@cleocode/cleo 2026.10.3 → 2026.10.4

package/dist/cli/chunk-ULN4OKQQ.js

@@ -0,0 +1,259 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  negatedFlag
+} from "./chunk-47JYZAMS.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine,
+  isHumanOutput
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/lib/nexus-account-cli.ts
+import { ExitCode } from "@cleocode/contracts";
+
+// packages/cleo/src/cli/lib/device-code-prompt.ts
+function writeDeviceCodePrompt(info, serviceName) {
+  process.stderr.write("\n");
+  process.stderr.write(`  Visit:      ${info.verificationUriComplete ?? info.verificationUri}
+`);
+  process.stderr.write(`  Enter code: ${info.userCode}
+`);
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Waiting for ${serviceName} authorization (up to ${Math.round(info.expiresIn / 60)} min)...
+`
+  );
+}
+function writeDeviceCodePending(elapsed) {
+  process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
+}
+function writeDeviceCodeInterrupted() {
+  process.stderr.write("\n");
+}
+function writeDeviceCodeApproved(serviceName) {
+  process.stderr.write(`\r  ${serviceName} authorization approved.              
+
+`);
+}
+
+// packages/cleo/src/cli/lib/nexus-account-cli.ts
+var SERVICE_NAME = "Cleo Nexus";
+var NEXUS_API_URL_ARG = {
+  type: "string",
+  description: "Cleo Nexus API URL (default: $CLEO_NEXUS_API_URL, else https://api.cleocode.dev; staging: https://api.staging.cleocode.dev)."
+};
+function nexusApiUrlArg(args) {
+  const raw = args["api-url"];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+var VAULT_REFUSAL_EXIT_CODES = {
+  E_NEXUS_VAULT_LEASE_HELD: ExitCode.LOCK_TIMEOUT,
+  E_NEXUS_VAULT_STORE_BUSY: ExitCode.LOCK_TIMEOUT,
+  E_NEXUS_VAULT_BEHIND: ExitCode.VERSION_CONFLICT,
+  E_NEXUS_VAULT_LOCAL_CHANGES: ExitCode.CONCURRENT_MODIFICATION,
+  E_NEXUS_VAULT_VERIFY_FAILED: ExitCode.CHECKSUM_MISMATCH,
+  E_NEXUS_VAULT_TARGET_OCCUPIED: ExitCode.ID_COLLISION,
+  // `cleo cloud restore <name>` (T13102).
+  E_NEXUS_PROJECT_NOT_FOUND: ExitCode.NOT_FOUND,
+  E_NEXUS_PROJECT_AMBIGUOUS: ExitCode.VALIDATION_ERROR
+};
+function failNexus(err, operation) {
+  const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
+  const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : VAULT_REFUSAL_EXIT_CODES[code ?? ""] ?? 1;
+  const details = err instanceof Error && "publicDetails" in err && typeof err.publicDetails === "object" && err.publicDetails ? err.publicDetails : void 0;
+  cliError(
+    err instanceof Error ? err.message : String(err),
+    exitCode,
+    {
+      name: code ?? "E_NEXUS_REQUEST_FAILED",
+      ...fix ? { fix } : {},
+      ...details ? { details } : {}
+    },
+    { operation }
+  );
+  process.exit(exitCode);
+}
+function writeNexusWarnings(warnings) {
+  for (const warning of warnings) process.stderr.write(`warning: ${warning}
+`);
+}
+function emitNexusResult(data, summary, command, operation) {
+  if (isHumanOutput()) humanLine(summary);
+  else cliOutput(data, { command, operation });
+}
+async function runNexusLogin(args, openBrowser) {
+  const { loginToNexus } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-auth.js"
+  );
+  const { isNexusDeviceEnabled } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-device.js"
+  );
+  const noBrowser = negatedFlag(args, "browser");
+  let codeShown = false;
+  const hooks = {
+    apiUrl: nexusApiUrlArg(args),
+    onCode: (code) => {
+      codeShown = true;
+      writeDeviceCodePrompt(code, SERVICE_NAME);
+      if (!noBrowser) openBrowser(code.verificationUriComplete ?? code.verificationUri);
+    },
+    onPending: writeDeviceCodePending
+  };
+  const readOnly = args["read-only"] === true;
+  const name = typeof args["name"] === "string" && args["name"] !== "" ? args["name"] : void 0;
+  if (readOnly && !isNexusDeviceEnabled()) {
+    throw Object.assign(
+      new Error(
+        "--read-only needs device credentials, which are not enabled; nothing was signed in"
+      ),
+      {
+        code: "E_NEXUS_DEVICE_REQUIRED",
+        fix: "unset CLEO_NEXUS_DEVICE (=0 turns device credentials off) to enrol a read-only device, or log in without --read-only"
+      }
+    );
+  }
+  try {
+    let result;
+    if (isNexusDeviceEnabled()) {
+      const { loginToNexusDevice } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      result = await loginToNexusDevice({
+        ...hooks,
+        readOnly,
+        ...name !== void 0 ? { name } : {}
+      });
+      if (!readOnly) {
+        const { attachNexusGlobalStore } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-home.js"
+        );
+        try {
+          const global = await attachNexusGlobalStore({ apiUrl: hooks.apiUrl });
+          result = { ...result, warnings: [...result.warnings, ...global.warnings] };
+        } catch (err) {
+          result = {
+            ...result,
+            warnings: [
+              ...result.warnings,
+              `signed in, but attaching this device's global store failed (${err instanceof Error ? err.message : String(err)}); run \`cleo login nexus\` again`
+            ]
+          };
+        }
+      }
+    } else {
+      if (name !== void 0) {
+        process.stderr.write(
+          "warning: --name needs device credentials, which CLEO_NEXUS_DEVICE=0 turns off; ignored\n"
+        );
+      }
+      const { NEXUS_TEST_BEARER_ENV, W_NEXUS_TEST_BEARER_IGNORED } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      if ((process.env[NEXUS_TEST_BEARER_ENV]?.trim() ?? "") !== "") {
+        process.stderr.write(
+          `warning: ${W_NEXUS_TEST_BEARER_IGNORED}: ${NEXUS_TEST_BEARER_ENV} needs device credentials, which CLEO_NEXUS_DEVICE turns off; ignored
+`
+        );
+      }
+      result = await loginToNexus(hooks);
+    }
+    if (codeShown) writeDeviceCodeApproved(SERVICE_NAME);
+    for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+    return result;
+  } catch (err) {
+    writeDeviceCodeInterrupted();
+    throw err;
+  }
+}
+function nexusLoginSummary(r) {
+  const who = r.user?.email ?? "your account";
+  const org = r.organization ? ` (${r.organization.name})` : "";
+  const device = r.device ? ` This machine is device ${r.device.deviceId}${r.device.name ? ` (${r.device.name})` : ""}, profile ${r.device.profile ?? "unknown"}.` : "";
+  return `Signed in to ${r.apiUrl} as ${who}${org}.${device}${nexusAccountSetupLine(r)}`;
+}
+function nexusAccountSetupLine(r) {
+  const account = r.account;
+  if (account === void 0) return "";
+  switch (account.status) {
+    case "ready":
+    case "skipped":
+      return ` ${account.summary}`;
+    case "unsupported":
+      return " Encrypted backups are not available on this server (see warnings).";
+    case "failed":
+      return ` Encrypted backups are NOT set up: step ${account.step} failed (see warnings for the fix).`;
+  }
+}
+function nexusDeviceLogoutSummary(r) {
+  const count = (o) => r.devices.filter((d) => d.outcome === o).length;
+  const confirmed = count("confirmed");
+  const open = r.devices.length - confirmed;
+  const what = r.action === "revoke" ? "Revoke" : "Sign-out";
+  if (r.devices.length === 0 && r.session === null) {
+    return r.warnings.length > 0 ? `${what} on ${r.apiUrl}: nothing was sent (see warnings).` : `Not signed in to ${r.apiUrl}; nothing to do.`;
+  }
+  const parts = [];
+  if (r.devices.length > 0)
+    parts.push(`${confirmed} of ${r.devices.length} device request(s) confirmed`);
+  if (open > 0) parts.push(`${open} NOT confirmed (see warnings)`);
+  if (r.session !== null) parts.push(`9.24 session ${r.session.revocation}`);
+  const notConfirmed = open > 0 || r.devices.length > 0 && confirmed === 0 || r.session?.revocation === "failed";
+  const lead = notConfirmed ? `${what} NOT fully confirmed on` : `${what} confirmed on`;
+  return `${lead} ${r.apiUrl}: ${parts.join("; ")}.`;
+}
+async function runNexusDeviceLogout(args) {
+  let result;
+  try {
+    const { logoutNexusDevice } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-logout.js"
+    );
+    result = await logoutNexusDevice({
+      apiUrl: nexusApiUrlArg(args),
+      revoke: args["revoke"] === true
+    });
+  } catch (err) {
+    failNexus(err, "logout.run");
+  }
+  for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+  emitNexusResult(result, nexusDeviceLogoutSummary(result), "logout", "logout.run");
+}
+
+export {
+  writeDeviceCodePrompt,
+  writeDeviceCodePending,
+  writeDeviceCodeInterrupted,
+  writeDeviceCodeApproved,
+  NEXUS_API_URL_ARG,
+  nexusApiUrlArg,
+  failNexus,
+  writeNexusWarnings,
+  emitNexusResult,
+  runNexusLogin,
+  nexusLoginSummary,
+  runNexusDeviceLogout
+};
+//# sourceMappingURL=chunk-ULN4OKQQ.js.map

package/dist/cli/chunk-V5GBGOGM.js

@@ -0,0 +1,46 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/renderers/colors.ts
+import {
+  BLUE,
+  BOLD,
+  BOX,
+  CYAN,
+  DIM,
+  GREEN,
+  hRule,
+  MAGENTA,
+  NC,
+  priorityColor,
+  prioritySymbol,
+  RED,
+  shortDate,
+  statusColor,
+  statusSymbol,
+  YELLOW
+} from "@cleocode/core";
+
+export {
+  BOLD,
+  CYAN,
+  DIM,
+  GREEN,
+  NC,
+  RED,
+  YELLOW
+};
+//# sourceMappingURL=chunk-V5GBGOGM.js.map

package/dist/cli/chunk-VLEYOOPH.js

@@ -0,0 +1,31 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/cleo-error-like.ts
+function asCleoErrorLike(err) {
+  if (!(err instanceof Error)) return null;
+  const candidate = err;
+  return typeof candidate.code === "number" && Number.isInteger(candidate.code) && typeof candidate.toLAFSError === "function" ? candidate : null;
+}
+function cleoErrorCodeName(typed) {
+  return typeof typed.codeName === "string" && typed.codeName.length > 0 ? typed.codeName : typed.toLAFSError().code;
+}
+
+export {
+  asCleoErrorLike,
+  cleoErrorCodeName
+};
+//# sourceMappingURL=chunk-VLEYOOPH.js.map

package/dist/cli/chunk-W33Q3FBH.js

@@ -0,0 +1,66 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  OPERATIONS
+} from "./chunk-AWCQH2W5.js";
+
+// packages/cleo/src/cli/lib/registry-args.ts
+import { paramsToCittyArgs } from "@cleocode/contracts";
+var IDEMPOTENCY_KEY_PARAM = {
+  name: "idempotencyKey",
+  type: "string",
+  required: false,
+  description: "Optional retry token for safely replaying idempotent mutating commands.",
+  cli: { flag: "idempotency-key" }
+};
+function getOperationParams(gateway, domain, operation) {
+  const def = OPERATIONS.find(
+    (o) => o.gateway === gateway && o.domain === domain && o.operation === operation
+  );
+  const params = def?.params ?? [];
+  if (!def || def.gateway !== "mutate" || !def.idempotent) return params;
+  if (params.some((param) => param.name === IDEMPOTENCY_KEY_PARAM.name)) return params;
+  return [...params, IDEMPOTENCY_KEY_PARAM];
+}
+function registryParamsToDispatchPayload(params, args) {
+  const payload = {};
+  for (const param of params) {
+    const flag = param.cli?.flag ?? param.name;
+    const raw = args[flag];
+    if (raw === void 0 || raw === null) continue;
+    if (param.type === "number") {
+      payload[param.name] = typeof raw === "number" ? raw : Number(String(raw));
+      continue;
+    }
+    if (param.type === "boolean") {
+      payload[param.name] = typeof raw === "boolean" ? raw : String(raw) !== "false";
+      continue;
+    }
+    if (param.type === "array") {
+      payload[param.name] = Array.isArray(raw) ? raw : String(raw).split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+      continue;
+    }
+    payload[param.name] = raw;
+  }
+  return payload;
+}
+
+export {
+  getOperationParams,
+  registryParamsToDispatchPayload,
+  paramsToCittyArgs
+};
+//# sourceMappingURL=chunk-W33Q3FBH.js.map

package/dist/cli/chunk-W3JLYKKY.js

@@ -0,0 +1,140 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  isQuiet
+} from "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/progress.ts
+import { stderr } from "node:process";
+var ProgressTracker = class {
+  enabled;
+  prefix;
+  currentStep = 0;
+  totalSteps;
+  steps;
+  constructor(options) {
+    this.enabled = options.enabled;
+    this.prefix = options.prefix ?? "CLEO";
+    this.steps = options.steps;
+    this.totalSteps = options.steps.length;
+  }
+  /**
+   * Start the progress tracker.
+   */
+  start() {
+    if (!this.enabled || isQuiet()) return;
+    this.currentStep = 0;
+    stderr.write(`
+${this.prefix}: Starting...
+`);
+  }
+  /**
+   * Update to a specific step.
+   */
+  step(index, message) {
+    if (!this.enabled || isQuiet()) return;
+    this.currentStep = index;
+    const stepName = this.steps[index] ?? message ?? "Working...";
+    const progress = `[${index + 1}/${this.totalSteps}]`;
+    stderr.write(`  ${progress} ${stepName}...
+`);
+  }
+  /**
+   * Move to next step.
+   */
+  next(message) {
+    this.step(this.currentStep + 1, message);
+  }
+  /**
+   * Mark as complete with optional summary.
+   *
+   * @remarks
+   * Writes to stderr (not stdout) so that progress messages never pollute
+   * the machine-readable JSON envelope on stdout. Stdout MUST contain exactly
+   * one JSON object per CLI invocation (ADR-039 / T927).
+   */
+  complete(summary) {
+    if (!this.enabled || isQuiet()) return;
+    if (summary) {
+      stderr.write(`
+${this.prefix}: \u2713 ${summary}
+
+`);
+    } else {
+      stderr.write(`
+${this.prefix}: \u2713 Complete
+
+`);
+    }
+  }
+  /**
+   * Report an error.
+   */
+  error(message) {
+    if (!this.enabled || isQuiet()) return;
+    stderr.write(`
+${this.prefix}: \u2717 ${message}
+
+`);
+  }
+};
+function createSelfUpdateProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO",
+    steps: [
+      "Detecting installation type",
+      "Checking current version",
+      "Querying npm registry",
+      "Comparing versions",
+      "Running post-update checks",
+      "Finalizing"
+    ]
+  });
+}
+function createDoctorProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO Doctor",
+    steps: [
+      "Checking CLEO directory",
+      "Verifying tasks database",
+      "Checking configuration",
+      "Validating schemas",
+      "Running health checks"
+    ]
+  });
+}
+function createUpgradeProgress(enabled) {
+  return new ProgressTracker({
+    enabled,
+    prefix: "CLEO Upgrade",
+    steps: [
+      "Analyzing current state",
+      "Checking storage migration needs",
+      "Validating schemas",
+      "Applying fixes",
+      "Verifying results"
+    ]
+  });
+}
+
+export {
+  createSelfUpdateProgress,
+  createDoctorProgress,
+  createUpgradeProgress
+};
+//# sourceMappingURL=chunk-W3JLYKKY.js.map

package/dist/cli/chunk-XRAX6XFP.js

@@ -0,0 +1,48 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/commands/doctor-dep-cycles.ts
+import { scanDependencyCycles } from "@cleocode/core/doctor/dependency-cycles.js";
+import { getProjectRoot } from "@cleocode/core/paths.js";
+var doctorDepCyclesCommand = defineCommand({
+  meta: {
+    name: "dep-cycles",
+    description: "Report task dependency cycles already stored (edges written before the T12886 cycle guard) with a repair plan: the edges whose removal breaks every cycle, each with its `cleo update <id> --remove-depends <dep>` command. Read-only; never removes an edge."
+  },
+  args: {
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run() {
+    const report = await scanDependencyCycles(getProjectRoot());
+    cliOutput(report, { command: "doctor", operation: "doctor.dep-cycles.run" });
+    if (report.cycleCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+      process.exitCode = 2;
+    }
+  }
+});
+
+export {
+  doctorDepCyclesCommand
+};
+//# sourceMappingURL=chunk-XRAX6XFP.js.map

package/dist/cli/chunk-YGKEECTI.js

@@ -0,0 +1,78 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput
+} from "./chunk-3ZO3M37V.js";
+
+// packages/cleo/src/cli/commands/doctor-memory-guard.ts
+import { spawnSync } from "node:child_process";
+import {
+  auditMemoryGuard,
+  buildMemoryGuardFixCommands
+} from "@cleocode/core/resources/memory-guard.js";
+var doctorMemoryGuardCommand = defineCommand({
+  meta: {
+    name: "memory-guard",
+    description: "Audit the machine-wide memory guard that bounds test runs an agent starts OUTSIDE cleo (pnpm test / npx vitest). Read-only; --fix applies the recommended cgroup limits."
+  },
+  args: {
+    fix: {
+      type: "boolean",
+      description: "Apply the recommended MemoryHigh/MemoryMax to app.slice. Persists a systemd user drop-in and affects the whole desktop session."
+    },
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const audit = auditMemoryGuard();
+    const commands = buildMemoryGuardFixCommands(audit);
+    const applied = [];
+    if (args.fix === true) {
+      for (const argv of commands) {
+        const [cmd, ...rest] = argv;
+        const r = spawnSync(cmd, rest, { encoding: "utf8" });
+        applied.push({
+          command: argv.join(" "),
+          exitCode: r.status,
+          stderr: (r.stderr ?? "").trim()
+        });
+      }
+    }
+    const finalAudit = args.fix === true ? auditMemoryGuard() : audit;
+    cliOutput(
+      {
+        ...finalAudit,
+        fixApplied: args.fix === true,
+        recommendedCommands: commands.map((c) => c.join(" ")),
+        applied
+      },
+      { command: "doctor", operation: "doctor.memory-guard.run" }
+    );
+    const failed = applied.some((a) => a.exitCode !== 0);
+    if ((!finalAudit.guarded || failed) && (process.exitCode ?? 0) === 0) {
+      process.exitCode = 1;
+    }
+  }
+});
+
+export {
+  doctorMemoryGuardCommand
+};
+//# sourceMappingURL=chunk-YGKEECTI.js.map