@unbrained/pm-cli 2026.9.5 → 2026.9.7

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.9.5"
+    "version": "2026.9.7"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.9.5",
+      "version": "2026.9.7",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/CHANGELOG.md

@@ -1,9 +1,48 @@
 # Changelog
 
+## 2026.9.7 - 2026-09-07
+
+### Fixed
+
+- Release preparation omits the calendar date and fails post-tag main CI ([pm-071wg4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-071wg4.toon))
+
+## 2026.9.6 - 2026-09-06
+
+### Fixed
+
+- GH-1207: Make advisory health checks and strict verdict authority explicit ([pm-fkohe8](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fkohe8.toon))
+- The tracker's recurrence edges and the CI recurrence policy are two ledgers with no join, so 59 of the 75 items in a recorded recurrence lineage produce no gate anywhere ([pm-7c27ep](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7c27ep.toon))
+- Refresh review acknowledgements when bot feedback changes ([pm-8we38i](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8we38i.toon))
+- pm health --check-only, the diagnostic AGENTS.md routes agents to, reduces nothing: it costs 33k tokens where --summary states the same verdict in 142 ([pm-du93sr](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-du93sr.toon))
+- GH-1203: Offer actionable acceptance-evidence backfill after a warning close ([pm-ub1ott](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ub1ott.toon))
+- GH-1202: Classify abandoned merge receipts without losing durable provenance ([pm-466m0j](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-466m0j.toon))
+- GH-1200: Preview exact receipt proof before merge reconciliation ([pm-ao0bu9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ao0bu9.toon))
+- GH-1206: Verify legacy receipt redactions across hash encodings ([pm-v66zir](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v66zir.toon))
+- GH-1205: Declare root-only versus inherited extension flag reservation scope ([pm-2h8t6y](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-2h8t6y.toon))
+- GH-1201: Recover invalid pending receipt evidence across release upgrades ([pm-2xtv84](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-2xtv84.toon))
+- The linked-file staleness check has no holder-lifecycle partition, so 1,220 links on closed holders warn forever while its worklist truncation hides the actionable subset behind a path count reported as a row count ([pm-zw9188](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zw9188.toon))
+- 2026.8.1 regression: governance dedupe audit rejects the restored all-lifecycle status sentinel ([pm-449do9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-449do9.toon))
+- Normalize local parent shorthand consistently with dependency identifiers ([pm-olcoon](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-olcoon.toon))
+- Every pm next and pm context read writes one usage-ledger row per open item under a single global lock, and the compaction trigger is a byte threshold that a count-based retention can never satisfy ([pm-bab3gb](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-bab3gb.toon))
+- Reading one item by its primary key scans the whole workspace: pm get is O(corpus) and the projection flags bound the output but not the work ([pm-ydshl9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ydshl9.toon))
+- Telemetry worker permanently retries JSONB-incompatible Unicode events ([pm-xlb6aw](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xlb6aw.toon))
+- Telemetry worker: no Postgres reconnect — ingestion stalls with events stuck in RabbitMQ after postgres restart ([pm-rj3w](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-rj3w.toon))
+- Metadata index rebuilds and mutations repeatedly scan an unindexed FTS identity column ([pm-gtw5zh](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gtw5zh.toon))
+- Read sessions emit invalid continuation identities from workspace activity rows ([pm-s8ybl9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-s8ybl9.toon))
+- Scale fixtures silently omit unregistered Story items from metadata reads ([pm-fx80w2](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fx80w2.toon))
+- Releases from the default branch are supported with analyzer evidence ([pm-u1baah](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u1baah.toon))
+
+### Other
+
+- Cross-process reproducibility gate: prove CLI and MCP deterministic runs are byte-identical and fail on ambient time leaks ([pm-vklr99](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-vklr99.toon))
+- The docs gate enforces link resolution but not doc reachability, so orphaned docs pass CI and the advertised docs map silently drifts ([pm-s4y3z4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-s4y3z4.toon))
+- docs-skills-gate: validate anchor fragments in relative links ([pm-esbt](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-esbt.toon))
+
 ## 2026.9.5 - 2026-09-05
 
 ### Fixed
 
+- Tag-push Release must regenerate the exact-tag changelog before immutable publication ([pm-e63v1x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-e63v1x.toon))
 - pm next recommends outcome-milestone gates as actionable work, and summary.containers counts a bucket the envelope never emits ([pm-08mt4k](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-08mt4k.toon))
 - Windows published-release verifier test can preempt its own readiness and cleanup contract ([pm-euqm7x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-euqm7x.toon))
 - Commander usage refusals omit token_accounting even when --token-accounting is parsed ([pm-bfa1ob](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-bfa1ob.toon))
@@ -18,7 +57,6 @@
 - Agent skills instruct flags and spellings the runtime refuses, and no guide topic routes the evidence or automation families ([pm-4957pz](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-4957pz.toon))
 - Sentry-injected release artifacts exceed the CI package budget because pre- and post-injection packlists share one ceiling ([pm-llbnua](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-llbnua.toon))
 - GH-1190: Windows nightly can publish the event index after an unlocked fallback append ([pm-a7207g](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-a7207g.toon))
-- Tag-push Release must regenerate the exact-tag changelog before immutable publication ([pm-e63v1x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-e63v1x.toon))
 
 ### Other
 
@@ -248,7 +286,6 @@
 - Structured release-failure causes are preserved in blocked-release alerts ([pm-x63izf](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-x63izf.toon))
 - Bulk writes accept newline/comma IDs from argv, stdin, and @path with effect-aware exits ([pm-3oq022](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-3oq022.toon))
 - update-many --dry-run allows filter-only preview for review and bulk-selection workflows ([pm-kexu](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-kexu.toon))
-- Releases from the default branch are supported with analyzer evidence ([pm-u1baah](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u1baah.toon))
 
 ### Other
 
@@ -279,7 +316,6 @@
 
 ### Other
 
-- Cross-process reproducibility gate: prove CLI and MCP deterministic runs are byte-identical and fail on ambient time leaks ([pm-vklr99](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-vklr99.toon))
 - Expose agent probe controls and versioned legacy-author vocabulary through pm config and SDK mutation APIs ([pm-yds9dt](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-yds9dt.toon))
 - Diagnostic output budget: errors, warnings, and recovery bundles are the output an agent reads most and the only output with no declared ceiling ([pm-cha95z](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-cha95z.toon))
 

package/dist/cli/main.js

@@ -3,9 +3,9 @@
  * @module cli/main
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aefde24d-ee93-53ac-9163-86c867d1eb78")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2b73baa7-f63e-5a3b-a8cb-659ac26d7c67")}catch(e){}}();
 import { Command, CommanderError } from "commander";
-import { activateExtensions, clearActiveExtensionHooks, createCoreCommandHookContext, resetActiveExtensionRuntimeState, createEmptyExtensionRegistrationRegistry, discoverExtensions, getActiveCommandResult, getActiveExtensionRegistrations, loadExtensions, consumeAfterCommandAffectedItems, runActiveCommandHandler, runActiveParserOverride, runActivePreflightOverride, runAfterCommandHooks, runBeforeCommandHooks, setActiveCommandResult, setActiveCommandContext, setActiveExtensionCommands, setActiveExtensionHooks, setActiveExtensionParsers, setActiveExtensionPreflight, setActiveExtensionRegistrations, setActiveExtensionRenderers, setActiveExtensionServices, pathExists, resolvePmCliVersion, resolvePmPackageRootFromModule, resolveItemTypeRegistry, resolveRuntimeFieldRegistry, EXIT_CODE, resolveTelemetryErrorCategory, PmCliError, asRecordOrNull, printError, printResult, writeStderr, maybeRunFirstUseTelemetryPrompt, emitTelemetryErrorEvent, startTelemetryCommand, deriveTelemetryCommandResolution, sentryCaptureCliError, sentryFinishCommandSpan, sentryFlush, sentryLogCliUsageError, sentrySetCommandContext, sentryStartCommandSpan, ensureSentryInit, getSettingsPath, resolvePmRoot, readSettings, readSettingsWithMetadata, runWithWorkspaceHarnessSignalDescriptors, createLazyModule, } from "../sdk/runtime-primitives.js";
+import { activateExtensions, clearActiveExtensionHooks, createCoreCommandHookContext, resetActiveExtensionRuntimeState, createEmptyExtensionRegistrationRegistry, discoverExtensions, getActiveCommandResult, getActiveExtensionRegistrations, loadExtensions, consumeAfterCommandAffectedItems, runActiveCommandHandler, runActiveParserOverride, runActivePreflightOverride, runAfterCommandHooks, runBeforeCommandHooks, setActiveCommandResult, setActiveCommandContext, setActiveExtensionCommands, setActiveExtensionHooks, setActiveExtensionParsers, setActiveExtensionPreflight, setActiveExtensionRegistrations, setActiveExtensionRenderers, setActiveExtensionServices, pathExists, resolvePmCliVersion, resolvePmPackageRootFromModule, resolveItemTypeRegistry, resolveRuntimeFieldRegistry, EXIT_CODE, resolveTelemetryErrorCategory, PmCliError, asRecordOrNull, printError, printResult, writeStderr, maybeRunFirstUseTelemetryPrompt, emitTelemetryErrorEvent, startTelemetryCommand, deriveTelemetryCommandResolution, sentryCaptureCliError, sentryFinishCommandSpan, sentryFlush, sentryLogCliUsageError, sentrySetCommandContext, sentryStartCommandSpan, ensureSentryInit, getSettingsPath, resolvePmRoot, readSettings, readSettingsWithMetadata, runWithHarnessDetectionSignals, runWithWorkspaceHarnessSignalDescriptors, createLazyModule, } from "../sdk/runtime-primitives.js";
 import { runWithReproducibleProcessEnvironment } from "../sdk/reproducibility/process.js";
 import { resolveSubcommandFlagContractsForCommand } from "../sdk/cli-contracts.js";
 import { createExtensionCommandSdk } from "../sdk/extension-command-context.js";
@@ -2391,6 +2391,7 @@ async function handleRunPmCliError(params) {
         emitTelemetryCommandError: context.emitTelemetryCommandError,
     });
 }
+/** Dispatch one fresh CLI invocation with deterministic process state and tracker-scoped attribution. */
 async function runPmCliInReproducibleContext(rawArgv) {
     program = createPmCliProgram(CLI_VERSION);
     attachProgramLifecycleHooks(program);
@@ -2452,14 +2453,15 @@ async function runPmCliInReproducibleContext(rawArgv) {
             program.outputHelp();
             return;
         }
-        const invocationSettings = await readSettings(resolvePmRoot(process.cwd(), bootstrapGlobal.path));
-        const intentSnapshot = await loadContextIntentSnapshotForInvocation(invocationArgv, resolvePmRoot(process.cwd(), bootstrapGlobal.path), bootstrapGlobal.noExtensions, loadRuntimeExtensionSnapshot);
+        const invocationPmRoot = resolvePmRoot(process.cwd(), bootstrapGlobal.path);
+        const invocationSettings = await readSettings(invocationPmRoot);
+        const intentSnapshot = await loadContextIntentSnapshotForInvocation(invocationArgv, invocationPmRoot, bootstrapGlobal.noExtensions, loadRuntimeExtensionSnapshot);
         await runWithDiscoveredContextIntentContracts({
-            pmRoot: resolvePmRoot(process.cwd(), bootstrapGlobal.path),
+            pmRoot: invocationPmRoot,
             packages: intentSnapshot?.contextIntentPackages,
-        }, () => runWithWorkspaceHarnessSignalDescriptors(invocationSettings.agent_identity.harness_signals, () => program.parseAsync(invocationProcessArgv), {
+        }, () => runWithHarnessDetectionSignals({ env: { ...process.env, PM_PATH: invocationPmRoot }, argv: invocationProcessArgv, cwd: process.cwd() }, () => runWithWorkspaceHarnessSignalDescriptors(invocationSettings.agent_identity.harness_signals, () => program.parseAsync(invocationProcessArgv), {
             probesEnabled: invocationSettings.agent_identity?.probes_enabled,
-        }));
+        })));
     }
     catch (error) {
         await handleRunPmCliError({ error, invocationArgv });
@@ -2570,4 +2572,4 @@ export const _testOnly = {
     wrapThrownErrorForSentry,
 };
 //# sourceMappingURL=main.js.map
-//# debugId=aefde24d-ee93-53ac-9163-86c867d1eb78
+//# debugId=2b73baa7-f63e-5a3b-a8cb-659ac26d7c67

package/dist/cli/register-operations.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4528cd9c-39e7-5d88-8e76-e7dec97c366a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="deed05b2-dba2-5022-804d-dccd2f7beb1b")}catch(e){}}();
 import { resolveRuntimeStatusRegistry, setActiveCommandResult, EXIT_CODE, PmCliError, createUnknownSubcommandError, resolveAuthor, resolvePmRoot, readSettings, } from "../sdk/runtime-primitives.js";
 import { resolveStartTaskInProgressStatus } from "../sdk/start-task-status.js";
 import { parseStatsAnalyticsJson } from "./stats-analytics-json.js";
@@ -286,12 +286,14 @@ async function runStatsAction(options, command) {
         printError(`profile:command=stats took_ms=${Date.now() - startedAt}`);
     }
 }
+/** Parse duplicate CLI controls and render the shared SDK analysis with optional timing. */
 async function runDuplicatesAction(options, command) {
     const globalOptions = getGlobalOptions(command);
     const startedAt = Date.now();
     const threshold = readOptionString(options, "threshold");
     const limit = readOptionString(options, "limit");
     const result = await runDuplicates(globalOptions, {
+        ...(options.exhaustive === true ? { exhaustive: true } : {}),
         status: Array.isArray(options.status) && options.status.length > 0
             ? options.status
             : undefined,
@@ -304,13 +306,15 @@ async function runDuplicatesAction(options, command) {
         printError(`profile:command=duplicates took_ms=${Date.now() - startedAt}`);
     }
 }
+/** Render the SDK health projection and mirror blocking strict verdicts in the CLI exit status. */
 async function runHealthAction(options, command) {
     const globalOptions = getGlobalOptions(command);
     const startedAt = Date.now();
     const strictExit = Boolean(options.strictExit) || Boolean(options.failOnWarn);
     const result = await runHealth(globalOptions, {
+        strictExit,
         strictDirectories: Boolean(options.strictDirectories),
-        requireMergeDrivers: Boolean(options.requireMergeDrivers) || strictExit,
+        requireMergeDrivers: Boolean(options.requireMergeDrivers),
         checkOnly: Boolean(options.checkOnly),
         checkTelemetry: Boolean(options.checkTelemetry),
         noRefresh: Boolean(options.noRefresh),
@@ -646,11 +650,12 @@ export function registerOperationCommands(program) {
         .action(runTelemetryAction);
     program
         .command("duplicates")
-        .description("Find existing duplicate clusters across all statuses without creating an item.")
-        .option("--status <value>", "Lifecycle status to include (repeatable or comma-separated)", collect, [])
-        .option("--since <value>", "Only inspect items created at or after this time")
-        .option("--threshold <value>", "Minimum similarity score from 0 through 1")
-        .option("--limit <n>", "Maximum duplicate clusters to return")
+        .description("Find duplicate clusters across all statuses.")
+        .option("--status <value>", "Statuses (repeatable or comma-separated)", collect, [])
+        .option("--since <value>", "Created at or after this time")
+        .option("--threshold <value>", "Minimum similarity (0-1)")
+        .option("--limit <n>", "Maximum clusters")
+        .option("--exhaustive", "Score all pairs within the safety bound")
         .action(runDuplicatesAction);
     program
         .command("stats")
@@ -913,4 +918,4 @@ function registerSchedulingShortcutCommands(program) {
     });
 }
 //# sourceMappingURL=register-operations.js.map
-//# debugId=4528cd9c-39e7-5d88-8e76-e7dec97c366a
+//# debugId=deed05b2-dba2-5022-804d-dccd2f7beb1b