chore(deps-dev): bump @unbrained/pm-cli from 2026.8.17 to 2026.8.18

[dependabot]

Bumps @unbrained/pm-cli from 2026.8.17 to 2026.8.18.

Release notes

Sourced from @​unbrained/pm-cli's releases.

v2026.8.18

@​unbrained/pm-cli 2026.8.18

Source range: v2026.8.17...v2026.8.18

Changelog

Added

• Alias shim layer: config-aware hidden aliases with one-line migration hints (foundation for all consolidations) (pm-0z7n)

Fixed

• A commit pushed directly to the default branch can never be released: both analyzer-evidence fallbacks presuppose a pull request, and nothing declares that precondition (pm-u1baah)
• GH-1052: typed fail-closed whole-list SDK primitive (pm-y4aaol)
• Packed Bun SDK import fails on node:module stripTypeScriptTypes (pm-ikj8ve)
• GH-1051: package catalog rejects universal output-budget controls (pm-2firut)
• Bun event streaming falls back to authoritative history without node:sqlite (pm-b8hwfr)
• Surface replication gate scopes trigger activation to relevant diff content (pm-mrhwow)
• CodeQL: remove generated-code artifact path interpolation from exporter integration harness (pm-ozxkm2)
• Exporter artifact-channel contract: clean stdout, bounded receipts, and binary-safe streaming (pm-dilou2)
• GH-1048: Windows Node 24 numeric EDQUOT fixtures construct NaN on platforms that do not declare that errno (pm-y4kovm)
• Queued daily releases recognize an already-published same-day release before analyzer provenance (pm-dm2vfz)

Security

• Adopt Dependabot PR #1046 pinned CodeQL 4.37.7 and TruffleHog 3.97.0 refresh (pm-pp6al9)

Deprecated

• ADR: noun-verb CLI grammar — accepted consolidation principles and alias-preserving deprecation policy (pm-pbyu)

Other

• Command-grammar conformance gate: the noun-verb table and shared verb vocabulary become machine-checked contracts a non-conforming command cannot pass (pm-wt43zj)
• Consolidate the 8 list-* status variants into pm list --status (list-all/open/draft/in-progress/blocked/closed/canceled become hidden aliases) (pm-pfqi)
• Command-destination census: 14 of 76 canonical commands have no declared home in the target grammar, so the surface can be frozen with its shape still undecided (pm-yy8rmx)
• Half of the pm events payload is per-row resume cursors an agent never reads: 48 percent of stream bytes buy a capability consumed once per batch (pm-ez1dfg)

PM Tracker Evidence

No closed pm tracker items were updated in the selected release window.

Changelog

Sourced from @​unbrained/pm-cli's changelog.

2026.8.18 - 2026-08-18

Added

• Alias shim layer: config-aware hidden aliases with one-line migration hints (foundation for all consolidations) (pm-0z7n)

Fixed

• A commit pushed directly to the default branch can never be released: both analyzer-evidence fallbacks presuppose a pull request, and nothing declares that precondition (pm-u1baah)
• GH-1052: typed fail-closed whole-list SDK primitive (pm-y4aaol)
• Packed Bun SDK import fails on node:module stripTypeScriptTypes (pm-ikj8ve)
• GH-1051: package catalog rejects universal output-budget controls (pm-2firut)
• Bun event streaming falls back to authoritative history without node:sqlite (pm-b8hwfr)
• Surface replication gate scopes trigger activation to relevant diff content (pm-mrhwow)
• CodeQL: remove generated-code artifact path interpolation from exporter integration harness (pm-ozxkm2)
• Exporter artifact-channel contract: clean stdout, bounded receipts, and binary-safe streaming (pm-dilou2)
• GH-1048: Windows Node 24 numeric EDQUOT fixtures construct NaN on platforms that do not declare that errno (pm-y4kovm)
• Queued daily releases recognize an already-published same-day release before analyzer provenance (pm-dm2vfz)

Security

• Adopt Dependabot PR #1046 pinned CodeQL 4.37.7 and TruffleHog 3.97.0 refresh (pm-pp6al9)

Deprecated

• ADR: noun-verb CLI grammar — accepted consolidation principles and alias-preserving deprecation policy (pm-pbyu)

Other

• Command-grammar conformance gate: the noun-verb table and shared verb vocabulary become machine-checked contracts a non-conforming command cannot pass (pm-wt43zj)
• Consolidate the 8 list-* status variants into pm list --status (list-all/open/draft/in-progress/blocked/closed/canceled become hidden aliases) (pm-pfqi)
• Command-destination census: 14 of 76 canonical commands have no declared home in the target grammar, so the surface can be frozen with its shape still undecided (pm-yy8rmx)
• Half of the pm events payload is per-row resume cursors an agent never reads: 48 percent of stream bytes buy a capability consumed once per batch (pm-ez1dfg)

Commits

• dd578f4 chore(release): cut 2026.8.18
• aedbba6 Publish canonical CLI grammar and typed alias contracts (#1058)
• 84d742c Resolve squash provenance and terminal cancellation telemetry (#1057)
• 41af793 Preserve reviewed provenance through PM delivery closeout (#1056)
• 2e5adcd chore(pm): record merged SDK delivery
• 52d2e95 Certify complete project reads across SDK, CLI, and package runtimes (#1054)
• 4c71075 Merge pull request #1053 from unbraind/codex/artifact-and-resumable-stream-co...
• a1e0d64 Record artifact stream review closeout
• 9cc7dfe fix: harden resumable stream review contracts
• 7f94e00 fix(tests): remove generated artifact path interpolation
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Update @unbrained/pm-cli dev dependency from 2026.8.17 to 2026.8.18 to pick up the alias shim layer and patch fixes. Old list-* subcommands were primary; now pm list --status is canonical, with hidden aliases that emit one-line migration hints.

• Review and rollout
  • Verify local/CI scripts that call pm still pass; expect deprecation hints in logs.
  • Migrate list-* calls to pm list --status=<status> (replace list-all/open/draft/in-progress/blocked/closed/canceled).
  • No app code changes; only package.json and lockfile updated.

^{Written for commit f17cb2d. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[dependabot]

Looks like @unbrained/pm-cli is up-to-date now, so this is no longer needed.