@unbrained/pm-cli 2026.9.16 → 2026.9.18

package/docs/READ_OUTPUT_CONTRACTS.md

@@ -1,6 +1,6 @@
 # Universal Read Output Contracts
 
-Tracker references: [pm-hb7ug8](../.agents/pm/features/pm-hb7ug8.toon), [pm-cxr0jb](../.agents/pm/features/pm-cxr0jb.toon), [pm-hid9g1](../.agents/pm/features/pm-hid9g1.toon), [pm-h8tpeh](../.agents/pm/features/pm-h8tpeh.toon), [pm-5t33or](../.agents/pm/features/pm-5t33or.toon), [pm-wv47pf](../.agents/pm/issues/pm-wv47pf.toon), [pm-srns](../.agents/pm/issues/pm-srns.toon), [pm-sb0tns](../.agents/pm/issues/pm-sb0tns.toon), [pm-gjjurs](../.agents/pm/issues/pm-gjjurs.toon), [pm-eugaqy](../.agents/pm/issues/pm-eugaqy.toon), [pm-jt8aa2](../.agents/pm/issues/pm-jt8aa2.toon), [pm-kyjdne](../.agents/pm/issues/pm-kyjdne.toon), [pm-8nev0o](../.agents/pm/issues/pm-8nev0o.toon), [pm-oahhyc](../.agents/pm/issues/pm-oahhyc.toon), [pm-q4isdq](../.agents/pm/issues/pm-q4isdq.toon), [pm-e5gl05](../.agents/pm/issues/pm-e5gl05.toon), [pm-cha95z](../.agents/pm/tasks/pm-cha95z.toon), [pm-2qvq7a](../.agents/pm/issues/pm-2qvq7a.toon), and [pm-xam9bt](../.agents/pm/issues/pm-xam9bt.toon).
+Tracker references: [pm-15yuly](../.agents/pm/issues/pm-15yuly.toon), [pm-g8oh0f](../.agents/pm/issues/pm-g8oh0f.toon), [pm-hb7ug8](../.agents/pm/features/pm-hb7ug8.toon), [pm-cxr0jb](../.agents/pm/features/pm-cxr0jb.toon), [pm-hid9g1](../.agents/pm/features/pm-hid9g1.toon), [pm-h8tpeh](../.agents/pm/features/pm-h8tpeh.toon), [pm-5t33or](../.agents/pm/features/pm-5t33or.toon), [pm-wv47pf](../.agents/pm/issues/pm-wv47pf.toon), [pm-srns](../.agents/pm/issues/pm-srns.toon), [pm-sb0tns](../.agents/pm/issues/pm-sb0tns.toon), [pm-gjjurs](../.agents/pm/issues/pm-gjjurs.toon), [pm-eugaqy](../.agents/pm/issues/pm-eugaqy.toon), [pm-jt8aa2](../.agents/pm/issues/pm-jt8aa2.toon), [pm-kyjdne](../.agents/pm/issues/pm-kyjdne.toon), [pm-8nev0o](../.agents/pm/issues/pm-8nev0o.toon), [pm-oahhyc](../.agents/pm/issues/pm-oahhyc.toon), [pm-q4isdq](../.agents/pm/issues/pm-q4isdq.toon), [pm-e5gl05](../.agents/pm/issues/pm-e5gl05.toon), [pm-cha95z](../.agents/pm/tasks/pm-cha95z.toon), [pm-2qvq7a](../.agents/pm/issues/pm-2qvq7a.toon), and [pm-xam9bt](../.agents/pm/issues/pm-xam9bt.toon).
 
 ## Agent Quick Context
 
@@ -165,7 +165,7 @@ pm stats --output-row-contract
 pm contracts --full --json
 ```
 
-Every projected result carries a `read_output` receipt with the requested dimensions, precedence, observed option provenance, deterministic estimated token count, string/row compaction signals, and budget outcome. When canonical controls are present, `canonical_options_used` records spellings such as `--output-include`; the optional field is omitted when no canonical control was supplied so minimum-budget session receipts remain compact. `legacy_aliases_used` and `migration_hints` record only compatibility flags the caller actually supplied. A command-local flag synthesized internally to execute a canonical projection mode is therefore never misreported as deprecated syntax. When both spellings are supplied, both provenance arrays report that mixed invocation. Budget degradation discovers nested arrays as well as declared result rows, so validation diagnostics and other governance payloads compact their inner findings before the useful result is omitted. `compacted_row_paths` names every reduced collection without redefining those nested arrays as ordinary pagination rows.
+Canonical amount, encoding, and cost controls that leave an already-fitting result unchanged do not add a `read_output` receipt. Explicit include projections, sessions, continuations, and `--output-row-contract` retain the detailed receipt. Every shaped or budget-compacted result carries a `read_output` receipt with the requested dimensions, precedence, observed option provenance, deterministic estimated token count, string/row compaction signals, and budget outcome. When canonical controls are present, `canonical_options_used` records spellings such as `--output-include`; the optional field is omitted when no canonical control was supplied so minimum-budget session receipts remain compact. `legacy_aliases_used` and `migration_hints` record only compatibility flags the caller actually supplied. A command-local flag synthesized internally to execute a canonical projection mode is therefore never misreported as deprecated syntax. When both spellings are supplied, both provenance arrays report that mixed invocation. Budget degradation discovers nested arrays as well as declared result rows, so validation diagnostics and other governance payloads compact their inner findings before the useful result is omitted. `compacted_row_paths` names every reduced collection without redefining those nested arrays as ordinary pagination rows.
 
 The estimate is `ceil(utf8_bytes / 4)` for the complete envelope. The CLI uses
 its selected built-in JSON or TOON representation, including indentation and
@@ -178,7 +178,11 @@ serializing an SDK object for measurement does not implicitly select that policy
 Per-call and session receipts include their own cost and continuation disclosure.
 Compaction reserves room for that disclosure before returning a useful page, so
 an envelope cannot claim to fit merely because its rows fit before receipts were
-added. An infeasible ceiling returns the explicit omission result.
+added. Each selected collection uses a measured prefix search instead of irreversible
+halving, retaining the largest prefix that fits with the other collections held
+fixed. `applied_limit` and both continuation forms follow the retained item count.
+A complete page and a truncated page have different mandatory metadata costs;
+row counts across that boundary are not an unconditional monotonicity guarantee. An infeasible ceiling returns the explicit omission result.
 
 For `context` and `next`, that final projection is also the usage-feedback
 delivery boundary. The SDK carries a JSON-invisible serve receipt through
@@ -188,7 +192,7 @@ rows; it can never leave the packer's earlier inclusions marked as served.
 `PmClient` finalizes the receipt before resolving, while the CLI finalizes it
 from the exact active result passed to telemetry and after-command hooks.
 
-When rows are dropped to satisfy a ceiling, the result also carries `output_budget_truncation`, naming the binding budget and its source, any explicitly requested dimension the budget overrode, every compacted collection path, and executable CLI/SDK/MCP recovery options — a default ceiling can override an explicit `--output-limit unbounded`, and that override is reported rather than silent. If a producer supplied an opaque item-page cursor, compaction rebases it to the last row actually returned and reports `continuation_cursor_rebased: true`; following the cursor therefore cannot skip rows removed from the middle of a producer page. If no useful content can fit, `PmReadOutputBudgetExceeded` provides a discriminated omission result, a compact `{ outputBudget: "unbounded" }` recovery object, and `omitted_result_estimated_tokens`, the last useful-result estimate before omission; use `isReadOutputBudgetExceeded` before accessing result-specific fields. Universal controls are rejected on mutation commands and on the mutation mode of hybrid commands such as `comments`, `notes`, `files`, and `docs`.
+When rows are dropped to satisfy a ceiling, the result also carries `output_budget_truncation`, naming the binding budget and its source, any explicitly requested dimension the budget overrode, every compacted collection path, and executable CLI/SDK/MCP recovery options — a default ceiling can override an explicit `--output-limit unbounded`, and that override is reported rather than silent. If a producer supplied an opaque item-page cursor, compaction rebases it to the last row actually returned and reports `continuation_cursor_rebased: true`; following the cursor therefore cannot skip rows removed from the middle of a producer page. If no useful content can fit, `PmReadOutputBudgetExceeded` provides a discriminated omission result, a compact `{ outputBudget: "unbounded" }` recovery object, and `omitted_result_estimated_tokens`, the last useful-result estimate before omission; use `isReadOutputBudgetExceeded` before accessing result-specific fields. The encoding control `--output-format <toon|json>` also applies to mutation envelopes, including the mutation modes of `comments`, `notes`, `files`, and `docs`. Other universal read controls remain rejected before mutation execution. `--json` remains supported.
 
 Cursor recovery carries the opaque value once in `recovery.cursor` and declares
 the accepting `cli`, `sdk`, and `mcp` binding beside it. This avoids

package/docs/agent-task-token-baseline.json

@@ -77,7 +77,7 @@
       {
         "task_id": "orientation-contracts-next",
         "command_count": 2,
-        "estimated_tokens": 4829,
+        "estimated_tokens": 5180,
         "capabilities": [
           "actionable_work",
           "active_ownership",
@@ -120,16 +120,16 @@
     },
     {
       "id": "orientation-contracts-next",
-      "max_estimated_tokens": 4829,
+      "max_estimated_tokens": 5180,
       "steps": [
         {
           "id": "contracts",
-          "max_estimated_tokens": 4111,
+          "max_estimated_tokens": 4458,
           "accounting_mode": "self_reported"
         },
         {
           "id": "next",
-          "max_estimated_tokens": 718,
+          "max_estimated_tokens": 722,
           "accounting_mode": "self_reported"
         }
       ]
@@ -199,11 +199,11 @@
     },
     {
       "id": "unknown-option-recovery",
-      "max_estimated_tokens": 603,
+      "max_estimated_tokens": 596,
       "steps": [
         {
           "id": "refuse-option",
-          "max_estimated_tokens": 440,
+          "max_estimated_tokens": 433,
           "accounting_mode": "self_reported"
         },
         {
@@ -261,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 12667
+  "composite_max_estimated_tokens": 13011
 }

package/docs/generated/AGENT_CAPABILITY_ROUTING.md

@@ -13,5 +13,5 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | evidence | `history`, `history events`, `history redact`, `history repair`, `history compact`, `history attest`, `history acknowledge`, `item append`, `item comments`, `item notes`, `item learnings`, `item files`, `item docs` |
 | graph | `graph`, `item deps`, `plan` |
 | quality | `item test`, `ops test-all`, `ops validate`, `assurance`, `contracts`, `ops` |
-| automation | `meet`, `event`, `remind` |
+| automation | `calendar meet`, `calendar event`, `calendar remind` |
 | extensions | `package` |

package/docs/generated/AGENT_COMMAND_SURFACE.md

@@ -105,8 +105,11 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `pause-task` | full | lifecycle |
 | `close-task` | full | lifecycle |
 | `meet` | full | automation |
+| `calendar meet` | full | automation |
 | `event` | full | automation |
+| `calendar event` | full | automation |
 | `remind` | full | automation |
+| `calendar remind` | full | automation |
 | `help` | core | context |
 | `ops` | core | quality |
 | `completion-statuses` | internal | internal |

package/docs/generated/FLAG_LEXICON_BUDGETS.md

@@ -108,3 +108,6 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `item copy` | intake | 24 | 24 |
 | `workspace merge` | workspace | 27 | 27 |
 | `item duplicates` | context | 25 | 25 |
+| `calendar meet` | automation | 33 | 33 |
+| `calendar event` | automation | 33 | 33 |
+| `calendar remind` | automation | 29 | 29 |

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,12 +4,12 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 374
+- Catalog error codes: 377
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 355
-- Coverage fraction: 0.050802
+- Uncovered error codes: 358
+- Coverage fraction: 0.050398
 - Closed-domain probes: 19
 - Grammar probes: 113
 
@@ -196,6 +196,8 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `mcp_task_not_found_or_not_authorized` | `mcp_task_not_found_or_not_authorized` | uncovered | none | 0 |
 | `merge_conflict_markers_detected` | `merge_conflict_markers_detected` | uncovered | none | 0 |
 | `merge_decisions_unreviewed` | `merge_decisions_unreviewed` | uncovered | none | 0 |
+| `merge_driver_configuration_drift` | `merge_driver_configuration_drift` | uncovered | none | 0 |
+| `merge_driver_configuration_missing` | `merge_driver_configuration_missing` | uncovered | none | 0 |
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
 | `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
@@ -345,6 +347,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `validate_lifecycle_dependency_cycles_error` | `validate_lifecycle_dependency_cycles_error` | uncovered | none | 0 |
 | `validate_lifecycle_stale_blockers` | `validate_lifecycle_stale_blockers` | uncovered | none | 0 |
 | `validate_merge_decisions_unreviewed` | `validate_merge_decisions_unreviewed` | uncovered | none | 0 |
+| `validate_merge_driver_configuration` | `validate_merge_driver_configuration` | uncovered | none | 0 |
 | `validate_merge_fence_drift` | `validate_merge_fence_drift` | uncovered | none | 0 |
 | `validate_metadata_custom_profile_missing_required_fields` | `validate_metadata_custom_profile_missing_required_fields` | uncovered | none | 0 |
 | `validate_metadata_duplicate_issue_codes` | `validate_metadata_duplicate_issue_codes` | uncovered | none | 0 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.16"
+    "version": "2026.9.18"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.16",
+      "version": "2026.9.18",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -98,6 +98,8 @@
     ".claude-plugin/**",
     "plugins/**",
     "packages/pm-*/**",
+    "scripts/build.mjs",
+    "scripts/build-lease.mjs",
     "scripts/bundle-cli.mjs",
     "scripts/generate-agent-capability-surfaces.mjs",
     "scripts/finalize-build.mjs",
@@ -108,7 +110,7 @@
     "marketplace.json"
   ],
   "scripts": {
-    "build": "node scripts/prepare-build-cache.mjs && tsc -p tsconfig.json && node scripts/bundle-cli.mjs && node scripts/finalize-build.mjs",
+    "build": "node scripts/build.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typetests.json && tsc -p tsconfig.packages.json && tsc -p tsconfig.examples.json",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
@@ -205,7 +207,7 @@
     "node": ">=22.18.0"
   },
   "dependencies": {
-    "@sentry/node": "10.74.0",
+    "@sentry/node": "10.75.0",
     "@toon-format/toon": "^4.1.1",
     "@types/node": ">=22",
     "commander": "^15.0.0",
@@ -219,18 +221,18 @@
     "@codspeed/vitest-plugin": "^5.7.1",
     "@eslint/js": "^10.0.1",
     "@modelcontextprotocol/ext-apps": "2.0.0",
-    "@sentry/cli": "^3.7.0",
+    "@sentry/cli": "^3.8.0",
     "@types/node": "^26.5.1",
     "@types/npm-package-arg": "^6.1.4",
     "@vitest/coverage-v8": "^4.1.11",
     "esbuild": "0.28.2",
     "eslint": "^10.10.0",
-    "eslint-plugin-sonarjs": "^4.2.0",
-    "eslint-plugin-unicorn": "74.0.0",
-    "fast-check": "^4.10.0",
+    "eslint-plugin-sonarjs": "^4.2.1",
+    "eslint-plugin-unicorn": "75.0.0",
+    "fast-check": "^4.10.1",
     "github-slugger": "2.0.0",
     "greptile": "^3.5.2",
-    "jscpd": "^5.2.0",
+    "jscpd": "^5.2.1",
     "marked": "18.0.13",
     "parse5": "8.0.1",
     "tsx": "^4.23.13",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/README.md

@@ -1,9 +1,9 @@
 # pm Calendar Package
 
-`@unbrained/pm-calendar` provides agenda and calendar views as an installable pm package.
+`@unbrained/pm-calendar` provides scheduling shortcuts, agenda, and calendar views as an installable pm package.
 
 ```bash
-pm install calendar --project
+pm package install calendar --project
 # Or bootstrap all bundled package commands in a new project:
 pm init --defaults --with-packages
 pm calendar --view week --full-period
@@ -14,6 +14,47 @@ The package owns presentation commands for deadline, reminder, and scheduled eve
 
 Runtime sources are authored in TypeScript and use only the public `@unbrained/pm-cli/sdk` surface.
 
+## Scheduling commands
+
+Tracking: [pm-o3fh](../../.agents/pm/tasks/pm-o3fh.toon),
+[pm-jkjt](../../.agents/pm/issues/pm-jkjt.toon).
+
+```bash
+pm calendar meet "Planning" --start +1d --duration 30min --location "Room A"
+pm calendar event "Release window" --start 2026-10-01T09:00:00Z --duration PT2H
+pm calendar remind "Review release" --at +2d --text "Check acceptance results"
+```
+
+The legacy `pm meet`, `pm event`, and `pm remind` spellings remain aliases.
+Install `calendar` in each project where these commands are needed; without the
+package, the CLI provides an installation hint. Core `create` and `update` retain
+scheduling metadata primitives. SDK integrations can continue calling `runMeet`,
+`runEvent`, and `runRemind` directly without installing presentation commands.
+
+Meetings and events default to a start of `now` and a duration of `1h`.
+An explicit `--end` overrides the shortcut's duration. Reminders default to `+1d`
+and use the title as their reminder text. All three commands support parent,
+tags, priority, body, description, history message, and the host's global author
+and output options. Use `pm contracts --command "calendar meet" --flags-only`
+for the active project's exact contract.
+
+### Duration decision
+
+Accepted [duration ADR](../../.agents/pm/decisions/pm-j1vw3a.toon).
+
+Event durations accept integer `min`, `mins`, `minute`, or `minutes`; `h`, `d`,
+`w`, or explicit `mo` for calendar months; and ISO time durations such as `PT30M`
+or `PT1H30M`. Bare `m`, including signed values such as `+5m`, is rejected with
+`min`/`mo` alternatives before mutation. This resolves the ambiguity recorded in
+pm-jkjt and supersedes the duration compatibility decision in
+[pm-zoe4](../../.agents/pm/features/pm-zoe4.toon).
+
+This rule applies to shortcut durations and the shared `create`/`update` event
+parser. Other relative date fields retain `m` for calendar months. Zero duration
+creates an instant event; an end before the start is rejected. Calendar month
+arithmetic clamps to the last valid day of the target month; compound offsets
+such as `+1d+2h` are rejected.
+
 ## Recurrence Notes
 
 Recurring event `recur_count` values are counted from the event series `start`, not from the query window. For example, a daily event starting April 1 with `recur_count=3` has its counted occurrences on April 1, 2, and 3; querying April 10 does not restart the count.

package/packages/pm-calendar/extensions/calendar/command-definitions.ts

@@ -0,0 +1,52 @@
+/**
+ * @module packages/pm-calendar/extensions/calendar/command-definitions
+ *
+ * Declares pure calendar command metadata shared by runtime and contract gates. The host
+ * supplies alias routing, argument validation, mutation receipts, and telemetry.
+ */
+import type { CommandDefinition, FlagDefinition } from "@unbrained/pm-cli/sdk";
+
+const commonFlags: FlagDefinition[] = [
+  { long: "--parent", value_name: "id", value_type: "string", description: "Parent item id" },
+  { long: "--allow-missing-parent", value_type: "boolean", description: "Permit a parent id that does not exist yet" },
+  { long: "--tags", value_name: "list", value_type: "string", description: "Comma-separated tags" },
+  { long: "--priority", value_name: "value", value_type: "string", description: "Priority" },
+  { long: "--body", value_name: "text", value_type: "string", description: "Body/markdown content" },
+  { long: "--description", value_name: "text", value_type: "string", description: "Short description" },
+  { long: "--message", value_name: "value", value_type: "string", description: "History message" },
+];
+
+const eventFlags: FlagDefinition[] = [
+  { long: "--start", value_name: "when", value_type: "string", description: "Start time (ISO, now, or relative +1h/+2d); defaults to now" },
+  { long: "--duration", value_name: "span", value_type: "string", description: "Duration: min|mins|minute|minutes, h, d, w, mo, or ISO PT time; bare m is ambiguous; defaults to 1h" },
+  { long: "--end", value_name: "when", value_type: "string", description: "End time (ISO or relative); overrides --duration" },
+  { long: "--location", value_name: "value", value_type: "string", description: "Location" },
+  { long: "--timezone", value_name: "value", value_type: "string", description: "IANA timezone (for example America/New_York)" },
+  { long: "--all-day", value_type: "boolean", description: "Mark as an all-day event" },
+];
+
+/** Package-owned shortcuts retain the public SDK operation identities and flags. */
+export const schedulingCommandDefinitions: Omit<CommandDefinition, "run">[] = [
+  ...(["meet", "event"] as const).map((name): Omit<CommandDefinition, "run"> => ({
+    name,
+    action: name,
+    tier: "standard",
+    family: "automation",
+    description: `Create a ${name === "meet" ? "Meeting" : "Event"} with a start time and duration.`,
+    arguments: [{ name: "title", required: true, description: "Item title" }],
+    flags: [...eventFlags, ...commonFlags],
+  })),
+  {
+    name: "remind",
+    action: "remind",
+    tier: "standard",
+    family: "automation",
+    description: "Create a Reminder from a single point in time.",
+    arguments: [{ name: "title", required: true, description: "Item title" }],
+    flags: [
+      { long: "--at", value_name: "when", value_type: "string", description: "Reminder time (ISO, now, or relative +2d); defaults to +1d" },
+      { long: "--text", value_name: "value", value_type: "string", description: "Reminder text; defaults to the title" },
+      ...commonFlags,
+    ],
+  },
+];

package/packages/pm-calendar/extensions/calendar/index.ts

@@ -10,6 +10,7 @@ import type {
 } from "@unbrained/pm-cli/sdk";
 import type { CalendarOptions } from "@unbrained/pm-cli/sdk/runtime";
 import { renderCalendarPackageOutput, runCalendarPackage } from "./runtime.ts";
+import { schedulingCommands } from "./shortcuts.ts";
 
 const CALENDAR_VIEW_NAMES = ["agenda", "day", "week", "month"] as const;
 
@@ -278,6 +279,7 @@ function calendarCommand(name: "calendar" | "cal"): CommandDefinition {
 export function activate(api: ExtensionApi): void {
   api.registerCommand(calendarCommand("calendar"));
   api.registerCommand(calendarCommand("cal"));
+  for (const command of schedulingCommands) api.registerCommand(command);
   api.registerService("output_format", (context) => {
     const rendered = renderCalendarPackageOutput(
       context as ServiceOverrideContext,

package/packages/pm-calendar/extensions/calendar/manifest.json

@@ -4,10 +4,10 @@
   "entry": "./index.ts",
   "priority": 0,
   "trusted": true,
-  "sandbox_profile": "strict",
+  "sandbox_profile": "restricted",
   "permissions": {
     "fs_read": true,
-    "fs_write": false,
+    "fs_write": true,
     "network": false,
     "env_read": true,
     "env_write": false,
@@ -17,6 +17,6 @@
   "manifest_version": 1,
   "pm_min_version": "2026.6.24",
   "activation": {
-    "commands": ["cal", "calendar"]
+    "commands": ["cal", "calendar", "meet", "event", "remind"]
   }
 }

package/packages/pm-calendar/extensions/calendar/shortcuts.ts

@@ -0,0 +1,15 @@
+/**
+ * @module packages/pm-calendar/extensions/calendar/shortcuts
+ *
+ * Binds package-owned scheduling declarations to the public SDK mutation paths.
+ */
+import { runEvent, runMeet, runRemind, type CommandDefinition } from "@unbrained/pm-cli/sdk";
+import { schedulingCommandDefinitions } from "./command-definitions.ts";
+
+/** Scheduling handlers preserve native SDK validation, history, and output receipts. */
+export const schedulingCommands: CommandDefinition[] = schedulingCommandDefinitions.map((definition) => ({
+  ...definition,
+  run: (context) => (
+    definition.name === "meet" ? runMeet : definition.name === "event" ? runEvent : runRemind
+  )(context.args[0], context.options, context.global),
+}));

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",

package/scripts/build-lease.mjs

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+/**
+ * Hold an exclusive checkout lease through a complete producer or consumer.
+ * Never steal a lock by age: a slow compiler or test is still its owner.
+ * Nested read-only runners may reuse the parent's opaque, live-owner receipt.
+ */
+export async function withBuildLease(root, operation, options = {}) {
+  const directory = path.join(await realpath(root), ".cache", "build-lease");
+  const ownerFile = path.join(directory, "owner.json");
+  if (options.inherited) {
+    const owner = JSON.parse(await readFile(ownerFile, "utf8"));
+    if (owner.token !== options.inherited || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+      throw new Error("Invalid inherited build lease; run validation from an independent shell.");
+    }
+    process.kill(owner.pid, 0);
+    return operation(owner.token);
+  }
+  await mkdir(path.dirname(directory), { recursive: true });
+  const deadline = Date.now() + (options.timeoutMs ?? 1_200_000);
+  for (;;) {
+    try {
+      await mkdir(directory);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) {
+        throw new Error("Timed out waiting for build lease. Check .cache/build-lease/owner.json; remove an abandoned lease only after confirming its producer and consumers have stopped.", { cause: error });
+      }
+      await delay(Math.min(100, Math.max(1, deadline - Date.now())));
+    }
+  }
+  const token = randomUUID();
+  try {
+    await writeFile(ownerFile, JSON.stringify({ token, pid: process.pid }), "utf8");
+    return await operation(token);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/scripts/build.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { withBuildLease } from "./build-lease.mjs";
+
+/** Run each build stage under one lease, retaining a failure marker until a complete rebuild. */
+export async function main(root = process.cwd()) {
+  if (process.env.PM_BUILD_CONSUMER_LEASE) {
+    throw new Error("Cannot rebuild dist inside a validation consumer lease. Build before starting tests.");
+  }
+  return withBuildLease(root, async () => {
+    const incomplete = path.join(root, ".cache", "build-incomplete");
+    await writeFile(incomplete, "Build has not completed. Run pnpm build before consuming dist.\n");
+    for (const args of [
+      ["scripts/prepare-build-cache.mjs"],
+      ["node_modules/typescript/bin/tsc", "-p", "tsconfig.json"],
+      ["scripts/bundle-cli.mjs"],
+      ["scripts/finalize-build.mjs"],
+    ]) {
+      const code = await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, args, { cwd: root, stdio: "inherit" });
+        child.once("error", reject);
+        child.once("close", (status, signal) => resolve(signal ? 1 : (status ?? 1)));
+      });
+      if (code !== 0) return code;
+    }
+    await rm(incomplete);
+    return 0;
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().then((code) => { process.exitCode = code; }).catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
+}