Adopt pm-cli 2026.7.29

[unbraind]

Summary

Bumps the pm-cli dependency to 2026.7.29 and audits for breaking changes and fixed upstream workarounds.

Changes

• Dependency bump: @unbrained/pm-cli devDependency → 2026.7.29, peerDependency → >=2026.7.29
• --all flag audit: No hits found. The removed pm list --all flag is not referenced anywhere in source, docs, or CI.
• Upstream workaround audit: None applicable.
  • GH-651 (signed activity window): no hits
  • GH-672 (context low_level blocked state): no hits
  • GH-676 (list --tag CSV): two hits in index.ts comment and README.md showing pm list --tag with a single tag value (not CSV), just documentation of the cycle tag feature — no workaround
  • GH-785/792 (pm health runtime dirs): no hits
  • GH-794 (output_format override): no hits

Quality gates

• npm run check (typecheck): ✅ pass
• npm run coverage: ✅ 63 tests pass, thresholds met (lines 70.53% / threshold 70, branches 80.42% / threshold 80, functions 80.43% / threshold 80)
• npm run changelog:check: ✅ up to date
• npm run audit:prod: ✅ 0 vulnerabilities

pm tracking item

• pm-linear-vp1l.toon

Summary by Sourcery

Adopt the latest pm-cli release and document the associated change in the changelog.

New Features:

• Introduce a real coverage gate by running tests against TypeScript source files.

Enhancements:

• Update pm-cli peer and dev dependency versions to 2026.7.29.

Documentation:

• Record the coverage gate addition and pm-cli adoption in the Unreleased changelog section.

Chores:

• Add pm tracking artifacts for the pm-cli adoption chore.

---

Summary by cubic

Upgrade @unbrained/pm-cli to 2026.7.29, align the peer range, and update the README requirement to match; no functional changes. Audited the removed pm list --all flag and upstream workarounds (GH-651/672/676/785/792/794) with no hits; all tests and coverage gates pass.

• Dependencies

  • @unbrained/pm-cli devDependency → ^2026.7.29
  • peerDependency → >=2026.7.29

• Documentation

  • README Requirements: pm-cli >=2026.7.29 to match peer range

^{Written for commit cc19488. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[sourcery-ai]

Sorry @unbraind, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR upgrades the @unbrained/pm-cli dependency to 2026.7.29, updates metadata and tracking files to record the adoption, and regenerates the lockfile accordingly, with no code-level references to removed flags or upstream workarounds found.

File-Level Changes

Change	Details	Files
Upgrade pm-cli dependency to version 2026.7.29 and align peer/dev requirements.	Update peerDependency range for @unbrained/pm-cli to >=2026.7.29. Update devDependency version of @unbrained/pm-cli to ^2026.7.29. Regenerate package-lock.json to reflect the new pm-cli version and dependency graph.	package.json package-lock.json
Document the pm-cli adoption and new coverage gate in the changelog.	Add an Unreleased section at the top of the changelog. Document enforcing a real coverage gate by running tests against TypeScript sources, linked to pm-linear-v618. Document adoption of pm-cli 2026.7.29, linked to pm-linear-vp1l.	CHANGELOG.md
Add pm tracking artifacts for the pm-cli adoption chore.	Add a .toon chore definition file tracking pm-linear-vp1l. Add a corresponding history JSONL entry for pm-linear-vp1l.	.agents/pm/chores/pm-linear-vp1l.toon .agents/pm/history/pm-linear-vp1l.jsonl

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Review limit reached

@unbraind, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 40 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 61489c02-9fcb-4f1e-8f7a-cbb405df3128

📥 Commits

Reviewing files that changed from the base of the PR and between 24fb162 and cc19488.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .agents/pm/chores/pm-linear-vp1l.toon
• .agents/pm/history/pm-linear-vp1l.jsonl
• CHANGELOG.md
• README.md
• package.json

Walkthrough

The project updates @unbrained/pm-cli requirements to version 2026.7.29, adds Unreleased changelog entries, and records the completed dependency audit and quality-gate results in PM chore files.

Changes

pm-cli adoption

Layer / File(s)	Summary
Dependency and release metadata package.json, CHANGELOG.md	The peer and development dependency requirements move to 2026.7.29, while the Unreleased changelog records the adoption and TypeScript coverage gate.
PM chore lifecycle .agents/pm/chores/*, .agents/pm/history/*	The chore and JSONL history record creation, progress, audit comments, closure, timestamps, and quality-gate results.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• unbraind/pm-linear#36: Both update @unbrained/pm-cli dependency declarations in package.json.
• unbraind/pm-linear#49: Both belong to the pm-cli dependency versioning update thread.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: adopting pm-cli 2026.7.29.
Description check	✅ Passed	The description is directly related to the dependency bump and audit work in the changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch adopt-pm-cli-2026-7-29

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Bumps @unbrained/pm-cli to 2026.7.29 and aligns docs with the peer floor.

• Raises devDependency to ^2026.7.29 and peerDependency to >=2026.7.29 (lockfile updated).
• Sets README Requirements pm-cli floor to >=2026.7.29 to match peers.
• Adds chore tracking artifacts and an Unreleased changelog entry for the adoption.

Confidence Score: 5/5

This PR appears safe to merge; the documented pm-cli floor now matches the peer requirement and no remaining blocking failure is evident.

The README Requirements line and package peer/dev dependency ranges both require pm-cli >=2026.7.29, so the earlier install-doc mismatch is resolved; the rest of the change is a routine dependency bump with tracking and changelog updates.

Important Files Changed

Filename	Overview
package.json	Peer and devDependency floors for @unbrained/pm-cli moved to 2026.7.29 with matching lockfile resolution.
README.md	Requirements pm-cli floor updated to >=2026.7.29, matching peerDependencies after the prior doc mismatch fix.
CHANGELOG.md	Unreleased notes cover the pm-cli adoption and the earlier coverage-gate work.

_{Reviews (3): Last reviewed commit: "Raise the documented pm-cli floor to the..." | Re-trigger Greptile}

[unbraind]

Pushed a documentation-floor fix in response to Greptile's finding on pm-jira#48, applied fleet-wide after checking all 18 READMEs.

The Requirements section advertised pm-cli >=2026.7.5 while peerDependencies now demands >=2026.7.29, so a strict-peer install would fail on versions the docs presented as supported. Floor raised to >=2026.7.29.

Deliberately unchanged: feature-availability notes (atomic import needs >=2026.7.19, pm merge reconcile needs >=2026.7.22) remain historically accurate — they state when a capability landed, which does not move when the floor rises.

@greptileai review
@coderabbitai full review

[coderabbitai]

@unbraind Thanks for the clarification. I’ll re-review the full PR, including consistency between the peer-dependency floor and all README Requirements sections, while treating the capability-introduction versions as intentional historical notes.

---

✏️ Learnings added

Learnt from: unbraind
URL: https://github.com/unbraind/pm-linear/pull/53

Timestamp: 2026-07-29T05:04:44.512Z
Learning: In the pm-linear repository documentation, README Requirements sections must advertise an `unbrained/pm-cli` minimum compatible with the `package.json` peer dependency floor. Feature-availability notes (for example, the version that introduced atomic import or `pm merge reconcile`) intentionally record when capabilities were introduced and must remain at their historical introduction versions rather than being raised with the general dependency floor.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

✅ Action performed

Full review finished.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 40 minutes.

[unbraind]

Review feedback acknowledged and every bot comment on this PR has been voted. Adding cross-PR context the reviewers here cannot see, since it changes what is and is not worth flagging on a change of this shape.

This is 1 of 18 identical adoptions. pm-cli 2026.7.29 published today and closes nine issues this fleet filed upstream (GH-784, GH-785, GH-787, GH-792, GH-793, GH-794, GH-799, plus the root causes behind GH-651/672/675/676). Every public package in the fleet got the same treatment on a branch named adopt-pm-cli-2026-7-29, so a finding that applies here almost certainly applies to the other 17 — please say so explicitly when you spot one, as that is how the fleet-wide fixes in this wave were found.

What the audit actually covered, and why no source changed here. 2026.7.29 has exactly one breaking change: pm list --all was removed (GH-793) in favour of explicit pm list-all / list-open / list-in-progress / list-blocked / list-closed / list-canceled / list-draft subcommands, with pm list --status <s> retained. A fleet-wide grep found zero references in any source, doc, README or workflow. Six upstream fixes were also checked for now-obsolete local workarounds (pm activity bare relative windows, pm context blocked-state rows, pm list --tag CSV shape, fresh-clone pm health semantics, and the destructive identity output_format override) — none of this package's code existed to work around them, so nothing was removed.

Two things NOT to flag here. A service override that returns the same ctx.payload reference to decline is the correct contract and must stay — GH-794 made a copied identity override inert, it did not make declining unnecessary. And --all-release-tags (pm-changelog) and --atomic (pm-csv/pm-jira) are our own packages' flags, unrelated to the removed host flag; a bare flag name is genuinely ambiguous in this ecosystem, so the command-qualified form is what any audit record should use.

Defects this wave's reviews caught, for calibration: an unbounded >= range written into runtime dependencies (correct only for peerDependencies), three READMEs advertising a pm-cli >=2026.7.5 floor that contradicted the new peer floor, two pm audit records describing a broader scope than was verified, and in pm-changelog a release-pinned provenance skew, a sample ordering that contradicted its own documented contract, a no-signal item mislabelled as a created_at fallback, and an unsound SDK cast that led to a genuine upstream type bug (pm-cli#808). Three upstream issues were filed from testing the new surfaces: #805, #806, #807.

Gates on this PR are green on Node 22 and 26, the coverage ratchet holds, audit:prod is clean, and changelog:check reports up to date.