@cleocode/adapters 2026.9.26 → 2026.10.2

package/dist/index.js

@@ -14216,6 +14216,326 @@ var init_adr_073_saga = __esm({
   }
 });
 
+// packages/contracts/src/invariants/sync-write-invariants.ts
+function checkPending(task) {
+  return { task, reason: "the post-apply check is not implemented yet (T12344 item)" };
+}
+function rulePending(task) {
+  return { task, reason: "the typed merge-rule registry does not define it yet (T12344 item)" };
+}
+function trigger(id, tables, triggers, inventory, reason) {
+  return { id, class: "trigger-covered", tables, sites: [], triggers, inventory, reason };
+}
+function pac(id, item, task, tables, footprint, reason) {
+  return {
+    id,
+    class: "post-apply-check",
+    tables,
+    sites: [],
+    check: { footprint },
+    inventory: [item],
+    pending: checkPending(task),
+    reason
+  };
+}
+function rule(id, task, table, columns, inventory, reason, tables = [table]) {
+  return {
+    id,
+    class: "monotonic-merge-rule",
+    tables,
+    sites: [],
+    mergeRule: { table, columns },
+    inventory,
+    pending: rulePending(task),
+    reason
+  };
+}
+var SYNC_WRITE_INVARIANTS;
+var init_sync_write_invariants = __esm({
+  "packages/contracts/src/invariants/sync-write-invariants.ts"() {
+    "use strict";
+    SYNC_WRITE_INVARIANTS = Object.freeze([
+      // §3.6.2: RAISE guards and UNIQUE indexes a migration creates on synced tables.
+      trigger(
+        "task.parent.no-cycle",
+        ["tasks_tasks"],
+        ["tasks_tasks_parent_cycle_guard_insert", "tasks_tasks_parent_cycle_guard_update"],
+        ["V10", "V11"],
+        "the parent chain is acyclic (the INSERT variant misses a self-parent, \xA73.6.3 item 2)"
+      ),
+      trigger(
+        "task.parent.type-matrix",
+        ["tasks_tasks"],
+        ["tasks_tasks_parent_type_matrix_insert", "tasks_tasks_parent_type_matrix_update"],
+        ["X1"],
+        "parent/child type matrix; weaker than TypeScript (\xA73.6.3 item 1), the rest is PAC-01"
+      ),
+      trigger(
+        "task.status.pipeline-consistency",
+        ["tasks_tasks"],
+        ["trg_tasks_tasks_status_pipeline_insert", "trg_tasks_tasks_status_pipeline_update"],
+        ["V19", "C21"],
+        "T877: status and pipeline_stage agree on one row"
+      ),
+      trigger(
+        "task.relation.non-containment",
+        ["tasks_task_relations"],
+        ["tasks_task_relations_non_containment_insert", "tasks_task_relations_non_containment_update"],
+        ["V31"],
+        "no relation between a parent and its child, on relation writes only (\xA73.6.3 item 4)"
+      ),
+      trigger(
+        "task.ac.child-target",
+        ["tasks_task_acceptance_criteria"],
+        ["tasks_task_acceptance_child_target_insert", "tasks_task_acceptance_child_target_update"],
+        ["C28"],
+        "a child_task AC targets a direct child, on AC writes only (\xA73.6.3 item 4)"
+      ),
+      trigger(
+        "session.handoff.append-only",
+        ["tasks_session_handoff_entries"],
+        ["trg_tasks_session_handoff_no_update"],
+        ["H2"],
+        "handoff entries are never updated"
+      ),
+      trigger(
+        "task.claim.lease-iso",
+        ["tasks_tasks"],
+        ["tasks_tasks_lease_iso_insert", "tasks_tasks_lease_iso_update"],
+        [],
+        "claim lease timestamps are ISO-8601 (t12736)"
+      ),
+      trigger(
+        "task.ac-binding.unique",
+        ["tasks_evidence_ac_bindings"],
+        ["uq_tasks_evidence_ac_bindings_atom_ac_type"],
+        ["C31"],
+        "one binding per (evidence atom, AC, binding type)"
+      ),
+      trigger(
+        "release.version.unique",
+        ["tasks_releases"],
+        ["uq_tasks_releases_version"],
+        ["REL-1"],
+        "one release row per version"
+      ),
+      trigger(
+        "selfimprove.dhq.one-open",
+        ["selfimprove_dhq"],
+        ["ux_selfimprove_dhq_open"],
+        ["D49"],
+        "at most one open DHQ entry per question_hash"
+      ),
+      trigger(
+        "account.one-active-per-provider",
+        ["accounts"],
+        ["ux_accounts_active_provider"],
+        ["A40"],
+        "at most one active account per provider (partial UNIQUE)"
+      ),
+      // §3.6.5: post-apply check families (T12344 items).
+      pac(
+        "task.tree.shape",
+        "PAC-01",
+        "T12922",
+        ["tasks_tasks"],
+        ["rows with a changed parent_id or type", "their direct children and ancestor chain"],
+        "saga\u2192epic\u2192task\u2192subtask matrix, non-saga has a parent, depth \u2264 3, no self-parent"
+      ),
+      pac(
+        "task.terminal-parent.live-children",
+        "PAC-02",
+        "T12923",
+        ["tasks_tasks"],
+        ["rows whose status, stage or parent changed", "their parent and siblings"],
+        "no terminal parent with a live child; epic stage \u2265 children; rollup re-evaluated"
+      ),
+      pac(
+        "task.dependency.graph",
+        "PAC-03",
+        "T12924",
+        ["tasks_task_dependencies", "tasks_tasks"],
+        ["dependency edges inserted in the page", "reachability from each depends_on"],
+        "dependencies are acyclic, with no self-edge"
+      ),
+      pac(
+        "task.done.evidence",
+        "PAC-04",
+        "T12925",
+        ["tasks_tasks", "tasks_task_acceptance_criteria", "tasks_evidence_ac_bindings"],
+        ["done rows in the page", "their AC rows, bindings, acceptance_json and verification_json"],
+        "a done task has passed verification and every AC bound or waived"
+      ),
+      pac(
+        "task.ac.integrity",
+        "PAC-05",
+        "T12926",
+        ["tasks_tasks", "tasks_task_acceptance_criteria", "tasks_evidence_ac_bindings"],
+        ["tasks whose AC rows, bindings, acceptance_json, parent_id or relations changed"],
+        "acceptance_json \u21D4 AC rows, child_task ACs match children, bindings resolve"
+      ),
+      pac(
+        "lifecycle.rows",
+        "PAC-06",
+        "T12927",
+        ["tasks_lifecycle_pipelines", "tasks_lifecycle_stages", "tasks_tasks"],
+        ["lifecycle pipeline, stage and gate rows in the page", "the owning task row"],
+        "one pipeline per task, one stage row per name, pipeline_stage \u2265 completed stages"
+      ),
+      pac(
+        "derived.mirrors",
+        "PAC-07",
+        "T12928",
+        ["tasks_task_labels", "brain_sticky_tags", "docs_wikilinks", "tasks_tasks"],
+        ["owning rows whose JSON or junction changed"],
+        "junction tables equal their JSON source"
+      ),
+      pac(
+        "session.goal.singletons",
+        "PAC-08",
+        "T12929",
+        ["tasks_sessions", "tasks_task_work_history", "tasks_goal"],
+        ["session rows whose status, scope or chain changed", "work-history rows per session"],
+        "one active session per scope, reciprocal chain, one open interval, one live goal"
+      ),
+      pac(
+        "audit.uniqueness",
+        "PAC-09",
+        "T12930",
+        ["tasks_audit_log"],
+        ["audit rows with a non-null idempotency key", "rollback audit rows"],
+        "idempotency keys are unique across replicas; at most one rollback per receipt"
+      ),
+      pac(
+        "identity.collisions",
+        "PAC-10",
+        "T12931",
+        ["tasks_tasks", "tasks_sessions", "brain_observations", "docs_attachments"],
+        ["inserted rows", "the natural key's index"],
+        "display-id and natural-key clashes become an alias or re-mint (T12341)"
+      ),
+      pac(
+        "dedupe.at-most-one",
+        "PAC-11",
+        "T12932",
+        ["brain_decisions", "brain_learnings", "tasks_external_task_links"],
+        ["inserted rows grouped by the natural key"],
+        "duplicates created on two devices are merged"
+      ),
+      pac(
+        "ref.soft-orphans",
+        "PAC-12",
+        "T12933",
+        ["brain_memory_links", "brain_page_edges", "docs_attachment_refs", "tasks_task_commits"],
+        ["reference columns of the rows in the page", "their targets"],
+        "cross-DB and polymorphic references resolve"
+      ),
+      pac(
+        "supersession.graph",
+        "PAC-13",
+        "T12934",
+        ["brain_decisions", "docs_attachments", "tasks_architecture_decisions"],
+        ["rows whose supersession columns changed", "a chain walk"],
+        "supersession chains are acyclic with at most one successor"
+      ),
+      pac(
+        "derived.counters",
+        "PAC-14",
+        "T12935",
+        ["docs_attachments", "conduit_attachments", "docs_pipeline_manifest"],
+        ["the owning rows"],
+        "derived counters and cross-column facts agree with their rows"
+      ),
+      pac(
+        "apply.preconditions",
+        "PAC-15",
+        "T12936",
+        ["tasks_tasks"],
+        ["the whole page"],
+        "no apply while the local twin collapse has failed; restore is a re-baseline"
+      ),
+      // §3.6.6: typed merge rules (T12344).
+      rule(
+        "task.status.absorbing",
+        "T12937",
+        "tasks_tasks",
+        ["status", "completed_at", "cancelled_at", "cancellation_reason", "pipeline_stage"],
+        ["V18", "V20", "C22", "P40", "P46", "P47"],
+        "done, cancelled and archived are absorbing; leaving them needs an explicit op"
+      ),
+      rule(
+        "task.pipeline-stage.max",
+        "T12938",
+        "tasks_tasks",
+        ["pipeline_stage"],
+        ["V21", "C20", "P01", "F3"],
+        "pipeline_stage is the maximum by STAGE_ORDER, except an explicit restore"
+      ),
+      rule(
+        "task.verification.frozen-on-done",
+        "T12939",
+        "tasks_tasks",
+        ["verification_json"],
+        ["C01", "C02", "C03", "C17"],
+        "verification is frozen once done; otherwise merged per gate"
+      ),
+      rule(
+        "session.status.terminal",
+        "T12940",
+        "tasks_sessions",
+        ["status", "ended_at"],
+        ["S7", "S8", "S9", "S10", "S11", "S17", "S18", "SC2", "N1", "SK5", "P32"],
+        "ended and orphaned are terminal except on an explicit resume"
+      ),
+      rule("audit.immutable", "T12941", "tasks_audit_log", ["*"], ["SA3"], "audit rows are immutable", [
+        "tasks_audit_log",
+        "audit_log"
+      ]),
+      rule(
+        "sticky.status.one-way",
+        "T12942",
+        "brain_sticky_notes",
+        ["status", "converted_to_json"],
+        ["SK2", "SK3", "B24"],
+        "active\u2192{converted, archived} is one-way; converted_to_json is write-once"
+      ),
+      rule(
+        "release.status.absorbing",
+        "T12943",
+        "tasks_releases",
+        ["status"],
+        ["REL-2", "REL-3", "REL-4", "REL-5", "REL-6", "REL-7", "REL-8"],
+        "shipped release statuses are absorbing"
+      ),
+      rule(
+        "playbook.approval.once",
+        "T12944",
+        "tasks_playbook_approvals",
+        ["status"],
+        ["PB-1", "PB-4", "PB-7", "P33"],
+        "an approval goes pending\u2192decided once"
+      ),
+      rule(
+        "docs.lifecycle.transitions",
+        "T12945",
+        "docs_attachments",
+        ["lifecycle_status"],
+        ["D04", "D05", "D31", "D32", "D39", "D50"],
+        "superseded is sticky; lifecycle transitions follow a matrix"
+      ),
+      // §3.6.0 identity-layer rows.
+      {
+        id: "identity.local-minting",
+        class: "identity-layer",
+        tables: ["tasks_tasks", "tasks_sessions"],
+        sites: [],
+        inventory: ["V12", "B07", "B12"],
+        reason: "ids minted from local state (display ids, integer PKs, device-derived ids) collide across replicas; T12341 uids and re-minting own it, no validator port can"
+      }
+    ]);
+  }
+});
+
 // packages/contracts/src/invariants/index.ts
 function buildKey(invariant) {
   return `${invariant.adr}.${invariant.code}`;
@@ -14246,6 +14566,7 @@ var init_invariants = __esm({
     init_adr_056_release();
     init_adr_070_orchestration();
     init_adr_073_saga();
+    init_sync_write_invariants();
     INVARIANTS_REGISTRY = buildRegistry();
   }
 });
@@ -16638,8 +16959,8 @@ var init_taxonomy = __esm({
       normalizeSet(labels) {
         const result = /* @__PURE__ */ new Set();
         for (const label of labels) {
-          const canonical = this.normalize(label);
-          result.add(canonical ?? label);
+          const canonical2 = this.normalize(label);
+          result.add(canonical2 ?? label);
         }
         return [...result];
       }
@@ -17669,6 +17990,311 @@ var init_nexus_account = __esm({
   }
 });
 
+// packages/contracts/src/nexus-cloud.ts
+import { z as z26 } from "zod";
+var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema, LOGIN, SESSION_EXPIRED_LOGIN, SERVER_REFUSED, NEXUS_FORBIDDEN_ERRORS;
+var init_nexus_cloud = __esm({
+  "packages/contracts/src/nexus-cloud.ts"() {
+    "use strict";
+    NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
+    NEXUS_CLOUD_PROFILES = ["device", "read-only"];
+    NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
+    isoTime = z26.iso.datetime({ offset: true });
+    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z26.object({
+      kind: z26.enum(["device", "session"]),
+      credentialId: z26.string().nullable().optional(),
+      profile: profile.optional(),
+      scopes: z26.array(z26.string()).default([]),
+      createdAt: isoTime.nullable().optional(),
+      lastUsedAt: isoTime.nullable().optional(),
+      /** When the credential expires if it is not used again; null for sessions. */
+      idleExpiresAt: isoTime.nullable().optional()
+    });
+    nexusCloudDeviceSchema = z26.object({
+      deviceId: z26.string(),
+      name: z26.string(),
+      platform: z26.string().optional(),
+      arch: z26.string().nullable().optional(),
+      cliVersion: z26.string().nullable().optional(),
+      createdAt: isoTime.optional(),
+      lastSeenAt: isoTime.nullable().optional(),
+      state: deviceState,
+      signedOutAt: isoTime.nullable().optional(),
+      /** Base64 device certificate; null until the device holds a key grant. */
+      certificate: z26.string().nullable().optional(),
+      /** The current credential's profile, or null with none (signed out or revoked). */
+      profile: profile.optional(),
+      /** True for the device whose credential made this request. */
+      current: z26.boolean().default(false),
+      projects: z26.number().int().nonnegative().optional(),
+      replicas: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional()
+    });
+    nexusCloudOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
+      personal: z26.boolean().optional()
+    });
+    nexusCloudUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusCloudWhoamiSchema = z26.object({
+      serverTime: isoTime.optional(),
+      user: nexusCloudUserSchema,
+      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      credential: nexusCloudCredentialSchema,
+      /** The calling device; null for a session caller. */
+      device: nexusCloudDeviceSchema.nullable()
+    });
+    nexusCloudDevicePageSchema = z26.object({
+      devices: z26.array(nexusCloudDeviceSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    nexusCloudPresenceSchema = z26.looseObject({
+      observedAt: isoTime.optional(),
+      sync: z26.object({ enabled: z26.boolean() }).optional()
+    });
+    nexusCloudReplicaSchema = z26.object({
+      projectId: z26.string(),
+      replicaId: z26.string(),
+      deviceId: z26.string(),
+      deviceName: z26.string(),
+      deviceState: deviceState.optional(),
+      attachedAt: isoTime.optional(),
+      lastSyncAt: isoTime.nullable(),
+      presence: nexusCloudPresenceSchema.nullable(),
+      presenceAt: isoTime.nullable()
+    });
+    nexusCloudDeviceCountsSchema = z26.object({
+      active: z26.number().int().nonnegative(),
+      total: z26.number().int().nonnegative()
+    });
+    projectFields = {
+      projectId: z26.string(),
+      label: z26.string().nullable(),
+      organizationId: z26.string(),
+      organizationName: z26.string().optional(),
+      remoteUrl: z26.string().nullable().optional(),
+      createdAt: isoTime.optional()
+    };
+    nexusCloudProjectListItemSchema = z26.object({
+      ...projectFields,
+      role: z26.string(),
+      streamId: z26.string().optional(),
+      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      openConflicts: z26.number().int().nonnegative().optional(),
+      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional(),
+      /** This project's replica list was cut at 50 (T12858). */
+      replicasTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectPageSchema = z26.object({
+      projects: z26.array(nexusCloudProjectListItemSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      /** Anything in the page was cut (the project list or a replica list). */
+      truncated: z26.boolean().default(false),
+      /** The project list itself was cut at 1000 (T12858). */
+      projectsTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectDetailSchema = z26.object({
+      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z26.string(),
+      canTrash: z26.boolean().optional(),
+      openConflicts: z26.number().int().nonnegative(),
+      /** At most 50, oldest attachment first. */
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema,
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      /** `replicas` was cut at 50. */
+      truncated: z26.boolean().default(false),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable()
+      }).nullable()
+    });
+    nexusCloudReplicaPageSchema = z26.object({
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    NEXUS_STATUS_CHECK_IDS = [
+      "credential.valid",
+      "device.registered",
+      "device.active",
+      "device.certified",
+      "project.registered",
+      "project.writable",
+      "replica.attached",
+      "presence.fresh",
+      "replica.synced",
+      "conflicts.none"
+    ];
+    NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
+    CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
+    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z26.object({
+      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z26.boolean(),
+      required: z26.boolean(),
+      detail: z26.string()
+    });
+    nexusCloudStatusSchema = z26.object({
+      serverTime: isoTime.optional(),
+      apiVersion: z26.string().optional(),
+      user: nexusCloudUserSchema,
+      credential: nexusCloudCredentialSchema,
+      device: nexusCloudDeviceSchema.nullable(),
+      project: z26.object({
+        projectId: z26.string(),
+        registered: z26.boolean(),
+        organizationId: z26.string().nullable(),
+        organizationName: z26.string().nullable(),
+        role: z26.string().nullable()
+      }).nullable(),
+      replica: z26.object({
+        replicaId: z26.string(),
+        attached: z26.boolean(),
+        attachedElsewhere: z26.boolean(),
+        attachedAt: isoTime.nullable(),
+        lastSyncAt: isoTime.nullable(),
+        presenceAt: isoTime.nullable(),
+        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+      }).nullable(),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable(),
+        openConflicts: z26.number().int().nonnegative(),
+        devices: nexusCloudDeviceCountsSchema
+      }).nullable(),
+      /** Check ids added by a newer server are dropped, never a parse failure. */
+      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+        (list) => list.flatMap((c) => {
+          const id = knownCheckId.safeParse(c.id);
+          return id.success ? [{ ...c, id: id.data }] : [];
+        })
+      ),
+      /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
+      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+    });
+    LOGIN = "run `cleo login nexus`";
+    SESSION_EXPIRED_LOGIN = {
+      code: "E_NEXUS_SESSION_EXPIRED",
+      message: "the session is too old for this request",
+      fix: "run `cleo login nexus` (needs a browser: on a headless machine a human must complete the login)"
+    };
+    SERVER_REFUSED = {
+      code: "E_NEXUS_REQUEST_FAILED",
+      message: null,
+      fix: null
+    };
+    NEXUS_FORBIDDEN_ERRORS = {
+      "insufficient-scope": {
+        code: "E_NEXUS_INSUFFICIENT_SCOPE",
+        message: "this device's credential lacks the scope for that request",
+        fix: "run `cleo login nexus` without --read-only to enrol with the full device profile"
+      },
+      "session-required": SERVER_REFUSED,
+      "device-required": SERVER_REFUSED,
+      "device-mismatch": SERVER_REFUSED,
+      "not-self": SERVER_REFUSED,
+      "project-role": SERVER_REFUSED,
+      "route-undeclared": SERVER_REFUSED,
+      "bearer-session-required": SESSION_EXPIRED_LOGIN,
+      "session-not-fresh": SESSION_EXPIRED_LOGIN,
+      "device-limit": {
+        code: "E_NEXUS_REQUEST_FAILED",
+        message: "the account has reached its device limit",
+        fix: "revoke unused devices on cleocode.dev, then retry"
+      },
+      "device-flow-session-required": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "this session was not issued to the CLI by `cleo login nexus`, so it cannot enrol a device",
+        fix: SESSION_EXPIRED_LOGIN.fix
+      },
+      "device-not-enrolled": {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device is not enrolled with Cleo Nexus",
+        fix: LOGIN
+      }
+    };
+  }
+});
+
+// packages/contracts/src/nexus-vault.ts
+import { z as z27 } from "zod";
+var isoTime2, uuid, nexusUserKeysSchema, nexusProjectKeysSchema, nexusLeaseSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, nexusActivityEventSchema, nexusActivityPageSchema;
+var init_nexus_vault = __esm({
+  "packages/contracts/src/nexus-vault.ts"() {
+    "use strict";
+    isoTime2 = z27.iso.datetime({ offset: true });
+    uuid = z27.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+    nexusUserKeysSchema = z27.looseObject({
+      keyVersion: z27.number().int().positive(),
+      masterKeyVerifier: z27.string()
+    });
+    nexusProjectKeysSchema = z27.looseObject({
+      keys: z27.array(
+        z27.looseObject({ wrappedProjectKey: z27.string(), keyVersion: z27.number().int().positive() })
+      )
+    });
+    nexusLeaseSchema = z27.looseObject({
+      streamId: z27.string(),
+      role: z27.string(),
+      replicaId: uuid,
+      expiresAt: isoTime2,
+      forkedFromReplicaId: uuid.nullable().optional()
+    });
+    nexusLeaseAcquireSchema = z27.looseObject({ lease: nexusLeaseSchema });
+    nexusStreamHeadSchema = z27.looseObject({
+      streamId: z27.string(),
+      kind: z27.string().optional(),
+      headSeq: z27.number().int().nonnegative(),
+      headCheckpointId: z27.string().nullable(),
+      /**
+       * The highest segment `schemaVersion` the stream holds (the server raises it on every append).
+       * Absent from an older server.
+       */
+      maxSchemaVersion: z27.number().int().nonnegative().optional()
+    });
+    nexusActivityEventSchema = z27.looseObject({
+      id: z27.union([z27.string(), z27.number()]),
+      at: isoTime2,
+      actorUserId: z27.string().nullable().optional(),
+      actorDeviceId: z27.string().nullable().optional(),
+      requestId: z27.string().nullable().optional(),
+      action: z27.string(),
+      target: z27.string().nullable().optional(),
+      detail: z27.unknown().optional()
+    });
+    nexusActivityPageSchema = z27.looseObject({
+      events: z27.array(nexusActivityEventSchema),
+      nextBefore: z27.union([z27.string(), z27.number()]).nullable().optional()
+    });
+  }
+});
+
+// packages/contracts/src/sync-schema.ts
+var init_sync_schema = __esm({
+  "packages/contracts/src/sync-schema.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/task-id.ts
 var init_task_id = __esm({
   "packages/contracts/src/task-id.ts"() {
@@ -17753,6 +18379,9 @@ var init_src = __esm({
     init_decide();
     init_decide_sites();
     init_nexus_account();
+    init_nexus_cloud();
+    init_nexus_vault();
+    init_sync_schema();
     init_task_id();
   }
 });
@@ -19265,7 +19894,7 @@ __export(regexes_exports, {
   undefined: () => _undefined,
   unicodeEmail: () => unicodeEmail,
   uppercase: () => uppercase,
-  uuid: () => uuid,
+  uuid: () => uuid2,
   uuid4: () => uuid4,
   uuid6: () => uuid6,
   uuid7: () => uuid7,
@@ -19298,7 +19927,7 @@ function fixedBase64(bodyLength, padding) {
 function fixedBase64url(length) {
   return new RegExp(`^[A-Za-z0-9_-]{${length}}$`);
 }
-var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
+var cuid, cuid2, ulid, xid, ksuid, nanoid, duration, extendedDuration, guid, uuid2, uuid4, uuid6, uuid7, email, html5Email, rfc5322Email, unicodeEmail, idnEmail, browserEmail, _emoji, ipv4, ipv6, mac, cidrv4, cidrv6, base64, base64url, hostname, domain, e164, dateSource, date, string, bigint, integer, number, boolean, _null, _undefined, lowercase, uppercase, hex, md5_hex, md5_base64, md5_base64url, sha1_hex, sha1_base64, sha1_base64url, sha256_hex, sha256_base64, sha256_base64url, sha384_hex, sha384_base64, sha384_base64url, sha512_hex, sha512_base64, sha512_base64url;
 var init_regexes = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/regexes.js"() {
     init_util();
@@ -19311,14 +19940,14 @@ var init_regexes = __esm({
     duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
     extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
     guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-    uuid = (version2) => {
+    uuid2 = (version2) => {
       if (!version2)
         return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
       return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
     };
-    uuid4 = /* @__PURE__ */ uuid(4);
-    uuid6 = /* @__PURE__ */ uuid(6);
-    uuid7 = /* @__PURE__ */ uuid(7);
+    uuid4 = /* @__PURE__ */ uuid2(4);
+    uuid6 = /* @__PURE__ */ uuid2(6);
+    uuid7 = /* @__PURE__ */ uuid2(7);
     email = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
     html5Email = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
     rfc5322Email = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
@@ -20502,9 +21131,9 @@ var init_schemas = __esm({
         const v = versionMap[def.version];
         if (v === void 0)
           throw new Error(`Invalid UUID version: "${def.version}"`);
-        def.pattern ?? (def.pattern = uuid(v));
+        def.pattern ?? (def.pattern = uuid2(v));
       } else
-        def.pattern ?? (def.pattern = uuid());
+        def.pattern ?? (def.pattern = uuid2());
       $ZodStringFormat.init(inst, def);
     });
     $ZodEmail = /* @__PURE__ */ $constructor("$ZodEmail", (inst, def) => {
@@ -30608,7 +31237,7 @@ __export(schemas_exports2, {
   union: () => union,
   unknown: () => unknown,
   url: () => url,
-  uuid: () => uuid2,
+  uuid: () => uuid3,
   uuidv4: () => uuidv4,
   uuidv6: () => uuidv6,
   uuidv7: () => uuidv7,
@@ -30625,7 +31254,7 @@ function email2(params) {
 function guid2(params) {
   return _guid(ZodGUID, params);
 }
-function uuid2(params) {
+function uuid3(params) {
   return _uuid(ZodUUID, params);
 }
 function uuidv4(params) {
@@ -31773,7 +32402,7 @@ function resolveRef(ref, ctx) {
 function convertBaseSchema(schema, ctx) {
   if (schema.not !== void 0) {
     if (typeof schema.not === "object" && Object.keys(schema.not).length === 0) {
-      return z26.never();
+      return z28.never();
     }
     throw new Error("not is not supported in Zod (except { not: {} } for never)");
   }
@@ -31795,7 +32424,7 @@ function convertBaseSchema(schema, ctx) {
       return ctx.refs.get(refPath);
     }
     if (ctx.processing.has(refPath)) {
-      return z26.lazy(() => {
+      return z28.lazy(() => {
         if (!ctx.refs.has(refPath)) {
           throw new Error(`Circular reference not resolved: ${refPath}`);
         }
@@ -31812,25 +32441,25 @@ function convertBaseSchema(schema, ctx) {
   if (schema.enum !== void 0) {
     const enumValues = schema.enum;
     if (ctx.version === "openapi-3.0" && schema.nullable === true && enumValues.length === 1 && enumValues[0] === null) {
-      return z26.null();
+      return z28.null();
     }
     if (enumValues.length === 0) {
-      return z26.never();
+      return z28.never();
     }
     if (enumValues.length === 1) {
-      return z26.literal(enumValues[0]);
+      return z28.literal(enumValues[0]);
     }
     if (enumValues.every((v) => typeof v === "string")) {
-      return z26.enum(enumValues);
+      return z28.enum(enumValues);
     }
-    const literalSchemas = enumValues.map((v) => z26.literal(v));
+    const literalSchemas = enumValues.map((v) => z28.literal(v));
     if (literalSchemas.length < 2) {
       return literalSchemas[0];
     }
-    return z26.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
+    return z28.union([literalSchemas[0], literalSchemas[1], ...literalSchemas.slice(2)]);
   }
   if (schema.const !== void 0) {
-    return z26.literal(schema.const);
+    return z28.literal(schema.const);
   }
   const type = schema.type;
   if (Array.isArray(type)) {
@@ -31839,68 +32468,68 @@ function convertBaseSchema(schema, ctx) {
       return convertBaseSchema(typeSchema, ctx);
     });
     if (typeSchemas.length === 0) {
-      return z26.never();
+      return z28.never();
     }
     if (typeSchemas.length === 1) {
       return typeSchemas[0];
     }
-    return z26.union(typeSchemas);
+    return z28.union(typeSchemas);
   }
   if (!type) {
-    return z26.any();
+    return z28.any();
   }
   let zodSchema2;
   switch (type) {
     case "string": {
-      let stringSchema = z26.string();
+      let stringSchema = z28.string();
       if (schema.format) {
         const format = schema.format;
         if (format === "email") {
-          stringSchema = stringSchema.check(z26.email());
+          stringSchema = stringSchema.check(z28.email());
         } else if (format === "uri" || format === "uri-reference") {
-          stringSchema = stringSchema.check(z26.url());
+          stringSchema = stringSchema.check(z28.url());
         } else if (format === "uuid" || format === "guid") {
-          stringSchema = stringSchema.check(z26.uuid());
+          stringSchema = stringSchema.check(z28.uuid());
         } else if (format === "date-time") {
-          stringSchema = stringSchema.check(z26.iso.datetime());
+          stringSchema = stringSchema.check(z28.iso.datetime());
         } else if (format === "date") {
-          stringSchema = stringSchema.check(z26.iso.date());
+          stringSchema = stringSchema.check(z28.iso.date());
         } else if (format === "time") {
-          stringSchema = stringSchema.check(z26.iso.time());
+          stringSchema = stringSchema.check(z28.iso.time());
         } else if (format === "duration") {
-          stringSchema = stringSchema.check(z26.iso.duration());
+          stringSchema = stringSchema.check(z28.iso.duration());
         } else if (format === "ipv4") {
-          stringSchema = stringSchema.check(z26.ipv4());
+          stringSchema = stringSchema.check(z28.ipv4());
         } else if (format === "ipv6") {
-          stringSchema = stringSchema.check(z26.ipv6());
+          stringSchema = stringSchema.check(z28.ipv6());
         } else if (format === "mac") {
-          stringSchema = stringSchema.check(z26.mac());
+          stringSchema = stringSchema.check(z28.mac());
         } else if (format === "cidr") {
-          stringSchema = stringSchema.check(z26.cidrv4());
+          stringSchema = stringSchema.check(z28.cidrv4());
         } else if (format === "cidr-v6") {
-          stringSchema = stringSchema.check(z26.cidrv6());
+          stringSchema = stringSchema.check(z28.cidrv6());
         } else if (format === "base64") {
-          stringSchema = stringSchema.check(z26.base64());
+          stringSchema = stringSchema.check(z28.base64());
         } else if (format === "base64url") {
-          stringSchema = stringSchema.check(z26.base64url());
+          stringSchema = stringSchema.check(z28.base64url());
         } else if (format === "e164") {
-          stringSchema = stringSchema.check(z26.e164());
+          stringSchema = stringSchema.check(z28.e164());
         } else if (format === "jwt") {
-          stringSchema = stringSchema.check(z26.jwt());
+          stringSchema = stringSchema.check(z28.jwt());
         } else if (format === "emoji") {
-          stringSchema = stringSchema.check(z26.emoji());
+          stringSchema = stringSchema.check(z28.emoji());
         } else if (format === "nanoid") {
-          stringSchema = stringSchema.check(z26.nanoid());
+          stringSchema = stringSchema.check(z28.nanoid());
         } else if (format === "cuid") {
-          stringSchema = stringSchema.check(z26.cuid());
+          stringSchema = stringSchema.check(z28.cuid());
         } else if (format === "cuid2") {
-          stringSchema = stringSchema.check(z26.cuid2());
+          stringSchema = stringSchema.check(z28.cuid2());
         } else if (format === "ulid") {
-          stringSchema = stringSchema.check(z26.ulid());
+          stringSchema = stringSchema.check(z28.ulid());
         } else if (format === "xid") {
-          stringSchema = stringSchema.check(z26.xid());
+          stringSchema = stringSchema.check(z28.xid());
         } else if (format === "ksuid") {
-          stringSchema = stringSchema.check(z26.ksuid());
+          stringSchema = stringSchema.check(z28.ksuid());
         }
       }
       if (typeof schema.minLength === "number") {
@@ -31917,7 +32546,7 @@ function convertBaseSchema(schema, ctx) {
     }
     case "number":
     case "integer": {
-      let numberSchema = type === "integer" ? z26.number().int() : z26.number();
+      let numberSchema = type === "integer" ? z28.number().int() : z28.number();
       if (typeof schema.minimum === "number") {
         numberSchema = numberSchema.min(schema.minimum);
       }
@@ -31941,11 +32570,11 @@ function convertBaseSchema(schema, ctx) {
       break;
     }
     case "boolean": {
-      zodSchema2 = z26.boolean();
+      zodSchema2 = z28.boolean();
       break;
     }
     case "null": {
-      zodSchema2 = z26.null();
+      zodSchema2 = z28.null();
       break;
     }
     case "object": {
@@ -31958,14 +32587,14 @@ function convertBaseSchema(schema, ctx) {
       }
       if (schema.propertyNames) {
         const keySchema = convertSchema(schema.propertyNames, ctx);
-        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z26.any();
+        const valueSchema = schema.additionalProperties && typeof schema.additionalProperties === "object" ? convertSchema(schema.additionalProperties, ctx) : z28.any();
         if (Object.keys(shape).length === 0) {
-          zodSchema2 = z26.record(keySchema, valueSchema);
+          zodSchema2 = z28.record(keySchema, valueSchema);
           break;
         }
-        const objectSchema2 = z26.object(shape).passthrough();
-        const recordSchema = z26.looseRecord(keySchema, valueSchema);
-        zodSchema2 = z26.intersection(objectSchema2, recordSchema);
+        const objectSchema2 = z28.object(shape).passthrough();
+        const recordSchema = z28.looseRecord(keySchema, valueSchema);
+        zodSchema2 = z28.intersection(objectSchema2, recordSchema);
         break;
       }
       if (schema.patternProperties) {
@@ -31974,28 +32603,28 @@ function convertBaseSchema(schema, ctx) {
         const looseRecords = [];
         for (const pattern of patternKeys) {
           const patternValue = convertSchema(patternProps[pattern], ctx);
-          const keySchema = z26.string().regex(new RegExp(pattern));
-          looseRecords.push(z26.looseRecord(keySchema, patternValue));
+          const keySchema = z28.string().regex(new RegExp(pattern));
+          looseRecords.push(z28.looseRecord(keySchema, patternValue));
         }
         const schemasToIntersect = [];
         if (Object.keys(shape).length > 0) {
-          schemasToIntersect.push(z26.object(shape).passthrough());
+          schemasToIntersect.push(z28.object(shape).passthrough());
         }
         schemasToIntersect.push(...looseRecords);
         if (schemasToIntersect.length === 0) {
-          zodSchema2 = z26.object({}).passthrough();
+          zodSchema2 = z28.object({}).passthrough();
         } else if (schemasToIntersect.length === 1) {
           zodSchema2 = schemasToIntersect[0];
         } else {
-          let result = z26.intersection(schemasToIntersect[0], schemasToIntersect[1]);
+          let result = z28.intersection(schemasToIntersect[0], schemasToIntersect[1]);
           for (let i = 2; i < schemasToIntersect.length; i++) {
-            result = z26.intersection(result, schemasToIntersect[i]);
+            result = z28.intersection(result, schemasToIntersect[i]);
           }
           zodSchema2 = result;
         }
         break;
       }
-      const objectSchema = z26.object(shape);
+      const objectSchema = z28.object(shape);
       if (schema.additionalProperties === false) {
         zodSchema2 = objectSchema.strict();
       } else if (typeof schema.additionalProperties === "object") {
@@ -32012,33 +32641,33 @@ function convertBaseSchema(schema, ctx) {
         const tupleItems = prefixItems.map((item) => convertSchema(item, ctx));
         const rest = items && typeof items === "object" && !Array.isArray(items) ? convertSchema(items, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z26.tuple(tupleItems).rest(rest);
+          zodSchema2 = z28.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z26.tuple(tupleItems);
+          zodSchema2 = z28.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z26.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z28.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z26.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z28.maxLength(schema.maxItems));
         }
       } else if (Array.isArray(items)) {
         const tupleItems = items.map((item) => convertSchema(item, ctx));
         const rest = schema.additionalItems && typeof schema.additionalItems === "object" ? convertSchema(schema.additionalItems, ctx) : void 0;
         if (rest) {
-          zodSchema2 = z26.tuple(tupleItems).rest(rest);
+          zodSchema2 = z28.tuple(tupleItems).rest(rest);
         } else {
-          zodSchema2 = z26.tuple(tupleItems);
+          zodSchema2 = z28.tuple(tupleItems);
         }
         if (typeof schema.minItems === "number") {
-          zodSchema2 = zodSchema2.check(z26.minLength(schema.minItems));
+          zodSchema2 = zodSchema2.check(z28.minLength(schema.minItems));
         }
         if (typeof schema.maxItems === "number") {
-          zodSchema2 = zodSchema2.check(z26.maxLength(schema.maxItems));
+          zodSchema2 = zodSchema2.check(z28.maxLength(schema.maxItems));
         }
       } else if (items !== void 0) {
         const element = convertSchema(items, ctx);
-        let arraySchema = z26.array(element);
+        let arraySchema = z28.array(element);
         if (typeof schema.minItems === "number") {
           arraySchema = arraySchema.min(schema.minItems);
         }
@@ -32047,7 +32676,7 @@ function convertBaseSchema(schema, ctx) {
         }
         zodSchema2 = arraySchema;
       } else {
-        zodSchema2 = z26.array(z26.any());
+        zodSchema2 = z28.array(z28.any());
       }
       break;
     }
@@ -32064,37 +32693,37 @@ function convertBaseSchema(schema, ctx) {
 }
 function convertSchema(schema, ctx) {
   if (typeof schema === "boolean") {
-    return schema ? z26.any() : z26.never();
+    return schema ? z28.any() : z28.never();
   }
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
     const options = schema.anyOf.map((s) => convertSchema(s, ctx));
-    const anyOfUnion = z26.union(options);
-    baseSchema = hasExplicitType ? z26.intersection(baseSchema, anyOfUnion) : anyOfUnion;
+    const anyOfUnion = z28.union(options);
+    baseSchema = hasExplicitType ? z28.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
     const options = schema.oneOf.map((s) => convertSchema(s, ctx));
-    const oneOfUnion = z26.xor(options);
-    baseSchema = hasExplicitType ? z26.intersection(baseSchema, oneOfUnion) : oneOfUnion;
+    const oneOfUnion = z28.xor(options);
+    baseSchema = hasExplicitType ? z28.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
   if (schema.allOf && Array.isArray(schema.allOf)) {
     if (schema.allOf.length === 0) {
-      baseSchema = hasExplicitType ? baseSchema : z26.any();
+      baseSchema = hasExplicitType ? baseSchema : z28.any();
     } else {
       let result = hasExplicitType ? baseSchema : convertSchema(schema.allOf[0], ctx);
       const startIdx = hasExplicitType ? 0 : 1;
       for (let i = startIdx; i < schema.allOf.length; i++) {
-        result = z26.intersection(result, convertSchema(schema.allOf[i], ctx));
+        result = z28.intersection(result, convertSchema(schema.allOf[i], ctx));
       }
       baseSchema = result;
     }
   }
   if (schema.nullable === true && ctx.version === "openapi-3.0") {
-    baseSchema = z26.nullable(baseSchema);
+    baseSchema = z28.nullable(baseSchema);
   }
   if (schema.readOnly === true) {
-    baseSchema = z26.readonly(baseSchema);
+    baseSchema = z28.readonly(baseSchema);
   }
   const extraMeta = {};
   const coreMetadataKeys = ["$id", "id", "$comment", "$anchor", "$vocabulary", "$dynamicRef", "$dynamicAnchor"];
@@ -32121,7 +32750,7 @@ function convertSchema(schema, ctx) {
 }
 function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
-    return schema ? z26.any() : z26.never();
+    return schema ? z28.any() : z28.never();
   }
   const version2 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
@@ -32135,14 +32764,14 @@ function fromJSONSchema(schema, params) {
   };
   return convertSchema(schema, ctx);
 }
-var z26, RECOGNIZED_KEYS;
+var z28, RECOGNIZED_KEYS;
 var init_from_json_schema = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/classic/from-json-schema.js"() {
     init_registries();
     init_checks2();
     init_iso();
     init_schemas2();
-    z26 = {
+    z28 = {
       ...schemas_exports2,
       ...checks_exports2,
       iso: iso_exports
@@ -32484,7 +33113,7 @@ __export(external_exports, {
   uppercase: () => _uppercase,
   url: () => url,
   util: () => util_exports,
-  uuid: () => uuid2,
+  uuid: () => uuid3,
   uuidv4: () => uuidv4,
   uuidv6: () => uuidv6,
   uuidv7: () => uuidv7,
@@ -43781,12 +44410,7 @@ var init_spawn = __esm({
   }
 });
 
-// packages/adapters/src/providers/claude-code/paths.ts
-import { homedir as homedir2 } from "node:os";
-import { join as join3 } from "node:path";
-function claudeSettingsPath() {
-  return new ClaudeCodePathProvider().getSettingsPath() ?? join3(homedir2(), ".claude", "settings.json");
-}
+// packages/adapters/src/providers/shared/hook-config.ts
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -43830,10 +44454,25 @@ function removeCleoHookEntries(hooks) {
   }
   return changed;
 }
-var ClaudeCodePathProvider, CLEO_HOOK_MARKER;
+var CLEO_HOOK_MARKER;
+var init_hook_config = __esm({
+  "packages/adapters/src/providers/shared/hook-config.ts"() {
+    "use strict";
+    CLEO_HOOK_MARKER = "# cleo-hook";
+  }
+});
+
+// packages/adapters/src/providers/claude-code/paths.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+function claudeSettingsPath() {
+  return new ClaudeCodePathProvider().getSettingsPath() ?? join3(homedir2(), ".claude", "settings.json");
+}
+var ClaudeCodePathProvider;
 var init_paths = __esm({
   "packages/adapters/src/providers/claude-code/paths.ts"() {
     "use strict";
+    init_hook_config();
     ClaudeCodePathProvider = class {
       /** Get the provider's root configuration directory. */
       getProviderDir() {
@@ -43852,7 +44491,6 @@ var init_paths = __esm({
         return process.env["CLAUDE_MEM_DB"] ?? join3(homedir2(), ".claude-mem", "claude-mem.db");
       }
     };
-    CLEO_HOOK_MARKER = "# cleo-hook";
   }
 });
 
@@ -44213,12 +44851,12 @@ var init_hooks = __esm({
        * @returns Claude Code native event name or null
        * @task T164
        */
-      async toNativeEvent(canonical) {
+      async toNativeEvent(canonical2) {
         try {
           const { toNative } = await import("@cleocode/caamp");
-          return toNative(canonical, PROVIDER_ID);
+          return toNative(canonical2, PROVIDER_ID);
         } catch {
-          const entry = Object.entries(CLAUDE_CODE_EVENT_MAP).find(([, v]) => v === canonical);
+          const entry = Object.entries(CLAUDE_CODE_EVENT_MAP).find(([, v]) => v === canonical2);
           return entry?.[0] ?? null;
         }
       }
@@ -44313,23 +44951,354 @@ var init_hooks = __esm({
   }
 });
 
+// packages/adapters/src/providers/shared/heavy-command-hook-install.ts
+import { execFileSync } from "node:child_process";
+import {
+  existsSync as existsSync5,
+  mkdirSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync4,
+  realpathSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir as homedir4, tmpdir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join6, resolve as resolve2 } from "node:path";
+import { updateJsonConfigFile as updateJsonConfigFile2 } from "@cleocode/caamp";
+function canonical(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve2(path);
+  }
+}
+function isUserHomeDir(projectDir, home = homedir4()) {
+  return canonical(projectDir) === canonical(home);
+}
+function clearOlderCleoMarkers(dir = process.env.XDG_RUNTIME_DIR || tmpdir()) {
+  let removed = 0;
+  let names;
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return 0;
+  }
+  for (const name15 of names) {
+    if (!name15.startsWith(OLDER_CLEO_MARKER_PREFIX)) continue;
+    try {
+      rmSync(join6(dir, name15), { force: true });
+      removed++;
+    } catch {
+    }
+  }
+  return removed;
+}
+function shellWord(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function heavyCommandGuardScript(provider) {
+  const words = HEAVY_TOOL_WORDS.join("|");
+  const old = `printf '%s\\n' '${OLDER_CLEO_HOOK_ANSWER}'`;
+  return [
+    "command -v cleo >/dev/null 2>&1 || exit 0",
+    'in="$(cat)"',
+    "set -f",
+    "hit=",
+    // `[\]` (not `\\`) matches a backslash: it survives fish's quoting under Codex.
+    `for w in $(printf '%s' "$in" | sed 's/[\\][nrt]/ /g; s/[^A-Za-z0-9_./@+-]/ /g'); do case "\${w##*/}" in ${words}) hit=1; break;; esac; done`,
+    '[ -n "$hit" ] || exit 0',
+    'p="$(command -v cleo)"',
+    `d="\${XDG_RUNTIME_DIR:-\${TMPDIR:-/tmp}}"`,
+    `k="$d/${OLDER_CLEO_MARKER_PREFIX}$(printf '%s|%s' "$p" "$PWD" | cksum | tr -c '0-9' '-')"`,
+    `if [ -f "$k" ] && [ ! -L "$k" ] && [ -O "$k" ] && ! [ "$p" -nt "$k" ] && [ -n "$(find "$k" -mmin -60 2>/dev/null)" ]; then ${old}; exit 0; fi`,
+    'e="$(mktemp 2>/dev/null)" || e=',
+    // Only the older-CLEO signature (exit 127, "Unknown command hook") writes the
+    // marker; a crash or kill of a current CLEO fails open and asks again next time.
+    `if out="$(printf '%s' "$in" | ${HEAVY_COMMAND_HOOK_ID} --provider ${provider} 2>"\${e:-/dev/null}")"; then case "$out" in "{"*) printf '%s\\n' "$out";; esac; else rc=$?; if [ "$rc" = 127 ] && [ -n "$e" ] && grep -q 'Unknown command' "$e" 2>/dev/null; then t="$(mktemp "$k.XXXXXX" 2>/dev/null)" && mv -f "$t" "$k"; ${old}; fi; fi`,
+    '[ -z "$e" ] || rm -f "$e"',
+    "exit 0"
+  ].join("; ");
+}
+function heavyCommandHookCommand(provider) {
+  const script = heavyCommandGuardScript(provider);
+  const line = provider === "codex" ? `/bin/sh -c ${shellWord(script)}` : script;
+  return `${line} ${CLEO_HOOK_MARKER}`;
+}
+function heavyCommandHookObject(provider) {
+  return {
+    type: "command",
+    command: heavyCommandHookCommand(provider),
+    timeout: HEAVY_COMMAND_HOOK_TIMEOUT_SEC
+  };
+}
+function heavyCommandHookEntry(provider) {
+  return { matcher: "Bash", hooks: [heavyCommandHookObject(provider)] };
+}
+function isHeavyHookObject(hook) {
+  return isPlainObject2(hook) && typeof hook.command === "string" && hook.command.includes(CLEO_HOOK_MARKER) && hook.command.includes(HEAVY_COMMAND_HOOK_ID);
+}
+function placeHeavyHook(hooks, desired) {
+  const groups = hooks.PreToolUse;
+  if (groups === void 0) return { changed: false, found: false };
+  if (!Array.isArray(groups)) {
+    throw new Error('hooks "PreToolUse" is not an array; not modifying it');
+  }
+  let changed = false;
+  let found = false;
+  const next = [];
+  for (const group of groups) {
+    if (!isPlainObject2(group) || !Array.isArray(group.hooks)) {
+      next.push(group);
+      continue;
+    }
+    const kept = [];
+    let groupChanged = false;
+    for (const hook of group.hooks) {
+      if (!isHeavyHookObject(hook)) {
+        kept.push(hook);
+      } else if (desired !== null && !found) {
+        found = true;
+        if (JSON.stringify(hook) !== JSON.stringify(desired)) groupChanged = true;
+        kept.push(desired);
+      } else {
+        groupChanged = true;
+      }
+    }
+    if (!groupChanged) {
+      next.push(group);
+      continue;
+    }
+    changed = true;
+    if (kept.length > 0) next.push({ ...group, hooks: kept });
+  }
+  if (changed) hooks.PreToolUse = next;
+  return { changed, found };
+}
+async function syncJsonHeavyCommandHook(configPath, provider, mode) {
+  if (mode === "off") {
+    if (!existsSync5(configPath)) return "unchanged";
+    const removed = await updateJsonConfigFile2(configPath, (config2) => {
+      if (config2.hooks === void 0) return false;
+      return placeHeavyHook(hookMap(config2), null).changed;
+    });
+    return removed ? "removed" : "unchanged";
+  }
+  mkdirSync(dirname2(configPath), { recursive: true });
+  clearOlderCleoMarkers();
+  let result = "unchanged";
+  await updateJsonConfigFile2(configPath, (config2) => {
+    const hooks = hookMap(config2);
+    const placed = placeHeavyHook(hooks, heavyCommandHookObject(provider));
+    if (placed.found) {
+      if (placed.changed) result = "updated";
+      return placed.changed;
+    }
+    const existing = hooks.PreToolUse;
+    hooks.PreToolUse = [
+      ...Array.isArray(existing) ? existing : [],
+      heavyCommandHookEntry(provider)
+    ];
+    result = "installed";
+    return true;
+  });
+  return result;
+}
+function gitOutput(projectDir, args) {
+  try {
+    return execFileSync("git", ["-C", projectDir, ...args], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function excludeFile(projectDir) {
+  if (gitOutput(projectDir, ["rev-parse", "--is-inside-work-tree"]) !== "true") return null;
+  const path = gitOutput(projectDir, ["rev-parse", "--git-path", "info/exclude"]);
+  if (path === null || path === "") return null;
+  return isAbsolute(path) ? path : join6(projectDir, path);
+}
+function excludeLine(projectDir) {
+  const prefix = gitOutput(projectDir, ["rev-parse", "--show-prefix"]) ?? "";
+  return `/${prefix}${CLAUDE_LOCAL_SETTINGS}`;
+}
+function excludeLocalSettingsFromGit(projectDir) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null) return false;
+  if (gitOutput(projectDir, ["check-ignore", CLAUDE_LOCAL_SETTINGS]) !== null) return false;
+  const line = excludeLine(projectDir);
+  const text = existsSync5(exclude) ? readFileSync4(exclude, "utf-8") : "";
+  if (text.split("\n").includes(line)) return false;
+  const block = `${LOCAL_SETTINGS_EXCLUDE_MARKER}
+${line}
+`;
+  mkdirSync(dirname2(exclude), { recursive: true });
+  writeFileSync2(exclude, text === "" || text.endsWith("\n") ? text + block : `${text}
+${block}`);
+  return true;
+}
+function unexcludeLocalSettingsFromGit(projectDir) {
+  const exclude = excludeFile(projectDir);
+  if (exclude === null || !existsSync5(exclude)) return false;
+  const lines = readFileSync4(exclude, "utf-8").split("\n");
+  const at = lines.indexOf(excludeLine(projectDir));
+  if (at < 1 || lines[at - 1] !== LOCAL_SETTINGS_EXCLUDE_MARKER) return false;
+  lines.splice(at - 1, 2);
+  writeFileSync2(exclude, lines.join("\n"));
+  return true;
+}
+async function syncClaudeCodeHeavyCommandHook(projectDir, mode) {
+  const result = await syncJsonHeavyCommandHook(
+    join6(projectDir, CLAUDE_LOCAL_SETTINGS),
+    "claude-code",
+    mode
+  );
+  if (mode === "off") unexcludeLocalSettingsFromGit(projectDir);
+  else excludeLocalSettingsFromGit(projectDir);
+  await syncJsonHeavyCommandHook(
+    join6(projectDir, ".claude", "settings.json"),
+    "claude-code",
+    "off"
+  );
+  return result;
+}
+function opencodeHeavyCommandPluginSource() {
+  return [
+    "// CLEO heavy-command plugin for OpenCode (generated by @cleocode/adapters, T12983).",
+    "// Routes heavy shell commands (tests, builds, typechecks, installs) through",
+    "// `cleo run`, the machine-wide resource budget. Opt out with",
+    '// CLEO_HEAVY_COMMAND_HOOK=off, or set resources.heavyCommandHook to "off" and',
+    "// run `cleo upgrade` (which deletes this file). Fails open: on any error the",
+    "// command runs unchanged.",
+    "",
+    "import { execFile } from 'node:child_process';",
+    "",
+    `const HEAVY = /(?:^|[^A-Za-z0-9_.@+-])(?:${HEAVY_TOOL_WORDS.join("|")})(?=$|[^A-Za-z0-9_.@+-])/;`,
+    "const contexts = new Map();",
+    "",
+    "function ask(payload) {",
+    "  return new Promise((done) => {",
+    "    const child = execFile(",
+    "      'cleo',",
+    "      ['hook', 'heavy-command', '--provider', 'opencode'],",
+    `      { timeout: ${HEAVY_COMMAND_HOOK_TIMEOUT_SEC * 1e3} },`,
+    "      (err, stdout) => done(err ? '' : stdout),",
+    "    );",
+    "    child.on('error', () => done(''));",
+    "    child.stdin?.end(JSON.stringify(payload));",
+    "  });",
+    "}",
+    "",
+    "export const CleoHeavyCommand = async ({ directory }) => ({",
+    "  'tool.execute.before': async (input, output) => {",
+    "    if (input?.tool !== 'bash' || typeof output?.args?.command !== 'string') return;",
+    "    if (process.env.CLEO_HEAVY_COMMAND_HOOK === 'off') return;",
+    "    if (!HEAVY.test(output.args.command)) return;",
+    "    try {",
+    "      const text = await ask({ tool_name: 'bash', tool_input: output.args, cwd: directory });",
+    "      const answer = JSON.parse(text || '{}');",
+    "      if (typeof answer.command === 'string') output.args.command = answer.command;",
+    "      if (typeof answer.timeout === 'number') output.args.timeout = answer.timeout;",
+    "      if (typeof answer.context === 'string' && input.callID) contexts.set(input.callID, answer.context);",
+    "    } catch {",
+    "      // Fail open.",
+    "    }",
+    "  },",
+    "  'tool.execute.after': async (input, output) => {",
+    "    const context = input?.callID ? contexts.get(input.callID) : undefined;",
+    "    if (context === undefined) return;",
+    "    contexts.delete(input.callID);",
+    "    if (typeof output?.output === 'string') output.output += '\\n\\n' + context;",
+    "  },",
+    "});",
+    ""
+  ].join("\n");
+}
+function syncOpencodeHeavyCommandPlugin(projectDir, mode) {
+  const pluginPath = join6(projectDir, ".opencode", "plugins", OPENCODE_HEAVY_COMMAND_PLUGIN);
+  const exists = existsSync5(pluginPath);
+  if (mode === "off") {
+    if (!exists) return "unchanged";
+    rmSync(pluginPath, { force: true });
+    return "removed";
+  }
+  const source = opencodeHeavyCommandPluginSource();
+  if (exists && readFileSync4(pluginPath, "utf-8") === source) return "unchanged";
+  mkdirSync(dirname2(pluginPath), { recursive: true });
+  writeFileSync2(pluginPath, source, "utf-8");
+  return exists ? "updated" : "installed";
+}
+var HEAVY_COMMAND_HOOK_ID, HEAVY_COMMAND_HOOK_TIMEOUT_SEC, OPENCODE_HEAVY_COMMAND_PLUGIN, HEAVY_TOOL_WORDS, OLDER_CLEO_HOOK_ANSWER, OLDER_CLEO_MARKER_PREFIX, CLAUDE_LOCAL_SETTINGS, LOCAL_SETTINGS_EXCLUDE_MARKER;
+var init_heavy_command_hook_install = __esm({
+  "packages/adapters/src/providers/shared/heavy-command-hook-install.ts"() {
+    "use strict";
+    init_hook_config();
+    HEAVY_COMMAND_HOOK_ID = "cleo hook heavy-command";
+    HEAVY_COMMAND_HOOK_TIMEOUT_SEC = 20;
+    OPENCODE_HEAVY_COMMAND_PLUGIN = "cleo-heavy-command.js";
+    HEAVY_TOOL_WORDS = Object.freeze([
+      "vitest",
+      "jest",
+      "mocha",
+      "ava",
+      "tap",
+      "playwright",
+      "pytest",
+      "rspec",
+      "phpunit",
+      "tsc",
+      "tsup",
+      "turbo",
+      "vite",
+      "esbuild",
+      "webpack",
+      "rollup",
+      "next",
+      "nx",
+      "biome",
+      "eslint",
+      "svelte-check",
+      "npm",
+      "pnpm",
+      "yarn",
+      "bun",
+      "npx",
+      "pnpx",
+      "bunx",
+      "cargo",
+      "go"
+    ]);
+    OLDER_CLEO_HOOK_ANSWER = JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: "[cleo] This may be a heavy command, but the cleo on PATH predates cleo hook and cleo run, so it runs outside the machine-wide resource budget. Upgrade CLEO to govern it."
+      }
+    });
+    OLDER_CLEO_MARKER_PREFIX = "cleo-hook-unsupported-";
+    CLAUDE_LOCAL_SETTINGS = ".claude/settings.local.json";
+    LOCAL_SETTINGS_EXCLUDE_MARKER = "# cleo-hook: keep the per-machine heavy-command hook settings out of git (T12983)";
+  }
+});
+
 // packages/adapters/src/providers/shared/hook-template-installer.ts
-import { copyFileSync, existsSync as existsSync5, mkdirSync, statSync } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { copyFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, statSync } from "node:fs";
+import { dirname as dirname3, join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function resolveProviderCandidates() {
-  const thisDir = dirname2(fileURLToPath(import.meta.url));
-  const here = dirname2(thisDir);
-  const fromDist = join6(here, "..", "..", "src", "providers");
+  const thisDir = dirname3(fileURLToPath(import.meta.url));
+  const here = dirname3(thisDir);
+  const fromDist = join7(here, "..", "..", "src", "providers");
   return [here, fromDist];
 }
 function findTemplateFile(relativeSegments) {
   for (const base of resolveProviderCandidates()) {
-    const candidate = join6(base, ...relativeSegments);
-    if (existsSync5(candidate)) return candidate;
+    const candidate = join7(base, ...relativeSegments);
+    if (existsSync6(candidate)) return candidate;
   }
   const [first] = resolveProviderCandidates();
-  return join6(first ?? "", ...relativeSegments);
+  return join7(first ?? "", ...relativeSegments);
 }
 function providerShimSource(provider) {
   return findTemplateFile([provider, "templates", "hooks", PROVIDER_SHIM[provider]]);
@@ -44338,17 +45307,17 @@ function sharedCoreSource() {
   return findTemplateFile(["shared", "templates", "hooks", SHARED_CORE_FILE]);
 }
 function copyTemplate(src, dest, force) {
-  if (!existsSync5(src)) {
+  if (!existsSync6(src)) {
     throw new Error(`CLEO hook template missing at source: ${src}`);
   }
-  if (!force && existsSync5(dest)) {
+  if (!force && existsSync6(dest)) {
     const srcStat = statSync(src);
     const destStat = statSync(dest);
     if (srcStat.size === destStat.size && srcStat.mtimeMs <= destStat.mtimeMs) {
       return { wrote: false };
     }
   }
-  mkdirSync(dirname2(dest), { recursive: true });
+  mkdirSync2(dirname3(dest), { recursive: true });
   copyFileSync(src, dest);
   return { wrote: true };
 }
@@ -44360,13 +45329,13 @@ function installProviderHookTemplates(options) {
     installedFiles: [],
     skipped: []
   };
-  mkdirSync(targetDir, { recursive: true });
-  const coreDest = join6(targetDir, SHARED_CORE_FILE);
+  mkdirSync2(targetDir, { recursive: true });
+  const coreDest = join7(targetDir, SHARED_CORE_FILE);
   const coreOutcome = copyTemplate(sharedCoreSource(), coreDest, force);
   if (coreOutcome.wrote) result.installedFiles.push(coreDest);
   else result.skipped.push(coreDest);
   const shimName = PROVIDER_SHIM[provider];
-  const shimDest = join6(targetDir, shimName);
+  const shimDest = join7(targetDir, shimName);
   const shimOutcome = copyTemplate(providerShimSource(provider), shimDest, force);
   if (shimOutcome.wrote) result.installedFiles.push(shimDest);
   else result.skipped.push(shimDest);
@@ -44393,22 +45362,23 @@ var init_hook_template_installer = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/install.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, join as join8, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { ensureProviderInstructionFile, updateJsonConfigFile as updateJsonConfigFile2 } from "@cleocode/caamp";
+import { ensureProviderInstructionFile, updateJsonConfigFile as updateJsonConfigFile3 } from "@cleocode/caamp";
 function getClaudeConfigDir() {
-  return process.env["CLAUDE_HOME"] ?? join7(homedir4(), ".claude");
+  return process.env["CLAUDE_HOME"] ?? join8(homedir5(), ".claude");
 }
 function getAdapterCommandsDir() {
-  const thisDir = dirname3(fileURLToPath2(import.meta.url));
-  return join7(thisDir, "commands");
+  const thisDir = dirname4(fileURLToPath2(import.meta.url));
+  return join8(thisDir, "commands");
 }
 var ClaudeCodeInstallProvider;
 var init_install = __esm({
   "packages/adapters/src/providers/claude-code/install.ts"() {
     "use strict";
+    init_heavy_command_hook_install();
     init_hook_template_installer();
     init_paths();
     ClaudeCodeInstallProvider = class {
@@ -44449,6 +45419,21 @@ var init_install = __esm({
         } catch (err) {
           settingsErrors.push(err instanceof Error ? err.message : String(err));
         }
+        if (options.heavyCommandHook !== void 0) {
+          const projectSettings = join8(projectDir, ".claude", "settings.json");
+          if (isUserHomeDir(projectDir) || resolve3(projectSettings) === resolve3(claudeSettingsPath())) {
+            details.heavyCommandHook = "skipped";
+          } else {
+            try {
+              details.heavyCommandHook = await syncClaudeCodeHeavyCommandHook(
+                projectDir,
+                options.heavyCommandHook
+              );
+            } catch (err) {
+              settingsErrors.push(err instanceof Error ? err.message : String(err));
+            }
+          }
+        }
         if (settingsErrors.length > 0) {
           details.settingsErrors = settingsErrors;
         }
@@ -44473,9 +45458,9 @@ var init_install = __esm({
        */
       async isInstalled() {
         const settingsPath = claudeSettingsPath();
-        if (existsSync6(settingsPath)) {
+        if (existsSync7(settingsPath)) {
           try {
-            const settings = JSON.parse(readFileSync4(settingsPath, "utf-8"));
+            const settings = JSON.parse(readFileSync5(settingsPath, "utf-8"));
             const plugins = settings.enabledPlugins;
             if (plugins && plugins["cleo@cleocode"] === true) {
               return true;
@@ -44507,16 +45492,16 @@ var init_install = __esm({
        */
       installCommands(projectDir) {
         const adapterCommandsDir = getAdapterCommandsDir();
-        if (!existsSync6(adapterCommandsDir)) {
+        if (!existsSync7(adapterCommandsDir)) {
           return [];
         }
-        const targetDir = join7(projectDir, ".claude", "commands");
-        mkdirSync2(targetDir, { recursive: true });
+        const targetDir = join8(projectDir, ".claude", "commands");
+        mkdirSync3(targetDir, { recursive: true });
         const installed = [];
-        const files = readdirSync2(adapterCommandsDir).filter((f) => f.endsWith(".md"));
+        const files = readdirSync3(adapterCommandsDir).filter((f) => f.endsWith(".md"));
         for (const file2 of files) {
-          const src = join7(adapterCommandsDir, file2);
-          const dest = join7(targetDir, file2);
+          const src = join8(adapterCommandsDir, file2);
+          const dest = join8(targetDir, file2);
           copyFileSync2(src, dest);
           installed.push(file2);
         }
@@ -44529,7 +45514,7 @@ var init_install = __esm({
        */
       async registerPlugin() {
         const pluginKey = "cleo@cleocode";
-        const wrote = await updateJsonConfigFile2(claudeSettingsPath(), (settings) => {
+        const wrote = await updateJsonConfigFile3(claudeSettingsPath(), (settings) => {
           const enabledPlugins = settings.enabledPlugins ?? {};
           if (!isPlainObject2(enabledPlugins)) {
             throw new Error('settings.json "enabledPlugins" is not an object; not modifying it');
@@ -44568,7 +45553,7 @@ var init_install = __esm({
        */
       async installHookTemplates() {
         const claudeDir = getClaudeConfigDir();
-        const hooksDir = join7(claudeDir, "hooks");
+        const hooksDir = join8(claudeDir, "hooks");
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -44579,7 +45564,7 @@ var init_install = __esm({
           return null;
         }
         const settingsEntryAdded = await this.registerPreCompactHook(
-          join7(hooksDir, "precompact-safestop.sh")
+          join8(hooksDir, "precompact-safestop.sh")
         );
         if (templates.installedFiles.length === 0 && !settingsEntryAdded) {
           return null;
@@ -44601,7 +45586,7 @@ var init_install = __esm({
        * @task T1013
        */
       async registerPreCompactHook(shimPath) {
-        return updateJsonConfigFile2(claudeSettingsPath(), (settings) => {
+        return updateJsonConfigFile3(claudeSettingsPath(), (settings) => {
           const hooks = hookMap(settings);
           if (hasCleoHook(hooks.PreCompact, "precompact-safestop.sh")) {
             return false;
@@ -44625,7 +45610,7 @@ var init_install = __esm({
 
 // packages/adapters/src/providers/shared/agent-spawn-wrapper.ts
 import { spawnSync } from "node:child_process";
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { resolveSpawnInvocation } from "@cleocode/paths";
 function hasSystemdRun() {
   if (_systemdRunAvailable !== void 0) return _systemdRunAvailable;
@@ -44640,7 +45625,7 @@ function hasSystemdRun() {
 function readMemTotalBytes() {
   if (process.platform !== "linux") return 32 * 1024 * 1024 * 1024;
   try {
-    const raw = readFileSync5("/proc/meminfo", "utf8");
+    const raw = readFileSync6("/proc/meminfo", "utf8");
     const m = raw.match(/^MemTotal:\s+(\d+)\s+kB/m);
     if (m?.[1]) return parseInt(m[1], 10) * 1024;
   } catch {
@@ -44723,16 +45708,16 @@ var init_agent_spawn_wrapper = __esm({
 
 // packages/adapters/src/providers/shared/prompt-file.ts
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname5, join as join9 } from "node:path";
 async function writeSpawnPromptFile(prefix, prompt) {
-  const dir = await mkdtemp(join8(tmpdir(), `cleo-${prefix}-`));
-  const file2 = join8(dir, "prompt.txt");
+  const dir = await mkdtemp(join9(tmpdir2(), `cleo-${prefix}-`));
+  const file2 = join9(dir, "prompt.txt");
   await writeFile(file2, prompt, "utf-8");
   return file2;
 }
 async function removeSpawnPromptFile(file2) {
-  await rm(dirname4(file2), { recursive: true, force: true }).catch(() => void 0);
+  await rm(dirname5(file2), { recursive: true, force: true }).catch(() => void 0);
 }
 var init_prompt_file = __esm({
   "packages/adapters/src/providers/shared/prompt-file.ts"() {
@@ -44824,7 +45809,7 @@ function isEsrch(err) {
   return false;
 }
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 var SIGTERM_GRACE_MS;
 var init_suite_reaper = __esm({
@@ -45025,7 +46010,7 @@ var init_spawn2 = __esm({
 
 // packages/adapters/src/providers/claude-code/task-sync.ts
 import { readFile as readFile2, stat } from "node:fs/promises";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function parseTaskId(content) {
   const match = content.match(/^\[T(\d+)\]/);
   return match ? `T${match[1]}` : null;
@@ -45046,7 +46031,7 @@ function mapStatus(twStatus) {
   }
 }
 function getTodoWriteFilePath(projectDir) {
-  return join9(projectDir, ".cleo", "sync", "todowrite-state.json");
+  return join10(projectDir, ".cleo", "sync", "todowrite-state.json");
 }
 var ClaudeCodeTaskSyncProvider;
 var init_task_sync = __esm({
@@ -45117,9 +46102,9 @@ var init_transport = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/adapter.ts
-import { existsSync as existsSync7 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as join11 } from "node:path";
 import { findOnPath as findOnPath2 } from "@cleocode/paths";
 var ClaudeCodeAdapter;
 var init_adapter = __esm({
@@ -45272,8 +46257,8 @@ var init_adapter = __esm({
         cliAvailable = resolvedCli !== null;
         if (resolvedCli) details.cliPath = resolvedCli;
         else details.cliAvailable = false;
-        const claudeConfigDir = join10(homedir5(), ".claude");
-        const configExists = existsSync7(claudeConfigDir);
+        const claudeConfigDir = join11(homedir6(), ".claude");
+        const configExists = existsSync8(claudeConfigDir);
         details.configDirExists = configExists;
         const entrypointSet = process.env.CLAUDE_CODE_ENTRYPOINT !== void 0;
         details.entrypointEnvSet = entrypointSet;
@@ -45302,17 +46287,17 @@ var init_adapter = __esm({
 });
 
 // packages/adapters/src/providers/claude-code/statusline.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join12 } from "node:path";
 function getClaudeSettingsPath() {
-  return process.env["CLAUDE_SETTINGS"] ?? join11(process.env["CLAUDE_HOME"] ?? join11(homedir6(), ".claude"), "settings.json");
+  return process.env["CLAUDE_SETTINGS"] ?? join12(process.env["CLAUDE_HOME"] ?? join12(homedir7(), ".claude"), "settings.json");
 }
 function checkStatuslineIntegration() {
   const settingsPath = getClaudeSettingsPath();
-  if (!existsSync8(settingsPath)) return "no_settings";
+  if (!existsSync9(settingsPath)) return "no_settings";
   try {
-    const settings = JSON.parse(readFileSync6(settingsPath, "utf-8"));
+    const settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
     const statusLine = settings.statusLine;
     if (!statusLine?.type) return "not_configured";
     if (statusLine.type !== "command") return "custom_no_cleo";
@@ -45320,10 +46305,10 @@ function checkStatuslineIntegration() {
     if (cmd.includes("context-monitor.sh") || cmd.includes("cleo-statusline") || cmd.includes(".context-state.json") || cmd.includes("context-states")) {
       return "configured";
     }
-    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir6()) : cmd;
-    if (existsSync8(scriptPath)) {
+    const scriptPath = cmd.startsWith("~") ? cmd.replace("~", homedir7()) : cmd;
+    if (existsSync9(scriptPath)) {
       try {
-        const content = readFileSync6(scriptPath, "utf-8");
+        const content = readFileSync7(scriptPath, "utf-8");
         if (content.includes("context-state.json")) return "configured";
       } catch {
       }
@@ -45337,7 +46322,7 @@ function getStatuslineConfig(cleoHome) {
   return {
     statusLine: {
       type: "command",
-      command: join11(cleoHome, "lib", "session", "context-monitor.sh")
+      command: join12(cleoHome, "lib", "session", "context-monitor.sh")
     }
   };
 }
@@ -45559,12 +46544,12 @@ var init_hooks2 = __esm({
        * @returns Cursor native event name (e.g. "preToolUse") or null
        * @task T165
        */
-      async toNativeEvent(canonical) {
+      async toNativeEvent(canonical2) {
         try {
           const { toNative } = await import("@cleocode/caamp");
-          return toNative(canonical, PROVIDER_ID2);
+          return toNative(canonical2, PROVIDER_ID2);
         } catch {
-          const entry = Object.entries(CURSOR_EVENT_MAP).find(([, v]) => v === canonical);
+          const entry = Object.entries(CURSOR_EVENT_MAP).find(([, v]) => v === canonical2);
           return entry?.[0] ?? null;
         }
       }
@@ -45573,12 +46558,12 @@ var init_hooks2 = __esm({
 });
 
 // packages/adapters/src/providers/cursor/install.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "node:fs";
+import { join as join18 } from "node:path";
 import {
   ensureProviderInstructionFile as ensureProviderInstructionFile3,
   ensureProviderRuleFile,
-  updateJsonConfigFile as updateJsonConfigFile3
+  updateJsonConfigFile as updateJsonConfigFile4
 } from "@cleocode/caamp";
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -45645,14 +46630,14 @@ var init_install2 = __esm({
        * Checks for .cursor/rules/cleo.mdc or .cursorrules with CLEO references.
        */
       async isInstalled() {
-        const mdcPath = join17(process.cwd(), ".cursor", "rules", "cleo.mdc");
-        if (existsSync11(mdcPath)) {
+        const mdcPath = join18(process.cwd(), ".cursor", "rules", "cleo.mdc");
+        if (existsSync12(mdcPath)) {
           return true;
         }
-        const rulesPath = join17(process.cwd(), ".cursorrules");
-        if (existsSync11(rulesPath)) {
+        const rulesPath = join18(process.cwd(), ".cursorrules");
+        if (existsSync12(rulesPath)) {
           try {
-            const content = readFileSync7(rulesPath, "utf-8");
+            const content = readFileSync8(rulesPath, "utf-8");
             const injectionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
             if (content.includes(injectionRef) || content.includes("@.cleo/memory-bridge.md")) {
               return true;
@@ -45697,7 +46682,7 @@ var init_install2 = __esm({
             onlyIfExists: true
           }),
           await ensureProviderRuleFile("cursor", projectDir, {
-            relativePath: join17(".cursor", "rules", "cleo.mdc"),
+            relativePath: join18(".cursor", "rules", "cleo.mdc"),
             preamble: CLEO_MDC_FRONTMATTER
           })
         ];
@@ -45708,10 +46693,10 @@ var init_install2 = __esm({
        */
       getUpdatedFileList(projectDir) {
         const files = [];
-        if (existsSync11(join17(projectDir, ".cursorrules"))) {
-          files.push(join17(projectDir, ".cursorrules"));
+        if (existsSync12(join18(projectDir, ".cursorrules"))) {
+          files.push(join18(projectDir, ".cursorrules"));
         }
-        files.push(join17(projectDir, ".cursor", "rules", "cleo.mdc"));
+        files.push(join18(projectDir, ".cursor", "rules", "cleo.mdc"));
         return files;
       }
       /**
@@ -45733,7 +46718,7 @@ var init_install2 = __esm({
        * @task T1013
        */
       async installHookTemplates(projectDir) {
-        const hooksDir = join17(projectDir, ".cursor", "hooks");
+        const hooksDir = join18(projectDir, ".cursor", "hooks");
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -45745,7 +46730,7 @@ var init_install2 = __esm({
         }
         const hooksJsonEntryAdded = await this.registerPreCompactHook(
           projectDir,
-          join17(hooksDir, "precompact.sh")
+          join18(hooksDir, "precompact.sh")
         );
         if (templates.installedFiles.length === 0 && !hooksJsonEntryAdded) {
           return null;
@@ -45766,8 +46751,8 @@ var init_install2 = __esm({
        * @task T1013
        */
       async registerPreCompactHook(projectDir, shimPath) {
-        const hooksJsonPath = join17(projectDir, ".cursor", "hooks.json");
-        return updateJsonConfigFile3(hooksJsonPath, (config2) => {
+        const hooksJsonPath = join18(projectDir, ".cursor", "hooks.json");
+        return updateJsonConfigFile4(hooksJsonPath, (config2) => {
           const hooks = config2.hooks ?? {};
           if (!isRecord(hooks)) {
             throw new Error('.cursor/hooks.json "hooks" is not an object; not modifying it');
@@ -45795,8 +46780,8 @@ var init_install2 = __esm({
 });
 
 // packages/adapters/src/providers/cursor/adapter.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 var CursorAdapter;
 var init_adapter2 = __esm({
   "packages/adapters/src/providers/cursor/adapter.ts"() {
@@ -45890,14 +46875,14 @@ var init_adapter2 = __esm({
         }
         let configExists = false;
         if (this.projectDir) {
-          const cursorConfigDir = join18(this.projectDir, ".cursor");
-          configExists = existsSync12(cursorConfigDir);
+          const cursorConfigDir = join19(this.projectDir, ".cursor");
+          configExists = existsSync13(cursorConfigDir);
           details.configDirExists = configExists;
         }
         const editorEnvSet = process.env.CURSOR_EDITOR !== void 0;
         details.editorEnvSet = editorEnvSet;
         if (this.projectDir) {
-          const legacyRulesExist = existsSync12(join18(this.projectDir, ".cursorrules"));
+          const legacyRulesExist = existsSync13(join19(this.projectDir, ".cursorrules"));
           details.legacyRulesExist = legacyRulesExist;
         }
         const healthy = configExists || editorEnvSet;
@@ -46087,12 +47072,12 @@ var init_hooks3 = __esm({
        * @returns OpenCode native event name or null
        * @task T164
        */
-      async toNativeEvent(canonical) {
+      async toNativeEvent(canonical2) {
         try {
           const { toNative } = await import("@cleocode/caamp");
-          return toNative(canonical, PROVIDER_ID3);
+          return toNative(canonical2, PROVIDER_ID3);
         } catch {
-          const entry = Object.entries(OPENCODE_EVENT_MAP).find(([, v]) => v === canonical);
+          const entry = Object.entries(OPENCODE_EVENT_MAP).find(([, v]) => v === canonical2);
           return entry?.[0] ?? null;
         }
       }
@@ -46101,13 +47086,14 @@ var init_hooks3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/install.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join25 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile6 } from "@cleocode/caamp";
 var OpenCodeInstallProvider;
 var init_install3 = __esm({
   "packages/adapters/src/providers/opencode/install.ts"() {
     "use strict";
+    init_heavy_command_hook_install();
     init_hook_template_installer();
     init_paths2();
     OpenCodeInstallProvider = class {
@@ -46127,14 +47113,28 @@ var init_install3 = __esm({
         });
         const instructionFileUpdated = instructResult.action !== "intact";
         if (instructionFileUpdated) {
-          details.instructionFile = join24(projectDir, instructResult.instructFile);
+          details.instructionFile = join25(projectDir, instructResult.instructFile);
         }
         const hookResult = this.installHookTemplates(projectDir);
         if (hookResult) {
           details.hookTemplates = hookResult;
         }
+        let success2 = true;
+        if (options.heavyCommandHook !== void 0 && isUserHomeDir(projectDir)) {
+          details.heavyCommandHook = "skipped";
+        } else if (options.heavyCommandHook !== void 0) {
+          try {
+            details.heavyCommandHook = syncOpencodeHeavyCommandPlugin(
+              projectDir,
+              options.heavyCommandHook
+            );
+          } catch (err) {
+            details.settingsErrors = [err instanceof Error ? err.message : String(err)];
+            success2 = false;
+          }
+        }
         return {
-          success: true,
+          success: success2,
           installedAt,
           instructionFileUpdated,
           details
@@ -46200,8 +47200,8 @@ var init_install3 = __esm({
        * @task T1013
        */
       installHookTemplates(projectDir) {
-        const pluginsDir = join24(projectDir, ".opencode", "plugins");
-        const hooksDir = join24(pluginsDir, "hooks");
+        const pluginsDir = join25(projectDir, ".opencode", "plugins");
+        const hooksDir = join25(pluginsDir, "hooks");
         let templates;
         try {
           templates = installProviderHookTemplates({
@@ -46213,7 +47213,7 @@ var init_install3 = __esm({
         }
         let pluginWritten = false;
         try {
-          pluginWritten = this.writePrecompactPlugin(pluginsDir, join24(hooksDir, "precompact.sh"));
+          pluginWritten = this.writePrecompactPlugin(pluginsDir, join25(hooksDir, "precompact.sh"));
         } catch {
         }
         if (templates.installedFiles.length === 0 && !pluginWritten) {
@@ -46237,7 +47237,7 @@ var init_install3 = __esm({
        * @task T1013
        */
       writePrecompactPlugin(pluginsDir, shimPath) {
-        const pluginPath = join24(pluginsDir, "cleo-precompact.js");
+        const pluginPath = join25(pluginsDir, "cleo-precompact.js");
         const generated = [
           "// CLEO PreCompact plugin for OpenCode (generated by @cleocode/adapters).",
           "// Bridges the canonical CAAMP `PreCompact` event",
@@ -46263,16 +47263,16 @@ var init_install3 = __esm({
           "}",
           ""
         ].join("\n");
-        if (existsSync17(pluginPath)) {
+        if (existsSync18(pluginPath)) {
           try {
-            if (readFileSync10(pluginPath, "utf-8") === generated) {
+            if (readFileSync11(pluginPath, "utf-8") === generated) {
               return false;
             }
           } catch {
           }
         }
-        mkdirSync3(pluginsDir, { recursive: true });
-        writeFileSync2(pluginPath, generated, "utf-8");
+        mkdirSync4(pluginsDir, { recursive: true });
+        writeFileSync3(pluginPath, generated, "utf-8");
         return true;
       }
     };
@@ -46281,7 +47281,7 @@ var init_install3 = __esm({
 
 // packages/adapters/src/providers/opencode/spawn.ts
 import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { findOnPath as findOnPath9 } from "@cleocode/paths";
 function buildOpenCodeAgentMarkdown(description, instructions) {
   const normalizedDesc = description.replace(/\s+/g, " ").trim();
@@ -46297,8 +47297,8 @@ function buildOpenCodeAgentMarkdown(description, instructions) {
   ].join("\n");
 }
 async function ensureSubagentDefinition(workingDirectory, enrichedInstructions) {
-  const agentDir = join25(workingDirectory, ".opencode", "agent");
-  const agentPath = join25(agentDir, `${OPENCODE_SUBAGENT_NAME}.md`);
+  const agentDir = join26(workingDirectory, ".opencode", "agent");
+  const agentPath = join26(agentDir, `${OPENCODE_SUBAGENT_NAME}.md`);
   const description = "CLEO task executor with protocol compliance and CANT context.";
   const instructions = enrichedInstructions ?? [
     "# CLEO Subagent",
@@ -46462,8 +47462,8 @@ var init_spawn3 = __esm({
 });
 
 // packages/adapters/src/providers/opencode/adapter.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join27 } from "node:path";
 import { findOnPath as findOnPath10 } from "@cleocode/paths";
 var OpenCodeAdapter;
 var init_adapter3 = __esm({
@@ -46571,8 +47571,8 @@ var init_adapter3 = __esm({
         if (resolvedCli) details.cliPath = resolvedCli;
         else details.cliAvailable = false;
         if (this.projectDir) {
-          const openCodeConfigDir = join26(this.projectDir, ".opencode");
-          const configExists = existsSync18(openCodeConfigDir);
+          const openCodeConfigDir = join27(this.projectDir, ".opencode");
+          const configExists = existsSync19(openCodeConfigDir);
           details.configDirExists = configExists;
         }
         const versionEnvSet = process.env.OPENCODE_VERSION !== void 0;
@@ -46767,12 +47767,12 @@ var init_hooks4 = __esm({
        * @returns Pi native event name or null
        * @task T553
        */
-      async toNativeEvent(canonical) {
+      async toNativeEvent(canonical2) {
         try {
           const { toNative } = await import("@cleocode/caamp");
-          return toNative(canonical, PROVIDER_ID4);
+          return toNative(canonical2, PROVIDER_ID4);
         } catch {
-          const entry = Object.entries(PI_EVENT_MAP).find(([, v]) => v === canonical);
+          const entry = Object.entries(PI_EVENT_MAP).find(([, v]) => v === canonical2);
           return entry?.[0] ?? null;
         }
       }
@@ -46781,7 +47781,7 @@ var init_hooks4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/install.ts
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile7 } from "@cleocode/caamp";
 function getCleoReferences() {
   return [`@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`, "@.cleo/memory-bridge.md"];
@@ -46808,7 +47808,7 @@ var init_install4 = __esm({
         });
         const projectUpdated = projectResult.action !== "intact";
         if (projectUpdated) {
-          details.instructionFile = join27(projectDir, projectResult.instructFile);
+          details.instructionFile = join28(projectDir, projectResult.instructFile);
         }
         let globalUpdated = false;
         try {
@@ -47013,22 +48013,22 @@ var init_spawn4 = __esm({
 });
 
 // packages/adapters/src/providers/pi/adapter.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
+import { join as join29 } from "node:path";
 import { findOnPath as findOnPath12 } from "@cleocode/paths";
 function getPiAgentDir() {
   const env = process.env["PI_CODING_AGENT_DIR"];
   if (env !== void 0 && env.length > 0) {
-    if (env === "~") return homedir12();
-    if (env.startsWith("~/")) return join28(homedir12(), env.slice(2));
+    if (env === "~") return homedir13();
+    if (env.startsWith("~/")) return join29(homedir13(), env.slice(2));
     return env;
   }
   const piHome = process.env["PI_HOME"];
   if (piHome !== void 0 && piHome.length > 0) {
-    return join28(piHome, "agent");
+    return join29(piHome, "agent");
   }
-  return join28(homedir12(), ".pi", "agent");
+  return join29(homedir13(), ".pi", "agent");
 }
 var PiAdapter;
 var init_adapter4 = __esm({
@@ -47136,12 +48136,12 @@ var init_adapter4 = __esm({
         if (resolvedCli) details.cliPath = cliPath === "pi" ? resolvedCli : cliPath;
         else details.cliAvailable = false;
         const agentDir = getPiAgentDir();
-        const agentDirExists = existsSync19(agentDir);
+        const agentDirExists = existsSync20(agentDir);
         details.agentDirExists = agentDirExists;
         details.agentDir = agentDir;
         if (this.projectDir) {
-          const projectPiDir = join28(this.projectDir, ".pi");
-          details.projectPiDirExists = existsSync19(projectPiDir);
+          const projectPiDir = join29(this.projectDir, ".pi");
+          details.projectPiDirExists = existsSync20(projectPiDir);
         }
         details.piCodingAgentDirSet = process.env["PI_CODING_AGENT_DIR"] !== void 0;
         details.piHomeSet = process.env["PI_HOME"] !== void 0;
@@ -47314,16 +48314,16 @@ var ClaudeSDKAdapter = class {
 };
 
 // packages/adapters/src/providers/claude-sdk/mcp-registry.ts
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join13 } from "node:path";
 var CLEO_MCP_CANDIDATES = [
   { name: "brain", binary: "cleo-mcp-brain" },
   { name: "nexus", binary: "cleo-mcp-nexus" },
   { name: "tasks", binary: "cleo-mcp-tasks" }
 ];
 function findInNodeModules(binary, workingDir) {
-  const binPath = join12(workingDir, "node_modules", ".bin", binary);
-  if (existsSync9(binPath)) {
+  const binPath = join13(workingDir, "node_modules", ".bin", binary);
+  if (existsSync10(binPath)) {
     return binPath;
   }
   return void 0;
@@ -47352,18 +48352,18 @@ function createAdapter2() {
 }
 
 // packages/adapters/src/providers/codex/adapter.ts
-import { existsSync as existsSync10 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join17 } from "node:path";
 import { findOnPath as findOnPath3 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/codex/hooks.ts
-import { homedir as homedir7 } from "node:os";
-import { join as join14 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join15 } from "node:path";
 
 // packages/adapters/src/providers/shared/transcript-reader.ts
 import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function parseTranscriptLines(raw) {
   const turns = [];
   const lines = raw.split("\n").filter((l) => l.trim());
@@ -47388,7 +48388,7 @@ async function readLatestTranscript(providerDir) {
       if (!entry.isFile()) continue;
       const name15 = entry.name;
       if (name15.endsWith(".json") || name15.endsWith(".jsonl")) {
-        allFiles.push(join13(providerDir, name15));
+        allFiles.push(join14(providerDir, name15));
       }
     }
   } catch {
@@ -47478,13 +48478,14 @@ var CodexHookProvider = class {
    * @task T162 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join14(homedir7(), ".codex"));
+    return readLatestTranscript(join15(homedir8(), ".codex"));
   }
 };
 
 // packages/adapters/src/providers/codex/install.ts
+init_heavy_command_hook_install();
 init_paths2();
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile2 } from "@cleocode/caamp";
 var CodexInstallProvider = class {
   /**
@@ -47504,10 +48505,25 @@ var CodexInstallProvider = class {
     });
     const instructionFileUpdated = result.action !== "intact";
     if (instructionFileUpdated) {
-      details.instructionFile = join15(projectDir, result.instructFile);
+      details.instructionFile = join16(projectDir, result.instructFile);
+    }
+    let success2 = true;
+    if (options.heavyCommandHook !== void 0 && isUserHomeDir(projectDir)) {
+      details.heavyCommandHook = "skipped";
+    } else if (options.heavyCommandHook !== void 0) {
+      try {
+        details.heavyCommandHook = await syncJsonHeavyCommandHook(
+          join16(projectDir, ".codex", "hooks.json"),
+          "codex",
+          options.heavyCommandHook
+        );
+      } catch (err) {
+        details.settingsErrors = [err instanceof Error ? err.message : String(err)];
+        success2 = false;
+      }
     }
     return {
-      success: true,
+      success: success2,
       installedAt,
       instructionFileUpdated,
       details
@@ -47638,8 +48654,8 @@ var CodexAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const codexConfigDir = join16(homedir8(), ".codex");
-    const configExists = existsSync10(codexConfigDir);
+    const codexConfigDir = join17(homedir9(), ".codex");
+    const configExists = existsSync11(codexConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
     details.cliAvailable = cliAvailable;
@@ -47680,14 +48696,14 @@ function createAdapter3() {
 init_cursor();
 
 // packages/adapters/src/providers/gemini-cli/adapter.ts
-import { existsSync as existsSync14 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { join as join22 } from "node:path";
 import { findOnPath as findOnPath5 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/gemini-cli/hooks.ts
-import { homedir as homedir9 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { join as join20 } from "node:path";
 var GEMINI_CLI_EVENT_MAP = {
   SessionStart: "SessionStart",
   SessionEnd: "SessionEnd",
@@ -47765,14 +48781,14 @@ var GeminiCliHookProvider = class {
    * @task T161 @epic T134
    */
   async getTranscript(_sessionId, _projectDir) {
-    return readLatestTranscript(join19(homedir9(), ".gemini"));
+    return readLatestTranscript(join20(homedir10(), ".gemini"));
   }
 };
 
 // packages/adapters/src/providers/gemini-cli/install.ts
 init_paths2();
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
+import { join as join21 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile4 } from "@cleocode/caamp";
 var GeminiCliInstallProvider = class {
   /**
@@ -47817,10 +48833,10 @@ var GeminiCliInstallProvider = class {
    */
   async isInstalled() {
     const instructionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
-    const geminiMdPath = join20(process.cwd(), "GEMINI.md");
-    if (existsSync13(geminiMdPath)) {
+    const geminiMdPath = join21(process.cwd(), "GEMINI.md");
+    if (existsSync14(geminiMdPath)) {
       try {
-        const content = readFileSync8(geminiMdPath, "utf-8");
+        const content = readFileSync9(geminiMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -47937,8 +48953,8 @@ var GeminiCliAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const geminiConfigDir = join21(homedir10(), ".gemini");
-    const configExists = existsSync14(geminiConfigDir);
+    const geminiConfigDir = join22(homedir11(), ".gemini");
+    const configExists = existsSync15(geminiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
     details.cliAvailable = cliAvailable;
@@ -47975,9 +48991,9 @@ function createAdapter5() {
 }
 
 // packages/adapters/src/providers/kimi/adapter.ts
-import { existsSync as existsSync16 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync17 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { join as join24 } from "node:path";
 import { findOnPath as findOnPath7 } from "@cleocode/paths";
 
 // packages/adapters/src/providers/kimi/hooks.ts
@@ -48037,8 +49053,8 @@ var KimiHookProvider = class {
 
 // packages/adapters/src/providers/kimi/install.ts
 init_paths2();
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
+import { join as join23 } from "node:path";
 import { ensureProviderInstructionFile as ensureProviderInstructionFile5 } from "@cleocode/caamp";
 var KimiInstallProvider = class {
   /**
@@ -48083,10 +49099,10 @@ var KimiInstallProvider = class {
    */
   async isInstalled() {
     const instructionRef = `@${getCleoTemplatesTildePath()}/CLEO-INJECTION.md`;
-    const agentsMdPath = join22(process.cwd(), "AGENTS.md");
-    if (existsSync15(agentsMdPath)) {
+    const agentsMdPath = join23(process.cwd(), "AGENTS.md");
+    if (existsSync16(agentsMdPath)) {
       try {
-        const content = readFileSync9(agentsMdPath, "utf-8");
+        const content = readFileSync10(agentsMdPath, "utf-8");
         if (content.includes(instructionRef)) {
           return true;
         }
@@ -48190,8 +49206,8 @@ var KimiAdapter = class {
     cliAvailable = resolvedCli !== null;
     if (resolvedCli) details.cliPath = resolvedCli;
     else details.cliAvailable = false;
-    const kimiConfigDir = join23(homedir11(), ".kimi");
-    const configExists = existsSync16(kimiConfigDir);
+    const kimiConfigDir = join24(homedir12(), ".kimi");
+    const configExists = existsSync17(kimiConfigDir);
     details.configDirExists = configExists;
     const healthy = cliAvailable;
     details.cliAvailable = cliAvailable;
@@ -48231,17 +49247,17 @@ init_opencode();
 init_hook_template_installer();
 
 // packages/adapters/src/registry.ts
-import { readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname5, join as join29, resolve as resolve2 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname6, join as join30, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PROVIDER_IDS = ["claude-code", "opencode", "cursor", "pi"];
 function getProviderManifests() {
   const manifests = [];
-  const baseDir = resolve2(dirname5(fileURLToPath3(import.meta.url)), "providers");
+  const baseDir = resolve4(dirname6(fileURLToPath3(import.meta.url)), "providers");
   for (const providerId of PROVIDER_IDS) {
     try {
-      const manifestPath = join29(baseDir, providerId, "manifest.json");
-      const raw = readFileSync11(manifestPath, "utf-8");
+      const manifestPath = join30(baseDir, providerId, "manifest.json");
+      const raw = readFileSync12(manifestPath, "utf-8");
       manifests.push(JSON.parse(raw));
     } catch {
     }