v2026.8.4

@unbrained/pm-cli 2026.8.4

Source range: v2026.8.3...v2026.8.4

Changelog

Added

• GH-471: pm context includes an installed package/extension health summary (pm-h85e)
• Static contribution manifest: persist the install-time contribution inventory so the command registry is built from data and extension modules import only when a contribution is actually invoked (pm-021kdp)

Fixed

• Uniform multi-value filter-value grammar: --status accepts CSV but --type/--priority fail fast and --tag silently matches the literal CSV string (pm-gknu)
• list applies an undisclosed default lifecycle scope and reports the scoped count as the corpus total with has_more false, while search applies no such scope, so the two discovery surfaces disagree about what exists (pm-999jh7)
• GH-882: unresolved extension commands must lead with the activation failure and actionable recovery (pm-4uplae)
• Extension-mode is folded into the metadata-cache identity, so alternating --no-extensions with a normal invocation evicts a 4.5 MB cache and every command costs 5 seconds instead of 0.4 (pm-77okxr)
• Declared activation.commands is silently overridden by the renderers/hooks/parser/preflight capability tier, so any extension beyond plain commands is eagerly imported on every invocation (pm-j0w7j9)
• GH-832: package command namespace ownership and collision diagnostics are not discoverable (pm-6z0wzf)
• GH-681: latest calendar ordinal must satisfy stable package peer ranges (pm-csuce0)
• The model provenance resolver derives the harness session-file path with an incomplete slug encoding, so it silently resolves nothing in any workspace whose path contains an underscore - including this repository (pm-9gvazz)
• GH-878: nested workspace snapshot and help paths are enumerated but not resolvable by structured help (pm-7wx1f9)
• Warn when custom schema fields collide with MCP transport or tool-specific inputs (pm-yfdav2)
• GH-844: local npm package archives are rejected as install sources (pm-lw6acw)
• The one-release-per-day guard compares a prefix glob against unpadded date keys, so it is correct only by accident of tag creation order and silently skips a real release for any out-of-order tag (pm-ki67py)

Security

• Refresh transitive brace-expansion and PostCSS patches for 2026-08-03 audit advisories (pm-2cv2o1)

Other

• Scripting contract: documented and test-gated guarantees for exit codes, stdout/stderr stream discipline, and stable machine-readable field names (pm-psy1)
• Published artifact weight: the npm tarball ships 20MB of inline-source sourcemaps plus duplicate tsc and bundle outputs (pm-998juj)

PM Tracker Evidence

Closed pm items in release window: 18
By type: Issue=13, Feature=2, Task=3
By status: closed=18

Selected release-related tracker items:

• pm-csuce0 [Issue/closed] GH-681: latest calendar ordinal must satisfy stable package peer ranges
• pm-ki67py [Issue/closed] The one-release-per-day guard compares a prefix glob against unpadded date keys, so it is correct only by accident of tag creation order and silently skips a real release for any out-of-order tag