@unbrained/pm-cli 2026.7.3 → 2026.7.5

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 2026.7.5 - 2026-07-05
+
+### Added
+
+- Architecture boundary ratchet: prevent new CLI/MCP private core imports while SDK promotion shrinks the baseline ([pm-8778](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-8778.toon))
+- Lock contention auto-retry: bounded jittered wait before lock_conflict so parallel agent mutations self-heal ([pm-2muu](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-2muu.toon))
+
+### Fixed
+
+- pm claim silently steals items already assigned to another agent — claim must be atomic test-and-set for multi-agent work distribution ([pm-8t5x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8t5x.toon))
+- Extension activation adds ~200ms to every command when bundled packages are installed ([pm-4oww](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-4oww.toon))
+- pm close <id\> -m 'text' still hard-blocks with close_reason_required: accept --message text as close-reason fallback (like closed pm-7x8d did for --resolution) ([pm-9hry](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-9hry.toon))
+- Extension installs are dead-on-arrival in CommonJS host projects: installed extension dirs lack package.json type:module ([pm-r0m4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-r0m4.toon))
+- beads/todos import-export runtime broken from real npm installs: runtime-loader imports .ts under node_modules (type-strip refused) ([pm-ejy7](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ejy7.toon))
+
+### Other
+
+- Bundle GH-433 self-parent guard, Windows nightly lock proof, and pnpm 11 bootstrap hardening ([pm-q1ke](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-q1ke.toon))
+- Inventory the CLI-to-core call graph: map every command to core modules and classify logic for SDK promotion ([pm-lodl](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-lodl.toon))
+- Sandbox audit fixes: package describe accepts npm package name; pm context <id\> routes to pm get ([pm-ayn7](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-ayn7.toon))
+- 2026-07-04 ecosystem audit \#4: coverage matrix, governance capability epic & relationship modeling ([pm-osea](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-osea.toon))
+- Backfill full-context bodies (and comments/deps/risk) on all active items so context is rebuildable from pm CLI alone ([pm-o043](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-o043.toon))
+- 2026-07-04 full pm-backlog audit: reconcile pm items with entire ecosystem (code, tests, docs, ideas, decisions) ([pm-y904](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-y904.toon))
+- GH-426: reduce complex method in compatibility-check.spec runCurrentPmCommand ([pm-24o5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-24o5.toon))
+- SDK testing-helper input validation: runRegisteredCommandForTest positional misuse crashes; createExtensionTestHarness accepts non-extension module silently ([pm-2exf](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-2exf.toon))
+
+## 2026.7.4 - 2026-07-04
+
+### Security
+
+- Extreme mandatory quality gates: strict ESLint everywhere, jscpd strict/zero-threshold, suppressions budget, Trivy/ShellCheck/PSScriptAnalyzer/actionlint CI, admin-proof branch protection ([pm-7wmq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-7wmq.toon))
+
+### Other
+
+- Test meaningfulness audit: strengthen hollow assertions, de-mock thin specs, convert contract source-mirrors to behavior ([pm-4i73](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-4i73.toon))
+
 ## 2026.7.3 - 2026-07-03
 
 ### Fixed

package/CONTRIBUTING.md

@@ -80,13 +80,17 @@ Every change must *only improve* the codebase — CI blocks any pull request tha
 introduces a new quality issue. Run the lint suite before pushing:
 
 ```bash
-pnpm lint           # eslint (complexity + maintainability) + jscpd duplication + static-quality gate
+pnpm lint           # eslint (recommended + complexity + maintainability) + jscpd duplication + static-quality gate
 ```
 
-**Complex Method no-regression gate.** ESLint enforces a cyclomatic-complexity
-ceiling (`complexity` max 17 — a function at CC ≥ 18 fails), calibrated to
-CodeFactor's "Complex Method" detector. The full set of pre-existing violations is
-grandfathered in `eslint-suppressions.json` (ESLint native bulk suppressions), so:
+**ESLint strict baseline.** The flat config layers `@eslint/js` recommended,
+`typescript-eslint` recommended, and the CodeFactor-calibrated maintainability
+rules over *all* surfaces including tests, with
+`reportUnusedDisableDirectives: "error"` so stale inline disables fail the run.
+It also enforces a cyclomatic-complexity ceiling (`complexity` max 17 — a
+function at CC ≥ 18 fails), calibrated to CodeFactor's "Complex Method"
+detector. The full set of pre-existing violations is grandfathered in
+`eslint-suppressions.json` (ESLint native bulk suppressions), so:
 
 - A **new** complex method (or making an existing one worse) fails `pnpm lint` in
   CI — you must simplify it.
@@ -95,8 +99,33 @@ grandfathered in `eslint-suppressions.json` (ESLint native bulk suppressions), s
   `eslint-suppressions.json` — the baseline only ever shrinks.
 
 Do not regenerate the whole baseline (`pnpm lint:complexity:baseline`) to silence a
-new violation; that defeats the gate. Driving the baseline to empty is the path to a
-CodeFactor **A+** (tracked under epic `pm-92if`).
+new violation; that defeats the gate — and the static quality gate enforces a hard
+budget (`MAX_ESLINT_SUPPRESSIONS` in `scripts/release/static-quality-gate.mjs`) on
+the baseline's total size, so growing it fails CI outright. Lower the budget as the
+baseline burns down. Driving the baseline to empty is the path to a CodeFactor
+**A+** (tracked under epic `pm-92if`).
+
+**jscpd duplication gate.** `jscpd` runs in `strict` mode with `threshold: 0`
+(any clone ≥ 22 lines / 115 tokens across src, packages, plugins, scripts,
+docs/examples, and tests fails). Extract shared helpers instead of loosening
+`.jscpd.json`.
+
+**Inline pragma budgets.** The static quality gate enforces hard ceilings on the
+inline escape hatches that could otherwise silence a gate without touching any
+config file a reviewer would watch: inline `eslint-disable` comments, coverage
+ignore pragmas (`v8 ignore` / `c8 ignore` / `istanbul ignore`), and
+`jscpd:ignore` blocks (budget 0 — never allowed). The ceilings live in
+`scripts/release/static-quality-gate.mjs` (`MAX_INLINE_ESLINT_DISABLES`,
+`MAX_COVERAGE_IGNORE_PRAGMAS`, `MAX_JSCPD_IGNORE_PRAGMAS`); adding a new pragma
+anywhere in the scanned surfaces fails CI. Lower the budgets as usage burns
+down — never raise them.
+
+**Security & script gates (`.github/workflows/security.yml`).** Every PR also
+runs Trivy (dependency vulnerabilities, secrets, misconfigurations — any
+HIGH/CRITICAL finding fails), ShellCheck at `--severity=style` over all tracked
+`*.sh`, PSScriptAnalyzer over all tracked PowerShell at Error/Warning/Information
+severity, and actionlint over the workflows themselves. All four are required
+branch-protection checks.
 
 **Greptile review.** `pnpm review:greptile:gate` runs the Greptile CLI reviewer over
 the current branch and fails on findings. It is wired into `pnpm release:gates`

package/README.md

@@ -10,12 +10,8 @@
 [![pm total](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=items&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
 [![pm open](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=status&status=open&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
 [![pm in progress](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=status&status=in_progress&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
-[![pm blocked](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=status&status=blocked&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
-[![pm canceled](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=status&status=canceled&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
 [![pm closed](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=closed&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
 [![pm completion](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=completion&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
-[![pm last activity](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=last-activity&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
-[![pm history events](https://pm-cli.unbrained.dev/badges/svg?repo=unbraind/pm-cli&metric=history-events&style=flat&rt=2)](https://pm-cli.unbrained.dev/badges)
 
 `pm` is a git-native project management CLI for humans and coding agents. It stores work items in reviewable repository files, records every mutation in append-only history, and defaults to sparse TOON output so agents can spend fewer tokens while still getting deterministic data.
 
@@ -137,11 +133,7 @@ For token-aware local routing, install `guide-shell` with `pm install guide-shel
 - `pm contracts` is the machine-readable command and schema contract surface for agents.
 - `pm guide` is the optional local progressive-disclosure docs and skills index for agents after installing `guide-shell`.
 
-`search.tuning` lexical defaults include `reminders_weight=2` and `events_weight=2` in addition to title/description/tag/status/body/comment/note/learning/dependency/linked-content weights. Keep docs and contracts aligned with runtime defaults when tuning behavior changes.
-
-Hybrid queries can override blend weight per call via `pm search --mode hybrid --semantic-weight <0..1>`, and semantic corpus truncation can be tuned via `pm config project set search_embedding_corpus_max_characters <positive-int>` (provider defaults still apply when unset).
-
-Advanced semantic tuning is opt-in: `search.query_expansion` can expand semantic/hybrid queries before embedding, and `search.rerank` can rerank hybrid top-k candidates (with graceful fallback warnings when providers are unavailable). Vector backends now also support `vector_store.collection_name` for multi-workspace/shared-store isolation.
+Search behavior (lexical `search.tuning` weights, hybrid `--semantic-weight`, query expansion, reranking, and vector-store options) is fully configurable — see [Search Configuration](docs/CONFIGURATION.md#search-configuration).
 
 ## Tracker References
 

package/dist/cli/commands/calendar.d.ts

@@ -1,11 +1,11 @@
 import type { GlobalOptions } from "../../core/shared/command-types.js";
 import type { ItemStatus, ItemType } from "../../types/index.js";
-export declare const CALENDAR_VIEW_VALUES: readonly ["agenda", "day", "week", "month"];
+declare const CALENDAR_VIEW_VALUES: readonly ["agenda", "day", "week", "month"];
 /**
  * Restricts calendar view values accepted by command, SDK, and storage contracts.
  */
 export type CalendarView = (typeof CALENDAR_VIEW_VALUES)[number];
-export declare const CALENDAR_OUTPUT_VALUES: readonly ["markdown", "toon", "json"];
+declare const CALENDAR_OUTPUT_VALUES: readonly ["markdown", "toon", "json"];
 /**
  * Restricts calendar output format values accepted by command, SDK, and storage contracts.
  */
@@ -142,3 +142,4 @@ export declare function renderCalendarToon(result: CalendarResult): string;
  * Implements run calendar for the public runtime surface of this module.
  */
 export declare function runCalendar(options: CalendarOptions, global: GlobalOptions): Promise<CalendarResult>;
+export {};

package/dist/cli/commands/calendar.js

@@ -4,7 +4,7 @@
  * Implements the pm calendar command surface and its agent-facing runtime behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="16039cc1-59c0-510f-9ae1-d452ba30096c")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b58c505e-43e8-5bc4-ae0e-a241ee5e72b9")}catch(e){}}();
 import { encode as encodeToon } from "@toon-format/toon";
 import { pathExists } from "../../core/fs/fs-utils.js";
 import { getActiveExtensionRegistrations } from "../../core/extensions/index.js";
@@ -21,8 +21,8 @@ import { listAllFrontMatterLight } from "../../core/store/item-store.js";
 import { getSettingsPath, resolvePmRoot } from "../../core/store/paths.js";
 import { readSettings } from "../../core/store/settings.js";
 import { weekdayOrderIndex } from "../../types/index.js";
-export const CALENDAR_VIEW_VALUES = ["agenda", "day", "week", "month"];
-export const CALENDAR_OUTPUT_VALUES = ["markdown", "toon", "json"];
+const CALENDAR_VIEW_VALUES = ["agenda", "day", "week", "month"];
+const CALENDAR_OUTPUT_VALUES = ["markdown", "toon", "json"];
 const UTC_DAY_TO_WEEKDAY = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
 const DEFAULT_RECURRENCE_LOOKAHEAD_DAYS = 365;
 const DEFAULT_RECURRENCE_LOOKBACK_DAYS = 365;
@@ -46,7 +46,7 @@ function parseIncludeSources(raw) {
         return new Set(["deadlines", "reminders", "events"]);
     }
     const values = normalized
-        .split(/[\|,]/)
+        .split(/[|,]/)
         .map((value) => value.trim())
         .filter((value) => value.length > 0);
     if (values.length === 0) {
@@ -936,4 +936,4 @@ export async function runCalendar(options, global) {
     };
 }
 //# sourceMappingURL=calendar.js.map
-//# debugId=16039cc1-59c0-510f-9ae1-d452ba30096c
+//# debugId=b58c505e-43e8-5bc4-ae0e-a241ee5e72b9