@unbrained/pm-cli 2026.9.17 → 2026.9.18

package/docs/agent-task-token-baseline.json

@@ -77,7 +77,7 @@
       {
         "task_id": "orientation-contracts-next",
         "command_count": 2,
-        "estimated_tokens": 4829,
+        "estimated_tokens": 5180,
         "capabilities": [
           "actionable_work",
           "active_ownership",
@@ -120,16 +120,16 @@
     },
     {
       "id": "orientation-contracts-next",
-      "max_estimated_tokens": 4829,
+      "max_estimated_tokens": 5180,
       "steps": [
         {
           "id": "contracts",
-          "max_estimated_tokens": 4111,
+          "max_estimated_tokens": 4458,
           "accounting_mode": "self_reported"
         },
         {
           "id": "next",
-          "max_estimated_tokens": 718,
+          "max_estimated_tokens": 722,
           "accounting_mode": "self_reported"
         }
       ]
@@ -199,11 +199,11 @@
     },
     {
       "id": "unknown-option-recovery",
-      "max_estimated_tokens": 603,
+      "max_estimated_tokens": 596,
       "steps": [
         {
           "id": "refuse-option",
-          "max_estimated_tokens": 440,
+          "max_estimated_tokens": 433,
           "accounting_mode": "self_reported"
         },
         {
@@ -261,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 12667
+  "composite_max_estimated_tokens": 13011
 }

package/docs/generated/AGENT_CAPABILITY_ROUTING.md

@@ -13,5 +13,5 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | evidence | `history`, `history events`, `history redact`, `history repair`, `history compact`, `history attest`, `history acknowledge`, `item append`, `item comments`, `item notes`, `item learnings`, `item files`, `item docs` |
 | graph | `graph`, `item deps`, `plan` |
 | quality | `item test`, `ops test-all`, `ops validate`, `assurance`, `contracts`, `ops` |
-| automation | `meet`, `event`, `remind` |
+| automation | `calendar meet`, `calendar event`, `calendar remind` |
 | extensions | `package` |

package/docs/generated/AGENT_COMMAND_SURFACE.md

@@ -105,8 +105,11 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `pause-task` | full | lifecycle |
 | `close-task` | full | lifecycle |
 | `meet` | full | automation |
+| `calendar meet` | full | automation |
 | `event` | full | automation |
+| `calendar event` | full | automation |
 | `remind` | full | automation |
+| `calendar remind` | full | automation |
 | `help` | core | context |
 | `ops` | core | quality |
 | `completion-statuses` | internal | internal |

package/docs/generated/FLAG_LEXICON_BUDGETS.md

@@ -108,3 +108,6 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `item copy` | intake | 24 | 24 |
 | `workspace merge` | workspace | 27 | 27 |
 | `item duplicates` | context | 25 | 25 |
+| `calendar meet` | automation | 33 | 33 |
+| `calendar event` | automation | 33 | 33 |
+| `calendar remind` | automation | 29 | 29 |

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.17"
+    "version": "2026.9.18"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.17",
+      "version": "2026.9.18",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -98,6 +98,8 @@
     ".claude-plugin/**",
     "plugins/**",
     "packages/pm-*/**",
+    "scripts/build.mjs",
+    "scripts/build-lease.mjs",
     "scripts/bundle-cli.mjs",
     "scripts/generate-agent-capability-surfaces.mjs",
     "scripts/finalize-build.mjs",
@@ -108,7 +110,7 @@
     "marketplace.json"
   ],
   "scripts": {
-    "build": "node scripts/prepare-build-cache.mjs && tsc -p tsconfig.json && node scripts/bundle-cli.mjs && node scripts/finalize-build.mjs",
+    "build": "node scripts/build.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.typetests.json && tsc -p tsconfig.packages.json && tsc -p tsconfig.examples.json",
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
@@ -205,7 +207,7 @@
     "node": ">=22.18.0"
   },
   "dependencies": {
-    "@sentry/node": "10.74.0",
+    "@sentry/node": "10.75.0",
     "@toon-format/toon": "^4.1.1",
     "@types/node": ">=22",
     "commander": "^15.0.0",
@@ -219,18 +221,18 @@
     "@codspeed/vitest-plugin": "^5.7.1",
     "@eslint/js": "^10.0.1",
     "@modelcontextprotocol/ext-apps": "2.0.0",
-    "@sentry/cli": "^3.7.0",
+    "@sentry/cli": "^3.8.0",
     "@types/node": "^26.5.1",
     "@types/npm-package-arg": "^6.1.4",
     "@vitest/coverage-v8": "^4.1.11",
     "esbuild": "0.28.2",
     "eslint": "^10.10.0",
-    "eslint-plugin-sonarjs": "^4.2.0",
-    "eslint-plugin-unicorn": "74.0.0",
-    "fast-check": "^4.10.0",
+    "eslint-plugin-sonarjs": "^4.2.1",
+    "eslint-plugin-unicorn": "75.0.0",
+    "fast-check": "^4.10.1",
     "github-slugger": "2.0.0",
     "greptile": "^3.5.2",
-    "jscpd": "^5.2.0",
+    "jscpd": "^5.2.1",
     "marked": "18.0.13",
     "parse5": "8.0.1",
     "tsx": "^4.23.13",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/README.md

@@ -1,9 +1,9 @@
 # pm Calendar Package
 
-`@unbrained/pm-calendar` provides agenda and calendar views as an installable pm package.
+`@unbrained/pm-calendar` provides scheduling shortcuts, agenda, and calendar views as an installable pm package.
 
 ```bash
-pm install calendar --project
+pm package install calendar --project
 # Or bootstrap all bundled package commands in a new project:
 pm init --defaults --with-packages
 pm calendar --view week --full-period
@@ -14,6 +14,47 @@ The package owns presentation commands for deadline, reminder, and scheduled eve
 
 Runtime sources are authored in TypeScript and use only the public `@unbrained/pm-cli/sdk` surface.
 
+## Scheduling commands
+
+Tracking: [pm-o3fh](../../.agents/pm/tasks/pm-o3fh.toon),
+[pm-jkjt](../../.agents/pm/issues/pm-jkjt.toon).
+
+```bash
+pm calendar meet "Planning" --start +1d --duration 30min --location "Room A"
+pm calendar event "Release window" --start 2026-10-01T09:00:00Z --duration PT2H
+pm calendar remind "Review release" --at +2d --text "Check acceptance results"
+```
+
+The legacy `pm meet`, `pm event`, and `pm remind` spellings remain aliases.
+Install `calendar` in each project where these commands are needed; without the
+package, the CLI provides an installation hint. Core `create` and `update` retain
+scheduling metadata primitives. SDK integrations can continue calling `runMeet`,
+`runEvent`, and `runRemind` directly without installing presentation commands.
+
+Meetings and events default to a start of `now` and a duration of `1h`.
+An explicit `--end` overrides the shortcut's duration. Reminders default to `+1d`
+and use the title as their reminder text. All three commands support parent,
+tags, priority, body, description, history message, and the host's global author
+and output options. Use `pm contracts --command "calendar meet" --flags-only`
+for the active project's exact contract.
+
+### Duration decision
+
+Accepted [duration ADR](../../.agents/pm/decisions/pm-j1vw3a.toon).
+
+Event durations accept integer `min`, `mins`, `minute`, or `minutes`; `h`, `d`,
+`w`, or explicit `mo` for calendar months; and ISO time durations such as `PT30M`
+or `PT1H30M`. Bare `m`, including signed values such as `+5m`, is rejected with
+`min`/`mo` alternatives before mutation. This resolves the ambiguity recorded in
+pm-jkjt and supersedes the duration compatibility decision in
+[pm-zoe4](../../.agents/pm/features/pm-zoe4.toon).
+
+This rule applies to shortcut durations and the shared `create`/`update` event
+parser. Other relative date fields retain `m` for calendar months. Zero duration
+creates an instant event; an end before the start is rejected. Calendar month
+arithmetic clamps to the last valid day of the target month; compound offsets
+such as `+1d+2h` are rejected.
+
 ## Recurrence Notes
 
 Recurring event `recur_count` values are counted from the event series `start`, not from the query window. For example, a daily event starting April 1 with `recur_count=3` has its counted occurrences on April 1, 2, and 3; querying April 10 does not restart the count.

package/packages/pm-calendar/extensions/calendar/command-definitions.ts

@@ -0,0 +1,52 @@
+/**
+ * @module packages/pm-calendar/extensions/calendar/command-definitions
+ *
+ * Declares pure calendar command metadata shared by runtime and contract gates. The host
+ * supplies alias routing, argument validation, mutation receipts, and telemetry.
+ */
+import type { CommandDefinition, FlagDefinition } from "@unbrained/pm-cli/sdk";
+
+const commonFlags: FlagDefinition[] = [
+  { long: "--parent", value_name: "id", value_type: "string", description: "Parent item id" },
+  { long: "--allow-missing-parent", value_type: "boolean", description: "Permit a parent id that does not exist yet" },
+  { long: "--tags", value_name: "list", value_type: "string", description: "Comma-separated tags" },
+  { long: "--priority", value_name: "value", value_type: "string", description: "Priority" },
+  { long: "--body", value_name: "text", value_type: "string", description: "Body/markdown content" },
+  { long: "--description", value_name: "text", value_type: "string", description: "Short description" },
+  { long: "--message", value_name: "value", value_type: "string", description: "History message" },
+];
+
+const eventFlags: FlagDefinition[] = [
+  { long: "--start", value_name: "when", value_type: "string", description: "Start time (ISO, now, or relative +1h/+2d); defaults to now" },
+  { long: "--duration", value_name: "span", value_type: "string", description: "Duration: min|mins|minute|minutes, h, d, w, mo, or ISO PT time; bare m is ambiguous; defaults to 1h" },
+  { long: "--end", value_name: "when", value_type: "string", description: "End time (ISO or relative); overrides --duration" },
+  { long: "--location", value_name: "value", value_type: "string", description: "Location" },
+  { long: "--timezone", value_name: "value", value_type: "string", description: "IANA timezone (for example America/New_York)" },
+  { long: "--all-day", value_type: "boolean", description: "Mark as an all-day event" },
+];
+
+/** Package-owned shortcuts retain the public SDK operation identities and flags. */
+export const schedulingCommandDefinitions: Omit<CommandDefinition, "run">[] = [
+  ...(["meet", "event"] as const).map((name): Omit<CommandDefinition, "run"> => ({
+    name,
+    action: name,
+    tier: "standard",
+    family: "automation",
+    description: `Create a ${name === "meet" ? "Meeting" : "Event"} with a start time and duration.`,
+    arguments: [{ name: "title", required: true, description: "Item title" }],
+    flags: [...eventFlags, ...commonFlags],
+  })),
+  {
+    name: "remind",
+    action: "remind",
+    tier: "standard",
+    family: "automation",
+    description: "Create a Reminder from a single point in time.",
+    arguments: [{ name: "title", required: true, description: "Item title" }],
+    flags: [
+      { long: "--at", value_name: "when", value_type: "string", description: "Reminder time (ISO, now, or relative +2d); defaults to +1d" },
+      { long: "--text", value_name: "value", value_type: "string", description: "Reminder text; defaults to the title" },
+      ...commonFlags,
+    ],
+  },
+];

package/packages/pm-calendar/extensions/calendar/index.ts

@@ -10,6 +10,7 @@ import type {
 } from "@unbrained/pm-cli/sdk";
 import type { CalendarOptions } from "@unbrained/pm-cli/sdk/runtime";
 import { renderCalendarPackageOutput, runCalendarPackage } from "./runtime.ts";
+import { schedulingCommands } from "./shortcuts.ts";
 
 const CALENDAR_VIEW_NAMES = ["agenda", "day", "week", "month"] as const;
 
@@ -278,6 +279,7 @@ function calendarCommand(name: "calendar" | "cal"): CommandDefinition {
 export function activate(api: ExtensionApi): void {
   api.registerCommand(calendarCommand("calendar"));
   api.registerCommand(calendarCommand("cal"));
+  for (const command of schedulingCommands) api.registerCommand(command);
   api.registerService("output_format", (context) => {
     const rendered = renderCalendarPackageOutput(
       context as ServiceOverrideContext,

package/packages/pm-calendar/extensions/calendar/manifest.json

@@ -4,10 +4,10 @@
   "entry": "./index.ts",
   "priority": 0,
   "trusted": true,
-  "sandbox_profile": "strict",
+  "sandbox_profile": "restricted",
   "permissions": {
     "fs_read": true,
-    "fs_write": false,
+    "fs_write": true,
     "network": false,
     "env_read": true,
     "env_write": false,
@@ -17,6 +17,6 @@
   "manifest_version": 1,
   "pm_min_version": "2026.6.24",
   "activation": {
-    "commands": ["cal", "calendar"]
+    "commands": ["cal", "calendar", "meet", "event", "remind"]
   }
 }

package/packages/pm-calendar/extensions/calendar/shortcuts.ts

@@ -0,0 +1,15 @@
+/**
+ * @module packages/pm-calendar/extensions/calendar/shortcuts
+ *
+ * Binds package-owned scheduling declarations to the public SDK mutation paths.
+ */
+import { runEvent, runMeet, runRemind, type CommandDefinition } from "@unbrained/pm-cli/sdk";
+import { schedulingCommandDefinitions } from "./command-definitions.ts";
+
+/** Scheduling handlers preserve native SDK validation, history, and output receipts. */
+export const schedulingCommands: CommandDefinition[] = schedulingCommandDefinitions.map((definition) => ({
+  ...definition,
+  run: (context) => (
+    definition.name === "meet" ? runMeet : definition.name === "event" ? runEvent : runRemind
+  )(context.args[0], context.options, context.global),
+}));

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",

package/scripts/build-lease.mjs

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+/**
+ * Hold an exclusive checkout lease through a complete producer or consumer.
+ * Never steal a lock by age: a slow compiler or test is still its owner.
+ * Nested read-only runners may reuse the parent's opaque, live-owner receipt.
+ */
+export async function withBuildLease(root, operation, options = {}) {
+  const directory = path.join(await realpath(root), ".cache", "build-lease");
+  const ownerFile = path.join(directory, "owner.json");
+  if (options.inherited) {
+    const owner = JSON.parse(await readFile(ownerFile, "utf8"));
+    if (owner.token !== options.inherited || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+      throw new Error("Invalid inherited build lease; run validation from an independent shell.");
+    }
+    process.kill(owner.pid, 0);
+    return operation(owner.token);
+  }
+  await mkdir(path.dirname(directory), { recursive: true });
+  const deadline = Date.now() + (options.timeoutMs ?? 1_200_000);
+  for (;;) {
+    try {
+      await mkdir(directory);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) {
+        throw new Error("Timed out waiting for build lease. Check .cache/build-lease/owner.json; remove an abandoned lease only after confirming its producer and consumers have stopped.", { cause: error });
+      }
+      await delay(Math.min(100, Math.max(1, deadline - Date.now())));
+    }
+  }
+  const token = randomUUID();
+  try {
+    await writeFile(ownerFile, JSON.stringify({ token, pid: process.pid }), "utf8");
+    return await operation(token);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/scripts/build.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { withBuildLease } from "./build-lease.mjs";
+
+/** Run each build stage under one lease, retaining a failure marker until a complete rebuild. */
+export async function main(root = process.cwd()) {
+  if (process.env.PM_BUILD_CONSUMER_LEASE) {
+    throw new Error("Cannot rebuild dist inside a validation consumer lease. Build before starting tests.");
+  }
+  return withBuildLease(root, async () => {
+    const incomplete = path.join(root, ".cache", "build-incomplete");
+    await writeFile(incomplete, "Build has not completed. Run pnpm build before consuming dist.\n");
+    for (const args of [
+      ["scripts/prepare-build-cache.mjs"],
+      ["node_modules/typescript/bin/tsc", "-p", "tsconfig.json"],
+      ["scripts/bundle-cli.mjs"],
+      ["scripts/finalize-build.mjs"],
+    ]) {
+      const code = await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, args, { cwd: root, stdio: "inherit" });
+        child.once("error", reject);
+        child.once("close", (status, signal) => resolve(signal ? 1 : (status ?? 1)));
+      });
+      if (code !== 0) return code;
+    }
+    await rm(incomplete);
+    return 0;
+  });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().then((code) => { process.exitCode = code; }).catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
+}