's `verificationMaxRounds` (default 3) — read the actual budget off the `Round N/M` line the command prints, never assume a number. All-pass → task to IN_REVIEW (agent stops); a fail on the last round → escalate to human. **Run this before claiming a task is done.**
 - `lumo task status [task] [--json]` — read-only acceptance self-check (no LLM): the contract with each criterion's latest verdict, verification history/round, last failure reasons, `nextActions` (the unmet criteria), and any OPEN boundary crossings (fails closed — `null`/`⚠` means "could not confirm", not safe). **Run it first when resuming a task or after a round was rejected.**
 - `lumo verdict [task] --pass | --fail` — acceptance verdicts. `--pass` deep-links to the human verdict bar (records nothing). `--fail --reason <enum> …` records an AGENT send-back → IN_PROGRESS. **An unresolved send-back blocks the DONE transition with 409.**
 - `lumo crossing explain <id> --note "<text>"` — append an agent self-explanation ("申辩") to a boundary crossing; append-only, **never clears the crossing or unblocks Done** (disposition stays web + human-only). A review aid, not a self-clear.
@@ -207,6 +268,16 @@ lumo criteria audit
 
 **When to suggest**: when the user wants to audit how much of the workspace's "green" criteria are self-confirming vs externally anchored; when diagnosing whether acceptance criteria have real external hooks or are circular.
 
+## Next-step hints (the trailing `Next:` block)
+
+`task create`, `task update`, `session attach`, `task context` and `next` end with a short `Next:` block naming what to do now — attach an unbound session, draft a missing contract, run `lumo verify`, read `task status` after a rejected round, explain an open boundary crossing, or stop and wait when the task is IN_REVIEW.
+
+The rules are computed **server-side** from task status × contract × session binding × verify round, so the advice tracks the real state machine rather than a hard-coded string. Capped at **3 suggestions**; a rule whose condition is already satisfied never appears. The block goes to **stdout**, after the command's own result line — the result line stays first and unchanged, so reading line 1 still works.
+
+Silence it with `--no-hints` on any command, or `LUMO_NO_HINTS=1` for a whole shell.
+
+The block never replaces the acceptance-contract section: on `session attach` / `task context` the criteria draft reminder comes from `criteriaSection` and is deliberately **not** repeated as a step.
+
 ## Commands & flags that do NOT exist (common mistakes)
 
 Don't guess these:
@@ -231,7 +302,7 @@ Don't guess these:
 2. `lumo task context LUM-42` — load background; review unresolved items, PR-review todos, the description
 3. **If the task has no acceptance criteria** (context shows the draft reminder, not a contract): draft outcome-level criteria sized to the task (3–7 for a typical multi-file task; 1–2 for a micro task) and submit them with `lumo task criteria set` **before writing the first line of code** — see [criteria.md](references/criteria.md)
 4. Do the work
-5. **Before claiming done: `lumo verify`** — the machine half of the acceptance loop. Fix failures and re-run (round cap 3). All-pass → task moves to IN_REVIEW and you stop. See [verify.md](references/verify.md)
+5. **Before claiming done: `lumo verify`** — the machine half of the acceptance loop. Fix failures and re-run (the cap is workspace-configurable — see the `Round N/M` line in the output). All-pass → task moves to IN_REVIEW and you stop. See [verify.md](references/verify.md)
 
 **Resuming / after a send-back** — `lumo task status` **before** re-reading code or planning. It tells you where the loop stands (round, what passed, what's unmet and why, any REVIEW_ADDED criteria from review) so you don't redo finished work or miss why it bounced. A send-back means **fix in place / amend the contract — do not spin off a new task.** See [verify.md](references/verify.md)
 

package/assets/skill/references/criteria.md

@@ -219,4 +219,4 @@ lumo task criteria list LUM-42
 
 ## After the contract: the verification loop
 
-The contract is judged by `lumo verify` — run it before claiming the task is done. See [verify.md](verify.md) for the loop (round cap 3, IN_REVIEW on all-pass, escalation on a round-3 fail).
+The contract is judged by `lumo verify` — run it before claiming the task is done. See [verify.md](verify.md) for the loop (a workspace-configurable round cap — `verificationMaxRounds`, default 3, shown as `Round N/M` in the output — IN_REVIEW on all-pass, escalation on a last-round fail).

package/assets/skill/references/priority.md

@@ -17,11 +17,8 @@ Declare the current team priority.
   ```bash
   lumo priority "Ship the idea-capture MVP; defer the converter to Spec 2."
   ```
-- **With no argument** — prompts interactively for a 1-3 sentence statement:
-  ```bash
-  lumo priority
-  # Priority (1-3 sentences): _
-  ```
+- **With no argument** — running `lumo priority` on its own prompts
+  interactively for a 1-3 sentence statement (`Priority (1-3 sentences): _`).
   An empty prompt records nothing and exits non-zero.
 
 On success it prints `Recorded priority: <statement>`. A blank statement is
@@ -32,6 +29,10 @@ rejected (the API's Zod layer returns 400).
 Print the append history, newest-first. The current declaration (the row with
 the latest `effectiveFrom`) is marked with a leading `*`:
 
+```bash
+lumo priority list
+```
+
 ```
 * 2026-02-01  Now focus on the converter state machine
   2026-01-01  Ship the idea-capture MVP

package/assets/skill/references/tasks.md

@@ -34,9 +34,15 @@ On success the command prints one or two lines to stdout:
 ```
 Created LUM-55 "Title"  https://www.uselumo.ai/workspace/<slug>/my-tasks/LUM-55
 Tags: bug, urgent
+
+Next:
+  lumo session attach LUM-55
+      Bind this session to the task so its work is recorded against it
+  lumo task criteria set LUM-55 --file <criteria.json>
+      Draft the acceptance contract before writing the first line of code
 ```
 
-The `Tags:` line is omitted when no tags were attached.
+The `Tags:` line is omitted when no tags were attached. The trailing `Next:` block is server-computed and conditional — the attach line is skipped when this session is already bound (a second attach is a 409), and the whole block is suppressed by `--no-hints` / `LUMO_NO_HINTS=1`. The `Created …` line stays first and unchanged. See SKILL.md "Next-step hints".
 
 If the workspace has multiple projects and `--project` is omitted, the server will return an error naming available projects — re-run with `--project <slug>`.
 
@@ -93,9 +99,13 @@ On success the command prints one or two lines to stdout:
 ```
 Updated LUM-48 "Title"  https://www.uselumo.ai/workspace/<slug>/my-tasks/LUM-48
 Tags: urgent
+
+Next:
+  lumo verify --note "<self-report>"
+      Run the machine acceptance loop before claiming the task is done
 ```
 
-The `Tags:` line is omitted when the resulting tag set is empty.
+The `Tags:` line is omitted when the resulting tag set is empty. The trailing `Next:` block reflects the **post-update** status — `--status in_review` prints a stop-and-wait note instead of a command, and a DONE task prints nothing. Suppressed by `--no-hints` / `LUMO_NO_HINTS=1`.
 
 ### Status transitions — direct moves are legal
 
@@ -213,7 +223,9 @@ Top 3 recommended tasks (of 12 open):
 3. LUM-12  TODO         MEDIUM  Add rate limiting
      ↳ MEDIUM · blocked by 1 open dep · due 2026-06-10
 
-Next: lumo session attach LUM-42 && lumo task context LUM-42
+Next:
+  lumo session attach LUM-42 && lumo task context LUM-42
+      start on the top-ranked task
 ```
 
 When to suggest: the user asks "what should I work on", "what's next", "recommend my next task" (in any language), "pick my next task", or starts a session without a task in mind. After they choose, run `session attach` + `task context` for the picked task.

package/assets/skill/references/verify.md

@@ -3,8 +3,11 @@
 `lumo verify` is the machine half of the acceptance system: it executes every **MACHINE** criterion's checkpointer in the local
 repo, POSTs one structured PASS/FAIL verdict per criterion, and prints what to
 do next. Execution is on the client; adjudication is server-side — round
-numbering, the **3-round cap**, escalation, and the **IN_REVIEW** transition all
-happen on the server.
+numbering, the **round cap**, escalation, and the **IN_REVIEW** transition all
+happen on the server. The cap is **not a universal constant** — it is the
+workspace-level `verificationMaxRounds` (default 3); the effective value for
+_this_ workspace is the `M` in the `Round N/M` line that `lumo verify` and
+`lumo task status` print.
 
 ## The claim-done rule
 
@@ -39,11 +42,11 @@ still verifies — the claim degrades to the synthesized run-summary fallback.)
    TaskActivity event.
 4. Prints the round outcome:
 
-| Round outcome             | Effect                                                                                                                                                            | What to do                                                                                    |
-| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| **All PASS**              | Task transitions to **IN_REVIEW** (existing state machine + TASK_IN_REVIEW notification); the `--note` self-report is frozen as the task's claim (source `AGENT`) | **Stop here.** Human adjudication + any HUMAN criteria take over; **never set DONE yourself** |
-| **Any FAIL**              | Task status untouched; unmet criteria printed as next actions (statement, checkpointer, failure tail)                                                             | Fix and re-run                                                                                |
-| **Round 3 still failing** | Loop escalates: a human is notified (AGENT_VERIFY, requires action); further `lumo verify` rounds are rejected with **409**                                       | **Stop retrying**; fix only what the human directs                                            |
+| Round outcome                                      | Effect                                                                                                                                                            | What to do                                                                                    |
+| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| **All PASS**                                       | Task transitions to **IN_REVIEW** (existing state machine + TASK_IN_REVIEW notification); the `--note` self-report is frozen as the task's claim (source `AGENT`) | **Stop here.** Human adjudication + any HUMAN criteria take over; **never set DONE yourself** |
+| **Any FAIL**                                       | Task status untouched; unmet criteria printed as next actions (statement, checkpointer, failure tail)                                                             | Fix and re-run                                                                                |
+| **Last round still failing** (round = the cap `M`) | Loop escalates: a human is notified (AGENT_VERIFY, requires action); further `lumo verify` rounds are rejected with **409**                                       | **Stop retrying**; fix only what the human directs                                            |
 
 Exit code 0 = all passed (or nothing to run); 1 = failures, escalation, or
 errors.
@@ -74,9 +77,10 @@ errors.
 
 ## Round discipline
 
-Rounds are a hard budget of 3, not a retry loop. Between rounds, actually fix
-the failures — re-running without changes burns a round and (at round 3) pages a
-human. **A FAIL round never changes task status; only an all-pass round moves it
+Rounds are a hard budget, not a retry loop — and the size of that budget is a
+workspace setting (`verificationMaxRounds`, default 3), so check `Round N/M`
+instead of assuming three. Between rounds, actually fix the failures —
+re-running without changes burns a round and (on the last one) pages a human. **A FAIL round never changes task status; only an all-pass round moves it
 (to IN_REVIEW, never further).**
 
 ## Review-time drift habits (gap findings)
@@ -120,7 +124,7 @@ what's unmet and why (the exact failure tails), and how many rounds are left.
 
 ### What it prints
 
-- **Header** — task identifier/title/status + `verification round N/3` (round 0 = never verified) + an escalation warning when the machine loop is exhausted.
+- **Header** — task identifier/title/status + `verification round N/M` (`M` = the workspace's `verificationMaxRounds`; round 0 = never verified) + an escalation warning when the machine loop is exhausted.
 - **Claim vs verification** — 规律 2 声称vs核验: the headline contrast, printed right after the header (whenever the contract exists), so the report shows **both** columns instead of only the verification one. Two sides:
   - **Claim** — what the agent _says_ it did: an **unverified self-report** (`agent self-report · estimated, not verification`), estimate-tier provenance (估, not 测). Sourced by layering (LUM-597, preference `AGENT > RUN_SUMMARY > DIGEST > null`): if you supplied a `lumo verify --note`, that **own self-report** is the claim (`↳ source: agent self-report (verify --note)`) — the汇报者's voice, what faithfulness judges. Absent a self-report (old CLI / non-verify path) it degrades to the summarizer paraphrase, labelled honestly (`↳ source: synthesized run summary (no self-report)`). **Fail-closed**: when only a raw STOP turn digest exists it prints `generating — the formal run summary is still being synthesized` and **withholds the raw digest**; with no material at all it prints `not generated yet — …`, never a fabricated claim.
   - **Verification** — what was actually _confirmed_ (measured): the machine-verification rollup `N machine-verified / M human override (of T MACHINE criteria)` over the active MACHINE criteria (relocated here from its old standalone line under `Criteria`), plus `X of Y criteria met by their latest verdict`. **Fail-closed**: before any round runs it prints `no verification has run yet — the claim is unconfirmed` rather than implying a pass.
@@ -179,8 +183,9 @@ fields don't. Pin on `version` when scripting against it.
 - **`openCrossings` is `null` when the crossings check failed** — distinct from `[]` (a successful read with zero open crossings). Script consumers must treat `null` as "unknown / could not confirm", **not** "safe".
 
 `status` reads; `verify` judges. Running status never starts a round, never
-escalates, and never changes task state — loop rules (cap 3, IN_REVIEW on
-all-pass, human-only DONE) live entirely in `lumo verify` and the server.
+escalates, and never changes task state — loop rules (the workspace round cap,
+IN_REVIEW on all-pass, human-only DONE) live entirely in `lumo verify` and the
+server.
 
 ## lumo verdict — the three verdict channels
 

package/assets/skill/references/worktree.md

@@ -1,10 +1,24 @@
 # Worktrees
 
-Local dev tooling that scaffolds parallel git worktrees. Unlike every other
-`lumo` command, these do **not** touch the Lumo server — they shell out to git
-and the local filesystem. **Run `add` and `rm` from the main checkout**, not from
-inside a worktree (the node_modules symlink source and `.worktrees/` both live
-there); `list` is read-only and runnable from anywhere.
+Local dev tooling that scaffolds parallel git worktrees. These are almost
+entirely local — they shell out to git and the local filesystem; the **only**
+server call is a single `GET /api/teams` to expand a **bare number** to your
+default team prefix (see "Accepted identifier forms" below), and even that is
+skipped when you pass an explicit `<TEAM>-N`. **Run `add` and `rm` from the main
+checkout**, not from inside a worktree (the node_modules symlink source and
+`.worktrees/` both live there); `list` is read-only and runnable from anywhere.
+
+### Accepted identifier forms
+
+The `<id>` argument to `add`/`rm` is a task id with **any team prefix**, not
+just `LUM-` (the `<LUM-N>` in the examples below is just a placeholder):
+
+- `LUM-267`, `SPEC-12`, `spec-12` — an explicit `<TEAM>-<n>` (1–10 letters,
+  case-insensitive; the prefix is upper-cased). Resolved locally, no network.
+- `267` — a **bare number**: expanded to the workspace's **default team**
+  prefix via `GET /api/teams` (or the sole team in a single-team workspace).
+  In a multi-team workspace with no default, this errors and asks for an
+  explicit prefix; the same happens when you're offline / not logged in.
 
 ## `lumo worktree add <LUM-N> [slug]`
 

package/dist/cli/src/commands/idea-comment.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaComment = ideaComment;
+exports.ideaCommentList = ideaCommentList;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const task_comment_list_1 = require("./task-comment-list");
+/**
+ * `lumo idea comment <id> <body>` — post a comment on a team-level idea.
+ *
+ * `<id>` is the `<TEAM>-I<n>` identifier (a bare `<n>` also resolves) or a cuid.
+ * Unlike task comments, the idea comments endpoint is keyed by the idea ref
+ * directly, so there's no separate resolve step. Body is plain text — quote it
+ * to pass spaces/newlines.
+ */
+async function ideaComment(idRef, body) {
+    if (!idRef || idRef.trim().length === 0) {
+        console.error('Error: usage: lumo idea comment <LUM-I42> "<body>"');
+        return 1;
+    }
+    if (!body || body.trim().length === 0) {
+        console.error('Error: comment body cannot be empty.');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/ideas/${encodeURIComponent(idRef.trim())}/comments`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${creds.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ body: body.trim() }),
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 201) {
+        process.stdout.write(`✓ commented on ${(0, sanitize_1.sanitizeField)(idRef.trim())}\n`);
+        return;
+    }
+    let serverMsg = null;
+    try {
+        const errBody = (await res.json());
+        if (typeof errBody.error === 'string')
+            serverMsg = errBody.error;
+    }
+    catch {
+        // Body wasn't JSON; fall through to status-only message
+    }
+    if (serverMsg) {
+        console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
+    }
+    else {
+        console.error(`Error: idea comment failed (HTTP ${res.status})`);
+    }
+    return 1;
+}
+/**
+ * `lumo idea comments list <id>` — print an idea's comment thread. Reuses the
+ * shared `formatCommentThread` renderer (same output-budget cap + `--full`
+ * escape hatch as `lumo task comments list`). Idea threads are flat, so each
+ * block is a single top-level comment.
+ */
+async function ideaCommentList(idRef, opts = {}) {
+    if (!idRef || idRef.trim().length === 0) {
+        console.error('Error: usage: lumo idea comments list <LUM-I42>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    const url = `${base}/api/ideas/${encodeURIComponent(idRef.trim())}/comments`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${(0, sanitize_1.sanitizeField)(idRef.trim())} not found`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: idea comments list failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { comments } = (await res.json());
+    if (!comments || comments.length === 0) {
+        console.log('(no comments)');
+        return;
+    }
+    console.log((0, task_comment_list_1.formatCommentThread)(comments, {
+        full: opts.full,
+        identifier: idRef.trim(),
+        fetchCommand: 'idea comments list',
+    }));
+}

package/dist/cli/src/commands/idea-figma-add.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaFigmaAdd = ideaFigmaAdd;
+const idea_figma_api_1 = require("../lib/idea-figma-api");
+const sanitize_1 = require("../lib/sanitize");
+async function ideaFigmaAdd(args) {
+    try {
+        const { link } = await (0, idea_figma_api_1.addIdeaFigmaLink)(args.identifier, args.url);
+        const label = (0, sanitize_1.sanitizeField)(link.frameName
+            ? `${link.fileName} · ${link.frameName}`
+            : `${link.fileName}${link.nodeId === '' ? ' (file-level)' : ''}`);
+        console.log(`Linked ${args.identifier} ↔ Figma "${label}"`);
+        console.log(`  ${link.url}`);
+        return 0;
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === 'figma_not_connected') {
+            console.error(`✗ You haven't connected Figma yet.`);
+            console.error(`  Run: open https://www.uselumo.ai/settings/integrations`);
+            return 1;
+        }
+        if (err.code === 'figma_needs_reauth') {
+            console.error(`✗ Your Figma token is no longer valid. Please reconnect.`);
+            console.error(`  Run: open https://www.uselumo.ai/settings/integrations`);
+            return 1;
+        }
+        throw e; // let wrap() in cli/src/index.ts log and exit 1
+    }
+}

package/dist/cli/src/commands/idea-figma-context.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaFigmaContext = ideaFigmaContext;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+const report_pull_1 = require("../lib/report-pull");
+/**
+ * `lumo idea figma context <LUM-I1> <link-id>`
+ *
+ * Tier-2 retrieval for the cheap inline Figma card on an idea. Reads the
+ * cached design metadata (file/frame name, url, thumbnail, last sync) from
+ * `/api/ideas/:id/figma-links/:linkId/context`. Mirrors `taskFigmaContext`
+ * (LUM-681).
+ */
+async function ideaFigmaContext(identifier, linkId) {
+    if (!identifier || !linkId) {
+        console.error('Error: usage: lumo idea figma context <LUM-I1> <link-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/ideas/${encodeURIComponent(identifier)}/figma-links/${encodeURIComponent(linkId)}/context`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: idea ${identifier} or figma link ${linkId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: figma context failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { metadata, note } = (await res.json());
+    if (metadata.fileName)
+        console.log(`file:  ${(0, sanitize_1.sanitizeField)(metadata.fileName)}`);
+    if (metadata.frameName)
+        console.log(`frame: ${(0, sanitize_1.sanitizeField)(metadata.frameName)}`);
+    console.log(`url:   ${metadata.url}`);
+    if (metadata.lastSyncedAt)
+        console.log(`synced: ${metadata.lastSyncedAt}`);
+    if (metadata.lastSyncError)
+        console.log(`syncError: ${(0, sanitize_1.sanitizeField)(metadata.lastSyncError)}`);
+    if (note)
+        console.log(`\nnote: ${(0, sanitize_1.sanitizeField)(note)}`);
+    // LUM-681: mirrors LUM-500 disclosure-funnel stamping for idea fragments.
+    // The linkId arg == lineage FIGMA fragmentId. Fire-and-forget — never
+    // blocks output, swallows failures.
+    await (0, report_pull_1.reportPull)({ fragmentType: 'FIGMA', fragmentId: linkId });
+}

package/dist/cli/src/commands/idea-figma-list.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaFigmaList = ideaFigmaList;
+const idea_figma_api_1 = require("../lib/idea-figma-api");
+const sanitize_1 = require("../lib/sanitize");
+const STALE_MS = 25 * 24 * 3600 * 1000;
+function formatRow(id, fileName, frame, synced, stale) {
+    return [
+        id.padEnd(10),
+        (0, sanitize_1.sanitizeField)(fileName).padEnd(20),
+        (0, sanitize_1.sanitizeField)(frame).padEnd(24),
+        synced.padEnd(12),
+        stale ? '⚠ thumbnail stale' : '',
+    ]
+        .join(' ')
+        .trimEnd();
+}
+async function ideaFigmaList(args) {
+    const { links } = await (0, idea_figma_api_1.listIdeaFigmaLinks)(args.identifier);
+    if (links.length === 0) {
+        console.log('No Figma links attached.');
+        return 0;
+    }
+    for (const link of links) {
+        const frame = link.frameName ?? '(file-level)';
+        const synced = link.lastSyncedAt.slice(0, 10);
+        const stale = link.thumbnailFetchedAt === null ||
+            Date.now() - new Date(link.thumbnailFetchedAt).getTime() > STALE_MS;
+        console.log(formatRow(link.id, link.fileName, frame, synced, stale && !!link.thumbnailUrl));
+    }
+    return 0;
+}

package/dist/cli/src/commands/idea-figma-refresh.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaFigmaRefresh = ideaFigmaRefresh;
+const idea_figma_api_1 = require("../lib/idea-figma-api");
+const sanitize_1 = require("../lib/sanitize");
+async function ideaFigmaRefresh(args) {
+    try {
+        const { links } = await (0, idea_figma_api_1.listIdeaFigmaLinks)(args.identifier);
+        const byId = new Map(links.map(l => [l.id, l]));
+        const { results } = await (0, idea_figma_api_1.refreshIdeaFigmaLinks)(args.identifier);
+        if (results.length === 0) {
+            console.log(`No Figma links attached to ${args.identifier}.`);
+            return 0;
+        }
+        console.log(`Refreshed ${results.length} Figma links on ${args.identifier}`);
+        for (const r of results) {
+            const link = byId.get(r.id);
+            const label = link
+                ? (0, sanitize_1.sanitizeField)(link.frameName
+                    ? `${link.fileName} · ${link.frameName}`
+                    : `${link.fileName} (file-level)`)
+                : r.id;
+            if (r.ok)
+                console.log(`  ✓ ${label}`);
+            else
+                console.log(`  ✗ ${label} (${(0, sanitize_1.sanitizeField)(r.error ?? '')})`);
+        }
+        return 0;
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === 'figma_not_connected' ||
+            err.code === 'figma_needs_reauth') {
+            console.error(`✗ Figma is not connected (or token expired). Reconnect:`);
+            console.error(`  open https://www.uselumo.ai/settings/integrations`);
+            return 1;
+        }
+        throw e;
+    }
+}

package/dist/cli/src/commands/idea-figma-rm.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ideaFigmaRm = ideaFigmaRm;
+const idea_figma_api_1 = require("../lib/idea-figma-api");
+const sanitize_1 = require("../lib/sanitize");
+async function ideaFigmaRm(args) {
+    const { links } = await (0, idea_figma_api_1.listIdeaFigmaLinks)(args.identifier);
+    const match = links.find(l => l.id === args.linkIdOrUrl || l.url === args.linkIdOrUrl);
+    if (!match) {
+        console.log(`Not linked: ${args.linkIdOrUrl}`);
+        return 0;
+    }
+    await (0, idea_figma_api_1.removeIdeaFigmaLink)(args.identifier, match.id);
+    const label = (0, sanitize_1.sanitizeField)(match.frameName
+        ? `${match.fileName} · ${match.frameName}`
+        : `${match.fileName} (file-level)`);
+    console.log(`Removed Figma link from ${args.identifier}: "${label}"`);
+    return 0;
+}