@unbrained/pm-cli 2026.6.24 → 2026.6.30

package/dist/mcp/server.js

@@ -5,7 +5,7 @@
  * Runs the MCP server adapter that exposes pm actions and contracts to external agents.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ad8d2ba8-8a0e-5d5e-b4d2-00e538908f91")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4921fdeb-d146-5458-bf25-02e9e7c091c0")}catch(e){}}();
 import { realpathSync } from "node:fs";
 import readline from "node:readline";
 import { fileURLToPath } from "node:url";
@@ -26,7 +26,7 @@ import { normalizeListOptions, normalizeUpdateOptions } from "../cli/registratio
 import { UPDATE_COMMANDER_STRING_OPTION_CONTRACTS } from "../sdk/cli-contracts/commander-mutation-options.js";
 import { clearWorkspaceContractsCache } from "../sdk/runtime.js";
 import { TOOLS } from "./tool-definitions.js";
-import { runActivity, runAggregate, runAppend, runClaim, runClose, runCloseMany, runComments, runContracts, runContext, runCreate, runCopy, runFocus, runConfig, runDelete, runDeps, runDocs, runExtension, runFiles, runFilesDiscover, runGc, runGet, runHealth, runHistory, runHistoryCompact, runHistoryRedact, runHistoryRepair, runHistoryRepairAll, assertHistoryRepairTarget, runInit, runLearnings, runList, runNotes, runPlan, runRelease, runSchemaAddStatus, runSchemaAddType, runSchemaAddField, runSchemaApplyPreset, runSchemaInferTypes, runSchemaList, runSchemaListFields, runSchemaRemoveStatus, runSchemaRemoveType, runSchemaRemoveField, runSchemaShow, runSchemaShowField, runSchemaShowStatus, runSearch, runStats, runTelemetry, runTest, runTestAll, runUpdate, runUpdateMany, runUpgrade, runValidate, } from "../cli/commands/index.js";
+import { runActivity, runAggregate, runAppend, runClaim, runClose, runCloseMany, runComments, runContracts, runContext, runCreate, runCopy, runFocus, runConfig, runDelete, runDeps, runDocs, runExtension, runFiles, runFilesDiscover, runGc, runGet, runHealth, runHistory, runHistoryCompact, runHistoryRedact, runHistoryRepair, runHistoryRepairAll, assertHistoryRepairTarget, runInit, runLearnings, runList, runNext, runNotes, runPlan, runRelease, runSchemaAddStatus, runSchemaAddType, runSchemaAddField, runSchemaApplyPreset, runSchemaInferTypes, runSchemaList, runSchemaListFields, runSchemaRemoveStatus, runSchemaRemoveType, runSchemaRemoveField, runSchemaShow, runSchemaShowField, runSchemaShowStatus, runProfileApply, runProfileLint, runProfileList, runProfileShow, runSearch, runStats, runTelemetry, runTest, runTestAll, runUpdate, runUpdateMany, runUpgrade, runValidate, } from "../cli/commands/index.js";
 const PM_PACKAGE_ROOT_ENV = "PM_CLI_PACKAGE_ROOT";
 function resolvePmPackageRoot() {
     return fileURLToPath(new URL("../..", import.meta.url));
@@ -287,63 +287,95 @@ function extensionOptionsFromArgs(args, options) {
     delete normalizedOptions.args;
     return normalizedOptions;
 }
-// pm-bl6m: runDynamicExtensionAction mutates the process-global active extension
-// registries (set globals -> run handler -> clear globals in a finally). The stdio
-// transport already processes JSON-RPC lines sequentially, but handleRequest is a
-// public entry point (tests, future concurrent transports) — if two native-action
-// requests ever ran concurrently, the newer request would overwrite the globals
-// mid-flight and whichever finished first would clear them out from under the
-// other (its lazily-read hooks/overrides would silently vanish). Serialize the
-// whole activation cycle (load -> activate -> set -> run -> clear -> deactivate)
-// on a dedicated FIFO queue so the critical section can never interleave. Full
+// pm-bl6m / pm-zumn: every native MCP action runs inside an activation cycle that
+// mutates the process-global active extension registries (set globals -> run -> clear
+// globals in a finally). The stdio transport already processes JSON-RPC lines
+// sequentially, but handleRequest is a public entry point (tests, future concurrent
+// transports) — if two requests ever ran concurrently, the newer one would overwrite
+// the globals mid-flight and whichever finished first would clear them out from under
+// the other (its lazily-read hooks/overrides would silently vanish). Serialize the
+// whole activation cycle (load -> activate -> set -> run -> clear -> deactivate) on a
+// dedicated FIFO queue so the critical section can never interleave. Full
 // request-scoped registry plumbing remains possible later if true intra-server
 // concurrency is ever needed.
-const dynamicExtensionActionQueue = createSerialQueue();
-async function runDynamicExtensionAction(action, args, options, global) {
-    if (global.noExtensions) {
-        throw new PmCliError(`Unsupported native pm action: ${action}`, 64);
-    }
-    const pmRoot = resolvePmRoot(process.cwd(), global.path);
-    if (!(await pathExists(getSettingsPath(pmRoot)))) {
-        throw new PmCliError(`Unsupported native pm action: ${action}`, 64);
-    }
-    return dynamicExtensionActionQueue.enqueue(async () => {
+const extensionActivationQueue = createSerialQueue();
+/**
+ * Publishes empty active extension registries so built-in fallback actions cannot
+ * observe stale or partially published extension state from a failed activation cycle.
+ */
+function resetActiveExtensionRegistries() {
+    setActiveExtensionHooks(createEmptyExtensionHookRegistry());
+    setActiveExtensionCommands(createEmptyExtensionCommandRegistry());
+    setActiveExtensionParsers(createEmptyExtensionParserRegistry());
+    setActiveExtensionPreflight(createEmptyExtensionPreflightRegistry());
+    setActiveExtensionServices(createEmptyExtensionServiceRegistry());
+    setActiveExtensionRenderers(createEmptyExtensionRendererRegistry());
+    setActiveExtensionRegistrations(createEmptyExtensionRegistrationRegistry());
+}
+/**
+ * Run `run` with workspace extensions loaded, activated, and published to the
+ * process-global active registries, then torn down afterwards. pm-zumn: built-in native
+ * actions (pm_list/pm_profile/pm_schema/pm_create/...) read
+ * `getActiveExtensionRegistrations()` for custom item types, fields, and profiles, so
+ * they must activate extensions exactly like the CLI (main.ts activates for every
+ * command). Previously only the dynamic-extension dispatch activated, leaving
+ * extension-contributed schema and profiles invisible over MCP for every built-in
+ * action. Activation is skipped (`run` receives `null`) when extensions are disabled or
+ * no workspace exists yet (for example `init`). EVERY action — activating or not — is
+ * serialized on {@link extensionActivationQueue} so a built-in action's reads of the
+ * process-global active registries can never interleave with another request's
+ * activation cycle; per-request isolation therefore holds even if a truly concurrent
+ * transport is added later (not just because the stdio transport is sequential today).
+ */
+async function withActiveExtensions(global, explicitCwd, resolutionCwd, run) {
+    // Run the whole cycle on the queue so registry mutations never interleave. Only an
+    // EXPLICIT cwd mutates process.cwd() — pinned inside this serialized slot so the chdir
+    // can't be clobbered mid-flight and the built-in handler resolves against it too. A
+    // request without an explicit cwd runs in the server's current directory and never
+    // touches process.cwd() (important so concurrent direct callers can't corrupt a shared
+    // cwd). Either way activation resolves against resolutionCwd, the entry-time snapshot,
+    // so it never depends on a deferred process.cwd() read.
+    return extensionActivationQueue.enqueue(async () => {
         try {
-            return await runDynamicExtensionActionExclusively(action, args, options, global, pmRoot);
+            return explicitCwd === undefined
+                ? await withActiveExtensionsExclusively(global, resolutionCwd, run)
+                : await withCwd(explicitCwd, () => withActiveExtensionsExclusively(global, resolutionCwd, run));
         }
         finally {
             clearWorkspaceContractsCache();
         }
     });
 }
-// Body of the dynamic-action activation cycle. Must only ever run under
-// dynamicExtensionActionQueue (see runDynamicExtensionAction above): it is the
-// exclusive owner of the process-global active extension registries while it runs.
-async function runDynamicExtensionActionExclusively(action, args, options, global, pmRoot) {
-    const settings = await readSettings(pmRoot);
-    const loadResult = await loadExtensions({
-        pmRoot,
-        settings,
-        cwd: process.cwd(),
-        noExtensions: false,
-    });
-    // This MCP server reloads + reactivates extensions per native-action request,
-    // so each request is a fresh activation cycle. Run the extension teardown
-    // lifecycle in a finally to release any resources opened during activate(),
-    // matching the long-running-server reload contract (pm-k1e4).
-    let activationResult;
+/**
+ * Body of the activation cycle. Must only ever run under {@link extensionActivationQueue}
+ * (see {@link withActiveExtensions}): it is the exclusive owner of the process-global
+ * active extension registries while it runs. Returns early with `run(null)` — still
+ * inside the serialized critical section — when extensions are disabled or no workspace
+ * exists yet, so those built-in actions also observe a stable (empty) registry. This MCP
+ * server reloads + reactivates extensions per request, so each call is a fresh cycle with
+ * teardown in a finally to release resources opened during activate() (the
+ * long-running-server reload contract, pm-k1e4). Load/activate failures are swallowed and
+ * `run` is invoked with `null`, mirroring the CLI's resilient snapshot loader
+ * (loadRuntimeExtensionSnapshot) so a broken extension can never break a built-in action.
+ */
+async function withActiveExtensionsExclusively(global, cwd, run) {
+    if (global.noExtensions) {
+        return run(null);
+    }
+    const pmRoot = resolvePmRoot(cwd, global.path);
+    if (!(await pathExists(getSettingsPath(pmRoot)))) {
+        return run(null);
+    }
+    let active = null;
+    let activated;
     try {
-        activationResult = await activateExtensions({
-            ...loadResult,
-            loaded: loadResult.loaded,
-        });
-        const normalizedAction = normalizeActionName(action);
-        const definition = activationResult.registrations.commands.find((entry) => normalizeActionName(entry.action) === normalizedAction);
-        const command = definition?.command ??
-            activationResult.commands.handlers.find((entry) => normalizeActionName(entry.command) === normalizedAction)?.command;
-        if (!command) {
-            throw new PmCliError(`Unsupported native pm action: ${action}`, 64);
-        }
+        const settings = await readSettings(pmRoot);
+        const loadResult = await loadExtensions({ pmRoot, settings, cwd, noExtensions: false });
+        const activationResult = await activateExtensions({ ...loadResult, loaded: loadResult.loaded });
+        // Record the teardown handle BEFORE publishing the registries so a throw from any
+        // setActive* setter still runs deactivateExtensions for resources opened during
+        // activate() instead of silently leaking them.
+        activated = { loadResult, activationResult };
         setActiveExtensionHooks(activationResult.hooks);
         setActiveExtensionCommands(activationResult.commands);
         setActiveExtensionParsers(activationResult.parsers);
@@ -351,42 +383,68 @@ async function runDynamicExtensionActionExclusively(action, args, options, globa
         setActiveExtensionServices(activationResult.services);
         setActiveExtensionRenderers(activationResult.renderers);
         setActiveExtensionRegistrations(activationResult.registrations);
-        const handlerResult = await runActiveCommandHandler({
-            command: normalizeCommandPath(command),
-            args: readStringArray(options.args ?? args.args),
-            options: extensionOptionsFromArgs(args, options),
-            global,
-            pm_root: pmRoot,
-        });
-        if (!handlerResult.handled) {
-            const suffix = handlerResult.warnings.length > 0 ? ` (${handlerResult.warnings.join(", ")})` : "";
-            throw new PmCliError(`Unsupported native pm action: ${action}${suffix}`, 64);
-        }
-        return handlerResult.result;
+        active = { registrations: activationResult.registrations, commands: activationResult.commands, pmRoot };
+    }
+    catch (error) {
+        resetActiveExtensionRegistries();
+        // CLI parity (loadRuntimeExtensionSnapshot): a load/activate failure must never
+        // break a built-in action — fall back to running with no active extensions. Surface
+        // the cause on stderr so a broken extension is diagnosable instead of being silently
+        // indistinguishable from a workspace that simply has no extensions.
+        console.error("[pm-mcp] extension activation failed; continuing without active extensions:", error);
+        active = null;
+    }
+    try {
+        return await run(active);
     }
     finally {
         // Reset the process-global active registries FIRST so a torn-down extension's
         // overrides/hooks cannot leak into a later request in this long-running server
-        // (e.g. a subsequent pm_list/pm_create) even if teardown below misbehaves.
-        setActiveExtensionHooks(createEmptyExtensionHookRegistry());
-        setActiveExtensionCommands(createEmptyExtensionCommandRegistry());
-        setActiveExtensionParsers(createEmptyExtensionParserRegistry());
-        setActiveExtensionPreflight(createEmptyExtensionPreflightRegistry());
-        setActiveExtensionServices(createEmptyExtensionServiceRegistry());
-        setActiveExtensionRenderers(createEmptyExtensionRendererRegistry());
-        setActiveExtensionRegistrations(createEmptyExtensionRegistrationRegistry());
-        // Best-effort teardown of extensions that activated successfully. Skip
-        // entirely if activation itself never produced a result (nothing was set
-        // up), and guard so an unexpected throw cannot escape the finally.
-        if (activationResult) {
-            await deactivateExtensions(loadResult, activationResult).catch(() => undefined);
+        // (for example a subsequent pm_list/pm_create) even if teardown below misbehaves.
+        resetActiveExtensionRegistries();
+        // Best-effort teardown of extensions that activated successfully. Skipped when
+        // activation never completed (nothing was set up); guarded so an unexpected throw
+        // cannot escape the finally.
+        if (activated) {
+            await deactivateExtensions(activated.loadResult, activated.activationResult).catch(() => undefined);
         }
     }
 }
-async function withCwd(cwd, run) {
-    if (typeof cwd !== "string" || cwd.trim().length === 0) {
-        return run();
+/**
+ * Resolve `action` against the active extension command registrations and dispatch it.
+ * Reached by runAction's default case for dynamic (non-built-in) actions after
+ * {@link withActiveExtensions} has published the active registries. `active` is `null`
+ * when no extensions are active (disabled, no workspace, or activation failed), in
+ * which case no extension command can match and the action is reported unsupported.
+ */
+async function dispatchActiveExtensionAction(action, args, options, global, active) {
+    if (!active) {
+        throw new PmCliError(`Unsupported native pm action: ${action}`, 64);
+    }
+    const normalizedAction = normalizeActionName(action);
+    const definition = active.registrations.commands.find((entry) => normalizeActionName(entry.action) === normalizedAction);
+    const command = definition?.command ??
+        active.commands.handlers.find((entry) => normalizeActionName(entry.command) === normalizedAction)?.command;
+    if (!command) {
+        throw new PmCliError(`Unsupported native pm action: ${action}`, 64);
     }
+    const handlerResult = await runActiveCommandHandler({
+        command: normalizeCommandPath(command),
+        args: readStringArray(options.args ?? args.args),
+        options: extensionOptionsFromArgs(args, options),
+        global,
+        pm_root: active.pmRoot,
+    });
+    if (!handlerResult.handled) {
+        const suffix = handlerResult.warnings.length > 0 ? ` (${handlerResult.warnings.join(", ")})` : "";
+        throw new PmCliError(`Unsupported native pm action: ${action}${suffix}`, 64);
+    }
+    return handlerResult.result;
+}
+async function withCwd(cwd, run) {
+    // Only ever called with an explicit, non-empty cwd (readString filters blanks), from
+    // inside the serialized activation queue, so the chdir/restore is exclusive per request
+    // and can never be clobbered by a concurrent caller.
     const previous = process.cwd();
     process.chdir(cwd);
     try {
@@ -404,7 +462,7 @@ async function withCwd(cwd, run) {
  * are forwarded unchanged so runtime fields named `full` remain valid user data.
  */
 function withMutationCompaction(args, options) {
-    return { changedFields: args.fullChangedFields === true ? "full" : "compact", idOnly: args.idOnly === true, runnerOptions: { ...(options ?? {}) } };
+    return { changedFields: args.fullChangedFields === true ? "full" : "compact", idOnly: args.idOnly === true, runnerOptions: { ...options } };
 }
 function mutationListOptions(options) {
     return {
@@ -519,6 +577,18 @@ function updateManyOptionsFromFlat(options) {
 async function runAction(args) {
     const action = readRequiredString(args, "action");
     const global = globalOptions(args);
+    // pm-zumn: dispatch every action (built-in and dynamic) inside one extension
+    // activation cycle so built-in actions see extension-contributed item types, fields,
+    // and profiles, consistent with the CLI. Snapshot the effective resolution cwd HERE,
+    // at request entry (the explicit args.cwd, else the server's current directory), so the
+    // queued cycle resolves against the directory the request arrived in rather than a value
+    // process.cwd() might hold by the time the task runs. Only an explicit cwd additionally
+    // pins process.cwd() (inside the serialized slot) for the built-in handler.
+    const explicitCwd = readString(args, "cwd");
+    const resolutionCwd = explicitCwd ?? process.cwd();
+    return withActiveExtensions(global, explicitCwd, resolutionCwd, (activeExtensions) => dispatchAction(action, args, global, activeExtensions));
+}
+async function dispatchAction(action, args, global, activeExtensions) {
     const options = optionsWithAuthor(args, action);
     const id = readString(args, "id");
     const force = args.force === true;
@@ -527,6 +597,8 @@ async function runAction(args) {
             return runInit(readString(args, "prefix"), global, options);
         case "context":
             return runContext(options, global);
+        case "next":
+            return runNext(options, global);
         case "list": {
             const listOptions = { ...options };
             if (listOptions.compact === undefined &&
@@ -830,6 +902,30 @@ async function runAction(args) {
                 force: schemaForce,
             }, global);
         }
+        case "profile": {
+            // subcommand/name are top-level fields in the published action contract,
+            // so accept them from args first and fall back to options for parity.
+            const subcommand = readString(args, "subcommand") ?? readRequiredString(options, "subcommand");
+            const normalizedSubcommand = subcommand.trim().toLowerCase();
+            const profileName = readString(args, "name") ?? readString(options, "name");
+            if (normalizedSubcommand === "list") {
+                return runProfileList();
+            }
+            if (normalizedSubcommand === "show") {
+                return runProfileShow(profileName);
+            }
+            if (normalizedSubcommand === "lint") {
+                return runProfileLint(profileName);
+            }
+            if (normalizedSubcommand === "apply") {
+                return runProfileApply(profileName, {
+                    dryRun: args.dryRun === true || options.dryRun === true,
+                    author: readString(args, "author") ?? readString(options, "author"),
+                    force: args.force === true || options.force === true,
+                }, global);
+            }
+            throw new PmCliError(`Unknown pm profile subcommand "${subcommand}". Allowed: list, show, apply, lint`, 64);
+        }
         case "stats":
             return runStats(global, {
                 storage: options.storage === true,
@@ -862,12 +958,13 @@ async function runAction(args) {
         case "gc":
             return runGc(global, options);
         default:
-            return runDynamicExtensionAction(action, args, options, global);
+            return dispatchActiveExtensionAction(action, args, options, global, activeExtensions);
     }
 }
 const HANDLERS = {
     pm_run: (args) => runAction(args),
     pm_context: (args) => runAction({ ...args, action: "context" }),
+    pm_next: (args) => runAction({ ...args, action: "next" }),
     pm_search: (args) => runAction({ ...args, action: "search" }),
     pm_list: (args) => runAction({ ...args, action: "list" }),
     pm_get: (args) => runAction({ ...args, action: "get" }),
@@ -890,6 +987,7 @@ const HANDLERS = {
     pm_health: (args) => runAction({ ...args, action: "health" }),
     pm_contracts: (args) => runAction({ ...args, action: "contracts" }),
     pm_schema: (args) => runAction({ ...args, action: "schema" }),
+    pm_profile: (args) => runAction({ ...args, action: "profile" }),
     pm_config: (args) => runAction({ ...args, action: "config" }),
     pm_plan: (args) => runAction({ ...args, action: "plan" }),
 };
@@ -939,8 +1037,8 @@ export async function handleRequest(request) {
             capabilities: { tools: {} },
             serverInfo: { name: "pm-mcp", version: PM_MCP_SERVER_VERSION },
             instructions: "You have access to native pm CLI tools for git-based project management. " +
-                "Use pm_context or pm_search before creating new work. " +
-                "Prefer narrow tools (pm_context, pm_list, pm_get, pm_search, pm_create, pm_copy, pm_focus, pm_update, pm_append, pm_claim, pm_release, pm_close, pm_comments, pm_files, pm_docs, pm_notes, pm_learnings, pm_deps, pm_test, pm_validate, pm_health, pm_contracts, pm_schema, pm_config, pm_plan) over pm_run when they cover the operation. " +
+                "Use pm_next to pick the next actionable item, or pm_context or pm_search before creating new work. " +
+                "Prefer narrow tools (pm_next, pm_context, pm_list, pm_get, pm_search, pm_create, pm_copy, pm_focus, pm_update, pm_append, pm_claim, pm_release, pm_close, pm_comments, pm_files, pm_docs, pm_notes, pm_learnings, pm_deps, pm_test, pm_validate, pm_health, pm_contracts, pm_schema, pm_profile, pm_config, pm_plan) over pm_run when they cover the operation. " +
                 "Use pm_plan for agent harness Plan workflows: it provides Codex/Claude/Cursor-style planning with durable steps, dependencies, decisions, discoveries, validation, and materialization. " +
                 "Use pm_schema and pm_config for workspace configuration: pm_schema manages custom item types/statuses and pm_config reads or writes settings keys. " +
                 "Use pm_run with an explicit action for package-owned operations (calendar/templates/guide/dedupe-audit/normalize/reindex/comments-audit/completion/test-runs-list/test-runs-status/test-runs-logs/test-runs-stop/test-runs-resume), plus activity, aggregate, history, stats, test-all, and gc. " +
@@ -972,7 +1070,9 @@ export async function handleRequest(request) {
         for (const warning of warnings) {
             console.error(`[pm-mcp] ${warning}`);
         }
-        const result = await withCwd(args.cwd, () => handler(args));
+        // cwd is applied inside the serialized activation cycle (see withActiveExtensions),
+        // so the chdir/restore is exclusive per request and cannot race a concurrent caller.
+        const result = await handler(args);
         return resultContent(result, warnings);
     }
     throw new PmCliError(`Unsupported MCP method: ${request.method ?? "(missing)"}`, 64);
@@ -1093,4 +1193,4 @@ if (isInvokedAsMcpMainModule(process.argv[1], import.meta.url)) {
 }
 /* c8 ignore stop */
 //# sourceMappingURL=server.js.map
-//# debugId=ad8d2ba8-8a0e-5d5e-b4d2-00e538908f91
+//# debugId=4921fdeb-d146-5458-bf25-02e9e7c091c0