@unbrained/pm-cli 2026.9.2 → 2026.9.4

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.2"
+    "version": "2026.9.4"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.2",
+      "version": "2026.9.4",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/CHANGELOG.md

@@ -1,15 +1,59 @@
 # Changelog
 
+## 2026.9.4 - 2026-09-04
+
+### Added
+
+- Verdict contract: one declared vocabulary of reproducible predicates over recorded state, composable into a score, with reward shaping explicitly refused ([pm-e1vkee](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-e1vkee.toon))
+
+### Fixed
+
+- Windows published-release verifier test can preempt its own readiness and cleanup contract ([pm-euqm7x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-euqm7x.toon))
+- Packed npx smoke timeout rejects valid slow dependency reification ([pm-8eebb6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8eebb6.toon))
+- GH-1186: unrecoverable legacy merge-receipt references block strict health with diagnostic-only remediation ([pm-cf4t42](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-cf4t42.toon))
+- GH-1185: hash-only merge receipts make discarded scalar values unreachable to the reviewing agent ([pm-mg13iz](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-mg13iz.toon))
+- GH-1184: scalar merge conflict ordering ignores recency and requested preference ([pm-7wzb6d](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7wzb6d.toon))
+- Acceptance criteria are documented as merging like tags but are stored as one delimiter-joined scalar, so concurrent criteria additions from different branches are silently discarded ([pm-inn5y5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-inn5y5.toon))
+- GH-1183: Windows nightly event-index lock acquisition and fallback publication are nondeterministic ([pm-fqlocp](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fqlocp.toon))
+- GH-1177: Claude session provenance path is derived from invocation cwd instead of the session-start workspace ([pm-l7m7k5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-l7m7k5.toon))
+- GH-1179: legacy merge-receipt shape is misclassified as a gate-failing missing history reference with no remedy ([pm-wn3ee5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-wn3ee5.toon))
+- Re-anchoring overwrites the original hash pair, so the immutability proof for every pre-merge entry is destroyed by the operation that repairs the chain ([pm-aka8m7](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-aka8m7.toon))
+
+### Security
+
+- GH-1178: history hashes exclude record author and agent provenance, so attribution can be rewritten without detection ([pm-javbsq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-javbsq.toon))
+
+### Other
+
+- Refresh compatible @types/node 26.4.1 patch ([pm-vwtwqj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-vwtwqj.toon))
+
+## 2026.9.3 - 2026-09-03
+
+### Fixed
+
+- Context recency is computed from updated_at, so every governance write the project mandates erases the freshness signal it ranks on ([pm-07pt16](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-07pt16.toon))
+
+### Security
+
+- OSSF Scorecard alert \#29: qs denial-of-service advisories in the MCP Apps development dependency tree ([pm-mlpn91](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-mlpn91.toon))
+
 ## 2026.9.2 - 2026-09-02
 
 ### Fixed
 
+- A read whose result was omitted for budget still records those items as served and included, so the usage-affinity signal learns from context the agent never received ([pm-wv47pf](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-wv47pf.toon))
+- Shape-qualified scale baselines drifted from current CLI/SDK output contracts and supported runtime ([pm-r8yytk](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-r8yytk.toon))
 - GH-1174: Windows Node 24 receipt traversal negative control must fail closed portably ([pm-r97901](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-r97901.toon))
 
 ### Security
 
 - GH-1173: make merge-receipt evidence diagnostics source-stable and record-addressable ([pm-dn8rwl](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-dn8rwl.toon))
 
+### Other
+
+- Refresh compatible 2026-09-01 jscpd 5.1.1 tooling ([pm-ur4swu](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-ur4swu.toon))
+- Refresh Sentry 10.73 and TypeScript-ESLint 8.69 with exact coverage ([pm-92tp12](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-92tp12.toon))
+
 ## 2026.9.1 - 2026-09-01
 
 ### Added

package/dist/cli/after-command-context-usage.js

@@ -4,9 +4,9 @@
  * Records privacy-minimal context feedback after successful CLI mutations.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1944833a-5d9b-514d-99d0-50cdad5db8f4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="095bd18e-bfc9-58d8-bcdc-14f47f7a238a")}catch(e){}}();
 import { finishTelemetryCommand, getActiveCommandResult, readSettings, resolveAuthor, } from "../sdk/runtime-primitives.js";
-import { recordContextUsageTouches } from "../sdk/context-usage.js";
+import { finalizeContextUsageDelivery, recordContextUsageTouches, } from "../sdk/context-usage.js";
 /** Finalizes the active telemetry command with its normalized CLI outcome. */
 export async function finishActiveTelemetryCommand(runtime, outcome) {
     await finishTelemetryCommand(runtime, {
@@ -24,6 +24,16 @@ export async function finishActiveTelemetryCommand(runtime, outcome) {
 export async function recordAfterCommandContextUsage(options) {
     if (process.env.PM_CONTEXT_USAGE_DISABLED === "1")
         return;
+    let deliveryError;
+    try {
+        await finalizeContextUsageDelivery({
+            pmRoot: options.pmRoot,
+            result: getActiveCommandResult(),
+        });
+    }
+    catch (error) {
+        deliveryError = error;
+    }
     const settings = await readSettings(options.pmRoot);
     await recordContextUsageTouches({
         pmRoot: options.pmRoot,
@@ -31,6 +41,9 @@ export async function recordAfterCommandContextUsage(options) {
         itemIds: options.itemIds,
         intent: options.intent,
     });
+    if (deliveryError !== undefined) {
+        throw deliveryError;
+    }
 }
 //# sourceMappingURL=after-command-context-usage.js.map
-//# debugId=1944833a-5d9b-514d-99d0-50cdad5db8f4
+//# debugId=095bd18e-bfc9-58d8-bcdc-14f47f7a238a