@unbrained/pm-cli 2026.6.19 → 2026.6.20

package/dist/cli-bundle/chunks/{chunk-II3WDRCM.js → chunk-HWHZ7EY7.js}

@@ -1,7 +1,7 @@
 import {
   parseItemDocument,
   serializeItemDocument
-} from "./chunk-QSH34DSQ.js";
+} from "./chunk-5MWA46UN.js";
 import {
   TYPE_TO_FOLDER,
   getItemFormatFromPath,
@@ -10,7 +10,7 @@ import {
   removeFileIfExists,
   runActiveOnWriteHooks,
   writeFileAtomic
-} from "./chunk-5QLHQK7V.js";
+} from "./chunk-QWAJPGEI.js";
 
 // dist/core/store/item-format-migration.js
 import fs from "node:fs/promises";
@@ -119,4 +119,4 @@ async function migrateItemFilesToFormat(pmRoot, targetFormat, op = "item_format:
 export {
   migrateItemFilesToFormat
 };
-//# sourceMappingURL=chunk-II3WDRCM.js.map
+//# sourceMappingURL=chunk-HWHZ7EY7.js.map

package/dist/cli-bundle/chunks/{chunk-7R5YKVKO.js → chunk-ICEWMJYH.js}

@@ -3,21 +3,21 @@ import {
 } from "./chunk-WW4E2DC3.js";
 import {
   parseCsvKv
-} from "./chunk-VG3B2CYD.js";
+} from "./chunk-4PW4C3ZB.js";
 import {
   parseLimit
-} from "./chunk-DYZKSIVX.js";
+} from "./chunk-VE3BUO3R.js";
 import {
   locateItem,
   mutateItem,
   readLocatedItem
-} from "./chunk-X7RKOJXL.js";
+} from "./chunk-SL233DQD.js";
 import {
   resolveItemTypeRegistry
-} from "./chunk-SO2IOH37.js";
+} from "./chunk-XNQ3YH6N.js";
 import {
   nowIso
-} from "./chunk-MTGMNUMJ.js";
+} from "./chunk-B3LROPTV.js";
 import {
   EXIT_CODE,
   PmCliError,
@@ -26,7 +26,7 @@ import {
   pathExists,
   readSettings,
   resolvePmRoot
-} from "./chunk-5QLHQK7V.js";
+} from "./chunk-QWAJPGEI.js";
 
 // dist/cli/commands/annotation-command.js
 !(function() {
@@ -222,4 +222,4 @@ export {
   wrapOwnershipConflict,
   runAnnotationCommand
 };
-//# sourceMappingURL=chunk-7R5YKVKO.js.map
+//# sourceMappingURL=chunk-ICEWMJYH.js.map

package/dist/cli-bundle/chunks/{chunk-UMTPQMEG.js → chunk-II4BRHKM.js}

@@ -2,7 +2,7 @@
 !function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cc38118c-431e-5112-8201-cf5ec5a89ce6")}catch(e){}}();
 import {
   parseOptionalNumber
-} from "./chunk-LEC57E7K.js";
+} from "./chunk-NCGQ27PK.js";
 import {
   splitCommaList
 } from "./chunk-P4SESZGT.js";
@@ -10,7 +10,7 @@ import {
   EXIT_CODE,
   PmCliError,
   SCOPE_VALUES
-} from "./chunk-I2VJM36R.js";
+} from "./chunk-AZ75OVK4.js";
 
 // dist/cli/commands/linked-test-entry.js
 var STRUCTURED_LINKED_TEST_KEYS = [
@@ -513,6 +513,6 @@ export {
   parseLinkedTestAssertionGteMap,
   parseLinkedTestJsonEntries
 };
-//# sourceMappingURL=chunk-UMTPQMEG.js.map
+//# sourceMappingURL=chunk-II4BRHKM.js.map
 
 //# debugId=cc38118c-431e-5112-8201-cf5ec5a89ce6

package/dist/cli-bundle/chunks/{chunk-GDOTTY2S.js → chunk-IWKD7B33.js}

@@ -2,7 +2,7 @@
 !(function() {
   try {
     var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
-    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "b4fea4d7-ec26-5176-a1ee-77473d6a5d9b");
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "18ec090a-cfc4-5acf-90b6-7e6fade40d8d");
   } catch (e2) {
   }
 })();
@@ -152,6 +152,18 @@ var REMEDIATION_REGISTRY = Object.freeze([
     command: "pm gc --scope locks --dry-run",
     summary: "Some lock files could not be read; preview the sweep and inspect the unreadable files manually \u2014 gc never deletes what it cannot read."
   },
+  // --- pm health: extensions ---
+  // Most extension findings keep their richer, contextual
+  // `details.triage.remediation` and are intentionally absent here. The
+  // partial-coverage code is the exception: it is not a per-extension triage
+  // result but a system-wide adoption gap (unmanaged installs the update-health
+  // scan had to skip), so it has a single deterministic fix and belongs in the
+  // shared registry like any other health finding (pm-bdvm).
+  {
+    code: "extension_update_health_partial_coverage",
+    command: "pm extension --adopt-all --project",
+    summary: "Update-health coverage is partial because unmanaged extensions were skipped; adopt the existing installs into managed metadata so the update scan covers them (use --global for global-scope extensions, or pm package --adopt-all when working with packages)."
+  },
   // --- pm health: vectorization ---
   {
     code: "vectorization_stale_items_remaining",
@@ -214,6 +226,11 @@ var REMEDIATION_REGISTRY = Object.freeze([
     command: 'pm config set metadata-required-fields --criterion "<field>"',
     summary: "Config-driven finding: the custom metadata profile has no required fields configured and falls back to core, so configure the fields rather than mutating items."
   },
+  {
+    code: "validate_metadata_duplicate_issue_codes",
+    command: 'pm update <id> --title "<distinct title>"',
+    summary: "Two or more items share one logical issue code (GH-235); give each a distinct title so the derived code is unique, or close the redundant item with pm close <id> --duplicate-of <canonical-id> (closed-as-duplicate items are excluded from the check)."
+  },
   // --- pm validate: resolution ---
   {
     code: "validate_resolution_missing_fields",
@@ -330,4 +347,4 @@ export {
   buildRemediationMap,
   buildRemediationCommands
 };
-//# sourceMappingURL=chunk-GDOTTY2S.js.map
+//# sourceMappingURL=chunk-IWKD7B33.js.map

package/dist/cli-bundle/chunks/chunk-IWKD7B33.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../core/diagnostics/remediation.ts"],
+  "sourcesContent": ["/**\n * Shared machine-executable remediation registry.\n *\n * `pm health` and `pm validate` both emit stable, colon-delimited warning tokens\n * (for example `history_drift_missing_stream:pm-abcd` or\n * `validate_resolution_missing_fields:3`). Agents that gate on these commands\n * previously had to hardcode the mapping from a warning code to the `pm` command\n * that fixes it. This module is the single source of truth for that mapping so\n * `pm health --json` (per-check `remediation_map`) and `pm validate --fix-hints`\n * (per-check `fix_hints`) can both surface executable remediation without any\n * duplicated, drift-prone lookup tables.\n *\n * Semantics of {@link RemediationEntry.command}: the suggested next `pm` command\n * an operator/agent should run to resolve findings with that code. Per-item\n * findings use an `<id>` placeholder (callers that have the concrete id may\n * substitute it); findings whose only fix is a manual file edit point at the\n * most useful diagnostic/repair command and describe the manual step in\n * {@link RemediationEntry.summary}.\n */\n\n/** Maps a stable diagnostic warning code to the command and summary that resolve it. */\nexport interface RemediationEntry {\n  /**\n   * Stable warning-code prefix this entry resolves. A warning matches when it\n   * equals this code or begins with `<code>:`. Registry codes are mutually\n   * exclusive under that colon-boundary rule (no code is a `:`-delimited prefix\n   * of another — e.g. `settings:id_prefix_empty` is distinct from a bare\n   * `settings`, which is intentionally not registered), so `resolveRemediation`\n   * uses first-match with no ordering dependency.\n   */\n  readonly code: string;\n  /** Executable `pm` command (or imperative) that resolves the finding. May contain an `<id>` placeholder. */\n  readonly command: string;\n  /** One-line description of what the command does / which manual step it covers. */\n  readonly summary: string;\n}\n\n/**\n * Registry of every non-extension `pm health` / `pm validate` warning code and\n * its remediation. Extension findings keep their richer, contextual\n * `details.triage.remediation` produced by the extension health triage and are\n * intentionally excluded here (see pm-0hnu: \"all non-extension checks\").\n */\nexport const REMEDIATION_REGISTRY: readonly RemediationEntry[] = Object.freeze([\n  // --- pm health: directories ---\n  {\n    code: \"missing_directory\",\n    command: \"pm init\",\n    summary: \"Recreate missing tracker directories (pm init is idempotent and restores the scaffold).\",\n  },\n  // --- pm health: settings (read/parse) ---\n  {\n    code: \"settings_read_invalid_json\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json is not valid JSON and pm fell back to defaults; fix the syntax error in the reported path, then re-run.\",\n  },\n  {\n    code: \"settings_read_invalid_schema\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json failed schema validation and pm fell back to defaults; correct the reported key in the file, then re-run.\",\n  },\n  {\n    code: \"settings_read_merge_failed\",\n    command: \"pm config list --json\",\n    summary: \"Global/project settings could not be merged; reconcile the conflicting keys in the reported settings files.\",\n  },\n  // --- pm health: settings_values ---\n  {\n    code: \"settings:id_prefix_empty\",\n    command: \"pm config list --json\",\n    summary: 'id_prefix is empty; set a non-empty \"id_prefix\" in settings.json so generated item ids are well-formed.',\n  },\n  {\n    code: \"settings:locks_ttl_non_positive\",\n    command: \"pm config list --json\",\n    summary: 'locks.ttl_seconds must be positive; set a positive \"locks.ttl_seconds\" in settings.json.',\n  },\n  // --- pm health: telemetry (advisory) ---\n  {\n    code: \"telemetry_state_invalid_json\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Local telemetry state file is corrupt; pm recreates it on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_invalid_rows\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry queue has unparseable rows; they are skipped on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_pending\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Telemetry events are queued; they flush automatically on the next reachable command. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_high_retries\",\n    command: \"pm telemetry flush\",\n    summary:\n      \"Some queued telemetry events are near retry exhaustion; flush now and verify endpoint reachability before entries are dropped.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_failed\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint is unreachable; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_http_status\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint returned a non-success status; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_schema_version_behind\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Client schema is behind server; upgrade pm-cli to emit the latest event shape.\",\n  },\n  {\n    code: \"telemetry_otel_export_failing\",\n    command: \"pm health --check-telemetry\",\n    summary:\n      \"OTLP trace spans are queued but the traces endpoint export is failing; spans retry automatically on the next reachable command, or set PM_TELEMETRY_OTEL_DISABLED=1 to skip OTLP export. Advisory only.\",\n  },\n  // --- pm health: integrity ---\n  {\n    code: \"integrity_item_unreadable\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file could not be read; restore or repair the file at the reported path.\",\n  },\n  {\n    code: \"integrity_item_parse_failed\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file failed to parse; fix the malformed front matter at the reported path.\",\n  },\n  {\n    code: \"integrity_item_conflict_marker\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file contains Git conflict markers; resolve the <<<<<<< / >>>>>>> markers at the reported line.\",\n  },\n  {\n    code: \"integrity_history_unreadable\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream could not be read; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_invalid_json\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains invalid JSON; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_conflict_marker\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains Git conflict markers; resolve the markers, then re-anchor the chain.\",\n  },\n  // --- pm health: history_drift ---\n  // `pm health` rewrites these commands to `pm history-repair --all` in the\n  // per-check remediation_map when more than one stream is drifted.\n  {\n    code: \"history_drift_missing_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item has no history stream; re-anchor the chain to rebuild it (pm history-repair --all repairs every drifted stream in one pass).\",\n  },\n  {\n    code: \"history_drift_unreadable_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history stream is unreadable; re-anchor the chain (pm history-repair --all repairs every drifted stream in one pass).\",\n  },\n  {\n    code: \"history_drift_hash_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's content hash no longer matches its history; re-anchor the chain (pm history-repair --all repairs every drifted stream in one pass).\",\n  },\n  {\n    code: \"history_drift_chain_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history chain is broken; re-anchor the chain (pm history-repair --all repairs every drifted stream in one pass).\",\n  },\n  // --- pm health: storage (history compaction policy) ---\n  {\n    code: \"history_stream_over_compact_threshold\",\n    command: \"pm history-compact <id>\",\n    summary: \"The history stream exceeds the configured compaction threshold; compact it (pm history-compact --all-streams sweeps every over-threshold stream in one pass).\",\n  },\n  // --- pm health: locks ---\n  {\n    code: \"locks_stale_count\",\n    command: \"pm gc --scope locks\",\n    summary:\n      \"Stale item-claim locks (embedded ttl elapsed) can block mutations; sweep them — gc retains active and unparseable locks.\",\n  },\n  {\n    code: \"locks_unreadable\",\n    command: \"pm gc --scope locks --dry-run\",\n    summary:\n      \"Some lock files could not be read; preview the sweep and inspect the unreadable files manually — gc never deletes what it cannot read.\",\n  },\n  // --- pm health: extensions ---\n  // Most extension findings keep their richer, contextual\n  // `details.triage.remediation` and are intentionally absent here. The\n  // partial-coverage code is the exception: it is not a per-extension triage\n  // result but a system-wide adoption gap (unmanaged installs the update-health\n  // scan had to skip), so it has a single deterministic fix and belongs in the\n  // shared registry like any other health finding (pm-bdvm).\n  {\n    code: \"extension_update_health_partial_coverage\",\n    command: \"pm extension --adopt-all --project\",\n    summary:\n      \"Update-health coverage is partial because unmanaged extensions were skipped; adopt the existing installs into managed metadata so the update scan covers them (use --global for global-scope extensions, or pm package --adopt-all when working with packages).\",\n  },\n  // --- pm health: vectorization ---\n  {\n    code: \"vectorization_stale_items_remaining\",\n    command: \"pm health --refresh-vectors\",\n    summary: \"Some items have stale embeddings; refresh vectors so semantic search results stay current.\",\n  },\n  {\n    code: \"vectorization_embedding_identity_changed\",\n    command: \"pm reindex --mode semantic\",\n    summary: \"Embedding provider/model changed since the last index; run a semantic reindex to rebuild vectors.\",\n  },\n  // --- pm validate: metadata ---\n  // Note: validate_metadata_missing_author has no entry on purpose. `pm update\n  // --author` sets the mutation/audit author (history), not the item's\n  // `metadata.author` front-matter field, and there is no CLI flag that writes\n  // that field — so emitting a command here would record an audit entry without\n  // clearing the finding. A missing item author must be restored at the source.\n  {\n    code: \"validate_metadata_missing_acceptance_criteria\",\n    command: 'pm update <id> --acceptance-criteria \"<criteria>\"',\n    summary: \"Backfill the missing acceptance criteria on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_estimate\",\n    command: 'pm update <id> --estimate \"<estimate>\"',\n    summary: \"Backfill the missing estimate on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_close_reason\",\n    command: 'pm update <id> --close-reason \"<reason>\"',\n    summary: \"Backfill the missing close reason on the reported closed item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_reviewer\",\n    command: 'pm update <id> --reviewer \"<name>\"',\n    summary: \"Backfill the missing reviewer on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_risk\",\n    command: 'pm update <id> --risk \"<level>\"',\n    summary: \"Backfill the missing risk on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_confidence\",\n    command: 'pm update <id> --confidence \"<level>\"',\n    summary: \"Backfill the missing confidence on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_sprint\",\n    command: 'pm update <id> --sprint \"<sprint>\"',\n    summary: \"Backfill the missing sprint on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_release\",\n    command: 'pm update <id> --release \"<release>\"',\n    summary: \"Backfill the missing release on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_custom_profile_missing_required_fields\",\n    command: 'pm config set metadata-required-fields --criterion \"<field>\"',\n    summary:\n      \"Config-driven finding: the custom metadata profile has no required fields configured and falls back to core, so configure the fields rather than mutating items.\",\n  },\n  {\n    code: \"validate_metadata_duplicate_issue_codes\",\n    command: 'pm update <id> --title \"<distinct title>\"',\n    summary:\n      \"Two or more items share one logical issue code (GH-235); give each a distinct title so the derived code is unique, or close the redundant item with pm close <id> --duplicate-of <canonical-id> (closed-as-duplicate items are excluded from the check).\",\n  },\n  // --- pm validate: resolution ---\n  {\n    code: \"validate_resolution_missing_fields\",\n    command: 'pm update <id> --resolution \"<how resolved>\"',\n    summary: \"Backfill resolution / expected_result / actual_result on the reported closed item(s).\",\n  },\n  // --- pm validate: lifecycle ---\n  {\n    code: \"validate_lifecycle_active_closure_like_metadata\",\n    command: \"pm update <id> --unset <closure-like-field>\",\n    summary:\n      \"Clear the closure-like field the validator flags on this active item — the detail row names it (resolution / actual-result / blocked-reason) — or close the item if it is actually done.\",\n  },\n  {\n    code: \"validate_lifecycle_active_terminal_parent\",\n    command: \"pm update <id> --parent <active-parent-id>\",\n    summary: \"Reopen the terminal parent or move the active child under a non-terminal parent.\",\n  },\n  {\n    code: \"validate_lifecycle_stale_blockers\",\n    command: \"pm update <id> --unset blocked-by --unset blocked-reason\",\n    summary:\n      \"Resolve the stale blocker the validator flags: clear blocked-by/blocked-reason when they linger on a non-blocked item or report a resolved blocker; if instead a blocked item is missing blocker context, add the context or move it out of a blocked status.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles_error\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  {\n    code: \"validate_hierarchy_parent_cycle_error\",\n    command: \"pm update <id> --parent <other-id>\",\n    summary:\n      \"Break the parent-hierarchy cycle by reparenting one item in the reported cycle to a non-cyclic parent (or clear it with pm update <id> --unset parent).\",\n  },\n  {\n    code: \"validate_hierarchy_parent_cycle\",\n    command: \"pm update <id> --parent <other-id>\",\n    summary:\n      \"Break the parent-hierarchy cycle by reparenting one item in the reported cycle to a non-cyclic parent (or clear it with pm update <id> --unset parent).\",\n  },\n  // --- pm validate: files ---\n  {\n    code: \"validate_files_missing_linked_paths\",\n    command: \"pm <files|docs> <id> --remove <path>\",\n    summary:\n      \"The check spans both item.files and item.docs under one code: restore the missing linked artifact, or unlink it with pm files (linked file) or pm docs (linked doc).\",\n  },\n  {\n    code: \"validate_files_orphaned_paths\",\n    command: \"pm <files|docs> <id> --add <path>\",\n    summary:\n      \"Link the orphaned artifact with pm files (file) or pm docs (doc), or remove it from the workspace.\",\n  },\n  {\n    code: \"validate_files_tracked_all_strict_forces_pm_internals\",\n    command: \"pm validate --check-files --include-pm-internals\",\n    summary: \"tracked-all-strict scan flagged pm internals; re-run with --include-pm-internals or a softer --scan-mode.\",\n  },\n  // --- pm validate: history_drift ---\n  {\n    code: \"validate_history_drift_missing_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items missing a history stream.\",\n  },\n  {\n    code: \"validate_history_drift_unreadable_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with an unreadable history stream.\",\n  },\n  {\n    code: \"validate_history_drift_hash_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items whose content hash drifted.\",\n  },\n  {\n    code: \"validate_history_drift_chain_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with a broken history chain.\",\n  },\n  // --- pm validate: command_references ---\n  {\n    code: \"validate_command_references_stale_pm_ids\",\n    command: 'pm update <id> --replace-tests --test \"command=<corrected-command>\" [--test ...]',\n    summary:\n      \"Correct the stale pm-ID inside the item's linked test command (the check scans tests[].command, not the body). --replace-tests overwrites the entire tests list, so re-include the item's other linked tests in the same call.\",\n  },\n]);\n\n/**\n * Resolve the remediation entry for a warning token, or `undefined` when no\n * entry is registered. A warning matches an entry when it equals the entry code\n * or begins with `<code>:` (the colon boundary keeps sibling codes such as\n * `validate_lifecycle_dependency_cycles` and\n * `validate_lifecycle_dependency_cycles_error` disjoint).\n *\n * First match is intentional and correct: registry codes are mutually exclusive\n * under the colon-boundary rule, so at most one entry can ever match a warning\n * and order is irrelevant. That invariant is enforced by a test (see\n * remediation-registry.spec.ts \"keeps every registry code mutually exclusive\"),\n * which is why this stays a simple linear scan rather than a longest-prefix\n * search — a longest-prefix tie-break is unreachable with disjoint codes.\n *\n * Accepts unknown input defensively (this is an exported helper SDK consumers\n * may call from untyped JS): a non-string `warning` resolves to `undefined`.\n */\nexport function resolveRemediation(warning: string): RemediationEntry | undefined {\n  if (typeof warning !== \"string\") {\n    return undefined;\n  }\n  const normalized = warning.trim();\n  for (const entry of REMEDIATION_REGISTRY) {\n    if (normalized === entry.code || normalized.startsWith(`${entry.code}:`)) {\n      return entry;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Build a compact `remediation_map` (code -> command) for a set of warning\n * tokens. First match wins per code; unknown codes are skipped. Used by\n * `pm health --json` per-check details and as the source of deduped executable\n * commands for `pm validate --fix-hints`.\n */\nexport function buildRemediationMap(warnings: Iterable<string>): Record<string, string> {\n  const map: Record<string, string> = {};\n  for (const warning of warnings) {\n    const entry = resolveRemediation(warning);\n    if (entry !== undefined && !Object.prototype.hasOwnProperty.call(map, entry.code)) {\n      map[entry.code] = entry.command;\n    }\n  }\n  return map;\n}\n\n/**\n * Build a deduped, ordered list of executable remediation commands for a set of\n * warning tokens (one command per distinct matched code). Used by\n * `pm validate --fix-hints` for checks that do not already emit per-row\n * remediation commands.\n */\nexport function buildRemediationCommands(warnings: Iterable<string>): string[] {\n  return Object.values(buildRemediationMap(warnings));\n}\n"],
+  "mappings": ";;;;;;;;AA2CO,IAAM,uBAAoD,OAAO,OAAO;;EAE7E;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SACE;;;EAGJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;;;EAKX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;;;;;;;;EASJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;;EAGJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;;;;;;EAQX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;;EAGJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;;EAGJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SACE;;EAEJ;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;EAEX;IACE,MAAM;IACN,SAAS;IACT,SAAS;;;EAGX;IACE,MAAM;IACN,SAAS;IACT,SACE;;CAEL;AAmBK,SAAU,mBAAmB,SAAe;AAChD,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO;EACT;AACA,QAAM,aAAa,QAAQ,KAAI;AAC/B,aAAW,SAAS,sBAAsB;AACxC,QAAI,eAAe,MAAM,QAAQ,WAAW,WAAW,GAAG,MAAM,IAAI,GAAG,GAAG;AACxE,aAAO;IACT;EACF;AACA,SAAO;AACT;AAQM,SAAU,oBAAoB,UAA0B;AAC5D,QAAM,MAA8B,CAAA;AACpC,aAAW,WAAW,UAAU;AAC9B,UAAM,QAAQ,mBAAmB,OAAO;AACxC,QAAI,UAAU,UAAa,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,MAAM,IAAI,GAAG;AACjF,UAAI,MAAM,IAAI,IAAI,MAAM;IAC1B;EACF;AACA,SAAO;AACT;AAQM,SAAU,yBAAyB,UAA0B;AACjE,SAAO,OAAO,OAAO,oBAAoB,QAAQ,CAAC;AACpD;",
+  "names": []
+}

package/dist/cli-bundle/chunks/{chunk-QG6M6XQE.js → chunk-J7VSEFWB.js}

@@ -1,6 +1,6 @@
 import {
   nowIso
-} from "./chunk-MTGMNUMJ.js";
+} from "./chunk-B3LROPTV.js";
 import {
   EXIT_CODE,
   appendLineAtomic,
@@ -11,7 +11,7 @@ import {
   resolveTelemetryErrorCategory,
   writeFileAtomic,
   writeSettings
-} from "./chunk-5QLHQK7V.js";
+} from "./chunk-QWAJPGEI.js";
 
 // dist/core/telemetry/observability.js
 !(function() {
@@ -1768,4 +1768,4 @@ export {
   finishTelemetryCommand,
   emitTelemetryErrorEvent
 };
-//# sourceMappingURL=chunk-QG6M6XQE.js.map
+//# sourceMappingURL=chunk-J7VSEFWB.js.map

package/dist/cli-bundle/chunks/{chunk-22YA6GCA.js → chunk-K2LBDYDC.js}

@@ -3,7 +3,7 @@
 import {
   TYPE_TO_FOLDER,
   pathExists
-} from "./chunk-I2VJM36R.js";
+} from "./chunk-AZ75OVK4.js";
 
 // dist/core/item/id.js
 import crypto from "node:crypto";
@@ -70,6 +70,6 @@ export {
   normalizeItemId,
   generateItemId
 };
-//# sourceMappingURL=chunk-22YA6GCA.js.map
+//# sourceMappingURL=chunk-K2LBDYDC.js.map
 
 //# debugId=a1ee7a35-b64d-50fb-ac3f-a2f76e0c38b8

package/dist/cli-bundle/chunks/{chunk-BQVESTOG.js → chunk-KCJZREBI.js}

@@ -6,7 +6,7 @@ import {
   normalizeItemTypeDefinition,
   normalizeItemTypeStringList,
   strictPolicyCommand
-} from "./chunk-I2VJM36R.js";
+} from "./chunk-AZ75OVK4.js";
 
 // dist/core/item/type-registry.js
 var DEFAULT_REQUIRED_CREATE_FIELDS = [
@@ -649,6 +649,6 @@ export {
   resolveCommandOptionPolicyState,
   validateTypeOptions
 };
-//# sourceMappingURL=chunk-BQVESTOG.js.map
+//# sourceMappingURL=chunk-KCJZREBI.js.map
 
 //# debugId=b5b7dbb3-f811-524b-b6a0-8d6093e53bdd

package/dist/cli-bundle/chunks/{chunk-YWAYOWDQ.js → chunk-LTUB7ARL.js}

@@ -1,18 +1,18 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="22164ee8-de20-5c39-8e47-10a59c3f2d56")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0b7f7865-bed4-596b-a8fb-f30d5c0b1923")}catch(e){}}();
 import {
   normalizeExtensionNameForMatch,
   normalizeManagedDirectoryName,
   normalizeStringList,
   parseExtensionManifest,
   validateExtensionDirectory
-} from "./chunk-VP4Z36GO.js";
+} from "./chunk-6FSPWUBI.js";
 import {
   splitCommaList
 } from "./chunk-P4SESZGT.js";
 import {
   nowIso
-} from "./chunk-5P2LQV2F.js";
+} from "./chunk-MTQK5ZSB.js";
 import {
   EXIT_CODE,
   EXTENSION_CAPABILITY_CONTRACT,
@@ -31,7 +31,7 @@ import {
   resolvePmPackageRootFromModule,
   resolvePmRoot,
   writeSettings
-} from "./chunk-I2VJM36R.js";
+} from "./chunk-AZ75OVK4.js";
 
 // dist/cli/commands/extension.js
 import { execFile as execFile2 } from "node:child_process";
@@ -417,6 +417,7 @@ async function collectPackageExtensionDirectories(packageRoot) {
 
 // dist/cli/commands/extension/install-sources.js
 var execFileAsync = promisify(execFile);
+var PM_CLI_PACKAGE_NAME = "@unbrained/pm-cli";
 function parseGithubPathSpec(pathSpec, input, refOverride) {
   const segments = pathSpec.split("/").map((segment) => segment.trim()).filter((segment) => segment.length > 0);
   if (segments.length < 2) {
@@ -740,18 +741,75 @@ async function installNpmPackageRuntimeDependencies(packageRoot) {
   }
   const manifest = parsed;
   const dependencySpecs = runtimeDependencyInstallSpecs(manifest);
-  if (dependencySpecs.length === 0) {
+  const shouldLinkHostedPmCli = hasHostedPmCliDependency(manifest);
+  if (dependencySpecs.length === 0 && !shouldLinkHostedPmCli) {
     return;
   }
   const runtimeOnlyManifest = { ...parsed };
   delete runtimeOnlyManifest.devDependencies;
-  await fs3.writeFile(packageJsonPath, `${JSON.stringify(runtimeOnlyManifest, null, 2)}
+  const installManifest = { ...runtimeOnlyManifest };
+  removeHostedPmCliDependency(installManifest);
+  await fs3.writeFile(packageJsonPath, `${JSON.stringify(installManifest, null, 2)}
 `, "utf8");
-  await Promise.all([
-    fs3.rm(path3.join(packageRoot, "package-lock.json"), { force: true }),
-    fs3.rm(path3.join(packageRoot, "npm-shrinkwrap.json"), { force: true })
-  ]);
-  await runNpmCommand(["install", "--ignore-scripts", "--no-audit", "--fund=false", "--package-lock=false", "--no-save", ...dependencySpecs], packageRoot);
+  try {
+    await Promise.all([
+      fs3.rm(path3.join(packageRoot, "package-lock.json"), { force: true }),
+      fs3.rm(path3.join(packageRoot, "npm-shrinkwrap.json"), { force: true })
+    ]);
+    if (dependencySpecs.length > 0) {
+      await runNpmCommand([
+        "install",
+        "--ignore-scripts",
+        "--no-audit",
+        "--fund=false",
+        "--package-lock=false",
+        "--no-save",
+        "--omit=peer",
+        ...dependencySpecs
+      ], packageRoot);
+    }
+    if (shouldLinkHostedPmCli) {
+      await linkHostedPmCliDependency(packageRoot);
+    }
+  } finally {
+    await fs3.writeFile(packageJsonPath, `${JSON.stringify(runtimeOnlyManifest, null, 2)}
+`, "utf8");
+  }
+}
+function hasHostedPmCliDependency(manifest) {
+  for (const dependencyMap of [manifest.dependencies, manifest.optionalDependencies, manifest.peerDependencies]) {
+    if (typeof dependencyMap === "object" && dependencyMap !== null && PM_CLI_PACKAGE_NAME in dependencyMap) {
+      return true;
+    }
+  }
+  return false;
+}
+function removeHostedPmCliDependency(manifest) {
+  for (const field of ["dependencies", "optionalDependencies", "peerDependencies"]) {
+    const dependencyMap = manifest[field];
+    if (typeof dependencyMap !== "object" || dependencyMap === null) {
+      continue;
+    }
+    const nextMap = { ...dependencyMap };
+    delete nextMap[PM_CLI_PACKAGE_NAME];
+    if (Object.keys(nextMap).length === 0) {
+      delete manifest[field];
+    } else {
+      manifest[field] = nextMap;
+    }
+  }
+}
+async function linkHostedPmCliDependency(packageRoot) {
+  const hostPackageRoot = resolvePmPackageRootFromModule(import.meta.url, ["../../../.."]);
+  const [scope, packageName] = PM_CLI_PACKAGE_NAME.split("/");
+  const scopedDirectory = path3.join(packageRoot, "node_modules", scope);
+  const linkPath = path3.join(scopedDirectory, packageName);
+  await fs3.mkdir(scopedDirectory, { recursive: true });
+  await fs3.rm(linkPath, { recursive: true, force: true });
+  await fs3.symlink(hostPackageRoot, linkPath, resolveDirectorySymlinkType(process.platform));
+}
+function resolveDirectorySymlinkType(platform) {
+  return platform === "win32" ? "junction" : "dir";
 }
 function runtimeDependencyInstallSpecs(manifest) {
   const specs = /* @__PURE__ */ new Map();
@@ -760,7 +818,7 @@ function runtimeDependencyInstallSpecs(manifest) {
       continue;
     }
     for (const [name, version] of Object.entries(dependencyMap)) {
-      if (typeof version !== "string" || version.trim().length === 0 || specs.has(name)) {
+      if (name === PM_CLI_PACKAGE_NAME || typeof version !== "string" || version.trim().length === 0 || specs.has(name)) {
         continue;
       }
       specs.set(name, `${name}@${version.trim()}`);
@@ -3171,6 +3229,6 @@ export {
   runExtension,
   _testOnly
 };
-//# sourceMappingURL=chunk-YWAYOWDQ.js.map
+//# sourceMappingURL=chunk-LTUB7ARL.js.map
 
-//# debugId=22164ee8-de20-5c39-8e47-10a59c3f2d56
+//# debugId=0b7f7865-bed4-596b-a8fb-f30d5c0b1923