@unbrained/pm-web 2026.7.26 → 2026.7.28

package/dist/routes/pm.js

@@ -1,6 +1,11 @@
 import { Router } from "express";
 import { requireAuth } from "../middleware/auth.js";
-import { ensureGraphExtension, runPm, runGetItemAt, PmCliError, EXIT_CODE } from "../services/pm-runner.js";
+import { ensureGraphExtension, runPm, runGetItemAt, readPmSettings, PmCliError, EXIT_CODE } from "../services/pm-runner.js";
+// The search-tuning resolvers live only on the narrow sdk/query entrypoint — the
+// aggregate sdk barrel documents itself as re-exporting every supported export but
+// omits 45 of them, these three included (upstream: unbraind/pm-cli#740).
+import { resolveSearchMaxResults, resolveSearchScoreThreshold, resolveHybridSemanticWeight, } from "@unbrained/pm-cli/sdk/query";
+import { QUERY_CURSOR_CONTRACT } from "@unbrained/pm-cli/sdk";
 import { boardColumns, filterItemsByQuery } from "../board.js";
 import { buildIcsCalendar } from "../ical.js";
 import { verifyProjectAccess } from "./projects.js";
@@ -28,6 +33,53 @@ function getNeo4jDriver() {
 }
 const router = Router({ mergeParams: true });
 router.use(requireAuth);
+const BASE64URL_CURSOR_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+ * Validate an incoming opaque pagination cursor. Returns the original cursor or
+ * `undefined` when none was supplied. Rejects cursors that exceed the SDK
+ * cursor contract's maximum length with a 400 so callers can map the failure
+ * to a proper client error instead of forwarding an oversized token to the SDK.
+ */
+function validateCursor(raw) {
+    if (raw === undefined || raw === null || raw === "")
+        return {};
+    const cursor = String(raw);
+    if (cursor.length > QUERY_CURSOR_CONTRACT.max_length) {
+        return {
+            error: `Pagination cursor exceeds the maximum length of ${QUERY_CURSOR_CONTRACT.max_length} characters.`,
+        };
+    }
+    if (!BASE64URL_CURSOR_PATTERN.test(cursor)) {
+        return { error: "Pagination cursor must be a valid base64url token." };
+    }
+    return { cursor };
+}
+/** Coerce an optional request number into a finite, bounded value. */
+function boundedNumber(raw, fallback, minimum, maximum, integer = false) {
+    const parsed = typeof raw === "number" ? raw : Number(raw);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    const bounded = Math.min(maximum, Math.max(minimum, parsed));
+    return integer ? Math.trunc(bounded) : bounded;
+}
+/**
+ * Map a {@link PmRunResult} failure to the correct HTTP status using the pm CLI
+ * exit code surfaced by the in-process dispatcher. Expected validation failures
+ * (USAGE) and not-found (NOT_FOUND) become 4xx; anything without a recognised
+ * exit code is an unexpected runtime error and becomes 500 so it is not
+ * silently swallowed as a client error.
+ */
+function pmErrorStatus(result) {
+    if (result.exitCode === EXIT_CODE.NOT_FOUND)
+        return 404;
+    if (result.exitCode === EXIT_CODE.USAGE)
+        return 400;
+    if (result.exitCode === EXIT_CODE.CONFLICT)
+        return 409;
+    if (result.exitCode === EXIT_CODE.DEPENDENCY_FAILED)
+        return 424;
+    return 500;
+}
 const pendingGraphSyncs = new Map();
 router.use(async (req, res, next) => {
     if (["GET", "HEAD", "OPTIONS"].includes(req.method) || (req.method === "PATCH" && req.path.startsWith("/presence/"))) {
@@ -360,7 +412,7 @@ router.get("/list", async (req, res) => {
         res.status(404).json({ error: "Project not found" });
         return;
     }
-    const { status, type, limit, priority, sprint, release, assignee } = req.query;
+    const { status, type, limit, priority, sprint, release, assignee, after } = req.query;
     const args = ["list"];
     if (status)
         args.push("--status", status);
@@ -376,7 +428,18 @@ router.get("/list", async (req, res) => {
         args.push("--release", release);
     if (assignee)
         args.push("--assignee", assignee);
+    const cursorResult = validateCursor(after);
+    if (cursorResult.error) {
+        res.status(400).json({ error: cursorResult.error, items: [] });
+        return;
+    }
+    if (cursorResult.cursor)
+        args.push("--after", cursorResult.cursor);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
+    if (!result.ok && result.exitCode === EXIT_CODE.USAGE) {
+        res.status(400).json({ error: result.stderr, items: [] });
+        return;
+    }
     res.json(result.ok ? (result.parsed || {}) : { error: result.stderr, items: [] });
 });
 // GET /api/projects/:projectId/pm/list-all
@@ -386,13 +449,24 @@ router.get("/list-all", async (req, res) => {
         res.status(404).json({ error: "Project not found" });
         return;
     }
-    const { type, limit } = req.query;
+    const { type, limit, after } = req.query;
     const args = ["list-all"];
     if (type)
         args.push("--type", type);
     if (limit)
         args.push("--limit", limit);
+    const cursorResult = validateCursor(after);
+    if (cursorResult.error) {
+        res.status(400).json({ error: cursorResult.error, items: [] });
+        return;
+    }
+    if (cursorResult.cursor)
+        args.push("--after", cursorResult.cursor);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
+    if (!result.ok && result.exitCode === EXIT_CODE.USAGE) {
+        res.status(400).json({ error: result.stderr, items: [] });
+        return;
+    }
     res.json(result.ok ? (result.parsed || {}) : { error: result.stderr, items: [] });
 });
 // GET /api/projects/:projectId/pm/board
@@ -511,7 +585,7 @@ router.post("/create", async (req, res) => {
         args.push("--definition-of-ready", definitionOfReady);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to create item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to create item" });
         return;
     }
     // Broadcast SSE create event
@@ -628,7 +702,7 @@ router.patch("/update/:itemId", async (req, res) => {
         args.push("--type", body.type);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to update item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to update item" });
         return;
     }
     // Broadcast SSE update event
@@ -658,7 +732,7 @@ router.post("/close/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to close item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to close item" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -681,7 +755,7 @@ router.delete("/delete/:itemId", async (req, res) => {
         slug: project.slug,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to delete item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to delete item" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -710,7 +784,7 @@ router.post("/comments/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add comment" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add comment" });
         return;
     }
     res.status(201).json(result.parsed || { ok: true });
@@ -764,7 +838,7 @@ router.post("/notes/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add note" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add note" });
         return;
     }
     res.status(201).json(result.parsed || { ok: true });
@@ -838,21 +912,41 @@ router.post("/search", async (req, res) => {
         res.status(404).json({ error: "Project not found" });
         return;
     }
-    const { query, mode } = req.body;
+    const body = req.body;
+    const query = typeof body["query"] === "string" ? body["query"] : "";
+    const mode = typeof body["mode"] === "string" ? body["mode"] : "";
     if (!query?.trim()) {
         res.status(400).json({ error: "Search query is required" });
         return;
     }
     const validModes = ["keyword", "semantic", "hybrid"];
-    const safeMode = validModes.includes(mode || "") ? mode : "hybrid";
+    const safeMode = validModes.includes(mode) ? mode : "hybrid";
+    // Adopt the sdk/query search-tuning resolvers: read the workspace settings and
+    // resolve the bounded max-results, score threshold, and hybrid semantic weight
+    // from the same defaults the pm CLI applies. Explicit per-request overrides
+    // (limit / minScore / semanticWeight) win over the workspace defaults so the
+    // browser can still narrow a page.
+    const settings = readPmSettings(project.ownerUserId, project.slug);
+    const resolvedLimit = boundedNumber(body["limit"], resolveSearchMaxResults(settings), 1, 500, true);
+    const resolvedMinScore = boundedNumber(body["minScore"], resolveSearchScoreThreshold(settings), 0, 1_000_000);
+    const resolvedSemanticWeight = boundedNumber(body["semanticWeight"], resolveHybridSemanticWeight(settings), 0, 1);
+    const cursorResult = validateCursor(body["after"]);
+    if (cursorResult.error) {
+        res.status(400).json({ error: cursorResult.error, results: [] });
+        return;
+    }
+    const args = ["search", "--mode", safeMode, "--limit", String(resolvedLimit), "--min-score", String(resolvedMinScore), "--semantic-weight", String(resolvedSemanticWeight)];
+    if (cursorResult.cursor)
+        args.push("--after", cursorResult.cursor);
+    args.push("--", ...query.trim().split(/\s+/));
     const result = await runPm({
-        args: ["search", "--mode", safeMode, ...query.trim().split(/\s+/)],
+        args,
         userId: project.ownerUserId,
         slug: project.slug,
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({
+        res.status(pmErrorStatus(result)).json({
             error: result.stderr || "Search failed. Check that Ollama is reachable and the configured embedding model is available.",
             results: [],
         });
@@ -951,7 +1045,7 @@ router.post("/append/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to append" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to append" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "item-appended");
@@ -1007,7 +1101,7 @@ router.post("/deps/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add dependency" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add dependency" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "dependency-added");
@@ -1040,7 +1134,7 @@ router.delete("/deps/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to remove dependency" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to remove dependency" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "dependency-removed");
@@ -1072,7 +1166,7 @@ router.post("/rel", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to create relationship" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to create relationship" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "rel-created");
@@ -1105,7 +1199,7 @@ router.delete("/rel", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to remove relationship" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to remove relationship" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "rel-removed");
@@ -1229,7 +1323,7 @@ router.post("/graph/query", async (req, res) => {
         jsonOutput: false,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "pm-graph query failed — ensure Neo4j is configured and pm-graph extension is installed" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "pm-graph query failed — ensure Neo4j is configured and pm-graph extension is installed" });
         return;
     }
     try {
@@ -1274,7 +1368,7 @@ router.post("/learnings/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add learning" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add learning" });
         return;
     }
     res.status(201).json(result.parsed || { ok: true });
@@ -1293,7 +1387,7 @@ router.post("/claim/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to claim item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to claim item" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "item-claimed");
@@ -1313,7 +1407,7 @@ router.post("/release/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to release item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to release item" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "item-released");
@@ -1333,7 +1427,7 @@ router.post("/start-task/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to start task" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to start task" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "task-started");
@@ -1353,7 +1447,7 @@ router.post("/pause-task/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to pause task" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to pause task" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "task-paused");
@@ -1396,7 +1490,7 @@ router.post("/tests/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add test" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add test" });
         return;
     }
     res.status(201).json(result.parsed || { ok: true });
@@ -1450,7 +1544,7 @@ router.post("/restore/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to restore item" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to restore item" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "item-restored");
@@ -1475,7 +1569,7 @@ router.post("/close-task/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to close task" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to close task" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "task-closed");
@@ -1557,7 +1651,7 @@ router.post("/files/:itemId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to link file" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to link file" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "file-linked");
@@ -1825,7 +1919,7 @@ router.post("/update-many", async (req, res) => {
     }
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "update-many failed" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "update-many failed" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -1867,7 +1961,7 @@ router.post("/close-many", async (req, res) => {
     }
     const listResult = await runPm({ args: listArgs, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!listResult.ok) {
-        res.status(400).json({ error: listResult.stderr || "Failed to list items for close-many" });
+        res.status(pmErrorStatus(listResult)).json({ error: listResult.stderr || "Failed to list items for close-many" });
         return;
     }
     const parsed = listResult.parsed;
@@ -1954,7 +2048,7 @@ router.post("/docs/:itemId", async (req, res) => {
     }
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to update docs" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to update docs" });
         return;
     }
     scheduleGraphSync(routeParam(req, "projectId"), project, "docs-updated");
@@ -1977,7 +2071,7 @@ router.post("/test-all", async (req, res) => {
         args.push("--timeout", body.timeout);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "test-all failed" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "test-all failed" });
         return;
     }
     res.json(result.parsed || {});
@@ -2077,7 +2171,7 @@ function buildListShortcutRoute(pmCommand) {
             res.status(404).json({ error: "Project not found" });
             return;
         }
-        const { type, limit, offset, tag, priority, assignee, sprint, release } = req.query;
+        const { type, limit, offset, tag, priority, assignee, sprint, release, after } = req.query;
         const args = [pmCommand];
         if (type)
             args.push("--type", type);
@@ -2095,7 +2189,18 @@ function buildListShortcutRoute(pmCommand) {
             args.push("--sprint", sprint);
         if (release)
             args.push("--release", release);
+        const cursorResult = validateCursor(after);
+        if (cursorResult.error) {
+            res.status(400).json({ error: cursorResult.error, items: [] });
+            return;
+        }
+        if (cursorResult.cursor)
+            args.push("--after", cursorResult.cursor);
         const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
+        if (!result.ok && result.exitCode === EXIT_CODE.USAGE) {
+            res.status(400).json({ error: result.stderr, items: [] });
+            return;
+        }
         res.json(result.ok ? (result.parsed || {}) : { items: [] });
     };
 }
@@ -2133,7 +2238,7 @@ router.post("/plan", async (req, res) => {
         args.push("--body", body);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to create plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to create plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2176,7 +2281,7 @@ router.patch("/plan/:planId", async (req, res) => {
         args.push("--description", description);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to update plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to update plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2199,7 +2304,7 @@ router.delete("/plan/:planId", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to delete plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to delete plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2227,7 +2332,7 @@ router.post("/plan/:planId/steps", async (req, res) => {
         args.push("--depends-on", dependsOn);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to add step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to add step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2251,7 +2356,7 @@ router.patch("/plan/:planId/steps/:stepRef", async (req, res) => {
         args.push("--description", description);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to update step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to update step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2274,7 +2379,7 @@ router.post("/plan/:planId/steps/:stepRef/complete", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to complete step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to complete step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2302,7 +2407,7 @@ router.post("/plan/:planId/steps/:stepRef/block", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to block step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to block step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2325,7 +2430,7 @@ router.delete("/plan/:planId/steps/:stepRef", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to remove step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to remove step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2348,7 +2453,7 @@ router.post("/plan/:planId/approve", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to approve plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to approve plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2374,7 +2479,7 @@ router.post("/plan/:planId/materialize", async (req, res) => {
         args.push("--steps", steps);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to materialize plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to materialize plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2402,7 +2507,7 @@ router.post("/plan/:planId/steps/:stepRef/reorder", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to reorder step" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to reorder step" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2432,7 +2537,7 @@ router.post("/plan/:planId/link", async (req, res) => {
         args.push("--promote-to-item-dep");
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to link plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to link plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2458,7 +2563,7 @@ router.delete("/plan/:planId/link", async (req, res) => {
         args.push("--link-kind", linkKind);
     const result = await runPm({ args, userId: project.ownerUserId, slug: project.slug, jsonOutput: true });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Failed to unlink plan" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Failed to unlink plan" });
         return;
     }
     broadcastProjectEvent(routeParam(req, "projectId"), {
@@ -2499,7 +2604,7 @@ router.post("/upgrade", async (req, res) => {
         jsonOutput: true,
     });
     if (!result.ok) {
-        res.status(400).json({ error: result.stderr || "Upgrade failed" });
+        res.status(pmErrorStatus(result)).json({ error: result.stderr || "Upgrade failed" });
         return;
     }
     res.json(result.parsed || { ok: true });