@cleocode/cleo 2026.10.2 → 2026.10.4

package/dist/cli/sentient-M4YMAVGV.js

@@ -0,0 +1,1088 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  negatedFlag
+} from "./chunk-47JYZAMS.js";
+import {
+  isSubCommandDispatch
+} from "./chunk-YY66LFZF.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/sentient.ts
+import { join } from "node:path";
+import { cwd as processCwd, stdin, stdout } from "node:process";
+import { createInterface } from "node:readline/promises";
+import {
+  getSentientDaemonStatus,
+  monitorWorkers,
+  RUNAWAY_BUDGET_MULTIPLIER,
+  resumeSentientDaemon,
+  SENTIENT_STATE_FILE,
+  spawnSentientDaemon,
+  stopSentientDaemon,
+  WORKER_BUDGET_MS
+} from "@cleocode/core/sentient/daemon.js";
+import {
+  appendSentientExecuteAudit,
+  executeFixAction,
+  extractFixActionFromNotesJson,
+  parseFixAction
+} from "@cleocode/core/sentient/execute-action.js";
+import { safeRunProposeTick } from "@cleocode/core/sentient/propose-tick.js";
+import { patchSentientState, readSentientState } from "@cleocode/core/sentient/state.js";
+import { safeRunTick } from "@cleocode/core/sentient/tick.js";
+import {
+  getSkillPatch,
+  getSkillReview,
+  listSkillReviews,
+  markSkillPatchRejected
+} from "@cleocode/core/store/skills-store.js";
+var projectArgs = {
+  project: {
+    type: "string",
+    description: "Project root (defaults to process cwd)"
+  },
+  json: {
+    type: "boolean",
+    description: "Emit LAFS JSON envelope"
+  }
+};
+function resolveProjectRoot(arg) {
+  return arg && arg.length > 0 ? arg : processCwd();
+}
+function emitSuccess(payload, _jsonMode, message, operation) {
+  cliOutput(payload, { command: "sentient", message, ...operation ? { operation } : {} });
+}
+function emitFailure(code, message, _jsonMode, operation) {
+  cliError(message, code, { name: code }, operation ? { operation } : void 0);
+  process.exit(1);
+}
+var startSub = defineCommand({
+  meta: {
+    name: "start",
+    description: "Spawn the sentient daemon as a detached background process"
+  },
+  args: {
+    ...projectArgs,
+    "dry-run": {
+      type: "boolean",
+      description: "Run a single in-process tick without spawning the daemon"
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const dryRun = args["dry-run"] === true;
+    try {
+      const existing = await getSentientDaemonStatus(projectRoot);
+      if (existing.running && existing.pid) {
+        emitSuccess(
+          { running: true, pid: existing.pid, message: "daemon already running" },
+          jsonMode,
+          `Sentient daemon already running (pid ${existing.pid})`
+        );
+        return;
+      }
+      if (dryRun) {
+        const statePath2 = join(projectRoot, SENTIENT_STATE_FILE);
+        const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
+        emitSuccess(
+          { dryRun: true, outcome },
+          jsonMode,
+          `Dry-run tick: ${outcome.kind} (task=${outcome.taskId ?? "n/a"}) ${outcome.detail}`
+        );
+        return;
+      }
+      const { pid, statePath, logPath } = await spawnSentientDaemon(projectRoot);
+      emitSuccess(
+        { pid, statePath, logPath, message: "sentient daemon started" },
+        jsonMode,
+        `Sentient daemon started (pid ${pid})
+State: ${statePath}
+Logs:  ${logPath}`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_START", message, jsonMode);
+    }
+  }
+});
+var stopSub = defineCommand({
+  meta: {
+    name: "stop",
+    description: "Flip killSwitch=true and send SIGTERM to the daemon"
+  },
+  args: {
+    ...projectArgs,
+    reason: {
+      type: "string",
+      description: "Reason stored on sentient-state.json for diagnostics"
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const reason = args.reason ?? "cleo sentient stop";
+    try {
+      const result = await stopSentientDaemon(projectRoot, reason);
+      emitSuccess(result, jsonMode, `Sentient stop: ${result.reason}`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_STOP", message, jsonMode);
+    }
+  }
+});
+var statusSub = defineCommand({
+  meta: {
+    name: "status",
+    description: "Show daemon pid, stats, kill-switch state"
+  },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const status = await getSentientDaemonStatus(projectRoot);
+      const runStr = status.running ? `running (pid ${status.pid})` : "stopped";
+      const ksStr = status.killSwitch ? `ACTIVE${status.killSwitchReason ? ` (${status.killSwitchReason})` : ""}` : "inactive";
+      emitSuccess(
+        status,
+        jsonMode,
+        `Daemon: ${runStr} | killSwitch=${ksStr} | picked=${status.stats.tasksPicked} completed=${status.stats.tasksCompleted} failed=${status.stats.tasksFailed}`,
+        "sentient.status"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_STATUS", message, jsonMode, "sentient.status");
+    }
+  }
+});
+var resumeSub = defineCommand({
+  meta: {
+    name: "resume",
+    description: "Clear killSwitch so the cron schedule resumes execution"
+  },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const state = await resumeSentientDaemon(projectRoot);
+      emitSuccess(
+        {
+          killSwitch: state.killSwitch,
+          killSwitchReason: state.killSwitchReason,
+          message: "killSwitch cleared"
+        },
+        jsonMode,
+        "Sentient kill-switch cleared. Daemon will resume ticks on next cron cadence."
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_RESUME", message, jsonMode);
+    }
+  }
+});
+var tickSub = defineCommand({
+  meta: {
+    name: "tick",
+    description: "Run a single tick in-process (diagnostic / owner verify)"
+  },
+  args: {
+    ...projectArgs,
+    "dry-run": {
+      type: "boolean",
+      description: "Skip the actual worker spawn"
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const dryRun = args["dry-run"] === true;
+    try {
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
+      emitSuccess(
+        { outcome, dryRun },
+        jsonMode,
+        `Tick outcome: ${outcome.kind} (task=${outcome.taskId ?? "n/a"}) ${outcome.detail}`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_TICK", message, jsonMode);
+    }
+  }
+});
+var proposeListSub = defineCommand({
+  meta: {
+    name: "list",
+    description: "List all Tier-2 proposals (status=proposed)"
+  },
+  args: {
+    ...projectArgs,
+    limit: { type: "string", description: "Maximum proposals to return (default 50)" }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const limit = args.limit ? Number.parseInt(args.limit, 10) : 50;
+    try {
+      const { Cleo } = await import("@cleocode/core/sdk");
+      const cleo = await Cleo.init(projectRoot);
+      const result = await cleo.dispatch?.("sentient", "query", "propose.list", { limit });
+      const data = result?.data ?? result;
+      emitSuccess(data, jsonMode, JSON.stringify(data, null, 2));
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_PROPOSE_LIST", message, jsonMode);
+    }
+  }
+});
+var promptAcceptExecution = async (fixAction) => {
+  const rl = createInterface({ input: stdin, output: stdout });
+  try {
+    stdout.write(`[sentient] Proposal accepted. fixAction:
+  $ ${fixAction}
+`);
+    const answer = await rl.question("Execute now? [y/N] ");
+    const normalised = answer.trim().toLowerCase();
+    return normalised === "y" || normalised === "yes";
+  } finally {
+    rl.close();
+  }
+};
+function __setPromptAcceptExecutionForTest(next) {
+  const prev = promptAcceptExecution;
+  promptAcceptExecution = next;
+  return () => {
+    promptAcceptExecution = prev;
+  };
+}
+var proposeAcceptSub = defineCommand({
+  meta: {
+    name: "accept",
+    description: "Accept a proposal \u2014 transition proposed \u2192 pending, optionally execute its fixAction"
+  },
+  args: {
+    ...projectArgs,
+    id: { type: "positional", description: "Proposal task ID", required: true },
+    execute: {
+      type: "boolean",
+      description: "Execute proposal.fixAction without prompting"
+    },
+    "no-execute": {
+      type: "boolean",
+      description: "Skip fixAction execution even if the proposal carries one"
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const id = args.id;
+    const forceExecute = args.execute === true;
+    const skipExecute = negatedFlag(args, "execute");
+    try {
+      const { getDb } = await import("@cleocode/core/store/sqlite.js");
+      const { tasks } = await import("@cleocode/core/store/tasks-schema");
+      const { and, eq, like } = await import("drizzle-orm");
+      const db = await getDb(projectRoot);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const existing = await db.select().from(tasks).where(
+        and(
+          eq(tasks.id, id),
+          eq(tasks.status, "proposed"),
+          like(tasks.labelsJson, "%sentient-tier2%")
+        )
+      ).get();
+      if (!existing) {
+        emitFailure("E_NOT_FOUND", `Task ${id} is not a pending Tier-2 proposal`, jsonMode);
+        return;
+      }
+      await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq(tasks.id, id)).run();
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const state = await readSentientState(statePath);
+      await patchSentientState(statePath, {
+        tier2Stats: {
+          ...state.tier2Stats,
+          proposalsAccepted: state.tier2Stats.proposalsAccepted + 1
+        }
+      });
+      const fixAction = extractFixActionFromNotesJson(existing.notesJson ?? null);
+      let shouldExecute = false;
+      if (fixAction && !skipExecute) {
+        if (forceExecute) {
+          shouldExecute = true;
+        } else {
+          shouldExecute = await promptAcceptExecution(fixAction);
+        }
+      }
+      if (!shouldExecute) {
+        emitSuccess(
+          {
+            id,
+            status: "pending",
+            acceptedAt: now,
+            executed: false,
+            fixAction: fixAction ?? null
+          },
+          jsonMode,
+          `Proposal ${id} accepted \u2192 pending`
+        );
+        return;
+      }
+      const parsed = parseFixAction(fixAction);
+      if (!parsed.ok) {
+        emitFailure(parsed.code, parsed.reason, jsonMode);
+        return;
+      }
+      const result = await executeFixAction(parsed, { cwd: projectRoot });
+      await appendSentientExecuteAudit(projectRoot, {
+        proposalId: id,
+        fixAction,
+        exitCode: result.exitCode,
+        durationMs: result.durationMs,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      emitSuccess(
+        {
+          id,
+          status: "pending",
+          acceptedAt: now,
+          executed: true,
+          exitCode: result.exitCode,
+          stderrSnippet: result.stderrSnippet,
+          fixAction
+        },
+        jsonMode,
+        `Proposal ${id} accepted \u2192 pending (fixAction exit=${result.exitCode})`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_PROPOSE_ACCEPT", message, jsonMode);
+    }
+  }
+});
+var proposeRejectSub = defineCommand({
+  meta: {
+    name: "reject",
+    description: "Reject a proposal \u2014 transition proposed \u2192 cancelled"
+  },
+  args: {
+    ...projectArgs,
+    id: { type: "positional", description: "Proposal task ID", required: true },
+    reason: { type: "string", description: "Rejection reason" }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const id = args.id;
+    const reason = args.reason ?? "rejected by owner";
+    try {
+      const { getDb } = await import("@cleocode/core/store/sqlite.js");
+      const { tasks } = await import("@cleocode/core/store/tasks-schema");
+      const { and, eq, like } = await import("drizzle-orm");
+      const db = await getDb(projectRoot);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const existing = await db.select().from(tasks).where(
+        and(
+          eq(tasks.id, id),
+          eq(tasks.status, "proposed"),
+          like(tasks.labelsJson, "%sentient-tier2%")
+        )
+      ).get();
+      if (!existing) {
+        emitFailure("E_NOT_FOUND", `Task ${id} is not a pending Tier-2 proposal`, jsonMode);
+        return;
+      }
+      await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq(tasks.id, id)).run();
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const state = await readSentientState(statePath);
+      await patchSentientState(statePath, {
+        tier2Stats: {
+          ...state.tier2Stats,
+          proposalsRejected: state.tier2Stats.proposalsRejected + 1
+        }
+      });
+      emitSuccess(
+        { id, status: "cancelled", rejectedAt: now, reason },
+        jsonMode,
+        `Proposal ${id} rejected \u2192 cancelled`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_PROPOSE_REJECT", message, jsonMode);
+    }
+  }
+});
+var proposeDiffSub = defineCommand({
+  meta: {
+    name: "diff",
+    description: "Show what a proposal would change (Tier-3 stub)"
+  },
+  args: {
+    ...projectArgs,
+    id: { type: "positional", description: "Proposal task ID", required: true }
+  },
+  async run({ args }) {
+    const jsonMode = args.json === true;
+    const id = args.id;
+    const msg = `Content diff is a Tier-3 feature (blocked on T992+T993+T995). Proposal ${id} is a task-creation suggestion; no diff is available.`;
+    emitSuccess({ id, diff: null, message: msg }, jsonMode, msg);
+  }
+});
+var proposeRunSub = defineCommand({
+  meta: {
+    name: "run",
+    description: "Manually trigger a single propose tick in-process"
+  },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const outcome = await safeRunProposeTick({ projectRoot, statePath });
+      emitSuccess(
+        { outcome },
+        jsonMode,
+        `Propose tick: ${outcome.kind} (written=${outcome.written}, count=${outcome.count}) ${outcome.detail}`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_PROPOSE_RUN", message, jsonMode);
+    }
+  }
+});
+var proposeEnableSub = defineCommand({
+  meta: { name: "enable", description: "Enable Tier-2 proposal generation" },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const updated = await patchSentientState(statePath, { tier2Enabled: true });
+      emitSuccess({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
+    } catch (err) {
+      emitFailure(
+        "E_SENTIENT_PROPOSE_ENABLE",
+        err instanceof Error ? err.message : String(err),
+        jsonMode
+      );
+    }
+  }
+});
+var proposeDisableSub = defineCommand({
+  meta: { name: "disable", description: "Disable Tier-2 proposal generation" },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const updated = await patchSentientState(statePath, { tier2Enabled: false });
+      emitSuccess({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
+    } catch (err) {
+      emitFailure(
+        "E_SENTIENT_PROPOSE_DISABLE",
+        err instanceof Error ? err.message : String(err),
+        jsonMode
+      );
+    }
+  }
+});
+var proposeSub = defineCommand({
+  meta: {
+    name: "propose",
+    description: "Tier-2 proposal queue management (list/accept/reject/diff/run)"
+  },
+  args: projectArgs,
+  subCommands: {
+    list: proposeListSub,
+    accept: proposeAcceptSub,
+    reject: proposeRejectSub,
+    diff: proposeDiffSub,
+    run: proposeRunSub,
+    enable: proposeEnableSub,
+    disable: proposeDisableSub
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+      const state = await readSentientState(statePath);
+      emitSuccess(
+        {
+          tier2Enabled: state.tier2Enabled,
+          tier2Stats: state.tier2Stats
+        },
+        jsonMode,
+        `Tier-2 proposals: ${state.tier2Enabled ? "enabled" : "disabled"} | generated=${state.tier2Stats.proposalsGenerated} accepted=${state.tier2Stats.proposalsAccepted} rejected=${state.tier2Stats.proposalsRejected}`
+      );
+    } catch (err) {
+      emitFailure("E_SENTIENT_PROPOSE", err instanceof Error ? err.message : String(err), jsonMode);
+    }
+  }
+});
+var baselineCaptureSub = defineCommand({
+  meta: {
+    name: "capture",
+    description: "Capture a signed baseline event for a commit SHA (must predate experiment worktree creation)"
+  },
+  args: {
+    ...projectArgs,
+    sha: {
+      type: "positional",
+      description: "Git commit SHA to anchor the baseline to (40 hex chars)",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const commitSha = args.sha;
+    try {
+      const { captureBaseline } = await import("@cleocode/core/sentient/baseline.js");
+      const baseline = await captureBaseline(projectRoot, commitSha);
+      emitSuccess(
+        baseline,
+        jsonMode,
+        `Baseline captured: receipt=${baseline.receiptId} commit=${baseline.commitSha} pub=${baseline.publicKey.slice(0, 16)}...`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_BASELINE_CAPTURE", message, jsonMode);
+    }
+  }
+});
+var baselineSub = defineCommand({
+  meta: {
+    name: "baseline",
+    description: "Tier-3 baseline management (capture signed pre-experiment baseline)"
+  },
+  args: projectArgs,
+  subCommands: {
+    capture: baselineCaptureSub
+  },
+  async run({ args, cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    const jsonMode = args.json === true;
+    emitSuccess(
+      { message: "Use: cleo sentient baseline capture <sha>" },
+      jsonMode,
+      "Usage: cleo sentient baseline capture <sha>"
+    );
+  }
+});
+var allowlistListSub = defineCommand({
+  meta: {
+    name: "list",
+    description: "Show the current ownerPubkeys allowlist"
+  },
+  args: projectArgs,
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const { getOwnerPubkeys } = await import("@cleocode/core/sentient/allowlist.js");
+      const pubkeys = await getOwnerPubkeys(projectRoot, { noCache: true });
+      const b64List = pubkeys.map((k) => Buffer.from(k).toString("base64"));
+      emitSuccess(
+        { ownerPubkeys: b64List, count: b64List.length },
+        jsonMode,
+        b64List.length === 0 ? "No owner pubkeys configured (allowlist is empty)" : `Owner pubkeys (${b64List.length}):
+${b64List.map((k, i) => `  ${i + 1}. ${k}`).join("\n")}`
+      );
+    } catch (err) {
+      emitFailure(
+        "E_SENTIENT_ALLOWLIST_LIST",
+        err instanceof Error ? err.message : String(err),
+        jsonMode
+      );
+    }
+  }
+});
+var allowlistAddSub = defineCommand({
+  meta: {
+    name: "add",
+    description: "Add a base64-encoded Ed25519 pubkey to the owner allowlist"
+  },
+  args: {
+    ...projectArgs,
+    pubkey: {
+      type: "positional",
+      description: "Base64-encoded Ed25519 public key (32 bytes)",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const pubkeyBase64 = args.pubkey;
+    try {
+      const { addOwnerPubkey } = await import("@cleocode/core/sentient/allowlist.js");
+      await addOwnerPubkey(projectRoot, pubkeyBase64);
+      emitSuccess(
+        { added: pubkeyBase64 },
+        jsonMode,
+        `Pubkey added to allowlist: ${pubkeyBase64.slice(0, 16)}...`
+      );
+    } catch (err) {
+      emitFailure(
+        "E_SENTIENT_ALLOWLIST_ADD",
+        err instanceof Error ? err.message : String(err),
+        jsonMode
+      );
+    }
+  }
+});
+var allowlistRemoveSub = defineCommand({
+  meta: {
+    name: "remove",
+    description: "Remove a base64-encoded Ed25519 pubkey from the owner allowlist"
+  },
+  args: {
+    ...projectArgs,
+    pubkey: {
+      type: "positional",
+      description: "Base64-encoded Ed25519 public key to remove",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const pubkeyBase64 = args.pubkey;
+    try {
+      const { removeOwnerPubkey } = await import("@cleocode/core/sentient/allowlist.js");
+      await removeOwnerPubkey(projectRoot, pubkeyBase64);
+      emitSuccess(
+        { removed: pubkeyBase64 },
+        jsonMode,
+        `Pubkey removed from allowlist: ${pubkeyBase64.slice(0, 16)}...`
+      );
+    } catch (err) {
+      const code = err.code === "E_ALLOWLIST_KEY_NOT_FOUND" ? "E_ALLOWLIST_KEY_NOT_FOUND" : "E_SENTIENT_ALLOWLIST_REMOVE";
+      emitFailure(code, err instanceof Error ? err.message : String(err), jsonMode);
+    }
+  }
+});
+var allowlistSub = defineCommand({
+  meta: {
+    name: "allowlist",
+    description: "Manage the owner pubkey allowlist for Tier-3 sentient operations"
+  },
+  args: projectArgs,
+  subCommands: {
+    list: allowlistListSub,
+    add: allowlistAddSub,
+    remove: allowlistRemoveSub
+  },
+  async run({ args, cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    const jsonMode = args.json === true;
+    emitSuccess(
+      { message: "Use: cleo sentient allowlist list|add|remove" },
+      jsonMode,
+      "Usage: cleo sentient allowlist list|add <base64>|remove <base64>"
+    );
+  }
+});
+var monitorSub = defineCommand({
+  meta: {
+    name: "monitor",
+    description: "Show active workers and flag runaway tasks exceeding size-based budgets"
+  },
+  args: {
+    ...projectArgs,
+    "show-budgets": {
+      type: "boolean",
+      description: "Print the size-budget table before worker rows"
+    }
+  },
+  async run({ args }) {
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    const showBudgets = args["show-budgets"] === true;
+    try {
+      const rows = await monitorWorkers(projectRoot);
+      if (jsonMode) {
+        emitSuccess(
+          { workers: rows, budgetMultiplier: RUNAWAY_BUDGET_MULTIPLIER, budgets: WORKER_BUDGET_MS },
+          jsonMode,
+          `sentient monitor: ${rows.length} active worker(s), ${rows.filter((r) => r.runaway).length} runaway`,
+          "sentient.monitor"
+        );
+        return;
+      }
+      if (showBudgets) {
+        process.stdout.write("\nSize budgets:\n");
+        for (const [size, ms] of Object.entries(WORKER_BUDGET_MS)) {
+          const mins = Math.round(ms / 6e4);
+          process.stdout.write(
+            `  ${size.padEnd(8)} ${mins} min (runaway at ${mins * RUNAWAY_BUDGET_MULTIPLIER} min)
+`
+          );
+        }
+        process.stdout.write("\n");
+      }
+      if (rows.length === 0) {
+        process.stdout.write("No active workers.\n");
+        return;
+      }
+      process.stdout.write(`Active workers (${rows.length}):
+
+`);
+      for (const row of rows) {
+        const elapsed = Math.round(row.elapsedMs / 6e4);
+        const budget = Math.round(row.budgetMs / 6e4);
+        const label = row.runaway ? "RUNAWAY" : row.overBudget ? "WARNING" : "OK     ";
+        process.stdout.write(
+          `  [${label}] ${row.taskId} \u2014 ${row.title.slice(0, 50)} | size=${row.size} elapsed=${elapsed}m budget=${budget}m
+`
+        );
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_MONITOR", message, jsonMode, "sentient.monitor");
+    }
+  }
+});
+var reviewStatusListSub = defineCommand({
+  meta: {
+    name: "list",
+    description: "List pending auto-improve reviews + linked patches (read-only)"
+  },
+  args: {
+    json: { type: "boolean", description: "Emit LAFS JSON envelope" },
+    pending: {
+      type: "boolean",
+      description: "Filter to entries with a `proposed` patch awaiting accept/reject"
+    },
+    limit: { type: "string", description: "Max entries to return (default 50)" }
+  },
+  async run({ args }) {
+    const jsonMode = args.json === true;
+    const limit = args.limit ? Number.parseInt(args.limit, 10) : 50;
+    const pendingOnly = args.pending === true;
+    try {
+      const entries = await listSkillReviews({ pendingOnly, limit });
+      emitSuccess(
+        { entries, count: entries.length, pendingOnly },
+        jsonMode,
+        `Reviews: ${entries.length}${pendingOnly ? " (pending only)" : ""}`,
+        "sentient.review-status.list"
+      );
+    } catch (err) {
+      emitFailure(
+        "E_REVIEW_STATUS_LIST",
+        err instanceof Error ? err.message : String(err),
+        jsonMode,
+        "sentient.review-status.list"
+      );
+    }
+  }
+});
+var reviewStatusShowSub = defineCommand({
+  meta: {
+    name: "show",
+    description: "Show full detail for one auto-improve review row"
+  },
+  args: {
+    "review-id": {
+      type: "positional",
+      description: "`skill_reviews.id` to inspect",
+      required: true
+    },
+    json: { type: "boolean", description: "Emit LAFS JSON envelope" }
+  },
+  async run({ args }) {
+    const jsonMode = args.json === true;
+    const reviewId = Number.parseInt(String(args["review-id"]), 10);
+    if (!Number.isInteger(reviewId)) {
+      emitFailure(
+        "E_VALIDATION",
+        `review-id must be an integer (got '${String(args["review-id"])}')`,
+        jsonMode,
+        "sentient.review-status.show"
+      );
+      return;
+    }
+    try {
+      const detail = await getSkillReview(reviewId);
+      if (!detail.review) {
+        emitFailure(
+          "E_NOT_FOUND",
+          `No skill_reviews row for id=${reviewId}`,
+          jsonMode,
+          "sentient.review-status.show"
+        );
+        return;
+      }
+      emitSuccess(
+        {
+          review: detail.review,
+          patches: detail.patches,
+          isCanonical: detail.isCanonical,
+          skillRow: detail.skillRow
+        },
+        jsonMode,
+        `Review ${reviewId} for ${detail.review.skillName}: ${detail.review.outcome}`,
+        "sentient.review-status.show"
+      );
+    } catch (err) {
+      emitFailure(
+        "E_REVIEW_STATUS_SHOW",
+        err instanceof Error ? err.message : String(err),
+        jsonMode,
+        "sentient.review-status.show"
+      );
+    }
+  }
+});
+var reviewStatusAcceptSub = defineCommand({
+  meta: {
+    name: "accept",
+    description: "Accept a proposed patch \u2014 routes Sphere A to PR-cut, Sphere B to local-apply"
+  },
+  args: {
+    "patch-id": {
+      type: "positional",
+      description: "`skill_patches.id` to accept",
+      required: true
+    },
+    json: { type: "boolean", description: "Emit LAFS JSON envelope" }
+  },
+  async run({ args }) {
+    const jsonMode = args.json === true;
+    const patchId = Number.parseInt(String(args["patch-id"]), 10);
+    if (!Number.isInteger(patchId)) {
+      emitFailure(
+        "E_VALIDATION",
+        `patch-id must be an integer (got '${String(args["patch-id"])}')`,
+        jsonMode,
+        "sentient.review-status.accept"
+      );
+      return;
+    }
+    try {
+      const detail = await getSkillPatch(patchId);
+      const patch = detail.patch;
+      if (!patch) {
+        emitFailure(
+          "E_NOT_FOUND",
+          `No skill_patches row for id=${patchId}`,
+          jsonMode,
+          "sentient.review-status.accept"
+        );
+        return;
+      }
+      if (patch.status !== "proposed") {
+        emitFailure(
+          "E_VALIDATION",
+          `patch ${patchId} is not in 'proposed' state (status='${patch.status}')`,
+          jsonMode,
+          "sentient.review-status.accept"
+        );
+        return;
+      }
+      const skillRow = detail.skillRow;
+      if (!skillRow) {
+        emitFailure(
+          "E_NOT_FOUND",
+          `No skills row for name='${patch.skillName}'`,
+          jsonMode,
+          "sentient.review-status.accept"
+        );
+        return;
+      }
+      if (skillRow.sourceType === "canonical") {
+        const suggestion = `cleo skills propose-patch ${patch.skillName} --diff <write the diff to a file>`;
+        emitSuccess(
+          {
+            patchId,
+            skillName: patch.skillName,
+            route: "pr-generator",
+            isCanonical: true,
+            command: suggestion,
+            note: "Sphere A canonical \u2014 owner must run `cleo skills propose-patch` to cut a PR"
+          },
+          jsonMode,
+          `Patch ${patchId} targets canonical skill ${patch.skillName} \u2014 run: ${suggestion}`,
+          "sentient.review-status.accept"
+        );
+        return;
+      }
+      const { applyLocalSkillPatch } = await import("@cleocode/core/sentient");
+      emitSuccess(
+        {
+          patchId,
+          skillName: patch.skillName,
+          route: "local-apply",
+          isCanonical: false,
+          note: "Sphere B \u2014 daemons calling this CLI MUST also surface the file payload via `applyLocalSkillPatch`. This CLI is the dispatch surface; mutation happens in the daemon."
+        },
+        jsonMode,
+        `Patch ${patchId} routed to local-apply for ${patch.skillName}`,
+        "sentient.review-status.accept"
+      );
+      void applyLocalSkillPatch;
+    } catch (err) {
+      emitFailure(
+        "E_REVIEW_STATUS_ACCEPT",
+        err instanceof Error ? err.message : String(err),
+        jsonMode,
+        "sentient.review-status.accept"
+      );
+    }
+  }
+});
+var reviewStatusRejectSub = defineCommand({
+  meta: {
+    name: "reject",
+    description: "Reject a proposed patch \u2014 sets skill_patches.status=rejected"
+  },
+  args: {
+    "patch-id": {
+      type: "positional",
+      description: "`skill_patches.id` to reject",
+      required: true
+    },
+    reason: { type: "string", description: "Free-form rejection reason" },
+    json: { type: "boolean", description: "Emit LAFS JSON envelope" }
+  },
+  async run({ args }) {
+    const jsonMode = args.json === true;
+    const patchId = Number.parseInt(String(args["patch-id"]), 10);
+    if (!Number.isInteger(patchId)) {
+      emitFailure(
+        "E_VALIDATION",
+        `patch-id must be an integer (got '${String(args["patch-id"])}')`,
+        jsonMode,
+        "sentient.review-status.reject"
+      );
+      return;
+    }
+    try {
+      const detail = await getSkillPatch(patchId);
+      if (!detail.patch) {
+        emitFailure(
+          "E_NOT_FOUND",
+          `No skill_patches row for id=${patchId}`,
+          jsonMode,
+          "sentient.review-status.reject"
+        );
+        return;
+      }
+      if (detail.patch.status !== "proposed") {
+        emitFailure(
+          "E_VALIDATION",
+          `patch ${patchId} is not in 'proposed' state (status='${detail.patch.status}')`,
+          jsonMode,
+          "sentient.review-status.reject"
+        );
+        return;
+      }
+      await markSkillPatchRejected(patchId);
+      const reason = args.reason ?? "rejected by operator";
+      emitSuccess(
+        { patchId, skillName: detail.patch.skillName, status: "rejected", reason },
+        jsonMode,
+        `Patch ${patchId} rejected (${reason})`,
+        "sentient.review-status.reject"
+      );
+    } catch (err) {
+      emitFailure(
+        "E_REVIEW_STATUS_REJECT",
+        err instanceof Error ? err.message : String(err),
+        jsonMode,
+        "sentient.review-status.reject"
+      );
+    }
+  }
+});
+var reviewStatusSub = defineCommand({
+  meta: {
+    name: "review-status",
+    description: "Auto-improve review/patch status (read-only listing + accept/reject dispatch \u2014 T9727)"
+  },
+  subCommands: {
+    list: reviewStatusListSub,
+    show: reviewStatusShowSub,
+    accept: reviewStatusAcceptSub,
+    reject: reviewStatusRejectSub
+  },
+  async run({ cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    await reviewStatusListSub.run?.({
+      args: {},
+      cmd: reviewStatusListSub,
+      rawArgs,
+      data: void 0
+    });
+  }
+});
+var sentientCommand = defineCommand({
+  meta: {
+    name: "sentient",
+    description: "Manage the Tier-1 sentient autonomous loop daemon and Tier-2 proposals"
+  },
+  args: projectArgs,
+  subCommands: {
+    start: startSub,
+    stop: stopSub,
+    status: statusSub,
+    resume: resumeSub,
+    tick: tickSub,
+    propose: proposeSub,
+    baseline: baselineSub,
+    allowlist: allowlistSub,
+    monitor: monitorSub,
+    "review-status": reviewStatusSub
+  },
+  async run({ args, cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    const projectRoot = resolveProjectRoot(args.project);
+    const jsonMode = args.json === true;
+    try {
+      const status = await getSentientDaemonStatus(projectRoot);
+      const ksStr = status.killSwitch ? "ACTIVE" : "inactive";
+      emitSuccess(
+        status,
+        jsonMode,
+        `Daemon: ${status.running ? `running (pid ${status.pid})` : "stopped"} | killSwitch=${ksStr} | picked=${status.stats.tasksPicked} completed=${status.stats.tasksCompleted} failed=${status.stats.tasksFailed}`,
+        "sentient.status"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      emitFailure("E_SENTIENT_STATUS", message, jsonMode, "sentient.status");
+    }
+  }
+});
+export {
+  __setPromptAcceptExecutionForTest,
+  promptAcceptExecution,
+  sentientCommand
+};
+//# sourceMappingURL=sentient-M4YMAVGV.js.map