@unbrained/pm-cli 2026.8.16 → 2026.8.17

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.16"
+    "version": "2026.8.17"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.16",
+      "version": "2026.8.17",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 2026.8.17 - 2026-08-17
+
+### Added
+
+- History-derived defect recurrence gate: turn resolved incident patterns into targeted local and hosted CI protections ([pm-1qkivy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-1qkivy.toon))
+- Agent skills routed to a workflow loop but named no capability family and no read-cost, so four of twelve command families and the entire output-budget surface were unreachable through progressive disclosure ([pm-f6zjpq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-f6zjpq.toon))
+
+### Fixed
+
+- Linked tests retain high-volume Vitest output without aborting ([pm-giks4s](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-giks4s.toon))
+- A declared context intent returns no context when combined with the narrowing flag, and its refusal receipt reports 122 tokens against a 2400 budget as the reason it does not fit ([pm-3crymx](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-3crymx.toon))
+- The relationship lexicon cannot express recurrence, so a defect family fixed thirty times is thirty unrelated nodes to every graph algorithm ([pm-ouyq3n](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ouyq3n.toon))
+- The gate contributors run before merging fails on every Claude Code workstation and passes on the runner for the same tree, because a harness probe writes advisory warnings into the surface the token budget measures ([pm-95h7pg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-95h7pg.toon))
+- The public-surface gate enumerates its own hand-written entrypoint list, so two published code exports ship ungoverned and ./cli publishes 86 internal functions as typed API ([pm-suhxny](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-suhxny.toon))
+- GH-1033: read fields selectors can erase identity and requested empty collections ([pm-4fwgaz](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-4fwgaz.toon))
+- GH-1036/GH-1040: history integrity verdicts and repairs are incompatible across supported CLI versions ([pm-0wfdim](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-0wfdim.toon))
+- GH-1032: extension manifests silently accept unenforced version-floor spellings ([pm-qqoumq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qqoumq.toon))
+- GH-1038: docs linked-resource pair syntax corrupts URLs and splits labeled entries ([pm-fpdk37](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fpdk37.toon))
+- GH-1039: graph impact discards dependency direction and makes the direction selector inert ([pm-jn1x30](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jn1x30.toon))
+
+### Other
+
+- Decision: adopt reviewed defect-evidence field constraints into audited workspace history ([pm-4smp5b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-4smp5b.toon))
+- Defect-escape ratchet: every escaped defect must land a gate that would have caught it, tracked as evidence on the fixing item ([pm-rtn5h6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-rtn5h6.toon))
+- Boundary-fixture gate: every value that must match a system outside this repository is tested against a captured real sample, never against a fixture the production code generated ([pm-0pzgit](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-0pzgit.toon))
+- Disposition the test-only escape hatch published through the ./cli entrypoint: 86 internal functions are consumer-visible API with no support intent ([pm-rf120g](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-rf120g.toon))
+
 ## 2026.8.16 - 2026-08-16
 
 ### Fixed
@@ -1269,12 +1296,12 @@
 
 ### Fixed
 
+- GH-363: Windows nightly (Node 24) red — runtime-loader colon-path + telemetry detached-spawn unhandled error + npm-install regression ([pm-xaib](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xaib.toon))
 - pm validate --check-files mis-handles remote (URL) doc/file references: flagged as deleted and silently destroyed by --prune-missing ([pm-k2n4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-k2n4.toon))
 - pm next hides completed-container closeout rows while leaf work exists ([pm-9g87](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-9g87.toon))
 - MCP action-schema contracts drifted from CLI flag tables (guide.list, health.brief, validate.parentCycleSeverity, contracts.full) ([pm-zx13](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zx13.toon))
 - describeExtensionBlueprint omits importer/exporter-with-options command definitions (parity gap vs describeExtensionActivation) ([pm-zqes](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zqes.toon))
 - Contracts command lookup should handle package namespace roots ([pm-y1o4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-y1o4.toon))
-- GH-363: Windows nightly (Node 24) red — runtime-loader colon-path + telemetry detached-spawn unhandled error + npm-install regression ([pm-xaib](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xaib.toon))
 - CI: make Codecov badge uploads branch-explicit ([pm-x878](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-x878.toon))
 - deriveExtensionCapabilities omits 'schema' for importer/exporter options.flags (declarative blueprint under-grant) ([pm-v3ty](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v3ty.toon))
 - pm install does not scaffold extension-contributed item-type folders (transient missing_directory health warning) ([pm-rjab](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-rjab.toon))
@@ -1502,6 +1529,7 @@
 
 ### Fixed
 
+- PR \#266 review feedback: tighten init and dynamic option validation ([pm-at1j](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-at1j.toon))
 - pm templates: unknown subcommand + flags silently fall back to 'list' (exit 0) instead of erroring ([pm-r2kd](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-r2kd.toon))
 - linked-test-adapters package install loses ESM module type ([pm-v8fy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v8fy.toon))
 - GH-215: enforce timestamps in history entries ([pm-u42x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u42x.toon))
@@ -1511,7 +1539,6 @@
 - GH-262: prevent path-like pm init from corrupting caller tracker settings ([pm-jek2](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jek2.toon))
 - GH-284: align pm init required schema directories with health ([pm-hl9y](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-hl9y.toon))
 - CI contracts snapshot temp cleanup can fail with ENOTEMPTY ([pm-c61g](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-c61g.toon))
-- PR \#266 review feedback: tighten init and dynamic option validation ([pm-at1j](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-at1j.toon))
 - GH-265: schema unknown subcommands must not create custom types ([pm-ablm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ablm.toon))
 - GH-280: pm validate does not detect circular parent references (hierarchy cycles A-\>B-\>A of any length) ([pm-8vul](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8vul.toon))
 - Auto Release retries branch push after main advances ([pm-5oti](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-5oti.toon))
@@ -2709,6 +2736,7 @@
 
 ### Security
 
+- Ignore local .env files for telemetry/security operations ([pm-qgvj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qgvj.toon))
 - Track GitHub Dependabot alert \#8 for undici (GHSA-wqq4-5wpv-mx2g) ([pm-v6vi](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v6vi.toon))
 - Track GitHub Dependabot alert \#11 for undici (GHSA-9qxr-qj54-h672) ([pm-tl4d](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-tl4d.toon))
 - Track GitHub Dependabot alert \#12 for undici (GHSA-cxrh-j4jr-qwg3) ([pm-pagj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-pagj.toon))
@@ -2729,7 +2757,6 @@
 - Track GitHub Dependabot alert \#27 for undici (GHSA-4992-7rv2-5pvq) ([pm-02c4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-02c4.toon))
 - Issue: Private IP address in committed pm task files ([pm-xk8b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xk8b.toon))
 - Track GitHub Dependabot alert \#19 for undici (GHSA-f269-vfmq-vjvj) ([pm-rb9v](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-rb9v.toon))
-- Ignore local .env files for telemetry/security operations ([pm-qgvj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qgvj.toon))
 - Track GitHub Dependabot alert \#22 for undici (GHSA-vrm6-8vpv-qv8q) ([pm-i1rm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-i1rm.toon))
 - Track GitHub Dependabot alert \#21 for undici (GHSA-4992-7rv2-5pvq) ([pm-cg7l](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-cg7l.toon))
 - Track GitHub Dependabot alert \#29 for picomatch (GHSA-3v7f-55p6-f55p) ([pm-5e88](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-5e88.toon))

package/README.md

@@ -21,19 +21,19 @@
 
 ## Start Here
 
-| Need                                                           | Read                                                                                                                                    |
-| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| Install and create the first item                              | [Quickstart](docs/QUICKSTART.md)                                                                                                        |
-| New maintainer onboarding                                      | [Onboarding](docs/ONBOARDING.md)                                                                                                        |
-| Agent workflow and token-minimal loops                         | [Agent Guide](docs/AGENT_GUIDE.md)                                                                                                      |
-| Command families and examples                                  | [Command Reference](docs/COMMANDS.md)                                                                                                   |
-| Shell, CI, and machine-client composition                       | [CLI Scripting Contract](docs/SCRIPTING.md)                                                                                              |
-| Settings, storage, search, and output                          | [Configuration](docs/CONFIGURATION.md)                                                                                                  |
-| Safe test execution and linked tests                           | [Testing](docs/TESTING.md)                                                                                                              |
-| Security reporting and resilience controls                    | [Security Policy](SECURITY.md), [Security Governance](docs/SECURITY_GOVERNANCE.md)                                                      |
-| Package and extension authoring                                | [Packages and Extensions](docs/EXTENSIONS.md), [SDK](docs/SDK.md), [Customization Primitives](docs/SDK_CUSTOMIZATION_PRIMITIVES.md), [Evidence Traceability](docs/SDK_EVIDENCE_TRACEABILITY.md), and [Agent Runtime Primitives](docs/AGENT_RUNTIME_PRIMITIVES.md) |
-| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md)                                                                                                          |
-| Contributor internals                                          | [Architecture](docs/ARCHITECTURE.md)                                                                                                    |
+| Need                                                           | Read                                                                                                                                                                                                                                                                                                                        |
+| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Install and create the first item                              | [Quickstart](docs/QUICKSTART.md)                                                                                                                                                                                                                                                                                            |
+| New maintainer onboarding                                      | [Onboarding](docs/ONBOARDING.md)                                                                                                                                                                                                                                                                                            |
+| Agent workflow and token-minimal loops                         | [Agent Guide](docs/AGENT_GUIDE.md)                                                                                                                                                                                                                                                                                          |
+| Command families and examples                                  | [Command Reference](docs/COMMANDS.md)                                                                                                                                                                                                                                                                                       |
+| Shell, CI, and machine-client composition                      | [CLI Scripting Contract](docs/SCRIPTING.md)                                                                                                                                                                                                                                                                                 |
+| Settings, storage, search, and output                          | [Configuration](docs/CONFIGURATION.md)                                                                                                                                                                                                                                                                                      |
+| Safe test execution and linked tests                           | [Testing](docs/TESTING.md)                                                                                                                                                                                                                                                                                                  |
+| Security reporting and resilience controls                     | [Security Policy](SECURITY.md), [Security Governance](docs/SECURITY_GOVERNANCE.md)                                                                                                                                                                                                                                          |
+| Package and extension authoring                                | [Packages and Extensions](docs/EXTENSIONS.md), [SDK](docs/SDK.md), [Context Integrity](docs/CONTEXT_INTEGRITY_CONTRACTS.md), [Customization Primitives](docs/SDK_CUSTOMIZATION_PRIMITIVES.md), [Evidence Traceability](docs/SDK_EVIDENCE_TRACEABILITY.md), and [Agent Runtime Primitives](docs/AGENT_RUNTIME_PRIMITIVES.md) |
+| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md)                                                                                                                                                                                                                                                                                              |
+| Contributor internals                                          | [Architecture](docs/ARCHITECTURE.md)                                                                                                                                                                                                                                                                                        |
 
 Full documentation starts at [docs/README.md](docs/README.md).
 

package/dist/cli/public.d.ts

@@ -0,0 +1,2 @@
+/** Run one embedded CLI invocation without leaking its exit status into the host process. */
+export declare function runPmCli(rawArgv?: string[]): Promise<void>;

package/dist/cli/public.js

@@ -0,0 +1,21 @@
+/**
+ * @module cli/public
+ *
+ * Publishes the supported embeddable CLI entrypoint without exposing the
+ * implementation module's repository-only test seams to package consumers.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8e212bdf-7568-54dd-91aa-7de146d65d03")}catch(e){}}();
+import { runPmCli as runInternalPmCli } from "./main.js";
+/** Run one embedded CLI invocation without leaking its exit status into the host process. */
+export async function runPmCli(rawArgv) {
+    const previousExitCode = process.exitCode;
+    try {
+        await runInternalPmCli(rawArgv);
+    }
+    finally {
+        process.exitCode = previousExitCode;
+    }
+}
+//# sourceMappingURL=public.js.map
+//# debugId=8e212bdf-7568-54dd-91aa-7de146d65d03

package/dist/cli/register-mutation.js

@@ -1,8 +1,8 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="60ee1ab9-00a0-50a7-839e-4938ecc6a48f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7feb0fe0-386c-56dc-afe1-e7b4ce1bc95a")}catch(e){}}();
 import { resolveBodyFileContent, EXIT_CODE, splitCommaList, PmCliError, createUnknownSubcommandError, } from "../sdk/runtime-primitives.js";
 import { CREATE_COMMANDER_OPTION_REGISTRATION_CONTRACTS, PLAN_CREATE_METADATA_PARAMETER_KEYS, UPDATE_COMMANDER_OPTION_REGISTRATION_CONTRACTS, } from "../sdk/cli-contracts.js";
-import { BUILTIN_ITEM_TYPE_VALUES } from "../types/index.js";
+import { BUILTIN_ITEM_TYPE_VALUES, PLAN_STEP_LINK_KIND_VALUES, } from "../types/index.js";
 import { MERGE_DRIVER_ARTIFACT_VALUES, runMergeDriver, runMergeInstall, runMergeReconcile, runMergeReceiptReport, } from "./commands/merge.js";
 import { runAppend } from "./commands/append.js";
 import { runClose } from "./commands/close.js";
@@ -1565,7 +1565,7 @@ export function registerMutationCommands(program, registrationOptions = {}) {
         .option("--step-replacement <value>", "Replacement reference for a superseded step")
         .option("--depends-on <value>", "Pm item ids the step depends on (repeatable, csv-friendly)", collect)
         .option("--link <value>", "Pm item id to link (repeatable, csv-friendly)", collect)
-        .option("--link-kind <value>", "Link kind: related|blocks|blocked_by|depends_on|discovered_from|implements|verifies|supersedes")
+        .option("--link-kind <value>", `Link kind: ${PLAN_STEP_LINK_KIND_VALUES.join("|")}`)
         .option("--link-note <value>", "Optional note for the link")
         .option("--promote-to-item-dep", "Also add the linked id as a top-level item dependency when linking")
         .option("--allow-multiple-active", "Allow multiple steps to be in_progress at once")
@@ -1840,4 +1840,4 @@ export function registerMutationCommands(program, registrationOptions = {}) {
         .action(runDepsAction);
 }
 //# sourceMappingURL=register-mutation.js.map
-//# debugId=60ee1ab9-00a0-50a7-839e-4938ecc6a48f
+//# debugId=7feb0fe0-386c-56dc-afe1-e7b4ce1bc95a