@unbrained/pm-cli 2026.9.26 → 2026.9.28

package/docs/CONFIGURATION.md

@@ -67,6 +67,8 @@ Precedence:
 
 When `settings.json` cannot be loaded, `pm` falls back to built-in defaults and prints a one-time `settings_read_fs_error`, `settings_read_invalid_json`, or `settings_read_invalid_schema` warning to stderr (stdout output is unchanged); run `pm health` for remediation.
 
+If the existing project `settings.json` has invalid JSON, a configuration write refuses with `settings_write_invalid_existing_json`. It leaves the file and workspace history untouched. Repair the syntax in `.agents/pm/settings.json`, run `pm health`, then retry the configuration command. The read fallback to defaults does not authorize replacing malformed settings.
+
 ## Common Settings
 
 | Setting                                    | Purpose                                                                                                                                                                                               |

package/docs/EXTENSION_LIFECYCLE.md

@@ -3,6 +3,24 @@
 Tracked by [pm-ig5cfe](../.agents/pm/issues/pm-ig5cfe.toon),
 [pm-495lkc](../.agents/pm/issues/pm-495lkc.toon), and
 [pm-miy5k6](../.agents/pm/issues/pm-miy5k6.toon).
+Static inventory is tracked by [pm-lhhnx9](../.agents/pm/issues/pm-lhhnx9.toon).
+
+## Read-only configured inventory
+
+Use `pm package inventory --project --json` (or `--global`) for a host GET route
+or agent read. Pass a name to receive an explicit `absent` row. The public SDK
+equivalent is `inspectStaticExtensionInventory({ pmRoot, scope, name })` from
+`@unbrained/pm-cli/sdk`. Both read settings, managed metadata, and manifests
+without importing package entrypoints, running hooks, checking for updates,
+adopting installs, or writing workspace files. An absent managed-state file is
+reported separately from an invalid one. `complete: false` and `errors` mean
+the list must not be treated as authoritative; the CLI also exits nonzero.
+
+`configured_enabled` is the effective saved enablement setting, while
+`runtime_active` is always `null`. The static read does not prove that a package
+will activate successfully. `pm package explore`, `manage`, `doctor`, and
+`describe` probe runtime state and may execute installed package code. Run
+those commands only when an activation probe is intended.
 
 ## Explicit Install-Source Identity
 

package/docs/PACKAGE_EVIDENCE.md

@@ -1,8 +1,10 @@
 # Install Plans and Update Evidence
 
-Tracked by [pm-5bsofk](../.agents/pm/issues/pm-5bsofk.toon) and
+Tracked by [pm-erogk1](../.agents/pm/issues/pm-erogk1.toon),
+[pm-5bsofk](../.agents/pm/issues/pm-5bsofk.toon) and
 [pm-gf5zw8](../.agents/pm/issues/pm-gf5zw8.toon), with claim controls tracked by
-[pm-eqdo85](../.agents/pm/issues/pm-eqdo85.toon).
+[pm-eqdo85](../.agents/pm/issues/pm-eqdo85.toon) and Git metadata exclusion by
+[pm-k7nxaz](../.agents/pm/issues/pm-k7nxaz.toon).
 
 ## Install planning
 
@@ -10,17 +12,26 @@ Preview an install with `pm package install ./local-package --project --dry-run`
 The `details.install_plan` receipt distinguishes directory, archive, npm, and
 GitHub sources and reports logical file bytes, file/directory/link counts, and
 the copy policy. External local directories are directory snapshots, including
-development artifacts; nested destinations exclude `.agents`, `node_modules`,
-and installer backup directories at every depth using the installer's filter.
-Counts are lower bounds when `complete` is false, with `stop_reason`
-identifying the entry or depth limit. A source-directory alias resolves to its
+development artifacts other than `.git`. All copied directory sources exclude
+`.git` entries at every depth, including worktree files and symlinks, and count
+those entries in `excluded_entries`. Nested destinations also exclude `.agents`,
+`node_modules`, and installer backup directories at every depth using the
+installer's filter.
+The bounded planner can return lower-bound counts with `complete: false` and a
+`stop_reason` when called directly. Installing a local directory now refuses
+that incomplete scan in both dry-run and real modes before writing or
+activating. SDK callers receive
+`extension_install_incomplete_source_scan`; the CLI exits nonzero with the
+entry or depth limit and a packed-archive recovery step. That recovery keeps
+the requested `--project` or `--global` installation scope. A source-directory
+alias resolves to its
 directory before copying; symlink entries inside the source remain links and
 their targets are never traversed.
 Planning writes no destination files, managed state, or activation settings;
 archive and remote source resolution can still prepare temporary source files
 and perform network or dependency-resolution work.
 
-For development-heavy or incomplete local snapshots, `packed_alternative`
+For development-heavy local snapshots, `packed_alternative`
 provides argument vectors for `npm pack --ignore-scripts --json` and archive
 installation. Run packing in its reported `cwd`, substitute the returned
 `pack_result[0].filename`, and install the resulting archive. Normal local

package/docs/README.md

@@ -34,6 +34,7 @@ pm guide release --json
 - [Quickstart](QUICKSTART.md) - install, initialize, create, claim, link, test, close.
 - [Onboarding](ONBOARDING.md) - first-two-hours maintainer and contributor setup.
 - [Agent Guide](AGENT_GUIDE.md) - canonical agent loop, tracker linking, and token-minimal command choices.
+- [Agent Read and Test Receipts](AGENT_READ_AND_TEST_RECEIPTS.md) - JSON help provenance, linked-test persistence, and history diff continuation.
 - [Command Reference](COMMANDS.md) - command families with examples and when to use each family.
 - [Context and Operations Namespaces](COMMAND_NAMESPACES.md) - native navigation, diagnostics, event streams, and compatibility aliases.
 - [CLI Scripting Contract](SCRIPTING.md) - exit codes, flat mutation receipts versus read envelopes, stdout/stderr boundaries, stable JSON fields, uniform OR filters, and shell composition recipes.

package/docs/RELEASING.md

@@ -76,7 +76,52 @@ pnpm version:check
 
 `.github/workflows/auto-release.yml` runs once per day and can also be dispatched manually.
 
-Policy:
+### Independent morning dispatch
+
+Tracked by [pm-9url9h](../.agents/pm/tasks/pm-9url9h.toon). An independent
+operator-managed timer can invoke `scripts/release/dispatch-daily-release.mjs`
+at **04:45 Europe/Vienna** (02:45 UTC in summer, 03:45 UTC in winter).
+The aim is completion before 06:30–07:00 local time; host availability, GitHub
+runner capacity and release gates can prevent that target. The host must be
+awake, online and able to authenticate with `gh` unattended.
+
+The existing **02:35 UTC GitHub cron remains enabled as a fallback**. Either
+clock can arrive first. The dispatcher checks both release workflows for active
+runs and skips an existing exact UTC-day tag. Tag existence is explicitly not
+publication proof: incomplete publication still requires the normal immutable-tag
+recovery procedure. Hosted concurrency and the one-release-per-UTC-day guard
+remain the final protection if a native run races the external request.
+
+The standalone dispatcher requires an absolute private state directory:
+
+```bash
+node scripts/release/dispatch-daily-release.mjs --state-dir /absolute/private/state --check
+```
+
+`--check` reads prerequisites without dispatching or writing state, including
+outside the morning window. Without it, the dispatcher accepts only
+04:45–05:15 Vienna time and sends `workflow_dispatch` to `auto-release.yml` on
+`main` with explicit `push=true`, `dry_run=false`, and `telemetry_mode=off`,
+matching scheduled production policy. It never builds from the operator's
+working branch, changes release secrets or bypasses hosted gates.
+
+An exclusive daily intent file is written **before** sending the request. A
+timeout can mean GitHub accepted the request, so an uncertain attempt is retained
+and never automatically resent that UTC day. Inspect hosted run history before
+any manual recovery. Pre-dispatch read failures leave no intent; a timer may
+try again within the morning window. Late persistent-timer catch-up is a no-op.
+Install a reviewed copy outside development checkouts so branch edits cannot
+silently change an unattended service.
+
+Keep dispatcher output in the service journal: `dispatch_accepted` proves only
+API acceptance. Verify the hosted run, GitHub Release and exact npm version
+separately. These runs remain `workflow_dispatch`; they do not improve or erase
+the native `schedule` denominator in [Release Reliability](RELEASE_RELIABILITY.md).
+Disable the independent timer to roll back; the original hosted schedule and
+publication path continue unchanged. Host-specific unit files and authentication
+configuration belong in private operator documentation.
+
+### Hosted release policy
 
 - release only when commits exist after the latest release tag
 - ignore tracker-governance-only commits for publish eligibility: `.agents/pm/**` and the mechanically generated `CHANGELOG.md` projection do not create a package release by themselves, while any product, test, documentation, workflow, or other changed path remains release-relevant

package/docs/TESTING.md

@@ -2,17 +2,22 @@
 
 This page describes safe local tests, linked tests, coverage, and release-readiness checks.
 
+Current linked-test and merge-fence work: [pm-t05d8d](../.agents/pm/issues/pm-t05d8d.toon), [pm-kynkl8](../.agents/pm/issues/pm-kynkl8.toon).
+
 Tracked implementation updates: [pm-52eh](../.agents/pm/features/pm-52eh.toon), [pm-mcxr](../.agents/pm/issues/pm-mcxr.toon), [pm-u42x](../.agents/pm/issues/pm-u42x.toon), [pm-atfm](../.agents/pm/features/pm-atfm.toon), [pm-xmp5](../.agents/pm/tasks/pm-xmp5.toon), [pm-39cqqx](../.agents/pm/tasks/pm-39cqqx.toon), [pm-5cgm2z](../.agents/pm/chores/pm-5cgm2z.toon), [pm-avv3wx](../.agents/pm/issues/pm-avv3wx.toon), [pm-rizqb6](../.agents/pm/issues/pm-rizqb6.toon), [pm-95h7pg](../.agents/pm/issues/pm-95h7pg.toon), [pm-giks4s](../.agents/pm/issues/pm-giks4s.toon), [pm-xa3t0o](../.agents/pm/issues/pm-xa3t0o.toon), [pm-e97jyf](../.agents/pm/issues/pm-e97jyf.toon), [pm-efkvdy](../.agents/pm/issues/pm-efkvdy.toon), [pm-ed28wi](../.agents/pm/issues/pm-ed28wi.toon), and [pm-5ug5xq](../.agents/pm/issues/pm-5ug5xq.toon).
 
 ## Agent Quick Context
 
 - Unit and integration tests must not read or write real `.agents/pm` data.
 - Prefer `node scripts/run-tests.mjs ...` because it creates sandboxed `PM_PATH` and `PM_GLOBAL_PATH`.
-- Linked-test execution injects isolated `PM_PATH` and `PM_GLOBAL_PATH` for
-  every command and applies stored-command provenance checks before process
+- Linked-test execution injects isolated `PM_GLOBAL_PATH` and normally
+  `PM_PATH`; `pm_context_mode=none` omits `PM_PATH` for self-isolating SDK tests
+  in disposable workspaces. It applies stored-command provenance checks before process
   creation. Direct runners are accepted; prefer
   `node scripts/run-tests.mjs ...` when the repository provides it because the
-  wrapper also reproduces build, coverage, and cleanup policy.
+  wrapper also reproduces build, coverage, and cleanup policy. Use a direct
+  runner when a `none`-mode test must observe an unset `PM_PATH`; the wrapper
+  creates its own sandboxed `PM_PATH`.
 - Run linked tests before closing the item that owns the work.
 
 Tracked documentation work: [pm-u9d0](../.agents/pm/epics/pm-u9d0.toon).
@@ -510,6 +515,11 @@ only their schema roots; a non-PM command explicitly configured with
 data are materialized only when at least one selected command requires tracker
 context. This preserves source isolation without copying an unrelated tracker
 into constrained temporary storage.
+For SDK tests that create independent temporary PM roots, use
+`pm_context_mode: "none"` with `workspace_context_mode: "isolated"` or
+`"snapshot"`. The runner omits `PM_PATH` so each SDK client can resolve its
+explicit workspace independently; `PM_GLOBAL_PATH` remains sandboxed. Source
+workspace execution and direct PM commands refuse this mode before execution.
 Capacity, permission, and resource failures while seeding a required tracker
 surface as typed, path-redacted host-environment refusals with recovery steps.
 When a legacy source tracker has settings but no `_workspace` history, tracker
@@ -593,6 +603,7 @@ Use explicit modes when needed:
 pm test <item-id> --run --pm-context schema
 pm test <item-id> --run --pm-context tracker
 pm test <item-id> --run --pm-context auto --check-context --auto-pm-context
+pm test <item-id> --add-json '{"command":"pnpm exec vitest run tests/integration/linked-test-context-trust.integration.spec.ts","pm_context_mode":"none","workspace_context_mode":"snapshot"}'
 ```
 
 For complex linked-test commands, prefer JSON input so shell syntax survives unchanged:

package/docs/agent-task-token-baseline.json

@@ -77,7 +77,7 @@
       {
         "task_id": "orientation-contracts-next",
         "command_count": 2,
-        "estimated_tokens": 5180,
+        "estimated_tokens": 5203,
         "capabilities": [
           "actionable_work",
           "active_ownership",
@@ -120,11 +120,11 @@
     },
     {
       "id": "orientation-contracts-next",
-      "max_estimated_tokens": 5180,
+      "max_estimated_tokens": 5203,
       "steps": [
         {
           "id": "contracts",
-          "max_estimated_tokens": 4458,
+          "max_estimated_tokens": 4481,
           "accounting_mode": "self_reported"
         },
         {
@@ -261,5 +261,5 @@
       ]
     }
   ],
-  "composite_max_estimated_tokens": 13011
+  "composite_max_estimated_tokens": 13034
 }

package/docs/generated/AGENT_CAPABILITY_ROUTING.md

@@ -6,7 +6,7 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 
 | Capability family | Commands |
 | --- | --- |
-| workspace | `init`, `config`, `workspace merge`, `schema`, `profile`, `ops telemetry`, `ops health`, `ops gc`, `workspace` |
+| workspace | `workspace init`, `workspace config`, `workspace merge`, `workspace schema`, `workspace profile`, `ops telemetry`, `ops health`, `ops gc`, `workspace` |
 | intake | `create`, `item`, `item copy`, `context focus`, `history restore` |
 | context | `list`, `aggregate`, `context`, `get`, `search`, `item duplicates`, `ops eval`, `context next`, `history activity`, `ops stats`, `help` |
 | lifecycle | `update`, `update many`, `close`, `close many`, `close delete`, `claim`, `release` |

package/docs/generated/AGENT_COMMAND_SURFACE.md

@@ -5,7 +5,9 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | Command | Minimum visibility tier | Capability family |
 | --- | --- | --- |
 | `init` | core | workspace |
+| `workspace init` | core | workspace |
 | `config` | standard | workspace |
+| `workspace config` | standard | workspace |
 | `extension` | full | extensions |
 | `package` | full | extensions |
 | `packages` | full | extensions |
@@ -54,7 +56,9 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `merge` | full | workspace |
 | `workspace merge` | full | workspace |
 | `schema` | standard | workspace |
+| `workspace schema` | standard | workspace |
 | `profile` | standard | workspace |
+| `workspace profile` | standard | workspace |
 | `activity` | full | context |
 | `history activity` | full | context |
 | `restore` | full | intake |
@@ -97,7 +101,7 @@ This file is generated from `PM_COMMAND_CAPABILITY_CONTRACTS`. Do not edit it ma
 | `assurance` | full | quality |
 | `gc` | full | workspace |
 | `ops gc` | full | workspace |
-| `workspace` | full | workspace |
+| `workspace` | core | workspace |
 | `contracts` | standard | quality |
 | `claim` | core | lifecycle |
 | `release` | core | lifecycle |

package/docs/generated/FLAG_LEXICON_BUDGETS.md

@@ -95,6 +95,10 @@ This file is generated by `listPmFlagLexicon()`. Compatibility aliases do not co
 | `update many` | lifecycle | 146 | 146 |
 | `close many` | lifecycle | 72 | 72 |
 | `close delete` | lifecycle | 24 | 24 |
+| `workspace init` | workspace | 30 | 30 |
+| `workspace config` | workspace | 36 | 36 |
+| `workspace schema` | workspace | 43 | 43 |
+| `workspace profile` | workspace | 22 | 22 |
 | `item comments` | evidence | 31 | 31 |
 | `item notes` | evidence | 35 | 35 |
 | `item learnings` | evidence | 31 | 31 |

package/docs/generated/REFUSAL_CLOSURE_CENSUS.md

@@ -4,14 +4,14 @@ Tracker: `pm-f05lsg`.
 
 Every catalog code is listed. An `uncovered` row is an explicit closure obligation, never an omission or implied approval.
 
-- Catalog error codes: 378
+- Catalog error codes: 389
 - Executable error codes: 19
 - Executable-code ratchet floor: 18
 - Required executable canonical codes: `bulk_ids_input_empty`, `bulk_ids_input_missing_path`, `bulk_ids_input_unreadable`, `invalid_argument_value`, `manifest_unknown_key`, `missing_lifecycle_target`, `missing_required_argument`, `no_version_bounds_declared`, `projection_options_mutually_exclusive`, `tracker_not_initialized`, `tracker_root_missing`, `tracker_root_not_directory`, `tracker_root_unreadable`, `unknown_context_intent`, `unknown_field_projection`, `unknown_option`, `unknown_subcommand`
-- Uncovered error codes: 359
-- Coverage fraction: 0.050265
+- Uncovered error codes: 370
+- Coverage fraction: 0.048843
 - Closed-domain probes: 19
-- Grammar probes: 113
+- Grammar probes: 117
 
 | Error code | Canonical code | Disposition | Evidence kinds | Probe count |
 | --- | --- | --- | --- | --- |
@@ -86,6 +86,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `extension_dependency_name_unsafe` | `extension_dependency_name_unsafe` | uncovered | none | 0 |
 | `extension_dependency_spec_invalid` | `extension_dependency_spec_invalid` | uncovered | none | 0 |
 | `extension_dependency_version_unsafe` | `extension_dependency_version_unsafe` | uncovered | none | 0 |
+| `extension_install_incomplete_source_scan` | `extension_install_incomplete_source_scan` | uncovered | none | 0 |
 | `extension_install_soft_failed` | `extension_install_soft_failed` | uncovered | none | 0 |
 | `extension_install_source_contains_destination` | `extension_install_source_contains_destination` | uncovered | none | 0 |
 | `extension_item_field_reserved` | `extension_item_field_reserved` | uncovered | none | 0 |
@@ -96,6 +97,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `extension_mutation_guard_invalid_denial` | `extension_mutation_guard_invalid_denial` | uncovered | none | 0 |
 | `extension_mutation_guard_timed_out` | `extension_mutation_guard_timed_out` | uncovered | none | 0 |
 | `extension_update_health_partial_coverage` | `extension_update_health_partial_coverage` | uncovered | none | 0 |
+| `extensions_unreadable` | `extensions_unreadable` | uncovered | none | 0 |
 | `field_duplicate` | `field_duplicate` | uncovered | none | 0 |
 | `field_invalid` | `field_invalid` | uncovered | none | 0 |
 | `field_mcp_input_collision` | `field_mcp_input_collision` | uncovered | none | 0 |
@@ -189,8 +191,12 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `locks_stale_count` | `locks_stale_count` | uncovered | none | 0 |
 | `locks_unreadable` | `locks_unreadable` | uncovered | none | 0 |
 | `malformed_plan_step_evidence` | `malformed_plan_step_evidence` | uncovered | none | 0 |
+| `managed_state_invalid` | `managed_state_invalid` | uncovered | none | 0 |
+| `managed_state_unreadable` | `managed_state_unreadable` | uncovered | none | 0 |
 | `manifest_capabilities_absent` | `manifest_capabilities_absent` | uncovered | none | 0 |
+| `manifest_invalid` | `manifest_invalid` | uncovered | none | 0 |
 | `manifest_unknown_key` | `manifest_unknown_key` | executable | owned_state | 1 |
+| `manifest_unreadable` | `manifest_unreadable` | uncovered | none | 0 |
 | `mcp_annotation_file_unavailable` | `mcp_annotation_file_unavailable` | uncovered | none | 0 |
 | `mcp_stdin_unavailable` | `mcp_stdin_unavailable` | uncovered | none | 0 |
 | `mcp_task_not_found_or_not_authorized` | `mcp_task_not_found_or_not_authorized` | uncovered | none | 0 |
@@ -198,6 +204,8 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `merge_decisions_unreviewed` | `merge_decisions_unreviewed` | uncovered | none | 0 |
 | `merge_driver_configuration_drift` | `merge_driver_configuration_drift` | uncovered | none | 0 |
 | `merge_driver_configuration_missing` | `merge_driver_configuration_missing` | uncovered | none | 0 |
+| `merge_fence_drift` | `merge_fence_drift` | uncovered | none | 0 |
+| `merge_fence_missing` | `merge_fence_missing` | uncovered | none | 0 |
 | `merge_git_config_unwritable` | `merge_git_config_unwritable` | uncovered | none | 0 |
 | `merge_receipt_evidence_invalid` | `merge_receipt_evidence_invalid` | uncovered | none | 0 |
 | `merge_receipt_history_reference_missing` | `merge_receipt_history_reference_missing` | uncovered | none | 0 |
@@ -216,7 +224,7 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `missing_parameter_alias` | `missing_parameter_alias` | uncovered | none | 0 |
 | `missing_positive_execution_receipt` | `missing_positive_execution_receipt` | uncovered | none | 0 |
 | `missing_probe` | `missing_probe` | uncovered | none | 0 |
-| `missing_required_argument` | `missing_required_argument` | executable | grammar | 75 |
+| `missing_required_argument` | `missing_required_argument` | executable | grammar | 77 |
 | `missing_required_option` | `missing_required_option` | uncovered | none | 0 |
 | `missing_suggested_retry` | `missing_suggested_retry` | uncovered | none | 0 |
 | `missing_suggested_retry_args` | `missing_suggested_retry_args` | uncovered | none | 0 |
@@ -274,10 +282,13 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `retry_failed` | `retry_failed` | uncovered | none | 0 |
 | `schema_migration_input_required` | `schema_migration_input_required` | uncovered | none | 0 |
 | `semantic_spelling_collision` | `semantic_spelling_collision` | uncovered | none | 0 |
+| `settings_invalid` | `settings_invalid` | uncovered | none | 0 |
 | `settings_read_fs_error` | `settings_read_fs_error` | uncovered | none | 0 |
 | `settings_read_invalid_json` | `settings_read_invalid_json` | uncovered | none | 0 |
 | `settings_read_invalid_schema` | `settings_read_invalid_schema` | uncovered | none | 0 |
 | `settings_read_merge_failed` | `settings_read_merge_failed` | uncovered | none | 0 |
+| `settings_unreadable` | `settings_unreadable` | uncovered | none | 0 |
+| `settings_write_invalid_existing_json` | `settings_write_invalid_existing_json` | uncovered | none | 0 |
 | `stale_budget` | `stale_budget` | uncovered | none | 0 |
 | `stale_destination` | `stale_destination` | uncovered | none | 0 |
 | `stale_observed_signature` | `stale_observed_signature` | uncovered | none | 0 |
@@ -318,13 +329,13 @@ Every catalog code is listed. An `uncovered` row is an explicit closure obligati
 | `unknown_field` | `unknown_field` | uncovered | none | 0 |
 | `unknown_field_projection` | `unknown_field_projection` | executable | closed_domain | 10 |
 | `unknown_item_type` | `unknown_item_type` | uncovered | none | 0 |
-| `unknown_lifecycle_action` | `unknown_subcommand` | executable | grammar, owned_state | 12 |
+| `unknown_lifecycle_action` | `unknown_subcommand` | executable | grammar, owned_state | 14 |
 | `unknown_noun` | `unknown_noun` | uncovered | none | 0 |
 | `unknown_option` | `unknown_option` | executable | owned_state | 1 |
 | `unknown_plan_template` | `unknown_plan_template` | uncovered | none | 0 |
 | `unknown_provenance_dimension` | `unknown_provenance_dimension` | uncovered | none | 0 |
 | `unknown_status` | `unknown_status` | uncovered | none | 0 |
-| `unknown_subcommand` | `unknown_subcommand` | executable | grammar, owned_state | 12 |
+| `unknown_subcommand` | `unknown_subcommand` | executable | grammar, owned_state | 14 |
 | `unsafe_init_recovery` | `unsafe_init_recovery` | uncovered | none | 0 |
 | `unsupported_update_option` | `unsupported_update_option` | uncovered | none | 0 |
 | `validate_command_references_stale_pm_ids` | `validate_command_references_stale_pm_ids` | uncovered | none | 0 |

package/marketplace.json

@@ -4,16 +4,14 @@
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"
   },
-  "metadata": {
-    "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.26"
-  },
+  "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
+  "version": "2026.9.28",
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
-      "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.26",
+      "description": "Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
+      "version": "2026.9.28",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -123,7 +123,7 @@
     "lint:complexity:baseline": "eslint . --suppress-rule complexity --suppress-rule sonarjs/cognitive-complexity",
     "lint:duplicates": "jscpd --config .jscpd.json && jscpd --config .jscpd.source.json && jscpd --config .jscpd.tables.json",
     "lint:codefactor": "pnpm quality:static",
-    "quality:static": "pnpm quality:docstrings && pnpm quality:exports && pnpm lint:eslint && pnpm lint:duplicates && node scripts/check-workflow-permissions.mjs && node scripts/check-dependency-cooldown.mjs && node scripts/gen-plugin-mcp-wrappers.mjs --check && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded && pnpm quality:mutation -- --prebuilt",
+    "quality:static": "pnpm quality:docstrings && pnpm quality:exports && pnpm lint:eslint && pnpm lint:duplicates && node scripts/check-workflow-permissions.mjs && node scripts/check-dependency-cooldown.mjs && node scripts/gen-plugin-mcp-wrappers.mjs --check && node scripts/gen-agent-plugin-skills.mjs --check && pnpm build && node scripts/contracts-snapshot.mjs --check && node scripts/generate-agent-capability-surfaces.mjs --check && node scripts/generate-error-code-catalog.mjs --check && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs && node scripts/release/refusal-closure-gate.mjs && node scripts/release/agent-task-token-gate.mjs && pnpm quality:mcp-deprecations && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded && pnpm quality:mutation -- --prebuilt",
     "quality:exports": "knip --no-config-hints && node scripts/run-tests.mjs test -- tests/unit/scripts/release/dead-exports.spec.ts",
     "quality:command-grammar": "pnpm build && node scripts/release/command-grammar-gate.mjs && node scripts/release/flag-invocation-parity.mjs && node scripts/release/flag-lexicon-gate.mjs",
     "quality:recovery-closure": "pnpm build && node scripts/release/refusal-closure-gate.mjs",
@@ -238,10 +238,10 @@
     "eslint-plugin-unicorn": "76.0.0",
     "fast-check": "^4.10.2",
     "github-slugger": "2.0.0",
-    "greptile": "^3.5.3",
-    "jscpd": "^5.3.1",
-    "knip": "^6.37.0",
-    "marked": "18.0.13",
+    "greptile": "^3.6.0",
+    "jscpd": "^5.3.2",
+    "knip": "^6.38.0",
+    "marked": "18.0.14",
     "parse5": "8.0.1",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.9.26",
+  "version": "2026.9.28",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,9 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "pm-claude",
-  "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.9.26",
+  "displayName": "pm CLI",
+  "description": "Native pm CLI integration for Claude Code — 32 MCP tools, 14 skills with slash invocations, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
+  "version": "2026.9.28",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-claude/.mcp.json

@@ -2,8 +2,7 @@
   "mcpServers": {
     "pm-mcp": {
       "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/pm-mcp-server.mjs"],
-      "note": "Native pm-cli MCP server with automatic client/harness identity. Imports pm command modules directly — no pm shell invocation needed."
+      "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/pm-mcp-server.mjs"]
     }
   }
 }