@cleocode/adapters 2026.11.1-canary.5 → 2026.11.1-canary.7

package/dist/.source-stamp.json

@@ -1,4 +1,4 @@
 {
   "schema": 2,
-  "sourceHash": "79af05ee5a21e77aae05600f90b6bd976e7356305d9f6cd4de1f97cb630f7704"
+  "sourceHash": "7df29811fa914e44b232d26641d31b5da6924c476227aba4c2fe2f0d6ded3a68"
 }

package/dist/index.js

@@ -3067,12 +3067,6 @@ var init_operations_registry = __esm({
             required: false,
             description: "Include lifecycle stage history in the response"
           },
-          {
-            name: "ivtr-history",
-            type: "boolean",
-            required: false,
-            description: "Include IVTR phase chain history in the response"
-          },
           {
             name: "relations",
             type: "boolean",
@@ -3860,114 +3854,6 @@ var init_operations_registry = __esm({
           }
         ]
       },
-      // T811 — IVTR multi-agent enforcement
-      {
-        gateway: "query",
-        domain: "orchestrate",
-        operation: "ivtr.status",
-        description: "orchestrate.ivtr.status (query) \u2014 current IVTR phase + history",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "taskId parameter",
-            cli: { positional: true }
-          }
-        ]
-      },
-      {
-        gateway: "mutate",
-        domain: "orchestrate",
-        operation: "ivtr.start",
-        description: "orchestrate.ivtr.start (mutate) \u2014 begin Implement phase",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: true,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "taskId parameter",
-            cli: { positional: true }
-          }
-        ]
-      },
-      {
-        gateway: "mutate",
-        domain: "orchestrate",
-        operation: "ivtr.next",
-        description: "orchestrate.ivtr.next (mutate) \u2014 advance to next phase (requires prior evidence)",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: true,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "taskId parameter",
-            cli: { positional: true }
-          }
-        ]
-      },
-      {
-        gateway: "mutate",
-        domain: "orchestrate",
-        operation: "ivtr.release",
-        description: "orchestrate.ivtr.release (mutate) \u2014 final gate, requires I+V+T evidence",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: true,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "taskId parameter",
-            cli: { positional: true }
-          }
-        ]
-      },
-      {
-        gateway: "mutate",
-        domain: "orchestrate",
-        operation: "ivtr.loop-back",
-        description: "orchestrate.ivtr.loop-back (mutate) \u2014 rewind to phase on failure",
-        tier: 1,
-        idempotent: false,
-        sessionRequired: true,
-        requiredParams: ["taskId", "phase", "reason"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "taskId parameter",
-            cli: { positional: true }
-          },
-          {
-            name: "phase",
-            type: "string",
-            required: true,
-            description: "phase parameter"
-          },
-          {
-            name: "reason",
-            type: "string",
-            required: true,
-            description: "reason parameter"
-          }
-        ]
-      },
       {
         gateway: "query",
         domain: "orchestrate",
@@ -11405,7 +11291,20 @@ var init_operations_registry = __esm({
         idempotent: true,
         sessionRequired: false,
         requiredParams: [],
-        params: []
+        params: [
+          {
+            name: "limit",
+            type: "number",
+            required: false,
+            description: "At most this many docs per run, oldest first (T14329); default all. Run again to continue"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Report the plan counts and write nothing (T14331)"
+          }
+        ]
       },
       // ── docs.modernize (T14113 — Epic T14106) ─────────────────────────────────
       {
@@ -12094,99 +11993,10 @@ var init_operations_registry = __esm({
       // Release domain — T1726 SDK surface parity
       //
       // Release ops dispatched via ReleaseHandler (registered under 'release' in
-      // the DomainHandler map) were absent from OPERATIONS. Adding gate +
-      // ivtr-suggest (the two ops ReleaseHandler serves) plus the canonical
-      // 4-step pipeline ops (start, verify, publish, reconcile) introduced by
-      // T1597 / ADR-063 that route through the core release module directly.
+      // the DomainHandler map). The IVTR-only ops `release.gate` and
+      // `release.ivtr-suggest` were deleted in T14311 with the retired
+      // `ivtr_state` column.
       // ---------------------------------------------------------------------------
-      // release query: gate
-      {
-        gateway: "query",
-        domain: "release",
-        operation: "gate",
-        description: "release.gate (query) \u2014 check all IVTR loops in a release epic have reached the released phase before allowing release.ship (T820 RELEASE-03)",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: ["epicId"],
-        params: [
-          {
-            name: "epicId",
-            type: "string",
-            required: true,
-            description: "Epic ID whose child tasks should be inspected"
-          },
-          {
-            name: "force",
-            type: "boolean",
-            required: false,
-            description: "Bypass the IVTR gate \u2014 requires explicit owner confirmation"
-          }
-        ]
-      },
-      // release mutate: gate
-      {
-        gateway: "mutate",
-        domain: "release",
-        operation: "gate",
-        description: "release.gate (mutate) \u2014 same IVTR gate check as query.gate; safe in both gateways (no DB writes)",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: ["epicId"],
-        params: [
-          {
-            name: "epicId",
-            type: "string",
-            required: true,
-            description: "Epic ID whose child tasks should be inspected"
-          },
-          {
-            name: "force",
-            type: "boolean",
-            required: false,
-            description: "Bypass the IVTR gate \u2014 requires explicit owner confirmation"
-          }
-        ]
-      },
-      // release query: ivtr-suggest
-      {
-        gateway: "query",
-        domain: "release",
-        operation: "ivtr-suggest",
-        description: "release.ivtr-suggest (query) \u2014 check if all epic tasks are released and suggest cleo release ship (T820 RELEASE-07)",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "Task ID that just reached the released phase"
-          }
-        ]
-      },
-      // release mutate: ivtr-suggest
-      {
-        gateway: "mutate",
-        domain: "release",
-        operation: "ivtr-suggest",
-        description: "release.ivtr-suggest (mutate) \u2014 same auto-suggest as query.ivtr-suggest; safe in both gateways (no DB writes)",
-        tier: 1,
-        idempotent: true,
-        sessionRequired: false,
-        requiredParams: ["taskId"],
-        params: [
-          {
-            name: "taskId",
-            type: "string",
-            required: true,
-            description: "Task ID that just reached the released phase"
-          }
-        ]
-      },
       // release.start / release.verify / release.publish removed in T9540
       // (Phase 6 of T9499) — backing functions in
       // `packages/core/src/release/pipeline.ts` (the legacy 4-step pipeline)
@@ -12856,7 +12666,7 @@ var init_operations_registry = __esm({
         gateway: "query",
         domain: "worktree",
         operation: "list",
-        description: "worktree.list (query) \u2014 enumerate git worktrees with 5 status categories (active|stale|merged|orphan|locked). Reads tasks.db for owning-task status. 60s git timeout (T9546).",
+        description: "worktree.list (query) \u2014 enumerate git worktrees with 4 status categories (active|redundant|keep|unknown) from the disposal proof (T14274). Reads tasks.db for owning-task status. 60s git timeout (T9546).",
         tier: 1,
         idempotent: true,
         sessionRequired: false,
@@ -14273,9 +14083,11 @@ var init_enums = __esm({
 });
 
 // packages/contracts/src/exit-codes.ts
+var E_LEAD_TOOLS_UNSTRIPPED;
 var init_exit_codes = __esm({
   "packages/contracts/src/exit-codes.ts"() {
     "use strict";
+    E_LEAD_TOOLS_UNSTRIPPED = "E_LEAD_TOOLS_UNSTRIPPED";
   }
 });
 
@@ -15352,7 +15164,9 @@ var init_sync_write_invariants = __esm({
           "docs_attachments",
           ["lifecycle_status"],
           ["D04", "D05", "D31", "D32", "D39", "D50"],
-          "superseded is sticky; lifecycle transitions follow a matrix"
+          "superseded is sticky; lifecycle transitions follow a matrix",
+          // T14288: the doc's identity row mirrors the metadata under the same rule.
+          ["docs_attachments", "conduit_attachments"]
         )
       ),
       // T13354 (D11165) — CleoDocs re-keyed history family; the typed merge rules
@@ -15409,6 +15223,17 @@ var init_sync_write_invariants = __esm({
         sites: [],
         reason: "two devices adopting one legacy doc must mint one uid: the shell takes the legacy birth and sentinel facts, so (uid, birth_fp) converge and receive places the peer copy as a duplicate; a lost local write is refused loudly at the writer"
       },
+      // T13360 — the legacy docs import mints natural uids (the doc over its
+      // slug, the receipt over its slug), so a re-run or a second device's import
+      // is an ON CONFLICT no-op. Tagged at the accessors since T13360; registered
+      // by T14288, which touched the import.
+      {
+        id: "docs.docs-migration.idempotent-import",
+        class: "identity-layer",
+        tables: ["conduit_attachments", "conduit_doc_migration_ledger"],
+        sites: [],
+        reason: "the docs migration imports each legacy doc once: natural uids over the slug make a re-run a verified no-op, and receipts are never updated or deleted"
+      },
       // T14118 — a slug is an alias, not an identity: renaming one moves the
       // live slug on the registry row and the conduit identity row together and
       // records the old slug in the append-only alias table.
@@ -19376,6 +19201,7 @@ var init_src = __esm({
     init_nexus();
     init_nexus_scope_map();
     init_nexus_user_profile();
+    init_orchestrate();
     init_output_contracts_data();
     init_params();
     init_service();
@@ -19445,6 +19271,45 @@ var init_credentials2 = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/lead-tool-strip.ts
+function leadDeniedTools(context) {
+  const denied = context.leadDeniedTools;
+  return denied !== void 0 && denied.length > 0 ? denied : null;
+}
+function assertLeadToolsStrippable(providerId, support, context) {
+  const denied = leadDeniedTools(context);
+  if (denied !== null && support !== "enforced") {
+    throw new LeadToolsUnstrippedError(providerId, denied);
+  }
+}
+var LeadToolsUnstrippedError;
+var init_lead_tool_strip = __esm({
+  "packages/adapters/src/providers/shared/lead-tool-strip.ts"() {
+    "use strict";
+    init_src();
+    LeadToolsUnstrippedError = class extends Error {
+      /**
+       * @param providerId - Provider that refused the lead spawn.
+       * @param deniedTools - Tools the lead had to lose.
+       */
+      constructor(providerId, deniedTools) {
+        super(
+          `${E_LEAD_TOOLS_UNSTRIPPED}: provider '${providerId}' cannot strip the lead's denied tools [${deniedTools.join(", ")}]. Spawn the lead on a provider that enforces the strip (claude-code, claude-sdk) or turn off orchestrate.leadWorker.v1.`
+        );
+        this.providerId = providerId;
+        this.deniedTools = deniedTools;
+        this.name = "LeadToolsUnstrippedError";
+      }
+      providerId;
+      deniedTools;
+      /** Stable LAFS error code string for envelope emission. */
+      code = E_LEAD_TOOLS_UNSTRIPPED;
+      /** Numeric exit code aligned with {@link ExitCode.SPAWN_VALIDATION_FAILED} (63). */
+      exitCode = 63 /* SPAWN_VALIDATION_FAILED */;
+    };
+  }
+});
+
 // packages/adapters/src/providers/claude-sdk/session-store.ts
 var SessionStore;
 var init_session_store = __esm({
@@ -45295,10 +45160,17 @@ var init_spawn = __esm({
     "use strict";
     init_src();
     init_credentials2();
+    init_lead_tool_strip();
     init_session_store();
     init_tool_bridge();
     DEFAULT_MODEL = "claude-sonnet-4-5";
     ClaudeSDKSpawnProvider = class {
+      /**
+       * `generateText()` is called with no `tools`, so a spawned agent can call no
+       * tool at all; for a lead the denied tools are also dropped from the recorded
+       * allowlist (T14357).
+       */
+      leadToolStrip = "enforced";
       /** In-memory session registry. */
       sessions = new SessionStore();
       /**
@@ -45362,7 +45234,10 @@ var init_spawn = __esm({
           }
           const anthropicProvider = createAnthropic2({ apiKey });
           const toolAllowlist = context.options?.toolAllowlist;
-          const allowedTools = resolveTools(toolAllowlist);
+          const denied = leadDeniedTools(context);
+          const allowedTools = resolveTools(toolAllowlist).filter(
+            (tool2) => denied === null || !denied.includes(tool2)
+          );
           const modelId = context.options?.model ?? DEFAULT_MODEL;
           const result = await generateText({
             model: anthropicProvider(modelId),
@@ -47283,15 +47158,23 @@ var init_suite_reaper = __esm({
 // packages/adapters/src/providers/claude-code/spawn.ts
 import { spawn as nodeSpawn } from "node:child_process";
 import { findOnPath } from "@cleocode/paths";
+function buildClaudeArgs(context, promptFile) {
+  const denied = leadDeniedTools(context);
+  const permissionArgs = denied === null ? ["--dangerously-skip-permissions"] : ["--disallowedTools", denied.join(",")];
+  return ["--print", ...permissionArgs, "--output-format", "json", promptFile];
+}
 var ClaudeCodeSpawnProvider;
 var init_spawn2 = __esm({
   "packages/adapters/src/providers/claude-code/spawn.ts"() {
     "use strict";
     init_src();
     init_agent_spawn_wrapper();
+    init_lead_tool_strip();
     init_prompt_file();
     init_suite_reaper();
     ClaudeCodeSpawnProvider = class {
+      /** Lead spawns lose their denied tools through `--disallowedTools` (T14357). */
+      leadToolStrip = "enforced";
       /** Map of instance IDs to tracked process info. */
       processMap = /* @__PURE__ */ new Map();
       /**
@@ -47331,13 +47214,7 @@ var init_spawn2 = __esm({
           } catch {
           }
           tmpFile = await writeSpawnPromptFile("claude-spawn", enrichedPrompt);
-          const claudeArgs = [
-            "--print",
-            "--dangerously-skip-permissions",
-            "--output-format",
-            "json",
-            tmpFile
-          ];
+          const claudeArgs = buildClaudeArgs(context, tmpFile);
           const spawnBuild = buildAgentSpawnArgs("claude", claudeArgs, instanceId);
           const isSystemd = spawnBuild.ownership.mode === "systemd";
           const spawnOpts = {
@@ -48778,10 +48655,13 @@ var init_spawn3 = __esm({
   "packages/adapters/src/providers/opencode/spawn.ts"() {
     "use strict";
     init_cli_spawn();
+    init_lead_tool_strip();
     init_paths2();
     OPENCODE_SUBAGENT_NAME = "cleo-subagent";
     OPENCODE_FALLBACK_AGENT = "general";
     OpenCodeSpawnProvider = class {
+      /** Cannot remove tools from a spawned agent: a lead spawn is refused (T14357). */
+      leadToolStrip = "unsupported";
       /** Map of instance IDs to tracked process info. */
       processMap = /* @__PURE__ */ new Map();
       /**
@@ -48803,6 +48683,7 @@ var init_spawn3 = __esm({
        * @returns Spawn result with instance ID and status
        */
       async spawn(context) {
+        assertLeadToolsStrippable("opencode", this.leadToolStrip, context);
         const instanceId = `opencode-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
         const startTime = (/* @__PURE__ */ new Date()).toISOString();
         const workingDirectory = context.workingDirectory ?? process.cwd();
@@ -49319,8 +49200,11 @@ var init_spawn4 = __esm({
     "use strict";
     init_src();
     init_cli_spawn();
+    init_lead_tool_strip();
     init_prompt_file();
     PiSpawnProvider = class {
+      /** Cannot remove tools from a spawned agent: a lead spawn is refused (T14357). */
+      leadToolStrip = "unsupported";
       /** Map of instance IDs to tracked process info. */
       processMap = /* @__PURE__ */ new Map();
       /**
@@ -49344,6 +49228,7 @@ var init_spawn4 = __esm({
        * @returns Spawn result with instance ID and status
        */
       async spawn(context) {
+        assertLeadToolsStrippable("pi", this.leadToolStrip, context);
         const instanceId = `pi-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
         const startTime = (/* @__PURE__ */ new Date()).toISOString();
         let tmpFile;
@@ -50112,6 +49997,7 @@ var CodexAdapter = class {
 // packages/adapters/src/providers/codex/spawn.ts
 init_src();
 init_cli_spawn();
+init_lead_tool_strip();
 init_prompt_file();
 import { findOnPath as findOnPath4 } from "@cleocode/paths";
 
@@ -50403,6 +50289,7 @@ var GeminiCliAdapter = class {
 // packages/adapters/src/providers/gemini-cli/spawn.ts
 init_src();
 init_cli_spawn();
+init_lead_tool_strip();
 import { findOnPath as findOnPath6 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/gemini-cli/index.ts
@@ -50657,6 +50544,7 @@ var KimiAdapter = class {
 
 // packages/adapters/src/providers/kimi/spawn.ts
 init_src();
+init_lead_tool_strip();
 import { findOnPath as findOnPath8 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/kimi/index.ts