@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/chunk-GRU74UE4.js

@@ -0,0 +1,270 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  negatedFlag
+} from "./chunk-47JYZAMS.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine,
+  isHumanOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/lib/nexus-account-cli.ts
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
+
+// packages/cleo/src/cli/lib/device-code-prompt.ts
+function writeDeviceCodePrompt(info, serviceName) {
+  process.stderr.write("\n");
+  process.stderr.write(`  Visit:      ${info.verificationUriComplete ?? info.verificationUri}
+`);
+  process.stderr.write(`  Enter code: ${info.userCode}
+`);
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Waiting for ${serviceName} authorization (up to ${Math.round(info.expiresIn / 60)} min)...
+`
+  );
+}
+function writeDeviceCodePending(elapsed) {
+  process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
+}
+function writeDeviceCodeInterrupted() {
+  process.stderr.write("\n");
+}
+function writeDeviceCodeApproved(serviceName) {
+  process.stderr.write(`\r  ${serviceName} authorization approved.              
+
+`);
+}
+
+// packages/cleo/src/cli/lib/terminal-safe.ts
+var ESC_SEQUENCE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)?|[PX^_][^\x1b]*(?:\x1b\\)?|[ -~]?)/g;
+var C1_SEQUENCE = /\x9b[0-?]*[ -/]*[@-~]|[\x90\x98\x9d-\x9f][^\x07\x9c\x1b]*(?:\x07|\x9c)?/g;
+var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
+var BIDI = /[\u202a-\u202e\u2066-\u2069]/g;
+function terminalSafeLines(text) {
+  return text.replace(ESC_SEQUENCE, "").replace(C1_SEQUENCE, "").replace(CONTROL, "").replace(BIDI, "");
+}
+function terminalSafe(text) {
+  return terminalSafeLines(text.replace(/ *[\t\n\r][\t\n\r ]*/g, " "));
+}
+
+// packages/cleo/src/cli/lib/nexus-account-cli.ts
+var SERVICE_NAME = "Cleo Nexus";
+var NEXUS_API_URL_ARG = {
+  type: "string",
+  description: "Cleo Nexus API URL (default: $CLEO_NEXUS_API_URL, else https://api.cleocode.dev; staging: https://api.staging.cleocode.dev)."
+};
+function nexusApiUrlArg(args) {
+  const raw = args["api-url"];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+var VAULT_REFUSAL_EXIT_CODES = {
+  E_NEXUS_VAULT_LEASE_HELD: ExitCode.LOCK_TIMEOUT,
+  E_NEXUS_VAULT_STORE_BUSY: ExitCode.LOCK_TIMEOUT,
+  E_NEXUS_VAULT_BEHIND: ExitCode.VERSION_CONFLICT,
+  E_NEXUS_VAULT_LOCAL_CHANGES: ExitCode.CONCURRENT_MODIFICATION,
+  E_NEXUS_VAULT_VERIFY_FAILED: ExitCode.CHECKSUM_MISMATCH,
+  E_NEXUS_VAULT_TARGET_OCCUPIED: ExitCode.ID_COLLISION,
+  // `cleo cloud restore <name>` (T13102).
+  E_NEXUS_PROJECT_NOT_FOUND: ExitCode.NOT_FOUND,
+  E_NEXUS_PROJECT_AMBIGUOUS: ExitCode.VALIDATION_ERROR
+};
+function failNexus(err, operation) {
+  const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
+  const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : VAULT_REFUSAL_EXIT_CODES[code ?? ""] ?? 1;
+  const details = err instanceof Error && "publicDetails" in err && typeof err.publicDetails === "object" && err.publicDetails ? err.publicDetails : void 0;
+  cliError(
+    terminalSafeLines(err instanceof Error ? err.message : String(err)),
+    exitCode,
+    {
+      name: code ?? "E_NEXUS_REQUEST_FAILED",
+      ...fix ? { fix } : {},
+      ...details ? { details } : {}
+    },
+    { operation }
+  );
+  process.exit(exitCode);
+}
+function writeNexusWarnings(warnings) {
+  for (const warning of warnings) process.stderr.write(`warning: ${terminalSafe(warning)}
+`);
+}
+function emitNexusResult(data, summary, command, operation) {
+  if (isHumanOutput()) humanLine(terminalSafeLines(summary));
+  else cliOutput(data, { command, operation });
+}
+async function runNexusLogin(args, openBrowser) {
+  const { loginToNexus } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-auth.js"
+  );
+  const { isNexusDeviceEnabled } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-device.js"
+  );
+  const noBrowser = negatedFlag(args, "browser");
+  let codeShown = false;
+  const hooks = {
+    apiUrl: nexusApiUrlArg(args),
+    onCode: (code) => {
+      codeShown = true;
+      writeDeviceCodePrompt(code, SERVICE_NAME);
+      if (!noBrowser) openBrowser(code.verificationUriComplete ?? code.verificationUri);
+    },
+    onPending: writeDeviceCodePending
+  };
+  const readOnly = args["read-only"] === true;
+  const name = typeof args["name"] === "string" && args["name"] !== "" ? args["name"] : void 0;
+  if (readOnly && !isNexusDeviceEnabled()) {
+    throw Object.assign(
+      new Error(
+        "--read-only needs device credentials, which are not enabled; nothing was signed in"
+      ),
+      {
+        code: "E_NEXUS_DEVICE_REQUIRED",
+        fix: "unset CLEO_NEXUS_DEVICE (=0 turns device credentials off) to enrol a read-only device, or log in without --read-only"
+      }
+    );
+  }
+  try {
+    let result;
+    if (isNexusDeviceEnabled()) {
+      const { loginToNexusDevice } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      result = await loginToNexusDevice({
+        ...hooks,
+        readOnly,
+        ...name !== void 0 ? { name } : {}
+      });
+      if (!readOnly) {
+        const { attachNexusGlobalStore } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-home.js"
+        );
+        try {
+          const global = await attachNexusGlobalStore({ apiUrl: hooks.apiUrl });
+          result = { ...result, warnings: [...result.warnings, ...global.warnings] };
+        } catch (err) {
+          result = {
+            ...result,
+            warnings: [
+              ...result.warnings,
+              `signed in, but attaching this device's global store failed (${err instanceof Error ? err.message : String(err)}); run \`cleo login nexus\` again`
+            ]
+          };
+        }
+      }
+    } else {
+      if (name !== void 0) {
+        process.stderr.write(
+          "warning: --name needs device credentials, which CLEO_NEXUS_DEVICE=0 turns off; ignored\n"
+        );
+      }
+      const { NEXUS_TEST_BEARER_ENV, W_NEXUS_TEST_BEARER_IGNORED } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      if ((process.env[NEXUS_TEST_BEARER_ENV]?.trim() ?? "") !== "") {
+        process.stderr.write(
+          `warning: ${W_NEXUS_TEST_BEARER_IGNORED}: ${NEXUS_TEST_BEARER_ENV} needs device credentials, which CLEO_NEXUS_DEVICE turns off; ignored
+`
+        );
+      }
+      result = await loginToNexus(hooks);
+    }
+    if (codeShown) writeDeviceCodeApproved(SERVICE_NAME);
+    writeNexusWarnings(result.warnings);
+    return result;
+  } catch (err) {
+    writeDeviceCodeInterrupted();
+    throw err;
+  }
+}
+function nexusLoginSummary(r) {
+  const who = r.user?.email ?? "your account";
+  const org = r.organization ? ` (${r.organization.name})` : "";
+  const device = r.device ? ` This machine is device ${r.device.deviceId}${r.device.name ? ` (${r.device.name})` : ""}, profile ${r.device.profile ?? "unknown"}.` : "";
+  return `Signed in to ${r.apiUrl} as ${who}${org}.${device}${nexusAccountSetupLine(r)}`;
+}
+function nexusAccountSetupLine(r) {
+  const account = r.account;
+  if (account === void 0) return "";
+  switch (account.status) {
+    case "ready":
+    case "skipped":
+      return ` ${account.summary}`;
+    case "unsupported":
+      return " Encrypted backups are not available on this server (see warnings).";
+    case "failed":
+      return ` Encrypted backups are NOT set up: step ${account.step} failed (see warnings for the fix).`;
+  }
+}
+function nexusDeviceLogoutSummary(r) {
+  const count = (o) => r.devices.filter((d) => d.outcome === o).length;
+  const confirmed = count("confirmed");
+  const open = r.devices.length - confirmed;
+  const what = r.action === "revoke" ? "Revoke" : "Sign-out";
+  if (r.devices.length === 0 && r.session === null) {
+    return r.warnings.length > 0 ? `${what} on ${r.apiUrl}: nothing was sent (see warnings).` : `Not signed in to ${r.apiUrl}; nothing to do.`;
+  }
+  const parts = [];
+  if (r.devices.length > 0)
+    parts.push(`${confirmed} of ${r.devices.length} device request(s) confirmed`);
+  if (open > 0) parts.push(`${open} NOT confirmed (see warnings)`);
+  if (r.session !== null) parts.push(`9.24 session ${r.session.revocation}`);
+  const notConfirmed = open > 0 || r.devices.length > 0 && confirmed === 0 || r.session?.revocation === "failed";
+  const lead = notConfirmed ? `${what} NOT fully confirmed on` : `${what} confirmed on`;
+  return `${lead} ${r.apiUrl}: ${parts.join("; ")}.`;
+}
+async function runNexusDeviceLogout(args) {
+  let result;
+  try {
+    const { logoutNexusDevice } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-logout.js"
+    );
+    result = await logoutNexusDevice({
+      apiUrl: nexusApiUrlArg(args),
+      revoke: args["revoke"] === true
+    });
+  } catch (err) {
+    failNexus(err, "logout.run");
+  }
+  writeNexusWarnings(result.warnings);
+  emitNexusResult(result, nexusDeviceLogoutSummary(result), "logout", "logout.run");
+}
+
+export {
+  writeDeviceCodePrompt,
+  writeDeviceCodePending,
+  writeDeviceCodeInterrupted,
+  writeDeviceCodeApproved,
+  terminalSafe,
+  NEXUS_API_URL_ARG,
+  nexusApiUrlArg,
+  failNexus,
+  writeNexusWarnings,
+  emitNexusResult,
+  runNexusLogin,
+  nexusLoginSummary,
+  runNexusDeviceLogout
+};
+//# sourceMappingURL=chunk-GRU74UE4.js.map

package/dist/cli/chunk-GZFVDR44.js

@@ -0,0 +1,320 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/lib/readline-wizard-io.ts
+import { stdin as input, stdout as output } from "node:process";
+import * as readline from "node:readline/promises";
+import { Writable } from "node:stream";
+import { WizardFatalError, WizardInterruptError } from "@cleocode/core/setup";
+function stripBracketedPaste(raw) {
+  return raw.replace(/\x1b\[200~/g, "").replace(/\x1b\[201~/g, "").trim();
+}
+var SETUP_STDIN_CLOSED_CODE = "E_SETUP_STDIN_CLOSED";
+var StdinClosedError = class _StdinClosedError extends WizardFatalError {
+  codeName = SETUP_STDIN_CLOSED_CODE;
+  constructor() {
+    super("stdin closed before section completed");
+    this.name = "StdinClosedError";
+  }
+  /**
+   * Type-guard so callers can identify this error without `instanceof`.
+   *
+   * @param err - Value caught from a `catch` block.
+   */
+  static is(err) {
+    return err instanceof _StdinClosedError;
+  }
+};
+var SECRET_ECHO_REFUSED_MESSAGE = 'Refusing to read a secret: stdin is a terminal but terminal mode is off, so the key would be echoed. Pipe it instead: printf %s "$KEY" | cleo decide config --provider layahost --key-stdin (or cleo llm add <provider> --api-key-stdin).';
+var SECRET_MASK_CHAR = "\u2022";
+function streamIsTTY(stream) {
+  return "isTTY" in stream && stream.isTTY === true;
+}
+var MutableOutput = class extends Writable {
+  /** @param target - Stream that receives writes while unmuted. */
+  constructor(target) {
+    super();
+    this.target = target;
+    this.isTTY = "isTTY" in target && target.isTTY === true;
+  }
+  target;
+  /** When true, writes are dropped. */
+  muted = false;
+  /** Mirrors the wrapped stream: readline enables terminal mode (and echo) from it. */
+  isTTY;
+  /** Terminal width of the wrapped stream, when it reports one. */
+  get columns() {
+    return "columns" in this.target && typeof this.target.columns === "number" ? this.target.columns : void 0;
+  }
+  /** Forward a chunk unless muted. */
+  _write(chunk, encoding, callback) {
+    if (this.muted) {
+      callback();
+      return;
+    }
+    const done = () => callback();
+    if (typeof chunk === "string") this.target.write(chunk, encoding, done);
+    else this.target.write(chunk, done);
+  }
+  /** Write straight to the wrapped stream, bypassing the mute. */
+  writeUnmuted(text) {
+    this.target.write(text);
+  }
+};
+var ReadlineWizardIO = class {
+  /**
+   * Underlying readline interface.
+   *
+   * Exposed as `protected` (not `private`) so tests can emit `'SIGINT'` on it
+   * to simulate Ctrl-C without requiring a real TTY. Production code MUST NOT
+   * access this field directly.
+   *
+   * @internal
+   */
+  rl;
+  /** The stream readline echoes into; muted while a secret is typed. */
+  output;
+  /** Whether the input stream is a TTY (the terminal echoes unless readline owns it). */
+  inputIsTTY;
+  /** The input stream (its keypress events drive the secret mask). */
+  inStream;
+  /** AbortController aborted when stdin closes — surfaced as {@link StdinClosedError}. */
+  eofController;
+  /**
+   * Whether a SIGINT was received. Set before throwing so `rethrowEof` does
+   * not mistakenly wrap the AbortError as a `StdinClosedError`.
+   */
+  sigintReceived = false;
+  /**
+   * Construct a readline interface bound to the supplied streams.
+   *
+   * The defaults (`process.stdin` / `process.stdout`) are correct for
+   * production use; tests inject in-memory streams.
+   *
+   * @param inStream - Input stream; defaults to `process.stdin`.
+   * @param outStream - Output stream passed to readline for terminal-echo
+   *   purposes only; informational output goes to stderr. CLI commands pass
+   *   `process.stderr` so prompts never reach a redirected stdout.
+   * @param options - See {@link ReadlineWizardIOOptions}; terminal mode
+   *   defaults to the input stream's `isTTY`.
+   */
+  constructor(inStream = input, outStream = output, options = {}) {
+    this.eofController = new AbortController();
+    this.output = new MutableOutput(outStream);
+    this.inStream = inStream;
+    this.inputIsTTY = streamIsTTY(inStream);
+    this.rl = readline.createInterface({
+      input: inStream,
+      output: this.output,
+      terminal: options.terminal ?? this.inputIsTTY,
+      // No history: a secret must never be recallable with Up-arrow.
+      historySize: 0
+    });
+    this.rl.on("close", () => {
+      if (!this.eofController.signal.aborted) {
+        this.eofController.abort(new StdinClosedError());
+      }
+    });
+    this.rl.on("SIGINT", () => {
+      this.sigintReceived = true;
+      if (!this.eofController.signal.aborted) {
+        this.eofController.abort(new WizardInterruptError("interrupted by user"));
+      }
+    });
+  }
+  /**
+   * Release the underlying readline interface.
+   *
+   * Safe to call multiple times — `readline.Interface.close()` is
+   * idempotent.
+   */
+  close() {
+    this.rl.close();
+  }
+  /**
+   * Wrap an AbortError thrown by `rl.question()` into the appropriate
+   * typed error.
+   *
+   * - SIGINT received → throw {@link WizardInterruptError}
+   * - Stdin EOF → throw {@link StdinClosedError}
+   * - Any other error → re-throw as-is.
+   *
+   * @internal
+   */
+  rethrowEof(err) {
+    if (err instanceof Error && (err.name === "AbortError" || err.name === "AbortSignal") && this.eofController.signal.aborted) {
+      if (this.sigintReceived) {
+        throw new WizardInterruptError("interrupted by user");
+      }
+      throw new StdinClosedError();
+    }
+    throw err;
+  }
+  async prompt(question) {
+    try {
+      const raw = await this.rl.question(`${question} `, {
+        signal: this.eofController.signal
+      });
+      return stripBracketedPaste(raw);
+    } catch (err) {
+      this.rethrowEof(err);
+    }
+  }
+  /**
+   * Ask for a secret without echoing it: the question is written, then the
+   * output stream is muted until the answer is submitted. Bracketed-paste
+   * markers are stripped like {@link prompt}. The answer is removed from
+   * readline's history afterwards.
+   *
+   * @param question - The question, e.g. `API key:`.
+   * @returns The trimmed answer; `''` when none was given.
+   * @throws Error with {@link SECRET_ECHO_REFUSED_MESSAGE} when stdin is a
+   *   terminal but terminal mode is off (the terminal would echo the key).
+   * @task T12714
+   */
+  async secret(question) {
+    if (this.inputIsTTY && !this.rl.terminal) throw new Error(SECRET_ECHO_REFUSED_MESSAGE);
+    this.output.writeUnmuted(`${question} `);
+    this.output.muted = true;
+    const stopMask = this.echoMask();
+    let raw;
+    try {
+      raw = await this.rl.question("", { signal: this.eofController.signal });
+      return stripBracketedPaste(raw);
+    } catch (err) {
+      return this.rethrowEof(err);
+    } finally {
+      stopMask();
+      this.output.muted = false;
+      this.output.writeUnmuted("\n");
+      if (raw !== void 0) this.scrubHistory(raw);
+    }
+  }
+  /**
+   * While a secret is typed (readline's echo muted), echo one
+   * {@link SECRET_MASK_CHAR} per character in the line and erase one per
+   * deleted character. Runs after readline's own keypress handler (registered
+   * first), so `rl.line` is already updated; only its LENGTH is read. The
+   * submitting key (Enter) is ignored, since readline clears the line then.
+   *
+   * @returns A function that stops the echo.
+   */
+  echoMask() {
+    if (!this.rl.terminal) return () => {
+    };
+    let shown = 0;
+    const onKeypress = (_str, key) => {
+      if (key?.name === "return" || key?.name === "enter") return;
+      const length = this.rl.line.length;
+      if (length > shown) this.output.writeUnmuted(SECRET_MASK_CHAR.repeat(length - shown));
+      else if (length < shown) this.output.writeUnmuted("\b \b".repeat(shown - length));
+      shown = length;
+    };
+    this.inStream.on("keypress", onKeypress);
+    return () => {
+      this.inStream.off("keypress", onKeypress);
+    };
+  }
+  /**
+   * Remove every history entry equal to `line`. `history` is a runtime field
+   * of `readline.Interface` that `@types/node` does not declare, so it is
+   * read reflectively and checked before use.
+   *
+   * @param line - The exact line readline recorded.
+   */
+  scrubHistory(line) {
+    const history = Reflect.get(this.rl, "history");
+    if (!Array.isArray(history)) return;
+    for (let i = history.length - 1; i >= 0; i--) {
+      if (history[i] === line) history.splice(i, 1);
+    }
+  }
+  async confirm(question, defaultValue) {
+    const hint = defaultValue === void 0 ? "[y/n]" : defaultValue ? "[Y/n]" : "[y/N]";
+    let raw;
+    try {
+      raw = stripBracketedPaste(
+        await this.rl.question(`${question} ${hint} `, { signal: this.eofController.signal })
+      ).toLowerCase();
+    } catch (err) {
+      this.rethrowEof(err);
+    }
+    if (raw === "") {
+      if (defaultValue === void 0) {
+        return this.confirm(question, defaultValue);
+      }
+      return defaultValue;
+    }
+    if (raw === "y" || raw === "yes") return true;
+    if (raw === "n" || raw === "no") return false;
+    return this.confirm(question, defaultValue);
+  }
+  async select(question, options) {
+    if (options.length === 0) {
+      throw new Error(`ReadlineWizardIO.select: option list is empty for '${question}'`);
+    }
+    process.stderr.write(`${question}
+`);
+    options.forEach((opt, idx) => {
+      process.stderr.write(`  ${idx + 1}) ${opt}
+`);
+    });
+    const MAX_RETRIES = 10;
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+      let raw;
+      try {
+        raw = stripBracketedPaste(
+          await this.rl.question(`Choose [1-${options.length}]: `, {
+            signal: this.eofController.signal
+          })
+        );
+      } catch (err) {
+        this.rethrowEof(err);
+      }
+      if (/^\d+$/.test(raw)) {
+        const idx = Number.parseInt(raw, 10) - 1;
+        if (idx >= 0 && idx < options.length) return options[idx];
+      }
+      if (options.includes(raw)) return raw;
+      process.stderr.write(`Invalid choice '${raw}'. Try again.
+`);
+    }
+    throw new Error(
+      `ReadlineWizardIO.select: gave up after ${MAX_RETRIES} invalid responses for '${question}'`
+    );
+  }
+  /** Informational message — goes to stderr, never stdout. */
+  info(message) {
+    process.stderr.write(`${message}
+`);
+  }
+  /** Non-fatal warning — goes to stderr. */
+  warn(message) {
+    process.stderr.write(`${message}
+`);
+  }
+  /** Error message — goes to stderr. */
+  error(message) {
+    process.stderr.write(`${message}
+`);
+  }
+};
+
+export {
+  StdinClosedError,
+  ReadlineWizardIO
+};
+//# sourceMappingURL=chunk-GZFVDR44.js.map

package/dist/cli/chunk-HFLLZE6A.js

@@ -0,0 +1,83 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/doctor-global-delivery.ts
+import {
+  auditGlobalDelivery,
+  repairGlobalDelivery
+} from "@cleocode/core/system/global-delivery.js";
+var doctorGlobalDeliveryCommand = defineCommand({
+  meta: {
+    name: "global-delivery",
+    description: "Check that ~/.cleo, the global hub reference and every harness CLEO skill install resolve. Read-only; --repair relinks them with a receipt (--dry-run to preview)."
+  },
+  args: {
+    repair: {
+      type: "boolean",
+      description: "Relink ~/.cleo to the OS data dir and every dangling or ~/.cleo-routed skill entry to the physical skills dir (verified symlink, else copy). Appends a receipt."
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "With --repair: report the receipt without touching disk"
+    },
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const dryRun = args["dry-run"] === true;
+    let result = null;
+    if (args.repair === true) {
+      try {
+        result = await repairGlobalDelivery({ dryRun });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliError(
+          message,
+          1,
+          {
+            name: "E_CLEO_LINK_REPAIR_FAILED",
+            fix: "The entry that failed was restored to its previous link (~/.cleo or the skill link). The intent and failed receipts under <cleoHome>/audit list every planned entry with its previous target. On Windows enable Developer Mode or run as administrator, then re-run `cleo doctor global-delivery --repair`."
+          },
+          { operation: "doctor.global-delivery.run" }
+        );
+        process.exitCode = 1;
+        return;
+      }
+    }
+    const audit = result?.audit ?? await auditGlobalDelivery();
+    cliOutput(
+      { ...audit, receipt: result?.receipt ?? null },
+      { command: "doctor", operation: "doctor.global-delivery.run" }
+    );
+    const refused = result?.receipt.link.action === "refused";
+    if ((refused || !audit.healthy && !dryRun) && (process.exitCode ?? 0) === 0) {
+      process.exitCode = 1;
+    }
+  }
+});
+
+export {
+  doctorGlobalDeliveryCommand
+};
+//# sourceMappingURL=chunk-HFLLZE6A.js.map