@unbrained/pm-cli 2026.5.31 → 2026.6.6

package/dist/mcp/server.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1988238d-a5e8-5080-b8ad-253b203dd069")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f59eb89f-30d4-55de-b785-a4bd3f3f0025")}catch(e){}}();
 import readline from "node:readline";
 import { fileURLToPath } from "node:url";
 import { activateExtensions, loadExtensions, runActiveCommandHandler, setActiveExtensionCommands, setActiveExtensionHooks, setActiveExtensionParsers, setActiveExtensionPreflight, setActiveExtensionRegistrations, setActiveExtensionRenderers, setActiveExtensionServices, } from "../core/extensions/index.js";
@@ -8,10 +8,15 @@ import { pathExists } from "../core/fs/fs-utils.js";
 import { projectMutationResult } from "../core/output/mutation-projection.js";
 import { PmCliError } from "../core/shared/errors.js";
 import { decodeHtmlEntitiesInOptions } from "../core/shared/html-entity-decode.js";
+import { levenshteinDistanceWithinLimit } from "../core/shared/levenshtein.js";
 import { asRecordClone } from "../core/shared/primitives.js";
+import { createSerialQueue } from "../core/shared/serial-queue.js";
 import { getSettingsPath, resolvePmRoot } from "../core/store/paths.js";
 import { readSettings } from "../core/store/settings.js";
-import { runActivity, runAggregate, runAppend, runClaim, runClose, runComments, runContracts, runContext, runCreate, runConfig, runDelete, runDeps, runDocs, runExtension, runFiles, runFilesDiscover, runGc, runGet, runHealth, runHistory, runHistoryRedact, runHistoryRepair, runInit, runLearnings, runList, runNotes, runPlan, runRelease, runSchemaAddType, runSearch, runStats, runTest, runTestAll, runUpdate, runUpdateMany, runUpgrade, runValidate, } from "../cli/commands/index.js";
+import { normalizeListOptions, normalizeUpdateOptions } from "../cli/registration-helpers.js";
+import { UPDATE_COMMANDER_STRING_OPTION_CONTRACTS } from "../sdk/cli-contracts/commander-mutation-options.js";
+import { PM_TOOL_ACTIONS } from "../sdk/cli-contracts/enum-contracts.js";
+import { runActivity, runAggregate, runAppend, runClaim, runClose, runCloseMany, runComments, runContracts, runContext, runCreate, runConfig, runDelete, runDeps, runDocs, runExtension, runFiles, runFilesDiscover, runGc, runGet, runHealth, runHistory, runHistoryRedact, runHistoryRepair, runInit, runLearnings, runList, runNotes, runPlan, runRelease, runSchemaAddStatus, runSchemaAddType, runSchemaList, runSchemaRemoveStatus, runSchemaRemoveType, runSchemaShow, runSearch, runStats, runTelemetry, runTest, runTestAll, runUpdate, runUpdateMany, runUpgrade, runValidate, } from "../cli/commands/index.js";
 const PM_PACKAGE_ROOT_ENV = "PM_CLI_PACKAGE_ROOT";
 function resolvePmPackageRoot() {
     return fileURLToPath(new URL("../..", import.meta.url));
@@ -41,6 +46,11 @@ const idSchema = {
     type: "string",
     description: "pm item id, for example pm-abc1.",
 };
+// pm-fd8n: derive the pm_run action enumeration from the canonical
+// PM_TOOL_ACTIONS contract instead of a hand-maintained prose list, so the
+// MCP-facing description can never drift from the actual supported actions.
+const PM_RUN_ACTION_DESCRIPTION = `Operation name (one of): ${PM_TOOL_ACTIONS.join(", ")}. ` +
+    "Package-owned actions (for example calendar/templates/guide/dedupe-audit/normalize/reindex/comments-audit/completion/test-runs-list/test-runs-status/test-runs-logs/test-runs-stop/test-runs-resume) are available dynamically when installed.";
 function objectSchema(properties, required = []) {
     return {
         ...TOOL_SCHEMA_BASE,
@@ -58,12 +68,38 @@ const TOOLS = [
         inputSchema: objectSchema({
             action: {
                 type: "string",
-                description: "Operation name: init, context, list, get, search, create, update, delete, claim, release, close, comments, notes, learnings, files, files-discover, docs, deps, test, test-all, validate, health, contracts, config, activity, aggregate, extension, extension-reload, package, package-install, package-catalog, install, upgrade, history, stats, append, update-many, gc. Package-owned actions (for example calendar/templates/guide/dedupe-audit/normalize/reindex/comments-audit/completion/test-runs-list/test-runs-status/test-runs-logs/test-runs-stop/test-runs-resume) are available dynamically when installed.",
+                description: PM_RUN_ACTION_DESCRIPTION,
             },
             id: idSchema,
             query: { type: "string", description: "Search query for action=search." },
             reason: { type: "string", description: "Close reason for action=close." },
             force: { type: "boolean", description: "Force ownership/terminal-state override when supported." },
+            subcommand: {
+                type: "string",
+                enum: ["list", "show", "add-type", "remove-type", "add-status", "remove-status"],
+                description: "Schema subcommand when action=schema.",
+            },
+            name: {
+                type: "string",
+                description: "Item type name for action=schema show/add-type/remove-type, or status id for add-status/remove-status.",
+            },
+            description: {
+                type: "string",
+                description: "Custom item type or status description for action=schema add-type/add-status.",
+            },
+            defaultStatus: { type: "string", description: "Default status for action=schema add-type." },
+            folder: { type: "string", description: "Storage folder for action=schema add-type." },
+            alias: {
+                type: "array",
+                items: { type: "string" },
+                description: "Aliases for action=schema add-type/add-status.",
+            },
+            role: {
+                type: "array",
+                items: { type: "string" },
+                description: "Lifecycle roles for action=schema add-status: draft, active, blocked, terminal, terminal_done, terminal_canceled, default_open, default_close, default_cancel.",
+            },
+            order: { type: "number", description: "Display/sort order for action=schema add-status." },
             options: { type: "object", description: "Underlying pm command options using camelCase keys." },
             fullChangedFields: {
                 type: "boolean",
@@ -159,6 +195,21 @@ const TOOLS = [
         description: "List, add, or remove linked docs for a pm item.",
         inputSchema: objectSchema({ id: idSchema, options: { type: "object" } }, ["id"]),
     },
+    {
+        name: "pm_notes",
+        description: "List or add structured notes on a pm item. Use options.add to append a note; omit it to list existing notes.",
+        inputSchema: objectSchema({ id: idSchema, options: { type: "object" } }, ["id"]),
+    },
+    {
+        name: "pm_learnings",
+        description: "List or add learnings on a pm item. Use options.add to capture a learning/insight; omit it to list existing learnings.",
+        inputSchema: objectSchema({ id: idSchema, options: { type: "object" } }, ["id"]),
+    },
+    {
+        name: "pm_deps",
+        description: "List, add, or remove dependencies for a pm item. Use options.add to declare a dependency and options.remove to drop one; omit both to list current dependencies.",
+        inputSchema: objectSchema({ id: idSchema, options: { type: "object" } }, ["id"]),
+    },
     {
         name: "pm_test",
         description: "List, add, remove, or run linked tests for a pm item.",
@@ -190,10 +241,83 @@ const TOOLS = [
         }),
     },
 ];
+// pm-qxwu: TOOL_SCHEMA_BASE keeps additionalProperties:true so legitimate
+// passthrough keeps working, which means a typo'd top-level arg (e.g.
+// "fullChangedField" missing the trailing "s") is silently swallowed and the
+// agent gets default behavior with no signal. We precompute the declared
+// top-level property keys for each tool and, on every tools/call, warn (without
+// rejecting) when an unexpected top-level key appears. The warning is surfaced
+// to stderr and additively in structuredContent.warnings.
+const TOOL_DECLARED_KEYS = new Map(TOOLS.map((tool) => {
+    const schema = tool.inputSchema;
+    const properties = schema.properties ?? {};
+    return [tool.name, Object.keys(properties)];
+}));
+function nearestDeclaredKey(unexpected, declared) {
+    // Cheap did-you-mean: budget grows with key length but stays small so we only
+    // suggest genuine near-misses (a single typo / transposition for short keys).
+    const limit = Math.max(1, Math.min(3, Math.floor(unexpected.length / 4) + 1));
+    let best;
+    for (const candidate of declared) {
+        const distance = levenshteinDistanceWithinLimit(unexpected, candidate, limit);
+        if (distance === null) {
+            continue;
+        }
+        if (best === undefined || distance < best.distance) {
+            best = { key: candidate, distance };
+        }
+    }
+    return best?.key;
+}
+// pm_run is the explicit catch-all passthrough tool: extension/package actions
+// accept arbitrary top-level keys (see extensionOptionsFromArgs), so unexpected
+// keys there are by-design rather than typos and must not be flagged.
+const UNEXPECTED_KEY_WARNING_EXEMPT_TOOLS = new Set(["pm_run"]);
+function detectUnexpectedTopLevelKeys(toolName, args) {
+    if (typeof args !== "object" || args === null || Array.isArray(args)) {
+        return [];
+    }
+    if (UNEXPECTED_KEY_WARNING_EXEMPT_TOOLS.has(toolName)) {
+        return [];
+    }
+    const declared = TOOL_DECLARED_KEYS.get(toolName);
+    if (declared === undefined) {
+        return [];
+    }
+    const declaredSet = new Set(declared);
+    const warnings = [];
+    for (const key of Object.keys(args)) {
+        if (declaredSet.has(key)) {
+            continue;
+        }
+        const suggestion = nearestDeclaredKey(key, declared);
+        warnings.push(suggestion !== undefined
+            ? `Unexpected top-level argument "${key}" for ${toolName} (did you mean "${suggestion}"?). It was passed through unchanged; declared arguments are: ${declared.join(", ")}.`
+            : `Unexpected top-level argument "${key}" for ${toolName}. It was passed through unchanged; declared arguments are: ${declared.join(", ")}.`);
+    }
+    return warnings;
+}
 function readString(args, key) {
     const value = args[key];
     return typeof value === "string" && value.trim().length > 0 ? value : undefined;
 }
+function readScalarString(args, key) {
+    const value = args[key];
+    if (typeof value === "string") {
+        return value.trim().length > 0 ? value : undefined;
+    }
+    return typeof value === "number" && Number.isFinite(value) ? String(value) : undefined;
+}
+function readScalarStringAllowBlank(args, key) {
+    const value = args[key];
+    if (typeof value === "string") {
+        return value;
+    }
+    return typeof value === "number" && Number.isFinite(value) ? String(value) : undefined;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function readRequiredString(args, key) {
     const value = readString(args, key);
     if (!value) {
@@ -241,7 +365,7 @@ const ARRAY_ADD_REMOVE_ACTIONS = new Set([
     "test",
     "test-all",
 ]);
-function normalizeOptionsArrays(options, action) {
+function normalizeMcpOptionsArrays(options, action) {
     const result = {};
     const promoteAddRemove = action !== undefined && ARRAY_ADD_REMOVE_ACTIONS.has(action);
     for (const [key, value] of Object.entries(options)) {
@@ -262,7 +386,7 @@ function normalizeOptionsArrays(options, action) {
     return result;
 }
 function optionsWithAuthor(args, action) {
-    const options = normalizeOptionsArrays(asRecordClone(args.options), action);
+    const options = normalizeMcpOptionsArrays(asRecordClone(args.options), action);
     const author = readString(args, "author");
     return author && options.author === undefined ? { ...options, author } : options;
 }
@@ -371,6 +495,116 @@ async function withCwd(cwd, run) {
 function withMutationCompaction(args, options) {
     return { changedFields: args.fullChangedFields === true ? "full" : "compact", runnerOptions: { ...(options ?? {}) } };
 }
+function mutationListOptions(options) {
+    return {
+        type: readScalarString(options, "filterType"),
+        tag: readScalarString(options, "filterTag"),
+        priority: readScalarString(options, "filterPriority"),
+        deadlineBefore: readScalarString(options, "filterDeadlineBefore"),
+        deadlineAfter: readScalarString(options, "filterDeadlineAfter"),
+        updatedAfter: readScalarString(options, "filterUpdatedAfter"),
+        updatedBefore: readScalarString(options, "filterUpdatedBefore"),
+        createdAfter: readScalarString(options, "filterCreatedAfter"),
+        createdBefore: readScalarString(options, "filterCreatedBefore"),
+        ids: readScalarStringAllowBlank(options, "ids"),
+        assignee: readScalarString(options, "filterAssignee"),
+        assigneeFilter: readScalarString(options, "filterAssigneeFilter") ?? readScalarString(options, "filterAssignee_filter"),
+        parent: readScalarString(options, "filterParent"),
+        sprint: readScalarString(options, "filterSprint"),
+        release: readScalarString(options, "filterRelease"),
+        limit: readScalarString(options, "limit"),
+        offset: readScalarString(options, "offset"),
+    };
+}
+function closeManyOptionsFromFlat(options) {
+    return {
+        status: readString(options, "filterStatus"),
+        list: isRecord(options.list) ? normalizeListOptions(options.list) : mutationListOptions(options),
+        reason: readString(options, "reason"),
+        resolution: readString(options, "resolution"),
+        expectedResult: readString(options, "expectedResult") ?? readString(options, "expected_result") ?? readString(options, "expected"),
+        actualResult: readString(options, "actualResult") ?? readString(options, "actual_result") ?? readString(options, "actual"),
+        validateClose: readString(options, "validateClose") ?? readString(options, "validate_close"),
+        author: readString(options, "author"),
+        message: readString(options, "message"),
+        force: options.force === true ? true : undefined,
+        dryRun: options.dryRun === true || options.dry_run === true ? true : undefined,
+        rollback: readString(options, "rollback"),
+        checkpoint: options.checkpoint === false || options.noCheckpoint === true || options.no_checkpoint === true ? false : undefined,
+    };
+}
+const UPDATE_MANY_FLAT_CONTROL_KEYS = new Set([
+    "filterStatus",
+    "filterType",
+    "filterTag",
+    "filterPriority",
+    "filterDeadlineBefore",
+    "filterDeadlineAfter",
+    "filterUpdatedAfter",
+    "filterUpdatedBefore",
+    "filterCreatedAfter",
+    "filterCreatedBefore",
+    "filterAssignee",
+    "filterAssigneeFilter",
+    "filterAssignee_filter",
+    "filterParent",
+    "filterSprint",
+    "filterRelease",
+    "ids",
+    "list",
+    "update",
+    "limit",
+    "offset",
+    "dryRun",
+    "dry_run",
+    "rollback",
+    "checkpoint",
+    "noCheckpoint",
+    "no_checkpoint",
+]);
+function updateManyUpdateOptionsFromFlat(options) {
+    const update = {};
+    for (const [key, value] of Object.entries(options)) {
+        if (UPDATE_MANY_FLAT_CONTROL_KEYS.has(key)) {
+            continue;
+        }
+        update[key] = value;
+    }
+    return normalizeMcpUpdateOptions(update);
+}
+function normalizeMcpUpdateOptions(options) {
+    const normalizedInput = normalizeMcpOptionsArrays(options, "update-many");
+    for (const contract of UPDATE_COMMANDER_STRING_OPTION_CONTRACTS) {
+        for (const key of contract.keys) {
+            const value = normalizedInput[key];
+            if (typeof value === "number" && Number.isFinite(value)) {
+                normalizedInput[key] = String(value);
+            }
+        }
+    }
+    return normalizeUpdateOptions(normalizedInput);
+}
+function updateManyOptionsFromFlat(options) {
+    if (isRecord(options.list) || isRecord(options.update)) {
+        const updateSource = isRecord(options.update) ? options.update : updateManyUpdateOptionsFromFlat(options);
+        return {
+            status: readScalarString(options, "filterStatus"),
+            list: isRecord(options.list) ? normalizeListOptions(options.list) : mutationListOptions(options),
+            update: normalizeMcpUpdateOptions(updateSource),
+            dryRun: options.dryRun === true || options.dry_run === true ? true : undefined,
+            rollback: readString(options, "rollback"),
+            checkpoint: options.checkpoint === false || options.noCheckpoint === true || options.no_checkpoint === true ? false : undefined,
+        };
+    }
+    return {
+        status: readScalarString(options, "filterStatus"),
+        list: mutationListOptions(options),
+        update: updateManyUpdateOptionsFromFlat(options),
+        dryRun: options.dryRun === true || options.dry_run === true ? true : undefined,
+        rollback: readString(options, "rollback"),
+        checkpoint: options.checkpoint === false || options.noCheckpoint === true || options.no_checkpoint === true ? false : undefined,
+    };
+}
 async function runAction(args) {
     const action = readRequiredString(args, "action");
     const global = globalOptions(args);
@@ -443,6 +677,15 @@ async function runAction(args) {
             return runTest(id ?? readRequiredString(options, "id"), options, global);
         case "test-all":
             return runTestAll(options, global);
+        case "telemetry":
+            return runTelemetry({
+                subcommand: readString(args, "subcommand") ?? readString(options, "subcommand"),
+                limit: typeof args.limit === "number" && Number.isFinite(args.limit)
+                    ? args.limit
+                    : typeof options.limit === "number" && Number.isFinite(options.limit)
+                        ? options.limit
+                        : readString(args, "limit") ?? readString(options, "limit"),
+            }, global);
         case "validate":
             return runValidate(options, global);
         case "health":
@@ -513,12 +756,55 @@ async function runAction(args) {
             // subcommand/name are top-level fields in the published action contract,
             // so accept them from args first and fall back to options for parity.
             const subcommand = readString(args, "subcommand") ?? readRequiredString(options, "subcommand");
-            if (subcommand.trim().toLowerCase() !== "add-type") {
-                throw new PmCliError(`Unknown pm schema subcommand "${subcommand}". Allowed: add-type`, 64);
+            const normalizedSubcommand = subcommand.trim().toLowerCase();
+            const schemaName = readString(args, "name") ?? readString(options, "name");
+            const schemaAuthor = readString(args, "author") ?? readString(options, "author");
+            const schemaForce = args.force === true || options.force === true;
+            if (normalizedSubcommand === "list") {
+                return runSchemaList(global);
+            }
+            if (normalizedSubcommand === "show") {
+                return runSchemaShow(schemaName, global);
+            }
+            if (normalizedSubcommand === "remove-type") {
+                return runSchemaRemoveType(schemaName, { author: schemaAuthor, force: schemaForce }, global);
             }
             const aliasSource = args.alias ?? options.alias;
             const aliases = aliasSource === undefined ? undefined : readStringArray(aliasSource);
-            return runSchemaAddType(readString(args, "name") ?? readString(options, "name"), {
+            if (normalizedSubcommand === "add-status") {
+                const roleSource = args.role ?? options.role;
+                const roles = roleSource === undefined ? undefined : readStringArray(roleSource);
+                const orderSource = args.order ?? options.order;
+                let order;
+                if (typeof orderSource === "number") {
+                    if (!Number.isInteger(orderSource)) {
+                        throw new PmCliError("schema add-status order must be a finite integer.", 64);
+                    }
+                    order = orderSource;
+                }
+                else if (typeof orderSource === "string" && orderSource.trim().length > 0) {
+                    const parsed = Number(orderSource);
+                    if (!Number.isInteger(parsed)) {
+                        throw new PmCliError("schema add-status order must be a finite integer.", 64);
+                    }
+                    order = parsed;
+                }
+                return runSchemaAddStatus(schemaName, {
+                    role: roles,
+                    alias: aliases,
+                    description: readString(args, "description") ?? readString(options, "description"),
+                    order,
+                    author: schemaAuthor,
+                    force: schemaForce,
+                }, global);
+            }
+            if (normalizedSubcommand === "remove-status") {
+                return runSchemaRemoveStatus(schemaName, { author: schemaAuthor, force: schemaForce }, global);
+            }
+            if (normalizedSubcommand !== "add-type") {
+                throw new PmCliError(`Unknown pm schema subcommand "${subcommand}". Allowed: add-type, remove-type, add-status, remove-status, list, show`, 64);
+            }
+            return runSchemaAddType(schemaName, {
                 description: readString(args, "description") ?? readString(options, "description"),
                 defaultStatus: readString(args, "defaultStatus") ??
                     readString(args, "default_status") ??
@@ -526,19 +812,30 @@ async function runAction(args) {
                     readString(options, "default_status"),
                 folder: readString(args, "folder") ?? readString(options, "folder"),
                 alias: aliases,
-                author: readString(args, "author") ?? readString(options, "author"),
-                force: args.force === true || options.force === true,
+                author: schemaAuthor,
+                force: schemaForce,
             }, global);
         }
         case "stats":
-            return runStats(global);
+            return runStats(global, { storage: options.storage === true });
         case "append": {
             const { changedFields, runnerOptions } = withMutationCompaction(args, options);
             return projectMutationResult(await runAppend(id ?? readRequiredString(runnerOptions, "id"), runnerOptions, global), { changedFields });
         }
         case "update-many": {
             const { changedFields, runnerOptions } = withMutationCompaction(args, options);
-            return projectMutationResult(await runUpdateMany(runnerOptions, global), { changedFields });
+            return projectMutationResult(await runUpdateMany(updateManyOptionsFromFlat(runnerOptions), global), { changedFields });
+        }
+        case "close-many": {
+            const { changedFields, runnerOptions } = withMutationCompaction(args, options);
+            const topLevelReason = readString(args, "reason");
+            const closeManyRunnerOptions = topLevelReason !== undefined && runnerOptions.reason === undefined
+                ? { ...runnerOptions, reason: topLevelReason }
+                : { ...runnerOptions };
+            if (force && closeManyRunnerOptions.force === undefined) {
+                closeManyRunnerOptions.force = true;
+            }
+            return projectMutationResult(await runCloseMany(closeManyOptionsFromFlat(closeManyRunnerOptions), global), { changedFields });
         }
         case "gc":
             return runGc(global, options);
@@ -560,13 +857,19 @@ const HANDLERS = {
     pm_comments: (args) => runAction({ ...args, action: "comments" }),
     pm_files: (args) => runAction({ ...args, action: "files" }),
     pm_docs: (args) => runAction({ ...args, action: "docs" }),
+    pm_notes: (args) => runAction({ ...args, action: "notes" }),
+    pm_learnings: (args) => runAction({ ...args, action: "learnings" }),
+    pm_deps: (args) => runAction({ ...args, action: "deps" }),
     pm_test: (args) => runAction({ ...args, action: "test" }),
     pm_validate: (args) => runAction({ ...args, action: "validate" }),
     pm_health: (args) => runAction({ ...args, action: "health" }),
     pm_contracts: (args) => runAction({ ...args, action: "contracts" }),
     pm_plan: (args) => runAction({ ...args, action: "plan" }),
 };
-function resultContent(result) {
+function resultContent(result, warnings) {
+    // pm-qxwu: warnings is additive — existing fields (content, structuredContent.result)
+    // are never removed or renamed. The warnings array only appears when non-empty.
+    const structuredContent = warnings !== undefined && warnings.length > 0 ? { result, warnings } : { result };
     return {
         content: [
             {
@@ -574,7 +877,7 @@ function resultContent(result) {
                 text: JSON.stringify(result, null, 2),
             },
         ],
-        structuredContent: { result },
+        structuredContent,
     };
 }
 function errorContent(error) {
@@ -602,9 +905,9 @@ export async function handleRequest(request) {
             serverInfo: { name: "pm-mcp", version: "1.0.0" },
             instructions: "You have access to native pm CLI tools for git-based project management. " +
                 "Use pm_context or pm_search before creating new work. " +
-                "Prefer narrow tools (pm_context, pm_list, pm_get, pm_search, pm_create, pm_update, pm_claim, pm_release, pm_close, pm_comments, pm_files, pm_docs, pm_test, pm_validate, pm_health, pm_contracts, pm_plan) over pm_run when they cover the operation. " +
+                "Prefer narrow tools (pm_context, pm_list, pm_get, pm_search, pm_create, pm_update, pm_claim, pm_release, pm_close, pm_comments, pm_files, pm_docs, pm_notes, pm_learnings, pm_deps, pm_test, pm_validate, pm_health, pm_contracts, pm_plan) over pm_run when they cover the operation. " +
                 "Use pm_plan for agent harness Plan workflows: it provides Codex/Claude/Cursor-style planning with durable steps, dependencies, decisions, discoveries, validation, and materialization. " +
-                "Use pm_run with an explicit action for package-owned operations (calendar/templates/guide/dedupe-audit/normalize/reindex/comments-audit/completion/test-runs-list/test-runs-status/test-runs-logs/test-runs-stop/test-runs-resume), plus activity, aggregate, history, stats, append, notes, learnings, test-all, and gc. " +
+                "Use pm_run with an explicit action for package-owned operations (calendar/templates/guide/dedupe-audit/normalize/reindex/comments-audit/completion/test-runs-list/test-runs-status/test-runs-logs/test-runs-stop/test-runs-resume), plus activity, aggregate, history, stats, append, test-all, and gc. " +
                 "Use history-redact for audited history-stream redaction workflows, and history-repair to re-anchor a drifted history chain so pm health/validate report ok. " +
                 "Set author to 'claude-code-agent' on all mutations. " +
                 "Do not pass path during real repository tracking — only pass path for sandbox or test runs.",
@@ -627,8 +930,14 @@ export async function handleRequest(request) {
         // affected; decoding at the MCP boundary normalizes the agent path while
         // leaving normal text untouched.
         const args = decodeHtmlEntitiesInOptions(asRecordClone(params.arguments));
+        // pm-qxwu: non-breaking detection of typo'd / unexpected top-level keys.
+        // additionalProperties stays true so passthrough still works; we only warn.
+        const warnings = detectUnexpectedTopLevelKeys(name, args);
+        for (const warning of warnings) {
+            console.error(`[pm-mcp] ${warning}`);
+        }
         const result = await withCwd(args.cwd, () => handler(args));
-        return resultContent(result);
+        return resultContent(result, warnings);
     }
     throw new PmCliError(`Unsupported MCP method: ${request.method ?? "(missing)"}`, 64);
 }
@@ -640,40 +949,58 @@ function writeError(id, error) {
     const message = error instanceof Error ? error.message : String(error);
     process.stdout.write(`${JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } })}\n`);
 }
+// pm-3puw: parse one JSON-RPC line, dispatch it, and write the response. Kept
+// as a standalone async unit so the stdio loop can enqueue it onto a serial
+// queue (process lines in arrival order) and tests can drive it directly.
+export async function processRpcLine(line) {
+    if (line.trim().length === 0) {
+        return;
+    }
+    let request;
+    try {
+        request = JSON.parse(line);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        writeError(null, new PmCliError(`Parse error: ${message}`, -32700));
+        return;
+    }
+    if (typeof request !== "object" || request === null || Array.isArray(request)) {
+        writeError(null, new PmCliError("Invalid JSON-RPC request: expected an object", -32600));
+        return;
+    }
+    const shouldRespond = Object.prototype.hasOwnProperty.call(request, "id");
+    try {
+        const result = await handleRequest(request);
+        if (shouldRespond && result !== undefined) {
+            writeResponse(request.id, result);
+        }
+    }
+    catch (error) {
+        if (!shouldRespond) {
+            return;
+        }
+        if (request.method === "tools/call") {
+            writeResponse(request.id, errorContent(error));
+        }
+        else {
+            writeError(request.id, error);
+        }
+    }
+}
 export function startMcpServer() {
     const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+    // pm-3puw: serialize line handling so pipelined requests are processed in
+    // arrival order. The previous fire-and-forget handler ran requests
+    // concurrently, so a client that pipelined two mutations on the same item
+    // (without awaiting the first response) hit a lock conflict on the second.
+    const queue = createSerialQueue();
     rl.on("line", (line) => {
-        void (async () => {
-            if (line.trim().length === 0) {
-                return;
-            }
-            let request;
-            try {
-                request = JSON.parse(line);
-            }
-            catch (error) {
-                writeError(null, error);
-                return;
-            }
-            try {
-                const result = await handleRequest(request);
-                if (result !== undefined) {
-                    writeResponse(request.id, result);
-                }
-            }
-            catch (error) {
-                if (request.method === "tools/call") {
-                    writeResponse(request.id, errorContent(error));
-                }
-                else {
-                    writeError(request.id, error);
-                }
-            }
-        })();
+        void queue.enqueue(() => processRpcLine(line));
     });
 }
 if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
     startMcpServer();
 }
 //# sourceMappingURL=server.js.map
-//# debugId=1988238d-a5e8-5080-b8ad-253b203dd069
+//# debugId=f59eb89f-30d4-55de-b785-a4bd3f3f0025