@cleocode/cleo 2026.10.3 → 2026.10.4

package/dist/cli/auth-ED7TAIXI.js

@@ -0,0 +1,491 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  authRemoveCommand
+} from "./chunk-7INMKEAD.js";
+import {
+  LOGIN_ARGS,
+  runLoginCommand
+} from "./chunk-J3ZFM3UQ.js";
+import "./chunk-GZFVDR44.js";
+import "./chunk-ULN4OKQQ.js";
+import "./chunk-47JYZAMS.js";
+import "./chunk-C3B7C43W.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/auth/consent.ts
+var authConsentCommand = defineCommand({
+  meta: {
+    name: "consent",
+    description: "Manage consent gates for external credential sources (e.g. Claude Code OAuth). Use --enable-claude-code / --disable-claude-code to toggle, --status to inspect."
+  },
+  args: {
+    "enable-claude-code": {
+      type: "boolean",
+      description: "Grant consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=true in the global config and removes any suppression entry."
+    },
+    "disable-claude-code": {
+      type: "boolean",
+      description: "Revoke consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=false, adds a suppression entry, and purges all source:claude-code entries from the pool."
+    },
+    status: {
+      type: "boolean",
+      description: "Print the current state of all consent gates."
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const enableClaudeCode = a["enable-claude-code"] === true;
+    const disableClaudeCode = a["disable-claude-code"] === true;
+    const showStatus = a["status"] === true;
+    if (!enableClaudeCode && !disableClaudeCode && !showStatus) {
+      cliError("Specify one of --enable-claude-code, --disable-claude-code, or --status.", 6, {
+        name: "E_INVALID_INPUT",
+        fix: "Run `cleo auth consent --status` to see current consent state."
+      });
+      process.exit(6);
+    }
+    if (enableClaudeCode && disableClaudeCode) {
+      cliError("--enable-claude-code and --disable-claude-code are mutually exclusive.", 6, {
+        name: "E_INVALID_INPUT"
+      });
+      process.exit(6);
+    }
+    const configMod = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/config.js"
+    );
+    const getConfigValue = configMod.getConfigValue;
+    const setConfigValue = configMod.setConfigValue;
+    const { addSuppression, removeSuppression, isSuppressed } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credential-removal.js"
+    );
+    const CONSENT_KEY = "auth.claudeCodeConsentGiven";
+    const SOURCE_ID = "claude-code";
+    const PROVIDER = "anthropic";
+    if (showStatus) {
+      const resolved = await getConfigValue(CONSENT_KEY);
+      const consentEnabled = resolved.value === true;
+      const suppressed = isSuppressed(PROVIDER, SOURCE_ID);
+      const result2 = {
+        gates: [
+          {
+            gate: "claudeCode",
+            configKey: CONSENT_KEY,
+            enabled: consentEnabled,
+            suppressed
+          }
+        ]
+      };
+      cliOutput(result2, {
+        command: "auth-consent-status",
+        operation: "auth.consent.status"
+      });
+      return;
+    }
+    if (enableClaudeCode) {
+      await setConfigValue(CONSENT_KEY, true, void 0, { global: true });
+      const suppressionChanged2 = removeSuppression(PROVIDER, SOURCE_ID);
+      const result2 = {
+        action: "enabled",
+        gate: "claudeCode",
+        configKey: CONSENT_KEY,
+        value: true,
+        suppressionChanged: suppressionChanged2,
+        purgedCount: 0
+      };
+      cliOutput(result2, {
+        command: "auth-consent-enable",
+        operation: "auth.consent.enable"
+      });
+      return;
+    }
+    await setConfigValue(CONSENT_KEY, false, void 0, { global: true });
+    const wasAlreadySuppressed = isSuppressed(PROVIDER, SOURCE_ID);
+    addSuppression(PROVIDER, SOURCE_ID);
+    const suppressionChanged = !wasAlreadySuppressed;
+    const { listCredentials, removeCredential } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credentials-store.js"
+    );
+    const allEntries = await listCredentials();
+    const claudeCodeEntries = allEntries.filter((c) => c.source === SOURCE_ID);
+    let purgedCount = 0;
+    for (const entry of claudeCodeEntries) {
+      const removed = await removeCredential(entry.provider, entry.label);
+      if (removed) purgedCount++;
+    }
+    const result = {
+      action: "disabled",
+      gate: "claudeCode",
+      configKey: CONSENT_KEY,
+      value: false,
+      suppressionChanged,
+      purgedCount
+    };
+    cliOutput(result, {
+      command: "auth-consent-disable",
+      operation: "auth.consent.disable"
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/list.ts
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function formatExpiry(expiresAt) {
+  if (expiresAt == null) return "never";
+  const remaining = expiresAt - Date.now();
+  if (remaining <= 0) return "expired";
+  const minutes = Math.floor(remaining / 6e4);
+  if (minutes <= 90) return `expires in ${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours <= 36) return `expires in ${hours}h`;
+  const days = Math.floor(hours / 24);
+  return `expires in ${days}d`;
+}
+var authListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List ALL pool entries from ALL sources (env, claude-code, cleo-pkce, codex-cli, gemini-cli, gh-cli, manual). Tokens are never surfaced \u2014 use `cleo llm list` for the LLM-scoped view that mirrors the manual store only."
+  },
+  args: {
+    provider: {
+      type: "string",
+      description: "Filter to a single provider id (e.g. anthropic)"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const providerFilter = typeof a["provider"] === "string" && a["provider"] !== "" ? a["provider"] : null;
+    const { getCredentialPool } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credential-pool.js"
+    );
+    const pool = getCredentialPool();
+    await pool.seed();
+    const allStored = await pool.list();
+    const ghCliEntries = allStored.filter((c) => c.source === "gh-cli");
+    if (ghCliEntries.length > 0) {
+      const { removeCredential } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/llm/credentials-store.js"
+      );
+      const { addSuppression } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/llm/credential-removal.js"
+      );
+      for (const entry of ghCliEntries) {
+        await removeCredential(
+          entry.provider,
+          entry.label
+        );
+      }
+      addSuppression("openai", "gh-cli");
+    }
+    const stored = allStored.filter((c) => c.source !== "gh-cli");
+    const entries = stored.filter((c) => providerFilter ? c.provider === providerFilter : true).map((c) => ({
+      provider: c.provider,
+      label: c.label,
+      source: c.source ?? "manual",
+      authType: c.authType,
+      expiryStatus: formatExpiry(c.expiresAt),
+      // `current` is "is this entry not in active cooldown AND not disabled"
+      // — i.e. could it be served right now. A richer notion of "default
+      // credential per provider" would require resolver introspection,
+      // which lands in a follow-up task.
+      current: !c.disabled && (c.lastErrorResetAt == null || c.lastErrorResetAt <= Date.now())
+    })).sort((a2, b) => {
+      const p = a2.provider.localeCompare(b.provider);
+      return p !== 0 ? p : a2.label.localeCompare(b.label);
+    });
+    const claudeCredsPath = join(homedir(), ".claude", ".credentials.json");
+    const hint = existsSync(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
+    const { getNexusAccountStatus } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-auth.js"
+    );
+    const nexus = providerFilter === null || providerFilter === "nexus" ? await getNexusAccountStatus().catch(() => []) : [];
+    cliOutput(
+      { entries, nexus, ...hint !== null ? { hint } : {} },
+      {
+        command: "auth-list",
+        operation: "auth.list"
+      }
+    );
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/login.ts
+var authLoginCommand = defineCommand({
+  meta: {
+    name: "login",
+    description: "Log in to a Cleo Nexus account (auth login nexus) or to an LLM provider and bind a usable profile (alias of `cleo login`). Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
+  },
+  args: LOGIN_ARGS,
+  async run({ args }) {
+    await runLoginCommand(args, "auth.login");
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { createInterface } from "node:readline";
+function resolveProjectRootArg(arg) {
+  if (typeof arg === "string" && arg.length > 0) return arg;
+  return process.cwd();
+}
+function projectConfigPath(projectRoot) {
+  const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
+  return join2(projectRoot, cleoDir, "config.json");
+}
+function extractApiKeyEntries(config) {
+  if (!config || typeof config !== "object") return [];
+  const llm = config["llm"];
+  if (!llm || typeof llm !== "object") return [];
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return [];
+  const out = [];
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") continue;
+    const apiKey = raw["apiKey"];
+    if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+      out.push({ provider, apiKey: apiKey.trim() });
+    }
+  }
+  return out;
+}
+function stripApiKeysFromConfig(config) {
+  const clone = structuredClone(config);
+  const llm = clone["llm"];
+  if (!llm || typeof llm !== "object") return clone;
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return clone;
+  const cleanedProviders = {};
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") {
+      cleanedProviders[provider] = raw;
+      continue;
+    }
+    const entry = { ...raw };
+    delete entry["apiKey"];
+    if (Object.keys(entry).length > 0) {
+      cleanedProviders[provider] = entry;
+    }
+  }
+  llm["providers"] = cleanedProviders;
+  return clone;
+}
+function detectAuthType(provider, token) {
+  if (provider !== "anthropic") return "api_key";
+  if (token.startsWith("sk-ant-oat-") || token.startsWith("sk-ant-ort-")) return "oauth";
+  return "api_key";
+}
+async function promptYesNo(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(question, (a) => resolve(a));
+    });
+    const clean = answer.trim().toLowerCase();
+    return clean === "y" || clean === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runMigrateProjectSecrets(opts) {
+  const configPath = projectConfigPath(opts.projectRoot);
+  if (!existsSync2(configPath)) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  const raw = readFileSync(configPath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${configPath}: ${err instanceof Error ? err.message : String(err)}. Fix the JSON syntax error before running migrate-project-secrets.`
+    );
+  }
+  const entries = extractApiKeyEntries(parsed);
+  if (entries.length === 0) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  if (!opts.yes) {
+    process.stderr.write(
+      `Found ${entries.length} project-config secret(s) to migrate:
+` + entries.map((e) => `  - ${e.provider}
+`).join("") + `
+This will:
+  1. Back up ${configPath} -> ${configPath}.pre-migration-bak
+  2. Move each apiKey into the unified credential pool with label 'migrated-from-project-config'
+  3. Remove the apiKey fields from the project config
+
+`
+    );
+    const confirmed = await promptYesNo("Proceed? [y/N] ");
+    if (!confirmed) {
+      return {
+        configPath,
+        backupPath: null,
+        migrated: [],
+        cancelled: true,
+        dryRun: opts.dryRun
+      };
+    }
+  }
+  if (opts.dryRun) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: entries.map((e) => ({
+        provider: e.provider,
+        label: "migrated-from-project-config",
+        moved: false
+      })),
+      cancelled: false,
+      dryRun: true
+    };
+  }
+  const backupPath = `${configPath}.pre-migration-bak`;
+  writeFileSync(backupPath, raw, { mode: 384 });
+  const { addCredential } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/credentials-store.js"
+  );
+  const migrated = [];
+  for (const { provider, apiKey } of entries) {
+    await addCredential({
+      provider,
+      label: "migrated-from-project-config",
+      authType: detectAuthType(provider, apiKey),
+      accessToken: apiKey,
+      source: "manual"
+    });
+    migrated.push({ provider, label: "migrated-from-project-config", moved: true });
+  }
+  const stripped = stripApiKeysFromConfig(parsed);
+  writeFileSync(configPath, `${JSON.stringify(stripped, null, 2)}
+`, "utf-8");
+  return {
+    configPath,
+    backupPath,
+    migrated,
+    cancelled: false,
+    dryRun: false
+  };
+}
+var authMigrateProjectSecretsCommand = defineCommand({
+  meta: {
+    name: "migrate-project-secrets",
+    description: "Move every llm.providers.*.apiKey out of .cleo/config.json (project-scoped, often committed to git) and into the unified credential pool. Atomic: backs up the original config to .cleo/config.json.pre-migration-bak first."
+  },
+  args: {
+    "project-root": {
+      type: "string",
+      description: "Override the project root (default: cwd)"
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation prompt",
+      default: false
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Show what would be migrated without writing anything",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const projectRoot = resolveProjectRootArg(a["project-root"]);
+    const yes = Boolean(a["yes"]);
+    const dryRun = Boolean(a["dry-run"]);
+    let result;
+    try {
+      result = await runMigrateProjectSecrets({ projectRoot, yes, dryRun });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      cliError(message, 6, { name: "E_VALIDATION" });
+      process.exit(6);
+    }
+    cliOutput(result, {
+      command: "auth-migrate-project-secrets",
+      operation: "auth.migrate-project-secrets"
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth.ts
+var authCommand = defineCommand({
+  meta: {
+    name: "auth",
+    // ONE quoted literal, no backticks — see login.ts meta for the generator
+    // DESC_RE constraint.
+    description: "Unified credential surface: auth login (front-door provider login, alias of cleo login), auth list, auth remove, auth consent. (cleo llm list is the LLM-scoped sister command.)"
+  },
+  subCommands: {
+    consent: authConsentCommand,
+    list: authListCommand,
+    login: authLoginCommand,
+    remove: authRemoveCommand,
+    "migrate-project-secrets": authMigrateProjectSecretsCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  authCommand
+};
+//# sourceMappingURL=auth-ED7TAIXI.js.map

package/dist/cli/backfill-32TRAYRD.js

@@ -0,0 +1,156 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine,
+  humanProgress,
+  humanWarn
+} from "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/backfill.ts
+import { backfillTasks, getProjectRoot, populateEmbeddings } from "@cleocode/core/internal";
+var backfillCommand = defineCommand({
+  meta: {
+    name: "backfill",
+    description: "Retroactively add acceptance criteria and verification metadata to existing tasks"
+  },
+  args: {
+    "dry-run": {
+      type: "boolean",
+      description: "Show what would be changed without modifying any tasks",
+      default: false
+    },
+    rollback: {
+      type: "boolean",
+      description: "Revert a previous backfill (clear auto-generated AC and verification)",
+      default: false
+    },
+    tasks: {
+      type: "string",
+      description: "Comma-separated list of task IDs to restrict backfill to (e.g. T001,T002)"
+    },
+    embeddings: {
+      type: "boolean",
+      description: "Retroactively generate embeddings for brain observations that lack them",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const root = getProjectRoot();
+    if (args.embeddings) {
+      try {
+        let lastLine = "";
+        const result = await populateEmbeddings(root, {
+          onProgress: (current, total) => {
+            if (process.stdout.isTTY) {
+              humanProgress(`\rEmbedding ${current}/${total}...`);
+            } else {
+              const line = `Embedding ${current}/${total}...`;
+              if (line !== lastLine) {
+                humanLine(line);
+                lastLine = line;
+              }
+            }
+          }
+        });
+        if (process.stdout.isTTY && result.processed + result.skipped + result.errors > 0) {
+          humanProgress("\n");
+        }
+        if (result.processed === 0 && result.skipped === 0 && result.errors === 0) {
+          cliOutput(
+            {
+              processed: 0,
+              skipped: 0,
+              errors: 0,
+              message: "No observations to embed (provider unavailable or nothing to backfill)."
+            },
+            { command: "backfill", operation: "admin.backfill", message: "Nothing to embed" }
+          );
+          return;
+        }
+        cliOutput(
+          { processed: result.processed, skipped: result.skipped, errors: result.errors },
+          {
+            command: "backfill",
+            operation: "admin.backfill",
+            message: `Processed ${result.processed}, skipped ${result.skipped}, errors ${result.errors}`
+          }
+        );
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliError(
+          `Embedding backfill failed: ${message}`,
+          "E_INTERNAL",
+          {
+            name: "E_INTERNAL"
+          },
+          { operation: "admin.backfill" }
+        );
+        process.exit(1);
+      }
+      return;
+    }
+    const dryRun = !!args["dry-run"];
+    const rollback = !!args.rollback;
+    const taskIds = args.tasks?.trim() ? args.tasks.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+    if (!dryRun && !rollback && !process.env["CLEO_NONINTERACTIVE"]) {
+      humanWarn(
+        "Warning: Backfill will modify tasks in-place. Run with --dry-run first to preview changes.\n  Set CLEO_NONINTERACTIVE=1 or pass --dry-run to suppress this warning.\n"
+      );
+    }
+    try {
+      const result = await backfillTasks(root, { dryRun, rollback, taskIds });
+      const output = {
+        dryRun,
+        rollback,
+        tasksScanned: result.tasksScanned,
+        tasksChanged: result.tasksChanged,
+        changes: result.changes
+      };
+      if (!rollback) {
+        output["acAdded"] = result.acAdded;
+        output["verificationAdded"] = result.verificationAdded;
+      }
+      const messagePrefix = dryRun ? "[dry run] " : rollback ? "[rollback] " : "";
+      const messageSuffix = result.changes.length === 0 ? "Nothing to do \u2014 all tasks already have AC and verification metadata." : `Scanned ${result.tasksScanned}, changed ${result.tasksChanged} task(s).`;
+      cliOutput(output, {
+        command: "backfill",
+        operation: "admin.backfill",
+        message: `${messagePrefix}${messageSuffix}`
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      cliError(
+        `Backfill failed: ${message}`,
+        "E_INTERNAL",
+        {
+          name: "E_INTERNAL"
+        },
+        { operation: "admin.backfill" }
+      );
+      process.exit(1);
+    }
+  }
+});
+export {
+  backfillCommand
+};
+//# sourceMappingURL=backfill-32TRAYRD.js.map