@unbrained/pm-cli 2026.9.16 → 2026.9.17

package/docs/MERGE_SAFETY.md

@@ -38,8 +38,13 @@ git commit -m "chore(pm): install tracker merge drivers"
 
 `pm merge install` writes an idempotent, fenced `.gitattributes` block and repository-local `git config` entries. The attributes are committed; the driver commands are clone-local, so every collaborator and fresh CI clone that performs merges must run the install command.
 
-The clone-local driver values record the absolute Node executable and bundled
-`dist/cli.js` path resolved by the installing SDK. Git therefore does not depend
+The clone-local driver values record the absolute runtime launcher and bundled
+`dist/cli.js` path resolved by the installing SDK. The installer preserves an
+absolute PATH symlink when it resolves to the executing runtime, so a runtime
+manager can retarget that launcher during upgrades without breaking every clone.
+Relative PATH entries, inaccessible launchers, and different runtimes are ignored;
+without a matching launcher, the installer retains the executing binary path.
+Git therefore does not depend
 on a bare `pm` command or the caller's later `PATH` when it merges tracker data.
 The item-path placeholder is stored as bare `%P`: Git performs the required
 shell quoting when it expands the placeholder. Receipt ingestion also removes
@@ -53,6 +58,9 @@ also accepted when its Node and `dist/cli.js` paths exist, its manifest owns the
 copied worktrees and upgraded global installs healthy without accepting an
 arbitrary executable. A missing, malformed, or semantically stale definition is
 reported even when the committed attribute fence is correct.
+Health and validation name `pm merge install` as the repair command for missing
+or drifted drivers. This upgrade behavior is tracked by
+[pm-rcjyft](../.agents/pm/issues/pm-rcjyft.toon).
 
 The installer publishes the shared `.gitattributes` fence only after the clone-local driver commands are configured. If the repository Git config is read-only or another Git process holds its lock, the command returns the stable `merge_git_config_unwritable` error with recovery guidance and leaves an absent fence absent. Use `pm merge install --dry-run --json` to inspect the contract in intentionally read-only workspaces.
 
@@ -476,3 +484,6 @@ Only aged `committed` or `compensated` journals are removed. `applying`, `compen
 ## Temporary-clone acceptance test
 
 Before releasing merge-contract changes, validate the packed package in a temporary Git repository: initialize pm, install the merge contract, create one base item, branch twice, append disjoint metadata/history on both branches, merge, and run the strict validation commands above. Include a same-key conflict case and prove Git leaves it unresolved while the output remains parseable.
+
+The [packed first-run matrix](PACKED_FIRST_RUN.md) exercises the installed
+README workflow, a real comment/history merge, and MCP on supported platforms.

package/docs/PACKED_FIRST_RUN.md

@@ -0,0 +1,46 @@
+# Packed First-Run Acceptance
+
+Tracked by [pm-ygli86](../.agents/pm/tasks/pm-ygli86.toon) and
+[pm-rcjyft](../.agents/pm/issues/pm-rcjyft.toon).
+
+The `Packed first run` CI matrix installs the same tarball globally into an
+isolated npm prefix on Ubuntu, macOS, and Windows, using Node 22.18.0 and Node 24.
+It executes the installed `pm` shim before passing the installed package directory
+to the acceptance harness:
+
+```bash
+node scripts/release/packed-first-run.mjs /path/to/installed/@unbrained/pm-cli
+```
+
+The harness extracts the first three commands from the installed README's
+`60 Second Example` section. It executes `init`, `create`, and `list` in a
+temporary Git workspace, requires nonempty output below 4,096 characters per
+command, and checks that the created item was persisted. Missing sections,
+reordered commands, unsupported shell expressions, and unbalanced quotes fail.
+Arguments are passed directly to the installed CLI without a shell.
+
+Two branches then append independent comments through that CLI. A real Git merge
+must preserve both comments and their history. The installed reconciliation and
+strict history verifier must succeed. The installed MCP server must complete an
+initialize round trip and advertise the installed package version. An additional
+mutation enables telemetry only against a loopback HTTP collector. The harness
+waits for the detached worker's request and then verifies the physical queue is
+empty and a successful flush is recorded. It removes inherited inline-flush and
+test-runner overrides so this exercises the real detached process. Other commands
+and MCP keep telemetry disabled; the install and workspace use isolated home
+and global tracker directories.
+
+MCP cleanup waits for process closure before removing its workspace. It allows
+five seconds after SIGTERM, then sends SIGKILL and allows five more seconds. If
+the child still does not close, the harness fails with captured diagnostics and
+retains that workspace rather than attempting removal while it is in use.
+
+The separate runtime-upgrade regression installs drivers through an absolute
+runtime symlink, removes the original runtime directory, retargets the symlink,
+and performs a real Git merge. It verifies the upgrade failure from GitHub #1248
+without altering any developer runtime or repository.
+
+This matrix proves the packed artifact's first-run behavior. Registry propagation,
+npm/Bun installed agent sessions, npx/bunx execution, production telemetry, and
+previous-release compatibility remain separate acceptance claims under the
+[release workflow](RELEASING.md).

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 374
+- Catalog error codes: 377
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 355
-- Coverage fraction: 0.050802
+- Uncovered error codes: 358
+- Coverage fraction: 0.050398
 - Closed-domain probes: 19
 - Grammar probes: 113
 
@@ -196,6 +196,8 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `mcp_task_not_found_or_not_authorized` | `mcp_task_not_found_or_not_authorized` | uncovered | none | 0 |
 | `merge_conflict_markers_detected` | `merge_conflict_markers_detected` | uncovered | none | 0 |
 | `merge_decisions_unreviewed` | `merge_decisions_unreviewed` | uncovered | none | 0 |
+| `merge_driver_configuration_drift` | `merge_driver_configuration_drift` | uncovered | none | 0 |
+| `merge_driver_configuration_missing` | `merge_driver_configuration_missing` | uncovered | none | 0 |
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
 | `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
@@ -345,6 +347,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `validate_lifecycle_dependency_cycles_error` | `validate_lifecycle_dependency_cycles_error` | uncovered | none | 0 |
 | `validate_lifecycle_stale_blockers` | `validate_lifecycle_stale_blockers` | uncovered | none | 0 |
 | `validate_merge_decisions_unreviewed` | `validate_merge_decisions_unreviewed` | uncovered | none | 0 |
+| `validate_merge_driver_configuration` | `validate_merge_driver_configuration` | uncovered | none | 0 |
 | `validate_merge_fence_drift` | `validate_merge_fence_drift` | uncovered | none | 0 |
 | `validate_metadata_custom_profile_missing_required_fields` | `validate_metadata_custom_profile_missing_required_fields` | uncovered | none | 0 |
 | `validate_metadata_duplicate_issue_codes` | `validate_metadata_duplicate_issue_codes` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.16"
+    "version": "2026.9.17"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.16",
+      "version": "2026.9.17",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.9.16",
+  "version": "2026.9.17",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",