[dependabot]

Bumps the pm-toolchain group with 1 update in the / directory: @unbrained/pm-cli.

Updates @unbrained/pm-cli from 2026.11.7 to 2026.11.9

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.11.9

@​unbrained/pm-cli 2026.11.9

Source range: v2026.11.8...v2026.11.9

Changelog

Fixed

• MCP pm_comments lists only the newest 20 comments by default: the backward output cursor stops at that producer page and the last page reports has_more without a continuation (pm-sbqn4h)
• Combining an annotation or linked-artifact mutation with a universal output control is refused untyped: code command_failed and pm --help examples instead of a stable code and a retry without the control (pm-rrwh2o)
• TOON get --fields drops an empty child collection nested inside a selected object field, while JSON keeps it (pm-fkhdy8)
• TOON annotation listings drop null rows while count reports them, so a malformed collection renders fewer rows than its count (pm-e3hfv8)
• Release verification shares the build job's timeout and waits fifteen minutes while npm's publish-time scan can hold a version longer: 2026.11.8 was published but the job was cancelled before acceptance (pm-0jzl5t)
• A malformed comments, notes or learnings entry in an item document crashes annotation reads with unknown_error (sortLogValues calls localeCompare on a missing text) (pm-30tjoh)

Other

• Exclude the dated ecosystem planning review from the npm tarball to restore publication headroom (pm-1ke3mz)

PM Tracker Evidence

Closed pm items in release window: 6 By type: Issue=5, Task=1 By status: closed=6

Selected release-related tracker items:

• pm-0jzl5t [Issue/closed] Release verification shares the build job's timeout and waits fifteen minutes while npm's publish-time scan can hold a version longer: 2026.11.8 was published but the job was cancelled before acceptance
• pm-1ke3mz [Task/closed] Exclude the dated ecosystem planning review from the npm tarball to restore publication headroom

v2026.11.8

@​unbrained/pm-cli 2026.11.8

Source range: v2026.11.7...v2026.11.8

Changelog

Fixed

• MCP annotation and linked-artifact tools silently read when add is passed at the top level: the strict schema declares add/text but dispatch only hoists ifAbsent (pm-wsqxwb)
• pm comments --edit/--delete take an absolute index while a budget-truncated listing reports count as the page size and shows no row index, so 'edit the last comment' by count rewrites an older comment (pm-hka7ep)
• Bare pm comments / pm notes reads keep the oldest page when output must be bounded, withholding the newest entries (GH-1605 fixed this for history only) (pm-8s53lj)
• CLI argv keeps one value silently when two spellings of one extension flag differ (--status-filter a -s b), while direct callers are refused with extension_option_spelling_conflict (pm-wlxf8f)
• pm comments/notes <id> --add --file <path> is refused as positional-and---add conflict instead of naming the swallowed --file flag, so the annotation flag-like check from pm-vcu7 loses precedence (pm-y26mvc)
• GH-1667: sdk/graph does not export ProjectedGraphResult, the public return type of runGraph, and the merge conflict_resolution union has no public name, so extensions derive both (pm-gh1667)
• GH-1666: per-command help and contracts for extension commands omit the inherited host flags (--json, --author, --pm-path) the command accepts and mark no flag as host- or extension-owned (pm-gh1666)
• GH-1665: extension flag contracts omit the SDK option key, so PmClient.run and the extension test harness silently ignore a CLI-spelled option such as status-filter and fall back to the default (pm-gh1665)
• TOON get --fields spends four lines on a complete omission receipt and drops requested empty collections, so a narrow read is two-thirds receipt and absent-vs-empty depends on that receipt (pm-sj66lm)
• GH-1662: an infeasible --token-budget on context --for orient exits 0 with no context and contradictory receipts, its restore_with retry fails, and get/list intent receipts undercount the emitted envelope (pm-gh1662)
• GH-1678: a scoped registerRenderer replacement bypasses --output-budget and its read_output receipt reports within_budget for the native payload, not the delivered bytes (pm-gh1678)

... (truncated)

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.11.9 - 2026-11-09

Fixed

• MCP pm_comments lists only the newest 20 comments by default: the backward output cursor stops at that producer page and the last page reports has_more without a continuation (pm-sbqn4h)
• Combining an annotation or linked-artifact mutation with a universal output control is refused untyped: code command_failed and pm --help examples instead of a stable code and a retry without the control (pm-rrwh2o)
• TOON get --fields drops an empty child collection nested inside a selected object field, while JSON keeps it (pm-fkhdy8)
• TOON annotation listings drop null rows while count reports them, so a malformed collection renders fewer rows than its count (pm-e3hfv8)
• Release verification shares the build job's timeout and waits fifteen minutes while npm's publish-time scan can hold a version longer: 2026.11.8 was published but the job was cancelled before acceptance (pm-0jzl5t)
• A malformed comments, notes or learnings entry in an item document crashes annotation reads with unknown_error (sortLogValues calls localeCompare on a missing text) (pm-30tjoh)

Other

• Exclude the dated ecosystem planning review from the npm tarball to restore publication headroom (pm-1ke3mz)

2026.11.8 - 2026-11-08

Fixed

• MCP annotation and linked-artifact tools silently read when add is passed at the top level: the strict schema declares add/text but dispatch only hoists ifAbsent (pm-wsqxwb)
• pm comments --edit/--delete take an absolute index while a budget-truncated listing reports count as the page size and shows no row index, so 'edit the last comment' by count rewrites an older comment (pm-hka7ep)
• Bare pm comments / pm notes reads keep the oldest page when output must be bounded, withholding the newest entries (GH-1605 fixed this for history only) (pm-8s53lj)
• CLI argv keeps one value silently when two spellings of one extension flag differ (--status-filter a -s b), while direct callers are refused with extension_option_spelling_conflict (pm-wlxf8f)
• pm comments/notes <id> --add --file <path> is refused as positional-and---add conflict instead of naming the swallowed --file flag, so the annotation flag-like check from pm-vcu7 loses precedence (pm-y26mvc)
• GH-1667: sdk/graph does not export ProjectedGraphResult, the public return type of runGraph, and the merge conflict_resolution union has no public name, so extensions derive both (pm-gh1667)
• GH-1666: per-command help and contracts for extension commands omit the inherited host flags (--json, --author, --pm-path) the command accepts and mark no flag as host- or extension-owned (pm-gh1666)
• GH-1665: extension flag contracts omit the SDK option key, so PmClient.run and the extension test harness silently ignore a CLI-spelled option such as status-filter and fall back to the default (pm-gh1665)
• TOON get --fields spends four lines on a complete omission receipt and drops requested empty collections, so a narrow read is two-thirds receipt and absent-vs-empty depends on that receipt (pm-sj66lm)
• GH-1662: an infeasible --token-budget on context --for orient exits 0 with no context and contradictory receipts, its restore_with retry fails, and get/list intent receipts undercount the emitted envelope (pm-gh1662)
• GH-1678: a scoped registerRenderer replacement bypasses --output-budget and its read_output receipt reports within_budget for the native payload, not the delivered bytes (pm-gh1678)

Other

• Restore package headroom by excluding the generated refusal-closure census from the npm tarball (pm-dwy8kb)
• Unknown-option refusals on extension commands with declared flags carry code unknown_option and list only the flags the command accepts (pm-1du7s3)

Commits

• 620fbd2 chore(release): cut 2026.11.9
• f2ea007 Merge pull request #1688 from unbraind/fix/annotation-read-fidelity
• c47c086 docs(read-output): qualify pm_comments windows and budgets; tighten review specs
• c5e2198 fix(read-output): withhold mutation retries for any token that may carry URL ...
• c7e12d2 fix(read-output): enumerate URL scheme starts linearly; never leave a control...
• 6daccc0 fix(read-output): scan credential candidates in linear time, through git+ wra...
• 90df1f3 fix(read-output): detect URL credentials in every parser-normalized spelling
• 1d03a41 fix(read-output): address CodeRabbit round 4 of PR #1688
• 81c9750 fix(read-output): address CodeRabbit re-review of PR #1688
• 4191d30 chore(pm): give pm-9ke7h9 its expected and actual results
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6d8ea681-e79b-4d61-ba22-9f8b48d83d79

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn