@unbrained/pm-cli 2026.7.14 → 2026.7.16

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.7.14"
+    "version": "2026.7.16"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.7.14",
+      "version": "2026.7.16",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/CHANGELOG.md

@@ -1,9 +1,56 @@
 # Changelog
 
+## 2026.7.16 - 2026-07-16
+
+### Other
+
+- 2026-07-15 full CLI SDK and ecosystem manual audit and optimization plan (review pass 91) ([pm-45lr](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/plans/pm-45lr.toon))
+
+## 2026.7.15 - 2026-07-15
+
+### Added
+
+- Promote governance, validation, health, and maintenance primitives to the public SDK: validate, health, gc, changelog/reporting hooks ([pm-oxrw](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-oxrw.toon))
+- GH-444: ergonomic author attribution — global --author, init author_default, unknown-author advisory ([pm-cpja](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-cpja.toon))
+- Promote schema, config, profile, and init primitives to the public SDK: full workspace customization programmatically ([pm-3mna](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-3mna.toon))
+- Promote package & extension lifecycle primitives to the public SDK: install, upgrade, extension list/enable/disable, managed-package state ([pm-x6jf](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-x6jf.toon))
+- Promote annotation and link primitives to the public SDK: comments, notes, learnings, files, docs, deps, append metadata ([pm-zwpp](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-zwpp.toon))
+- Point-in-time read projection: pm get --at <version\|timestamp\> renders reconstructed historical item state without mutating ([pm-hib1](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-hib1.toon))
+
+### Fixed
+
+- Linked-test item reference parser skips item IDs after value-bearing flags ([pm-jhg9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jhg9.toon))
+- Sentry PM-CLI-2B: external extension subprocess cannot resolve pm executable ([pm-d4ns](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-d4ns.toon))
+- Sentry PM-CLI-29: external Neo4j command reports missing configuration as a high pm-cli error ([pm-7n5a](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7n5a.toon))
+- Nightly windows/Node24: package-manifest SDK-surface exemption uses POSIX endsWith — governance-audit runtime.ts check fails on backslash paths ([pm-u5zr](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u5zr.toon))
+- GH-522: Windows nightly red — init next-steps hints POSIX-quote native Windows paths (quoteCommandArg backslash escaping) ([pm-b24b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-b24b.toon))
+- GH-567: macOS+Windows nightly red — extension-install copy self-nesting check misses symlinked/short-name temp paths (realpath fallback asymmetry) ([pm-0fhw](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-0fhw.toon))
+- Adopt CodSpeed continuous CPU benchmarking in CI: review/land PR\#564 and establish the per-PR perf-regression signal ([pm-yh6t](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-yh6t.toon))
+- GH-562: pm init rejects --id-prefix/--prefix flag though id prefix is only positional ([pm-nmzx](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-nmzx.toon))
+- GH-560: extension renderer overrides diverge between SDK harness and real CLI output ([pm-as4a](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-as4a.toon))
+- GH-557: contract layer intercepts -h/--help before variadic-positional handlers, blocking legitimate positional content ([pm-albl](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-albl.toon))
+- GH-547: SDK exporters and renderers cannot suppress host rendering of handled output ([pm-f38n](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-f38n.toon))
+- GH-550: extension list flags are erased at the real CLI boundary ([pm-evav](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-evav.toon))
+- GH-558: export canonical item-to-context-relevance candidate derivation from the public SDK ([pm-qyc6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qyc6.toon))
+- GH-555: remove unnecessary spread in relationship registry ordering assertion ([pm-ofgc](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ofgc.toon))
+- Validate lifecycle cycles using ordering relationship kinds only ([pm-6irg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-6irg.toon))
+
+### Security
+
+- Add TruffleHog OSS verified-secret scanning to the security workflow and complete free GitHub secret-scanning toggles ([pm-4ris](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-4ris.toon))
+- Add OSSF Scorecard supply-chain security workflow with published results and SARIF code-scanning upload ([pm-k7dp](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-k7dp.toon))
+
+### Other
+
+- validate_history_unknown_author_events: legacy/actionable split for immutable unknown-author history events + first-party automation author coverage ([pm-demq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-demq.toon))
+- Ship DeepSource, DeepScan, and Scrutinizer CI free-OSS analyzer configurations with documented activation ([pm-3a68](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-3a68.toon))
+- ADR: relationship graph semantics — typed directional, ordering, provenance, evidence, and associative edges with schema-extensible invariants ([pm-4jqm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-4jqm.toon))
+
 ## 2026.7.14 - 2026-07-14
 
 ### Added
 
+- Promote history-stream maintenance primitives to the public SDK: history-redact, history-repair, history-compact (audited rewrite, re-anchor, checkpoint/prune) ([pm-4a7m](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-4a7m.toon))
 - Context usage feedback signal: served-then-acted-on outcomes strengthen relevance scoring (retrieval-practice effect) ([pm-uwfs](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-uwfs.toon))
 - GH-544: linked-file path anchoring — files/docs add/glob/discover/validate-paths resolve at process.cwd() while validate --check-files anchors at the workspace root ([pm-chyh](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-chyh.toon))
 
@@ -13,6 +60,12 @@
 
 ### Fixed
 
+- pm get --full omits children for Plan parents while pm list --parent returns them ([pm-y4z5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-y4z5.toon))
+- Intentional package CommandError outcomes create high-severity Sentry issues (PM-CLI-16) ([pm-7071](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7071.toon))
+- Extension install self-copy guard: reject source-inside-destination layouts before fs.cp EINVAL (PM-CLI-28) ([pm-8myl](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8myl.toon))
+- Sentry captures deliberate Ctrl+C interrupts as error-level events (AbortError, PM-CLI-27) ([pm-ksv2](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ksv2.toon))
+- Torn-install bundle transients block scheduled releases: boot-time chunk-integrity self-check + distinct error code for gate classification ([pm-wfvq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-wfvq.toon))
+- GH-446: pm get omits schedule facet (events/start_at/end_at/location) for Meeting/Event/Reminder ([pm-x1g5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-x1g5.toon))
 - GH-533: create/update accept empty --title — required-title contract inconsistent between omitted and empty string ([pm-7je0](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7je0.toon))
 - GH-535: pm deps omits dangling parent references (missing_count:0, missing:false) contradicting validate's dangling_reference_count ([pm-p9sc](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-p9sc.toon))
 - GH-542: MCP pm_copy nests title/message under options while sibling tools declare flat camelCase params — own suite triggers unexpected-arg warnings ([pm-hno5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-hno5.toon))
@@ -24,6 +77,7 @@
 
 ### Other
 
+- Docstring coverage regressed below achieved-100% by PR\#536 extraction files; quality:static floors never ratcheted and mask drift; drop dead closure-pattern export ([pm-fb3i](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-fb3i.toon))
 - PR review helper: watch GitHub checks and enforce thread-scoped replies ([pm-0fxa](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-0fxa.toon))
 - Token-budget context packer: diversity-aware selection, projection degradation, and bounded output for pm context/next ([pm-55ra](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-55ra.toon))
 - Complete public linked-resource SDK primitives and actionable dependency governance ([pm-jcvg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-jcvg.toon))

package/README.md

@@ -3,6 +3,9 @@
 [![CI](https://github.com/unbraind/pm-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/unbraind/pm-cli/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/unbraind/pm-cli/branch/main/graph/badge.svg)](https://codecov.io/gh/unbraind/pm-cli)
 [![CodeFactor](https://www.codefactor.io/repository/github/unbraind/pm-cli/badge)](https://www.codefactor.io/repository/github/unbraind/pm-cli)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/unbraind/pm-cli/badge)](https://scorecard.dev/viewer/?uri=github.com/unbraind/pm-cli)
+[![DeepScan grade](https://deepscan.io/api/teams/30234/projects/32092/branches/1043829/badge/grade.svg)](https://deepscan.io/dashboard#view=project&tid=30234&pid=32092&bid=1043829)
+[![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://app.codspeed.io/unbraind/pm-cli?utm_source=badge)
 [![npm version](https://img.shields.io/npm/v/%40unbrained%2Fpm-cli)](https://www.npmjs.com/package/%40unbrained%2Fpm-cli)
 [![Node >=22.18](https://img.shields.io/node/v/%40unbrained%2Fpm-cli)](https://nodejs.org)
 ![NPM Downloads](https://img.shields.io/npm/d18m/%40unbrained%2Fpm-cli)
@@ -18,17 +21,17 @@
 
 ## Start Here
 
-| Need | Read |
-|------|------|
-| Install and create the first item | [Quickstart](docs/QUICKSTART.md) |
-| New maintainer onboarding | [Onboarding](docs/ONBOARDING.md) |
-| Agent workflow and token-minimal loops | [Agent Guide](docs/AGENT_GUIDE.md) |
-| Command families and examples | [Command Reference](docs/COMMANDS.md) |
-| Settings, storage, search, and output | [Configuration](docs/CONFIGURATION.md) |
-| Safe test execution and linked tests | [Testing](docs/TESTING.md) |
-| Package and extension authoring | [Packages and Extensions](docs/EXTENSIONS.md) and [SDK](docs/SDK.md) |
-| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md) |
-| Contributor internals | [Architecture](docs/ARCHITECTURE.md) |
+| Need                                                           | Read                                                                                                                                    |
+| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
+| Install and create the first item                              | [Quickstart](docs/QUICKSTART.md)                                                                                                        |
+| New maintainer onboarding                                      | [Onboarding](docs/ONBOARDING.md)                                                                                                        |
+| Agent workflow and token-minimal loops                         | [Agent Guide](docs/AGENT_GUIDE.md)                                                                                                      |
+| Command families and examples                                  | [Command Reference](docs/COMMANDS.md)                                                                                                   |
+| Settings, storage, search, and output                          | [Configuration](docs/CONFIGURATION.md)                                                                                                  |
+| Safe test execution and linked tests                           | [Testing](docs/TESTING.md)                                                                                                              |
+| Package and extension authoring                                | [Packages and Extensions](docs/EXTENSIONS.md), [SDK](docs/SDK.md), and [Customization Primitives](docs/SDK_CUSTOMIZATION_PRIMITIVES.md) |
+| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md)                                                                                                          |
+| Contributor internals                                          | [Architecture](docs/ARCHITECTURE.md)                                                                                                    |
 
 Full documentation starts at [docs/README.md](docs/README.md).
 

package/dist/cli/argv-utils.d.ts

@@ -9,7 +9,4 @@ export declare function normalizeLongFlag(flag: string): string;
 export declare function normalizeLongOptionFlag(token: string): string | undefined;
 /** Implements extract provided option flags for the public runtime surface of this module. */
 export declare function extractProvidedOptionFlags(argv: string[]): string[];
-/** Implements quote command arg for the public runtime surface of this module. */
-export declare function quoteCommandArg(arg: string): string;
-/** Implements render pm command for the public runtime surface of this module. */
-export declare function renderPmCommand(argv: string[]): string;
+export { quoteCommandArg, renderPmCommand } from "../sdk/command-line.js";

package/dist/cli/argv-utils.js

@@ -5,7 +5,7 @@
  */
 /** Normalizes a raw long-option token into the canonical flag spelling used by CLI bootstrap parsing. */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="721e529c-b0be-5f84-89d6-2c338dc2b466")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e931035a-0e65-560e-9480-cdafdeb01ecf")}catch(e){}}();
 export function normalizeLongFlag(flag) {
     return `--${flag
         .replace(/^--?/, "")
@@ -36,16 +36,6 @@ export function extractProvidedOptionFlags(argv) {
     }
     return ordered;
 }
-/** Implements quote command arg for the public runtime surface of this module. */
-export function quoteCommandArg(arg) {
-    if (/^[A-Za-z0-9._:/@=-]+$/.test(arg)) {
-        return arg;
-    }
-    return `"${arg.replace(/(["\\$`])/g, "\\$1")}"`;
-}
-/** Implements render pm command for the public runtime surface of this module. */
-export function renderPmCommand(argv) {
-    return `pm ${argv.map((token) => quoteCommandArg(token)).join(" ")}`;
-}
+export { quoteCommandArg, renderPmCommand } from "../sdk/command-line.js";
 //# sourceMappingURL=argv-utils.js.map
-//# debugId=721e529c-b0be-5f84-89d6-2c338dc2b466
+//# debugId=e931035a-0e65-560e-9480-cdafdeb01ecf

package/dist/cli/argv-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"argv-utils.js","sources":["cli/argv-utils.ts"],"sourceRoot":"/","sourcesContent":["/**\n * @module cli/argv-utils\n *\n * Provides CLI runtime support for Argv Utils.\n */\n/** Normalizes a raw long-option token into the canonical flag spelling used by CLI bootstrap parsing. */\nexport function normalizeLongFlag(flag: string): string {\n  return `--${flag\n    .replace(/^--?/, \"\")\n    .replace(/_/g, \"-\")\n    .replace(/([a-z0-9])([A-Z])/g, \"$1-$2\")\n    .toLowerCase()}`;\n}\n\n/** Implements normalize long option flag for the public runtime surface of this module. */\nexport function normalizeLongOptionFlag(token: string): string | undefined {\n  if (!token.startsWith(\"--\")) {\n    return undefined;\n  }\n  const key = token.includes(\"=\") ? token.slice(0, token.indexOf(\"=\")) : token;\n  return normalizeLongFlag(key);\n}\n\n/** Implements extract provided option flags for the public runtime surface of this module. */\nexport function extractProvidedOptionFlags(argv: string[]): string[] {\n  const provided = new Set<string>();\n  const ordered: string[] = [];\n  for (const token of argv) {\n    const normalized = normalizeLongOptionFlag(token);\n    if (normalized) {\n      if (!provided.has(normalized)) {\n        ordered.push(normalized);\n      }\n      provided.add(normalized);\n    }\n  }\n  return ordered;\n}\n\n/** Implements quote command arg for the public runtime surface of this module. */\nexport function quoteCommandArg(arg: string): string {\n  if (/^[A-Za-z0-9._:/@=-]+$/.test(arg)) {\n    return arg;\n  }\n  return `\"${arg.replace(/([\"\\\\$`])/g, \"\\\\$1\")}\"`;\n}\n\n/** Implements render pm command for the public runtime surface of this module. */\nexport function renderPmCommand(argv: string[]): string {\n  return `pm ${argv.map((token) => quoteCommandArg(token)).join(\" \")}`;\n}\n"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,yGAAyG;;;AACzG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,KAAK,IAAI;SACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACvE,CAAC","debugId":"721e529c-b0be-5f84-89d6-2c338dc2b466"}
+{"version":3,"file":"argv-utils.js","sources":["cli/argv-utils.ts"],"sourceRoot":"/","sourcesContent":["/**\n * @module cli/argv-utils\n *\n * Provides CLI runtime support for Argv Utils.\n */\n/** Normalizes a raw long-option token into the canonical flag spelling used by CLI bootstrap parsing. */\nexport function normalizeLongFlag(flag: string): string {\n  return `--${flag\n    .replace(/^--?/, \"\")\n    .replace(/_/g, \"-\")\n    .replace(/([a-z0-9])([A-Z])/g, \"$1-$2\")\n    .toLowerCase()}`;\n}\n\n/** Implements normalize long option flag for the public runtime surface of this module. */\nexport function normalizeLongOptionFlag(token: string): string | undefined {\n  if (!token.startsWith(\"--\")) {\n    return undefined;\n  }\n  const key = token.includes(\"=\") ? token.slice(0, token.indexOf(\"=\")) : token;\n  return normalizeLongFlag(key);\n}\n\n/** Implements extract provided option flags for the public runtime surface of this module. */\nexport function extractProvidedOptionFlags(argv: string[]): string[] {\n  const provided = new Set<string>();\n  const ordered: string[] = [];\n  for (const token of argv) {\n    const normalized = normalizeLongOptionFlag(token);\n    if (normalized) {\n      if (!provided.has(normalized)) {\n        ordered.push(normalized);\n      }\n      provided.add(normalized);\n    }\n  }\n  return ordered;\n}\n\nexport { quoteCommandArg, renderPmCommand } from \"../sdk/command-line.js\";\n"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,yGAAyG;;;AACzG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,KAAK,IAAI;SACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC","debugId":"e931035a-0e65-560e-9480-cdafdeb01ecf"}

package/dist/cli/bootstrap-args.d.ts

@@ -3,7 +3,8 @@
  *
  * Provides CLI runtime support for Bootstrap Args.
  */
-import { type CliFlagContract } from "../sdk/cli-contracts.js";
+import { EXECUTABLE_COMMAND_ALIASES, type CliFlagContract } from "../sdk/cli-contracts.js";
+export { EXECUTABLE_COMMAND_ALIASES };
 /** Documents the bootstrap global options payload exchanged by command, SDK, and package integrations. */
 export interface BootstrapGlobalOptions {
     /** Filesystem path used for path resolution. */
@@ -16,6 +17,10 @@ export interface BootstrapGlobalOptions {
     json: boolean;
     /** Value that configures or reports quiet for this contract. */
     quiet: boolean;
+    /** Invocation-wide mutation author override. */
+    author?: string;
+    /** Whether `--author` was present without its required value. */
+    authorMissingValue?: true;
 }
 /** Implements parse bootstrap global options for the public runtime surface of this module. */
 export declare function parseBootstrapGlobalOptions(argv: string[]): BootstrapGlobalOptions;
@@ -38,8 +43,6 @@ export declare function applyBootstrapPagerPolicy(argv: string[]): void;
 export declare function normalizeLegacyExtensionActionSyntax(argv: string[]): string[];
 type BootstrapNormalizationReason = "legacy_extension_action" | "command_alias" | "flag_alias" | "flag_typo" | "bare_key_value" | "list_merge";
 type BootstrapNormalizationConfidence = "high" | "medium";
-/** Executable command aliases: a leading command token here is rewritten to its canonical command BEFORE commander parses, so the alias actually runs instead of merely being suggested. These are the highest-frequency aliases real agents type (telemetry: `pm show <id>` alone is the single most common unknown-command) and each target takes the same positional/flags as the alias (with `--comment`/ `--note`/`--learning` flag-aliased to `--add` on the target command). Keeping this in one place means the alias is consistent across registration, commander dispatch, telemetry, and error handling — all of which read the normalized argv. */
-export declare const EXECUTABLE_COMMAND_ALIASES: Readonly<Record<string, string>>;
 /** Documents the bootstrap normalization event payload exchanged by command, SDK, and package integrations. */
 export interface BootstrapNormalizationEvent {
     /** Value that configures or reports from for this contract. */
@@ -114,4 +117,3 @@ export declare const _testOnly: {
     normalizeLongOptionToken: typeof normalizeLongOptionToken;
     resolveCanonicalFlag: typeof resolveCanonicalFlag;
 };
-export {};

package/dist/cli/bootstrap-args.js

@@ -4,9 +4,25 @@
  * Provides CLI runtime support for Bootstrap Args.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="af492dd6-e25a-5c2a-8c4e-d7d7a7dad41c")}catch(e){}}();
-import { resolveSubcommandFlagContractsForCommand, } from "../sdk/cli-contracts.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c8537d1b-6df6-53b0-a308-f91e09d39cf3")}catch(e){}}();
+import { EXECUTABLE_COMMAND_ALIASES, resolveSubcommandFlagContractsForCommand, } from "../sdk/cli-contracts.js";
+export { EXECUTABLE_COMMAND_ALIASES };
 import { levenshteinDistanceWithinLimit } from "../core/shared/levenshtein.js";
+const GLOBAL_VALUE_CONSUMING_FLAGS = new Set([
+    "--pm-path",
+    "--path",
+    "--author",
+]);
+/** Whether a global value-consuming flag uses its inline `--flag=value` form. */
+const isInlineGlobalValueToken = (token) => {
+    const equalsIndex = token.indexOf("=");
+    return (equalsIndex > 0 &&
+        GLOBAL_VALUE_CONSUMING_FLAGS.has(token.slice(0, equalsIndex)));
+};
+/** Whether optional bootstrap author syntax consumes the following token. */
+const consumesBootstrapAuthorValue = (next) => {
+    return typeof next === "string" && !next.startsWith("-");
+};
 function parseBootstrapPathToken(token, next) {
     if (token === "--path" || token === "--pm-path") {
         if (typeof next === "string" && next.length > 0) {
@@ -50,6 +66,8 @@ export function parseBootstrapGlobalOptions(argv) {
     let noPager = false;
     let json = false;
     let quiet = false;
+    let author;
+    let authorMissingValue = false;
     let index = 0;
     while (index < argv.length) {
         const token = argv[index];
@@ -89,6 +107,22 @@ export function parseBootstrapGlobalOptions(argv) {
             index += parsedPath.consumed;
             continue;
         }
+        if (token === "--author") {
+            if (consumesBootstrapAuthorValue(argv[index + 1])) {
+                author = argv[index + 1];
+                index += 2;
+            }
+            else {
+                authorMissingValue = true;
+                index += 1;
+            }
+            continue;
+        }
+        if (token.startsWith("--author=")) {
+            author = token.slice("--author=".length);
+            index += 1;
+            continue;
+        }
         index += 1;
     }
     return {
@@ -97,6 +131,8 @@ export function parseBootstrapGlobalOptions(argv) {
         noPager,
         json,
         quiet,
+        ...(author !== undefined ? { author } : {}),
+        ...(authorMissingValue ? { authorMissingValue: true } : {}),
     };
 }
 /** Implements strip global bootstrap tokens for the public runtime surface of this module. */
@@ -118,11 +154,15 @@ export function stripGlobalBootstrapTokens(argv) {
             index += 1;
             continue;
         }
-        if (token === "--path" || token === "--pm-path") {
+        if (token === "--author") {
+            index += consumesBootstrapAuthorValue(argv[index + 1]) ? 2 : 1;
+            continue;
+        }
+        if (GLOBAL_VALUE_CONSUMING_FLAGS.has(token)) {
             index += 2;
             continue;
         }
-        if (token.startsWith("--path=") || token.startsWith("--pm-path=")) {
+        if (isInlineGlobalValueToken(token)) {
             index += 1;
             continue;
         }
@@ -181,12 +221,15 @@ function findCommandTokenIndex(argv) {
         if (token === "--") {
             return undefined;
         }
-        if (token === "--path" || token === "--pm-path") {
+        if (token === "--author") {
+            index += consumesBootstrapAuthorValue(argv[index + 1]) ? 1 : 0;
+            continue;
+        }
+        if (GLOBAL_VALUE_CONSUMING_FLAGS.has(token)) {
             index += 1;
             continue;
         }
-        if (token.startsWith("--path=") ||
-            token.startsWith("--pm-path=") ||
+        if (isInlineGlobalValueToken(token) ||
             token === "--json" ||
             token === "--quiet" ||
             token === "--no-extensions" ||
@@ -270,13 +313,6 @@ export function normalizeLegacyExtensionActionSyntax(argv) {
     ];
 }
 /** Executable command aliases: a leading command token here is rewritten to its canonical command BEFORE commander parses, so the alias actually runs instead of merely being suggested. These are the highest-frequency aliases real agents type (telemetry: `pm show <id>` alone is the single most common unknown-command) and each target takes the same positional/flags as the alias (with `--comment`/ `--note`/`--learning` flag-aliased to `--add` on the target command). Keeping this in one place means the alias is consistent across registration, commander dispatch, telemetry, and error handling — all of which read the normalized argv. */
-export const EXECUTABLE_COMMAND_ALIASES = {
-    show: "get",
-    view: "get",
-    comment: "comments",
-    note: "notes",
-    learning: "learnings",
-};
 /**
  * Rewrite a leading command-alias token (e.g. `show` -> `get`) in place. Only the
  * command position is considered — the same token appearing later as an argument
@@ -482,7 +518,6 @@ function normalizeLongOptionToken(token, lookup) {
 // flag during coalescing. `--pm-path <dir>` and its legacy `--path <dir>`
 // alias are the documented cases; other globals
 // (--json/--quiet/--no-extensions/--no-pager/--profile) are boolean.
-const GLOBAL_VALUE_CONSUMING_FLAGS = new Set(["--pm-path", "--path"]);
 function splitCanonicalListToken(token) {
     if (!token.startsWith("--")) {
         return null;
@@ -799,4 +834,4 @@ export const _testOnly = {
     resolveCanonicalFlag,
 };
 //# sourceMappingURL=bootstrap-args.js.map
-//# debugId=af492dd6-e25a-5c2a-8c4e-d7d7a7dad41c
+//# debugId=c8537d1b-6df6-53b0-a308-f91e09d39cf3