@cleocode/cleo 2026.10.2 → 2026.10.4

package/dist/cli/chunk-EOPQFCSR.js

@@ -0,0 +1,148 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  dispatchRaw,
+  handleRawError,
+  maybeEmitDescribe
+} from "./chunk-3IOQVUO7.js";
+import {
+  cliOutput
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/commands/complete.ts
+var completeCommandArgs = {
+  taskId: {
+    type: "positional",
+    description: "ID of the task to complete",
+    required: true
+  },
+  notes: {
+    type: "string",
+    description: "Completion notes"
+  },
+  changeset: {
+    type: "string",
+    description: "Changeset reference"
+  },
+  "verification-note": {
+    type: "string",
+    description: "Evidence that acceptance criteria were met"
+  },
+  "acknowledge-risk": {
+    type: "string",
+    description: "Reason for acknowledging CRITICAL impact risk (bypasses nexusImpact gate)"
+  },
+  "override-reason": {
+    type: "string",
+    description: "Reason for bypassing E_EPIC_HAS_PENDING_CHILDREN guard (audited to .cleo/audit/premature-close.jsonl)"
+  },
+  // T10509 — AC-coverage gate (load-bearing IVTR closure)
+  "waive-ac": {
+    type: "string",
+    description: "Comma-separated AC tokens (UUIDs or AC<n> aliases) to waive from the AC-coverage gate. Requires --waive-reason. Audited to .cleo/audit/ac-waiver.jsonl."
+  },
+  "waive-reason": {
+    type: "string",
+    description: "Mandatory justification text for --waive-ac. Captured verbatim in the audit row."
+  },
+  // T10538 — cancelled-child waiver gate (PM-Core V2 agent-trust)
+  "waive-cancelled-children": {
+    type: "string",
+    description: "Reason for completing a parent that has cancelled children. Cancelled work does not silently satisfy completion; the reason is audited to .cleo/audit/cancelled-child-waiver.jsonl."
+  },
+  // T11954 (DHQ-071) — depends-edge waiver for stale/over-specified deps
+  "waive-depends": {
+    type: "string",
+    description: "Reason for completing a task whose own work is done but whose depends edges point at not-yet-terminal tasks (stale/over-specified). Audited to .cleo/audit/depends-waiver.jsonl."
+  },
+  // T12503 — optimistic concurrency
+  "if-match": {
+    type: "string",
+    description: "Fail with E_CONFLICT unless the task updatedAt still equals this version (from cleo show). Guards against completing over a concurrent edit."
+  }
+};
+function completeDispatchParams(args) {
+  const str = (key) => args[key];
+  return {
+    taskId: args.taskId,
+    notes: str("notes"),
+    changeset: str("changeset"),
+    verificationNote: str("verification-note"),
+    acknowledgeRisk: str("acknowledge-risk"),
+    overrideReason: str("override-reason"),
+    // T10509 — AC-coverage gate waiver path
+    waiveAc: str("waive-ac"),
+    waiveReason: str("waive-reason"),
+    // T10538 — cancelled-child waiver (PM-Core V2 agent-trust)
+    cancelledChildWaiverReason: str("waive-cancelled-children"),
+    // T11954 (DHQ-071) — depends-edge waiver for stale/over-specified deps
+    waiveDependsReason: str("waive-depends"),
+    // T12503 — optimistic concurrency
+    expectedUpdatedAt: str("if-match")
+  };
+}
+var completeCommand = defineCommand({
+  meta: {
+    name: "complete",
+    description: "Mark a task as completed (requires active session)"
+  },
+  args: completeCommandArgs,
+  async run({ args }) {
+    if (maybeEmitDescribe("mutate", "tasks", "complete", { command: "complete" })) return;
+    const response = await dispatchRaw("mutate", "tasks", "complete", completeDispatchParams(args));
+    if (!response.success) {
+      handleRawError(response, { command: "complete", operation: "tasks.complete" });
+    }
+    const data = response.data;
+    if (response.meta.mutateProjection === "mvi") {
+      cliOutput(response.data, { command: "complete", operation: "tasks.complete" });
+      return;
+    }
+    const task = data?.task ?? data;
+    const output = { task };
+    if (data?.alreadyDone === true) {
+      output["alreadyDone"] = true;
+    }
+    if (typeof data?.note === "string") {
+      output["note"] = data.note;
+    }
+    const autoCompleted = data?.autoCompleted;
+    if (Array.isArray(autoCompleted) && autoCompleted.length > 0) {
+      output["autoCompleted"] = autoCompleted;
+    }
+    const unblockedTasks = data?.unblockedTasks;
+    if (Array.isArray(unblockedTasks) && unblockedTasks.length > 0) {
+      output["unblockedTasks"] = unblockedTasks;
+    }
+    if (typeof data?.focusCleared === "boolean") output["focusCleared"] = data.focusCleared;
+    if (data?.nextSuggested !== void 0) output["nextSuggested"] = data.nextSuggested;
+    const worktreeAutoComplete = data?.worktreeAutoComplete;
+    if (worktreeAutoComplete && typeof worktreeAutoComplete === "object") {
+      output["worktreeAutoComplete"] = worktreeAutoComplete;
+    }
+    cliOutput(output, { command: "complete", operation: "tasks.complete" });
+  }
+});
+
+export {
+  completeCommandArgs,
+  completeDispatchParams,
+  completeCommand
+};
+//# sourceMappingURL=chunk-EOPQFCSR.js.map

package/dist/cli/chunk-FORFDPP5.js

@@ -0,0 +1,288 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/commands/backup-inspect.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import zlib from "node:zlib";
+import { ExitCode } from "@cleocode/contracts";
+import {
+  BackupObservationInspectionError,
+  detectEncryption,
+  ENC_MIN_LENGTH,
+  ENC_VERSION_OFFSET,
+  ENC_VERSION_SUPPORTED,
+  extractManifestFromTar,
+  fmtBytes,
+  inspectBackupObservation,
+  verifyManifestHash
+} from "@cleocode/core/store/backup-inspect.js";
+function printInspectReport(bundlePath, bundleSize, encrypted, manifest, integrityOk) {
+  const backup = manifest["backup"] ?? {};
+  const databases = manifest["databases"] ?? [];
+  const jsonFiles = manifest["json"] ?? [];
+  const manifestVersion = manifest["manifestVersion"] ?? "unknown";
+  const scope = backup["scope"] ?? "unknown";
+  const createdAt = backup["createdAt"] ?? "unknown";
+  const createdBy = backup["createdBy"] ?? "unknown";
+  const machineFingerprint = backup["machineFingerprint"] ?? "unknown";
+  const projectName = backup["projectName"] ?? "";
+  const projectFingerprint = backup["projectFingerprint"] ?? null;
+  const machineSame = false;
+  const lines = [
+    `Bundle:         ${bundlePath} (${fmtBytes(bundleSize)})`,
+    `Format:         CLEO Backup Bundle v${manifestVersion}`,
+    `Scope:          ${scope}`,
+    `Created:        ${createdAt} by ${createdBy}`,
+    `Encrypted:      ${encrypted ? "yes" : "no"}`,
+    `Source machine: ${machineFingerprint} (${machineSame ? "same" : "different"} as this machine)`
+  ];
+  if (projectName) {
+    lines.push(
+      `Project:        ${projectName}${projectFingerprint ? ` (${projectFingerprint})` : ""}`
+    );
+  }
+  if (databases.length > 0) {
+    lines.push("");
+    lines.push("Databases:");
+    for (const db of databases) {
+      const filename = db["filename"] ?? "";
+      const basename = path.basename(filename);
+      const size = db["size"] ?? 0;
+      const schemaVersion = db["schemaVersion"] ?? "unknown";
+      const rowCounts = db["rowCounts"] ?? {};
+      const rowSummary = Object.entries(rowCounts).map(([tbl, count]) => `${tbl}: ${count}`).join(", ");
+      const rowPart = rowSummary ? `   ${rowSummary}` : "";
+      lines.push(
+        `  ${basename.padEnd(20)} ${fmtBytes(size).padEnd(10)} schema: ${schemaVersion}${rowPart}`
+      );
+    }
+  }
+  if (jsonFiles.length > 0) {
+    lines.push("");
+    lines.push("JSON files:");
+    for (const jf of jsonFiles) {
+      const filename = jf["filename"] ?? "";
+      const basename = path.basename(filename);
+      const size = jf["size"] ?? 0;
+      lines.push(`  ${basename.padEnd(30)} ${fmtBytes(size)}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Manifest integrity: [${integrityOk ? "OK" : "TAMPERED"}]`);
+  humanLine(lines.join("\n"));
+}
+async function inspectAction(bundlePath) {
+  const resolved = path.resolve(bundlePath);
+  if (!fs.existsSync(resolved)) {
+    cliError(`Bundle not found: ${bundlePath}`, 4, { name: "E_NOT_FOUND" });
+    process.exitCode = 4;
+    return;
+  }
+  const encrypted = detectEncryption(resolved);
+  if (encrypted) {
+    const passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
+    if (!passphrase) {
+      humanLine(
+        [
+          `Bundle:    ${bundlePath}`,
+          "Encrypted: yes",
+          "",
+          "Bundle is encrypted. Set the CLEO_BACKUP_PASSPHRASE environment variable",
+          "to decrypt and inspect the manifest contents.",
+          "",
+          "Example:",
+          `  CLEO_BACKUP_PASSPHRASE=<passphrase> cleo backup inspect ${bundlePath}`
+        ].join("\n")
+      );
+      process.exitCode = 0;
+      return;
+    }
+    const { decryptBundle } = await import("@cleocode/core/internal");
+    const encrypted_buf = fs.readFileSync(resolved);
+    if (encrypted_buf.length < ENC_MIN_LENGTH) {
+      cliError("Encrypted bundle payload too short", 70, { name: "E_DECRYPT_FAILED" });
+      process.exitCode = 70;
+      return;
+    }
+    const versionByte = encrypted_buf[ENC_VERSION_OFFSET];
+    if (versionByte !== ENC_VERSION_SUPPORTED) {
+      cliError(
+        `Unsupported encrypted bundle version ${versionByte ?? "undefined"}; expected ${ENC_VERSION_SUPPORTED}`,
+        70,
+        { name: "E_DECRYPT_FAILED" }
+      );
+      process.exitCode = 70;
+      return;
+    }
+    let decryptedBuf;
+    try {
+      decryptedBuf = decryptBundle(encrypted_buf, passphrase);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      cliError(`Decryption failed: ${msg}`, 70, {
+        name: "E_DECRYPT_FAILED",
+        fix: "Verify CLEO_BACKUP_PASSPHRASE matches the bundle."
+      });
+      process.exitCode = 70;
+      return;
+    }
+    const tmpPath = path.join(os.tmpdir(), `cleo-inspect-${process.pid}-${Date.now()}.tar.gz`);
+    try {
+      fs.writeFileSync(tmpPath, decryptedBuf);
+      await inspectTarball(tmpPath, resolved, encrypted);
+    } finally {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+    }
+    return;
+  }
+  await inspectTarball(resolved, resolved, false);
+}
+async function inspectTarball(tarPath, displayPath, encrypted) {
+  const compressedBuf = fs.readFileSync(tarPath);
+  let tarBuf;
+  try {
+    tarBuf = zlib.gunzipSync(compressedBuf);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    cliError(`Failed to decompress bundle: ${msg}`, 71, { name: "E_DECOMPRESS_FAILED" });
+    process.exitCode = 71;
+    return;
+  }
+  const manifestContent = extractManifestFromTar(tarBuf);
+  if (!manifestContent) {
+    cliError("manifest.json not found in bundle", 74, { name: "E_MANIFEST_MISSING" });
+    process.exitCode = 74;
+    return;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestContent);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    cliError(`Failed to parse manifest.json: ${msg}`, 71, { name: "E_MANIFEST_PARSE" });
+    process.exitCode = 71;
+    return;
+  }
+  const integrityOk = verifyManifestHash(manifestContent, manifest);
+  const stat = fs.statSync(displayPath);
+  printInspectReport(displayPath, stat.size, encrypted, manifest, integrityOk);
+  process.exitCode = 0;
+}
+function resolveSnapshotPath(input) {
+  const absolute = path.resolve(input);
+  try {
+    return path.join(fs.realpathSync(path.dirname(absolute)), path.basename(absolute));
+  } catch {
+    return absolute;
+  }
+}
+var backupInspectSubCommand = defineCommand({
+  meta: {
+    name: "inspect",
+    description: "Inspect a bundle manifest or an exact observation in a read-only SQLite snapshot"
+  },
+  args: {
+    bundle: {
+      type: "positional",
+      description: "Path to a backup bundle, or SQLite snapshot when --record-id is supplied",
+      required: true
+    },
+    "record-id": {
+      type: "string",
+      description: "Exact observation ID to inspect in the supplied SQLite snapshot"
+    },
+    "expected-project-id": {
+      type: "string",
+      description: "Expected stable identity; absent historical provenance remains unknown"
+    },
+    label: {
+      type: "string",
+      description: "Advisory original snapshot label; does not establish ownership"
+    },
+    "max-snapshot-bytes": {
+      type: "string",
+      description: "Positive integer source byte ceiling (default 512 MiB, maximum 1 GiB)"
+    },
+    "max-payload-bytes": {
+      type: "string",
+      description: "Positive integer payload byte ceiling (default 1 MiB, maximum 16 MiB)"
+    },
+    json: { type: "boolean", description: "Output structured JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const recordId = args["record-id"];
+    if (recordId === void 0) {
+      if ([
+        args["expected-project-id"],
+        args.label,
+        args["max-snapshot-bytes"],
+        args["max-payload-bytes"]
+      ].some((value) => value !== void 0)) {
+        cliError(
+          "Snapshot inspection flags require --record-id.",
+          ExitCode.VALIDATION_ERROR,
+          { name: "E_BACKUP_INSPECT_INVALID_INPUT" },
+          { operation: "backup.inspect" }
+        );
+        process.exitCode = ExitCode.VALIDATION_ERROR;
+        return;
+      }
+      await inspectAction(args.bundle);
+      return;
+    }
+    try {
+      const result = await inspectBackupObservation({
+        snapshotPath: resolveSnapshotPath(args.bundle),
+        recordId,
+        expectedProjectId: args["expected-project-id"],
+        label: args.label,
+        maxSnapshotBytes: args["max-snapshot-bytes"] === void 0 ? void 0 : Number(args["max-snapshot-bytes"]),
+        maxPayloadBytes: args["max-payload-bytes"] === void 0 ? void 0 : Number(args["max-payload-bytes"])
+      });
+      cliOutput(result, { command: "backup", operation: "backup.inspect" });
+    } catch (error) {
+      cliError(
+        error instanceof Error ? error.message : String(error),
+        ExitCode.VALIDATION_ERROR,
+        {
+          name: error instanceof BackupObservationInspectionError ? `E_BACKUP_INSPECT_${error.code}` : "E_BACKUP_INSPECT_FAILED"
+        },
+        { operation: "backup.inspect" }
+      );
+      process.exitCode = ExitCode.VALIDATION_ERROR;
+    }
+  }
+});
+
+export {
+  backupInspectSubCommand
+};
+//# sourceMappingURL=chunk-FORFDPP5.js.map

package/dist/cli/chunk-GFGLLDXX.js

@@ -0,0 +1,110 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput,
+  humanInfo
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/commands/doctor-exodus-residue.ts
+import {
+  archiveStrandedResidue,
+  buildExodusPlan,
+  detectStrandedResidue
+} from "@cleocode/core/store/exodus/index.js";
+var doctorExodusResidueCommand = defineCommand({
+  meta: {
+    name: "exodus-residue",
+    description: "Detect legacy exodus source DBs still present after a cutover (stranded residue that re-arms the exodus-on-open corruption trigger). Use --fix to archive them into _archive/ (reversible move, never deletes)."
+  },
+  args: {
+    fix: {
+      type: "boolean",
+      description: "Archive stranded legacy source DBs into _archive/ (move, never delete)",
+      default: false
+    }
+  },
+  run({ args }) {
+    const fix = args.fix === true;
+    const cwd = process.cwd();
+    const plan = buildExodusPlan(cwd);
+    const stranded = detectStrandedResidue(plan.sources, cwd);
+    if (stranded.length === 0) {
+      cliOutput(
+        {
+          kind: "generic",
+          ok: true,
+          strandedCount: 0,
+          stranded: [],
+          fixed: false
+        },
+        {
+          command: "doctor exodus-residue",
+          message: "No stranded legacy exodus source DBs (clean cutover or pre-migration install)."
+        }
+      );
+      return;
+    }
+    for (const entry of stranded) {
+      humanInfo(`  STRANDED [${entry.scope}] ${entry.name} \u2192 ${entry.path}`);
+    }
+    if (!fix) {
+      cliOutput(
+        {
+          kind: "generic",
+          ok: false,
+          strandedCount: stranded.length,
+          stranded: stranded.map((s) => ({ name: s.name, path: s.path, scope: s.scope })),
+          fixed: false
+        },
+        {
+          command: "doctor exodus-residue",
+          message: `${stranded.length} stranded legacy source DB(s) found. Run \`cleo doctor exodus-residue --fix\` to archive them.`
+        }
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const archived = archiveStrandedResidue(stranded, plan.sources, cwd);
+    const movedCount = archived.filter((a) => a.action === "archived").length;
+    humanInfo(`  Archived ${movedCount} stranded source DB(s) \u2192 _archive/.`);
+    cliOutput(
+      {
+        kind: "generic",
+        ok: true,
+        strandedCount: stranded.length,
+        stranded: stranded.map((s) => ({ name: s.name, path: s.path, scope: s.scope })),
+        fixed: true,
+        archived: archived.map((a) => ({
+          name: a.name,
+          action: a.action,
+          archivedTo: a.archivedTo
+        }))
+      },
+      {
+        command: "doctor exodus-residue",
+        message: `Archived ${movedCount} stranded legacy source DB(s) into _archive/.`
+      }
+    );
+  }
+});
+
+export {
+  doctorExodusResidueCommand
+};
+//# sourceMappingURL=chunk-GFGLLDXX.js.map