@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/admin-L3F6CDYH.js

@@ -0,0 +1,1428 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  OPERATIONS
+} from "./chunk-4VASFLUW.js";
+import {
+  defineTypedHandler,
+  lafsError,
+  lafsSuccess,
+  typedDispatch
+} from "./chunk-QWNKLLLG.js";
+import {
+  lazyOperation
+} from "./chunk-TYC7G5LF.js";
+import {
+  dispatchMeta,
+  envelopeToEngineResult,
+  getListParams,
+  handleErrorResult,
+  unsupportedOp,
+  wrapResult
+} from "./chunk-XHRZ7OYZ.js";
+
+// packages/cleo/src/dispatch/domains/admin.ts
+import { computeHelp } from "@cleocode/core/admin/help";
+import { getContextWindow } from "@cleocode/core/context/index";
+import { configDomainHandler } from "@cleocode/core/dispatch/config-domain-handler";
+import { getLogger } from "@cleocode/core/logger";
+import { paginate } from "@cleocode/core/pagination";
+import { getProjectRoot } from "@cleocode/core/project-scope";
+import { getDefaultSnapshotPath } from "@cleocode/core/snapshot/index";
+import {
+  createGlobalBackup,
+  listGlobalBackups,
+  listSystemBackups,
+  restoreBackupById,
+  createBackup as systemCreateBackup
+} from "@cleocode/core/system/backup";
+import { getSystemPaths } from "@cleocode/core/system/platform-paths";
+var checkSequence = lazyOperation(
+  async () => (await import("@cleocode/core/sequence/index")).checkSequence
+);
+var cleanupSystem = lazyOperation(
+  async () => (await import("@cleocode/core/system/cleanup")).cleanupSystem
+);
+var clearTokenUsage = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).clearTokenUsage
+);
+var configGet = lazyOperation(
+  async () => (await import("@cleocode/core/config/engine-ops")).configGet
+);
+var configListPresets = lazyOperation(
+  async () => (await import("@cleocode/core/config/engine-ops")).configListPresets
+);
+var configSet = lazyOperation(
+  async () => (await import("@cleocode/core/config/engine-ops")).configSet
+);
+var configSetPreset = lazyOperation(
+  async () => (await import("@cleocode/core/config/engine-ops")).configSetPreset
+);
+var coreDoctorReport = lazyOperation(
+  async () => (await import("@cleocode/core/system/health")).coreDoctorReport
+);
+var deleteTokenUsage = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).deleteTokenUsage
+);
+var ensureCleoOsHub = lazyOperation(
+  async () => (await import("@cleocode/core/scaffold/global-scaffold")).ensureCleoOsHub
+);
+var exportSnapshot = lazyOperation(
+  async () => (await import("@cleocode/core/snapshot/index")).exportSnapshot
+);
+var exportTasks = lazyOperation(
+  async () => (await import("@cleocode/core/admin/export")).exportTasks
+);
+var exportTasksPackage = lazyOperation(
+  async () => (await import("@cleocode/core/admin/export-tasks")).exportTasksPackage
+);
+var fileRestore = lazyOperation(
+  async () => (await import("@cleocode/core/system/backup")).fileRestore
+);
+var findAdrs = lazyOperation(async () => (await import("@cleocode/core/adrs/find")).findAdrs);
+var generateInjection = lazyOperation(
+  async () => (await import("@cleocode/core/system/inject-generate")).generateInjection
+);
+var getDashboard = lazyOperation(
+  async () => (await import("@cleocode/core/stats/index")).getDashboard
+);
+var getMigrationStatus = lazyOperation(
+  async () => (await import("@cleocode/core/system/migrate")).getMigrationStatus
+);
+var getProjectStatsExtended = lazyOperation(
+  async () => (await import("@cleocode/core/stats/index")).getProjectStatsExtended
+);
+var getRoadmap = lazyOperation(
+  async () => (await import("@cleocode/core/roadmap/index")).getRoadmap
+);
+var getRuntimeDiagnostics = lazyOperation(
+  async () => (await import("@cleocode/core/system/runtime")).getRuntimeDiagnostics
+);
+var getSystemHealth = lazyOperation(
+  async () => (await import("@cleocode/core/system/health")).getSystemHealth
+);
+var getTaskAccessor = lazyOperation(
+  async () => (await import("@cleocode/core/store/data-accessor")).getTaskAccessor
+);
+var getVersion = lazyOperation(
+  async () => (await import("@cleocode/core/init/engine-ops")).getVersion
+);
+var importSnapshot = lazyOperation(
+  async () => (await import("@cleocode/core/snapshot/index")).importSnapshot
+);
+var importTasks = lazyOperation(
+  async () => (await import("@cleocode/core/admin/import")).importTasks
+);
+var importTasksPackage = lazyOperation(
+  async () => (await import("@cleocode/core/admin/import-tasks")).importTasksPackage
+);
+var initProject = lazyOperation(
+  async () => (await import("@cleocode/core/init/engine-ops")).initProject
+);
+var listAdrs = lazyOperation(async () => (await import("@cleocode/core/adrs/list")).listAdrs);
+var listTokenUsage = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).listTokenUsage
+);
+var mapCodebase = lazyOperation(
+  async () => (await import("@cleocode/core/codebase-map/index")).mapCodebase
+);
+var queryAuditLog = lazyOperation(
+  async () => (await import("@cleocode/core/system/audit")).queryAuditLog
+);
+var readSnapshot = lazyOperation(
+  async () => (await import("@cleocode/core/snapshot/index")).readSnapshot
+);
+var recordTokenExchange = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).recordTokenExchange
+);
+var runDoctorFixes = lazyOperation(
+  async () => (await import("@cleocode/core/system/health")).runDoctorFixes
+);
+var safestop = lazyOperation(
+  async () => (await import("@cleocode/core/system/safestop")).safestop
+);
+var sessionContextInject = lazyOperation(
+  async () => (await import("@cleocode/core/session/engine-ops")).sessionContextInject
+);
+var showAdr = lazyOperation(async () => (await import("@cleocode/core/adrs/show")).showAdr);
+var showSequence = lazyOperation(
+  async () => (await import("@cleocode/core/sequence/index")).showSequence
+);
+var showTokenUsage = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).showTokenUsage
+);
+var summarizeTokenUsage = lazyOperation(
+  async () => (await import("@cleocode/core/metrics/token-service")).summarizeTokenUsage
+);
+var syncAdrsToDb = lazyOperation(
+  async () => (await import("@cleocode/core/adrs/sync")).syncAdrsToDb
+);
+var systemHooksMatrix = lazyOperation(
+  async () => (await import("@cleocode/core/hooks/engine-ops")).systemHooksMatrix
+);
+var validateAllAdrs = lazyOperation(
+  async () => (await import("@cleocode/core/adrs/validate")).validateAllAdrs
+);
+var writeSnapshot = lazyOperation(
+  async () => (await import("@cleocode/core/snapshot/index")).writeSnapshot
+);
+var SMOKE_PROBES = [
+  { domain: "admin", operation: "version" },
+  { domain: "tasks", operation: "find", params: { query: "__smoke_probe__", limit: 1 } },
+  { domain: "session", operation: "status" },
+  { domain: "memory", operation: "find", params: { query: "__smoke_probe__" } },
+  { domain: "pipeline", operation: "list" },
+  { domain: "check", operation: "schema" },
+  { domain: "tools", operation: "list", params: { limit: 1 } },
+  { domain: "sticky", operation: "list", params: { limit: 1 } },
+  { domain: "nexus", operation: "status" },
+  { domain: "orchestrate", operation: "status" },
+  { domain: "adapter", operation: "list" }
+];
+async function runSystemSmoke() {
+  const { dispatchRaw } = await import("./cli-A23Q335V.js");
+  const totalStart = Date.now();
+  const probes = [];
+  for (const probe of SMOKE_PROBES) {
+    const start = Date.now();
+    try {
+      const response = await dispatchRaw("query", probe.domain, probe.operation, probe.params);
+      const elapsed = Date.now() - start;
+      if (response.success) {
+        probes.push({
+          domain: probe.domain,
+          operation: probe.operation,
+          status: "pass",
+          timeMs: elapsed
+        });
+      } else {
+        const code = response.error?.code ?? "";
+        const isCrash = code === "E_INTERNAL" || code === "E_NO_HANDLER";
+        probes.push({
+          domain: probe.domain,
+          operation: probe.operation,
+          status: isCrash ? "fail" : "pass",
+          timeMs: elapsed,
+          ...isCrash ? { error: response.error?.message } : {}
+        });
+      }
+    } catch (err) {
+      probes.push({
+        domain: probe.domain,
+        operation: probe.operation,
+        status: "fail",
+        timeMs: Date.now() - start,
+        error: err instanceof Error ? `${err.constructor.name}: ${err.message}` : String(err)
+      });
+    }
+  }
+  const dbChecks = [];
+  {
+    const start = Date.now();
+    try {
+      const { getDb, getNativeDb } = await import("@cleocode/core/store/sqlite");
+      const projectRoot = getProjectRoot();
+      await getDb(projectRoot);
+      const nativeDb = getNativeDb(projectRoot);
+      if (nativeDb) {
+        const result = nativeDb.prepare("PRAGMA integrity_check").get();
+        const ok = result?.integrity_check === "ok";
+        dbChecks.push({
+          domain: "db",
+          operation: "tasks.db",
+          status: ok ? "pass" : "fail",
+          timeMs: Date.now() - start,
+          ...!ok ? { error: "SQLite integrity check failed" } : {}
+        });
+      } else {
+        dbChecks.push({
+          domain: "db",
+          operation: "tasks.db",
+          status: "fail",
+          timeMs: Date.now() - start,
+          error: "Native DB handle unavailable"
+        });
+      }
+    } catch (err) {
+      dbChecks.push({
+        domain: "db",
+        operation: "tasks.db",
+        status: "fail",
+        timeMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  {
+    const start = Date.now();
+    try {
+      const { getBrainDb } = await import("@cleocode/core/store/memory-sqlite");
+      const projectRoot = getProjectRoot();
+      const brainDb = await getBrainDb(projectRoot);
+      if (brainDb) {
+        dbChecks.push({
+          domain: "db",
+          operation: "brain.db",
+          status: "pass",
+          timeMs: Date.now() - start
+        });
+      } else {
+        dbChecks.push({
+          domain: "db",
+          operation: "brain.db",
+          status: "fail",
+          timeMs: Date.now() - start,
+          error: "brain.db not initialized"
+        });
+      }
+    } catch (err) {
+      dbChecks.push({
+        domain: "db",
+        operation: "brain.db",
+        status: "fail",
+        timeMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  {
+    const start = Date.now();
+    try {
+      const migrationStatus = await getMigrationStatus(getProjectRoot());
+      const hasPending = migrationStatus.migrations.some(
+        (m) => !m.applied
+      );
+      dbChecks.push({
+        domain: "db",
+        operation: "migrations",
+        status: hasPending ? "fail" : "pass",
+        timeMs: Date.now() - start,
+        ...hasPending ? {
+          error: `Unapplied migrations detected (${migrationStatus.from} \u2192 ${migrationStatus.to}). Run: cleo upgrade`
+        } : {}
+      });
+    } catch (err) {
+      dbChecks.push({
+        domain: "db",
+        operation: "migrations",
+        status: "fail",
+        timeMs: Date.now() - start,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const allProbes = [...probes, ...dbChecks];
+  const totalMs = Date.now() - totalStart;
+  const passed = allProbes.filter((p) => p.status === "pass").length;
+  const failed = allProbes.filter((p) => p.status === "fail").length;
+  const skipped = allProbes.filter((p) => p.status === "skip").length;
+  return { probes, dbChecks, passed, failed, skipped, totalMs };
+}
+var _adminTypedHandler = defineTypedHandler("admin", {
+  // -------------------------------------------------------------------------
+  // Query ops
+  // -------------------------------------------------------------------------
+  version: async (_params) => {
+    const projectRoot = getProjectRoot();
+    const result = await getVersion(projectRoot);
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "version"
+      );
+    }
+    return lafsSuccess(result.data ?? { version: "" }, "version");
+  },
+  health: async (params) => {
+    const projectRoot = getProjectRoot();
+    if (params.mode === "diagnose") {
+      try {
+        const data = await coreDoctorReport(projectRoot);
+        return lafsSuccess(
+          data ?? { healthy: false, errors: 0, warnings: 0, checks: [] },
+          "health"
+        );
+      } catch (err) {
+        return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), "health");
+      }
+    }
+    try {
+      const data = await getSystemHealth(projectRoot, { detailed: params.detailed });
+      return lafsSuccess(
+        data ?? { overall: "error", checks: [], version: "", installation: "degraded" },
+        "health"
+      );
+    } catch (err) {
+      return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), "health");
+    }
+  },
+  "config.show": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configGet(projectRoot, params.key);
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "config.show"
+      );
+    }
+    return lafsSuccess(result.data ?? {}, "config.show");
+  },
+  "config.presets": async (_params) => {
+    const result = await configListPresets();
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "config.presets"
+      );
+    }
+    return lafsSuccess(result.data ?? { presets: [] }, "config.presets");
+  },
+  // T11917 — config-as-domain. Delegate to the CORE ConfigDomainHandler, which
+  // routes through the ConfigManifest cascade resolver (resolveCleoConfig /
+  // getConfigValue / validateConfig). The CLI handler only wraps the
+  // EngineResult into the LAFS envelope.
+  "config.get": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configDomainHandler.get(projectRoot, params.key, params.scope);
+    if (!result.success) {
+      return lafsError(result.error.code, result.error.message, "config.get");
+    }
+    return lafsSuccess(result.data, "config.get");
+  },
+  "config.list": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configDomainHandler.list(projectRoot, params.scope);
+    if (!result.success) {
+      return lafsError(result.error.code, result.error.message, "config.list");
+    }
+    return lafsSuccess(result.data, "config.list");
+  },
+  "config.validate": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configDomainHandler.validate(projectRoot, params.scope);
+    if (!result.success) {
+      return lafsError(result.error.code, result.error.message, "config.validate");
+    }
+    return lafsSuccess(result.data, "config.validate");
+  },
+  stats: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await getProjectStatsExtended(projectRoot, { period: params.period });
+      return lafsSuccess(data, "stats");
+    } catch (err) {
+      return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), "stats");
+    }
+  },
+  context: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = getContextWindow(
+        projectRoot,
+        params.session !== void 0 ? { session: params.session } : void 0
+      );
+      return lafsSuccess(data, "context");
+    } catch (err) {
+      return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), "context");
+    }
+  },
+  "context.pull": async (params) => {
+    const projectRoot = getProjectRoot();
+    const taskId = params.taskId;
+    try {
+      const [{ getTaskAccessor: getTaskAccessor2 }, { getLastHandoff }, { retrieveWithBudget }] = await Promise.all([
+        import("@cleocode/core/store/data-accessor"),
+        import("@cleocode/core/sessions/handoff"),
+        import("@cleocode/core/memory/retrieval/search")
+      ]);
+      const accessor = await getTaskAccessor2(projectRoot);
+      const task = await accessor.loadSingleTask(taskId);
+      if (!task) {
+        return lafsError("E_NOT_FOUND", `Task ${taskId} not found`, "context.pull");
+      }
+      const queryParts = [task.title, task.description].filter(
+        (v) => typeof v === "string" && v.trim().length > 0
+      );
+      const query = queryParts.join(" ");
+      const TOKEN_BUDGET = 800;
+      const [memoriesResult, lastHandoffResult] = await Promise.all([
+        retrieveWithBudget(projectRoot, query, TOKEN_BUDGET).catch(() => ({
+          entries: [],
+          tokensUsed: 0,
+          tokensRemaining: TOKEN_BUDGET,
+          excluded: 0
+        })),
+        getLastHandoff(projectRoot).catch(() => null)
+      ]);
+      const topMemories = memoriesResult.entries.slice(0, 5);
+      return lafsSuccess(
+        {
+          task: {
+            id: task.id,
+            title: task.title,
+            status: task.status,
+            acceptance: task.acceptance ?? []
+          },
+          relevantMemory: topMemories.map((e) => ({
+            id: e.id,
+            type: e.memoryType ?? "unknown",
+            summary: e.title
+          })),
+          lastHandoff: lastHandoffResult?.handoff?.note?.substring(0, 200) ?? null,
+          meta: {
+            memoryTokensUsed: memoriesResult.tokensUsed,
+            memoryEntriesExcluded: memoriesResult.excluded
+          }
+        },
+        "context.pull"
+      );
+    } catch (err) {
+      return lafsError(
+        "E_INTERNAL",
+        err instanceof Error ? err.message : String(err),
+        "context.pull"
+      );
+    }
+  },
+  runtime: async (params) => {
+    try {
+      const data = await getRuntimeDiagnostics({ detailed: params.detailed ?? false });
+      return lafsSuccess(data, "runtime");
+    } catch (err) {
+      return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), "runtime");
+    }
+  },
+  paths: async (_params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = getSystemPaths(projectRoot);
+      return lafsSuccess(data, "paths");
+    } catch (err) {
+      return lafsError(
+        "E_PATHS_RESOLVE_FAILED",
+        err instanceof Error ? err.message : String(err),
+        "paths"
+      );
+    }
+  },
+  job: async (params) => {
+    const { getJobManager } = await import("@cleocode/runtime/gateway");
+    const action = params.action ?? "status";
+    if (action === "list") {
+      const mgr = getJobManager();
+      if (!mgr) {
+        return lafsError(
+          "E_NOT_AVAILABLE",
+          "Job manager not available. Background jobs require a running CLEO daemon or long-lived process.",
+          "job"
+        );
+      }
+      const allJobs = mgr.listJobs();
+      const filteredJobs = params.status ? mgr.listJobs(params.status) : allJobs;
+      const { limit, offset } = getListParams({ limit: params.limit, offset: params.offset });
+      const page = paginate(filteredJobs, limit, offset);
+      return lafsSuccess(
+        {
+          jobs: page.items,
+          count: filteredJobs.length,
+          total: allJobs.length,
+          filtered: filteredJobs.length
+        },
+        "job"
+      );
+    }
+    const manager = getJobManager();
+    if (!manager) {
+      return lafsError(
+        "E_NOT_AVAILABLE",
+        "Job manager not available. Background jobs require a running CLEO daemon or long-lived process.",
+        "job"
+      );
+    }
+    const jobId = params.jobId;
+    if (!jobId) {
+      return lafsError("E_INVALID_INPUT", "jobId is required", "job");
+    }
+    const job = manager.getJob(jobId);
+    if (!job) {
+      return lafsError("E_NOT_FOUND", `Job ${jobId} not found`, "job");
+    }
+    return lafsSuccess(job, "job");
+  },
+  dash: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const accessor = await getTaskAccessor(projectRoot);
+      const raw = await getDashboard(
+        { cwd: projectRoot, blockedTasksLimit: params.blockedTasksLimit },
+        accessor
+      );
+      const data = raw;
+      const summary = data.summary;
+      return lafsSuccess(
+        {
+          project: data.project,
+          currentPhase: data.currentPhase,
+          summary: {
+            pending: summary.pending,
+            active: summary.active,
+            blocked: summary.blocked,
+            done: summary.done,
+            cancelled: summary.cancelled ?? 0,
+            total: summary.total,
+            archived: summary.archived ?? 0,
+            grandTotal: summary.grandTotal ?? summary.total
+          },
+          taskWork: data.focus ?? data.taskWork,
+          activeSession: data.activeSession ?? null,
+          highPriority: data.highPriority,
+          blockedTasks: data.blockedTasks,
+          recentCompletions: data.recentCompletions ?? [],
+          topLabels: data.topLabels
+        },
+        "dash"
+      );
+    } catch (err) {
+      return lafsError(
+        "E_NOT_INITIALIZED",
+        err instanceof Error ? err.message : String(err),
+        "dash"
+      );
+    }
+  },
+  log: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await queryAuditLog(projectRoot, {
+        operation: params.operation,
+        taskId: params.taskId,
+        since: params.since,
+        until: params.until,
+        limit: params.limit,
+        offset: params.offset
+      });
+      return lafsSuccess(data, "log");
+    } catch (err) {
+      return lafsError("E_FILE_ERROR", err instanceof Error ? err.message : String(err), "log");
+    }
+  },
+  sequence: async (params) => {
+    const projectRoot = getProjectRoot();
+    const action = params.action;
+    if (action && action !== "show" && action !== "check") {
+      return lafsError("E_INVALID_INPUT", "action must be show or check", "sequence");
+    }
+    try {
+      if (action === "check") {
+        const data = await checkSequence(projectRoot);
+        return lafsSuccess(data, "sequence");
+      }
+      const seq = await showSequence(projectRoot);
+      return lafsSuccess(
+        {
+          counter: Number(seq.counter ?? 0),
+          lastId: String(seq.lastId ?? ""),
+          checksum: String(seq.checksum ?? ""),
+          nextId: String(seq.nextId ?? "")
+        },
+        "sequence"
+      );
+    } catch (err) {
+      return lafsError("E_NOT_FOUND", err instanceof Error ? err.message : String(err), "sequence");
+    }
+  },
+  help: async (params) => {
+    const tier = params.tier ?? 0;
+    const verbose = params.verbose === true;
+    const helpResult = computeHelp(OPERATIONS, tier, verbose);
+    return lafsSuccess(helpResult, "help");
+  },
+  "adr.find": async (params) => {
+    const projectRoot = getProjectRoot();
+    if (params.query) {
+      const result2 = await findAdrs(projectRoot, params);
+      return lafsSuccess(result2, "adr.find");
+    }
+    const { limit, offset } = getListParams({ limit: params.limit, offset: params.offset });
+    const result = await listAdrs(projectRoot, { ...params, limit, offset });
+    return lafsSuccess(
+      {
+        ...result,
+        page: paginate(Array.from({ length: result.filtered }), limit, offset).page
+      },
+      "adr.find"
+    );
+  },
+  "adr.show": async (params) => {
+    const projectRoot = getProjectRoot();
+    const adr = await showAdr(projectRoot, params);
+    if (!adr) {
+      return lafsError("E_NOT_FOUND", `ADR not found: ${params.adrId}`, "adr.show");
+    }
+    return lafsSuccess(adr, "adr.show");
+  },
+  token: async (params) => {
+    const projectRoot = getProjectRoot();
+    const action = params.action ?? "summary";
+    if (action === "show") {
+      const tokenId = params.tokenId;
+      if (!tokenId) {
+        return lafsError("E_INVALID_INPUT", "tokenId is required", "token");
+      }
+      const result2 = await showTokenUsage(projectRoot, { id: tokenId });
+      if (!result2) {
+        return lafsError("E_NOT_FOUND", `Token usage record not found: ${tokenId}`, "token");
+      }
+      return lafsSuccess(result2, "token");
+    }
+    if (action === "list") {
+      const { limit, offset } = getListParams({ limit: params.limit, offset: params.offset });
+      const result2 = await listTokenUsage(projectRoot, {
+        provider: params.provider,
+        transport: params.transport,
+        gateway: params.gateway,
+        domain: params.domain,
+        operation: params.operationName,
+        sessionId: params.sessionId,
+        taskId: params.taskId,
+        method: params.method,
+        confidence: params.confidence,
+        requestId: params.requestId,
+        since: params.since,
+        until: params.until,
+        limit,
+        offset
+      });
+      return lafsSuccess(
+        {
+          records: result2.records,
+          total: result2.total,
+          filtered: result2.filtered
+        },
+        "token"
+      );
+    }
+    const result = await summarizeTokenUsage(projectRoot, {
+      provider: params.provider,
+      transport: params.transport,
+      gateway: params.gateway,
+      domain: params.domain,
+      operation: params.operationName,
+      sessionId: params.sessionId,
+      taskId: params.taskId,
+      method: params.method,
+      confidence: params.confidence,
+      requestId: params.requestId,
+      since: params.since,
+      until: params.until
+    });
+    return lafsSuccess(result, "token");
+  },
+  backup: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const scope = params.scope ?? "all";
+      const backups = [
+        ...scope === "global" ? [] : listSystemBackups(projectRoot),
+        ...scope === "project" ? [] : listGlobalBackups()
+      ].sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+      return lafsSuccess({ backups, count: backups.length }, "backup");
+    } catch (err) {
+      return lafsError("E_GENERAL", err instanceof Error ? err.message : String(err), "backup");
+    }
+  },
+  export: async (params) => {
+    const projectRoot = getProjectRoot();
+    if (params.scope === "snapshot") {
+      const snapshot = await exportSnapshot(projectRoot);
+      const outputPath = params.output ?? getDefaultSnapshotPath(projectRoot);
+      await writeSnapshot(snapshot, outputPath);
+      return lafsSuccess(
+        {
+          exported: true,
+          taskCount: snapshot._meta.taskCount,
+          outputPath,
+          checksum: snapshot._meta.checksum
+        },
+        "export"
+      );
+    }
+    if (params.scope === "tasks") {
+      const result2 = await exportTasksPackage(projectRoot, params);
+      return lafsSuccess(result2, "export");
+    }
+    const result = await exportTasks(projectRoot, params);
+    return lafsSuccess(result, "export");
+  },
+  map: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await mapCodebase(projectRoot, { focus: params.focus, storeToBrain: false });
+      return lafsSuccess(data, "map");
+    } catch (err) {
+      return lafsError("E_GENERAL", err instanceof Error ? err.message : String(err), "map");
+    }
+  },
+  roadmap: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const accessor = await getTaskAccessor(projectRoot);
+      const data = await getRoadmap(
+        {
+          includeHistory: params.includeHistory,
+          upcomingOnly: params.upcomingOnly,
+          cwd: projectRoot
+        },
+        accessor
+      );
+      return lafsSuccess(data, "roadmap");
+    } catch (err) {
+      return lafsError(
+        "E_NOT_INITIALIZED",
+        err instanceof Error ? err.message : String(err),
+        "roadmap"
+      );
+    }
+  },
+  smoke: async (_params) => {
+    const smokeResult = await runSystemSmoke();
+    if (smokeResult.failed === 0) {
+      return lafsSuccess(smokeResult, "smoke");
+    }
+    return lafsError(
+      "E_SMOKE_FAILURES",
+      `${smokeResult.failed} probe(s) failed smoke test`,
+      "smoke"
+    );
+  },
+  "smoke.provider": async (params) => {
+    const { smokeProvider } = await import("./smoke-provider-SKUFMZXU.js");
+    const result = await smokeProvider(params.provider);
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "smoke.provider"
+      );
+    }
+    return lafsSuccess(result.data, "smoke.provider");
+  },
+  "hooks.matrix": async (params) => {
+    const result = await systemHooksMatrix({
+      providerIds: params.providerIds,
+      detectProvider: params.detectProvider !== false
+    });
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "hooks.matrix"
+      );
+    }
+    return lafsSuccess(result.data, "hooks.matrix");
+  },
+  // -------------------------------------------------------------------------
+  // Mutate ops
+  // -------------------------------------------------------------------------
+  init: async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await initProject(projectRoot, {
+      projectName: params.projectName,
+      force: params.force,
+      mapCodebase: params.mapCodebase
+    });
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "init"
+      );
+    }
+    return lafsSuccess(result.data, "init");
+  },
+  "scaffold-hub": async (_params) => {
+    try {
+      const data = await ensureCleoOsHub();
+      return lafsSuccess(data, "scaffold-hub");
+    } catch (err) {
+      return lafsError(
+        "E_SCAFFOLD_HUB_FAILED",
+        err instanceof Error ? err.message : String(err),
+        "scaffold-hub"
+      );
+    }
+  },
+  "health.mutate": async (params) => {
+    const projectRoot = getProjectRoot();
+    if (params.mode === "diagnose") {
+      try {
+        const data = await coreDoctorReport(projectRoot);
+        return lafsSuccess(
+          data ?? { healthy: false, errors: 0, warnings: 0, checks: [] },
+          "health.mutate"
+        );
+      } catch (err) {
+        return lafsError(
+          "E_INTERNAL",
+          err instanceof Error ? err.message : String(err),
+          "health.mutate"
+        );
+      }
+    }
+    try {
+      const data = await runDoctorFixes(projectRoot);
+      return lafsSuccess(data, "health.mutate");
+    } catch (err) {
+      return lafsError(
+        "E_INTERNAL",
+        err instanceof Error ? err.message : String(err),
+        "health.mutate"
+      );
+    }
+  },
+  "config.set": async (params) => {
+    const projectRoot = getProjectRoot();
+    if (!params.key) {
+      return lafsError("E_INVALID_INPUT", "key is required", "config.set");
+    }
+    const result = await configSet(projectRoot, params.key, params.value);
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "config.set"
+      );
+    }
+    return lafsSuccess(result.data, "config.set");
+  },
+  "config.set-preset": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configSetPreset(projectRoot, params.preset);
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "config.set-preset"
+      );
+    }
+    return lafsSuccess(result.data, "config.set-preset");
+  },
+  // T11917 — config-as-domain. Remove a key via the CORE ConfigDomainHandler
+  // (ConfigManifest cascade writeback). Idempotent: removing an absent key
+  // succeeds with removed=false.
+  "config.unset": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await configDomainHandler.unset(projectRoot, params.key, params.global);
+    if (!result.success) {
+      return lafsError(result.error.code, result.error.message, "config.unset");
+    }
+    return lafsSuccess(result.data, "config.unset");
+  },
+  "backup.mutate": async (params) => {
+    const projectRoot = getProjectRoot();
+    const action = params.action;
+    if (action === "restore") {
+      const backupId = params.backupId;
+      if (!backupId) {
+        return lafsError("E_INVALID_INPUT", "backupId is required", "backup.mutate");
+      }
+      try {
+        const data = await restoreBackupById(projectRoot, {
+          backupId,
+          ...params.scope ? { scope: params.scope } : {},
+          force: params.force,
+          confirmOwnerStore: params.confirmOwnerStore,
+          // T12680: the invocation directory; core never falls back to it.
+          cwd: process.cwd()
+        });
+        return lafsSuccess(data, "backup.mutate");
+      } catch (err) {
+        return lafsError(
+          "E_RESTORE_FAILED",
+          err instanceof Error ? err.message : String(err),
+          "backup.mutate"
+        );
+      }
+    }
+    if (action === "restore.file") {
+      const file = params.file;
+      if (!file) {
+        return lafsError("E_INVALID_INPUT", "file is required", "backup.mutate");
+      }
+      try {
+        const data = await fileRestore(projectRoot, file, {
+          dryRun: params.dryRun,
+          confirmOwnerStore: params.confirmOwnerStore,
+          // T12680: the invocation directory; core never falls back to it.
+          cwd: process.cwd()
+        });
+        return lafsSuccess(data, "backup.mutate");
+      } catch (err) {
+        return lafsError(
+          "E_GENERAL",
+          err instanceof Error ? err.message : String(err),
+          "backup.mutate"
+        );
+      }
+    }
+    try {
+      const data = await systemCreateBackup(projectRoot, { type: params.type, note: params.note });
+      const global = params.includeGlobal ? await createGlobalBackup({ type: params.type, note: params.note }) : null;
+      return lafsSuccess({ ...data, ...global ? { global } : {} }, "backup.mutate");
+    } catch (err) {
+      return lafsError(
+        "E_GENERAL",
+        err instanceof Error ? err.message : String(err),
+        "backup.mutate"
+      );
+    }
+  },
+  migrate: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await getMigrationStatus(projectRoot, {
+        target: params.target,
+        dryRun: params.dryRun
+      });
+      return lafsSuccess(data, "migrate");
+    } catch (err) {
+      return lafsError(
+        "E_MIGRATE_FAILED",
+        err instanceof Error ? err.message : String(err),
+        "migrate"
+      );
+    }
+  },
+  cleanup: async (params) => {
+    const projectRoot = getProjectRoot();
+    if (!params.target) {
+      return lafsError("E_INVALID_INPUT", "target is required", "cleanup");
+    }
+    try {
+      const data = await cleanupSystem(projectRoot, {
+        target: params.target,
+        olderThan: params.olderThan,
+        dryRun: params.dryRun
+      });
+      return lafsSuccess(data, "cleanup");
+    } catch (err) {
+      return lafsError(
+        "E_CLEANUP_FAILED",
+        err instanceof Error ? err.message : String(err),
+        "cleanup"
+      );
+    }
+  },
+  "job.cancel": async (params) => {
+    const { getJobManager } = await import("@cleocode/runtime/gateway");
+    const mgr = getJobManager();
+    if (!mgr) {
+      return lafsError(
+        "E_NOT_AVAILABLE",
+        "Job manager not available. Background jobs require a running CLEO daemon or long-lived process.",
+        "job.cancel"
+      );
+    }
+    const cancellationRequested = mgr.cancelJob(params.jobId);
+    const job = mgr.getJob(params.jobId);
+    if (!job) {
+      return lafsError("E_NOT_FOUND", `Job ${params.jobId} not found`, "job.cancel");
+    }
+    return lafsSuccess(
+      {
+        jobId: params.jobId,
+        cancellationRequested,
+        cancelled: job.status === "cancelled",
+        status: job.status
+      },
+      "job.cancel"
+    );
+  },
+  safestop: async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await safestop(projectRoot, {
+        reason: params.reason,
+        commit: params.commit,
+        handoff: params.handoff,
+        noSessionEnd: params.noSessionEnd,
+        dryRun: params.dryRun
+      });
+      return lafsSuccess(data, "safestop");
+    } catch (err) {
+      return lafsError("E_GENERAL", err instanceof Error ? err.message : String(err), "safestop");
+    }
+  },
+  "inject.generate": async (_params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const accessor = await getTaskAccessor(projectRoot);
+      const data = await generateInjection(projectRoot, accessor);
+      return lafsSuccess(data, "inject.generate");
+    } catch (err) {
+      return lafsError(
+        "E_GENERAL",
+        err instanceof Error ? err.message : String(err),
+        "inject.generate"
+      );
+    }
+  },
+  "adr.sync": async (params) => {
+    const projectRoot = getProjectRoot();
+    if (params.validate) {
+      const result2 = await validateAllAdrs(projectRoot);
+      return lafsSuccess(result2, "adr.sync");
+    }
+    const result = await syncAdrsToDb(projectRoot);
+    return lafsSuccess(result, "adr.sync");
+  },
+  import: async (params) => {
+    const projectRoot = getProjectRoot();
+    const file = params.file;
+    if (params.scope === "snapshot") {
+      const snapshot = await readSnapshot(file);
+      if (params.dryRun) {
+        return lafsSuccess(
+          {
+            dryRun: true,
+            source: snapshot._meta.source,
+            taskCount: snapshot._meta.taskCount,
+            createdAt: snapshot._meta.createdAt
+          },
+          "import"
+        );
+      }
+      const result2 = await importSnapshot(snapshot, projectRoot);
+      return lafsSuccess(
+        {
+          imported: true,
+          added: result2.added,
+          updated: result2.updated,
+          skipped: result2.skipped,
+          conflicts: result2.conflicts.length > 0 ? result2.conflicts : void 0
+        },
+        "import"
+      );
+    }
+    if (params.scope === "tasks") {
+      const result2 = await importTasksPackage(projectRoot, params);
+      return lafsSuccess(result2, "import");
+    }
+    const result = await importTasks(projectRoot, params);
+    return lafsSuccess(result, "import");
+  },
+  detect: async (_params) => {
+    const projectRoot = getProjectRoot();
+    const [{ ensureProjectContext }, { ensureContributorMcp: ensureContributorDev }] = await Promise.all([
+      import("@cleocode/core/scaffold/ensure-skills"),
+      import("@cleocode/core/scaffold/ensure-config")
+    ]);
+    const contextResult = await ensureProjectContext(projectRoot, { force: true });
+    const devResult = await ensureContributorDev(projectRoot);
+    return lafsSuccess({ context: contextResult, devChannel: devResult }, "detect");
+  },
+  "token.mutate": async (params) => {
+    const projectRoot = getProjectRoot();
+    const action = params.action ?? "record";
+    if (action === "delete") {
+      const tokenId = params.tokenId;
+      if (!tokenId) {
+        return lafsError("E_INVALID_INPUT", "tokenId is required", "token.mutate");
+      }
+      const result2 = await deleteTokenUsage(projectRoot, { id: tokenId });
+      return lafsSuccess(result2, "token.mutate");
+    }
+    if (action === "clear") {
+      const result2 = await clearTokenUsage(projectRoot, {
+        provider: params.provider,
+        transport: params.transport,
+        gateway: params.gateway,
+        domain: params.domain,
+        operation: params.operationName,
+        sessionId: params.sessionId,
+        taskId: params.taskId,
+        method: params.method,
+        confidence: params.confidence,
+        requestId: params.requestId,
+        since: params.since,
+        until: params.until
+      });
+      return lafsSuccess(result2, "token.mutate");
+    }
+    const result = await recordTokenExchange(projectRoot, {
+      provider: params.provider,
+      model: params.model,
+      transport: params.transport,
+      gateway: params.gateway,
+      domain: params.domain,
+      operation: params.operationName,
+      sessionId: params.sessionId,
+      taskId: params.taskId,
+      requestId: params.requestId,
+      requestPayload: params.requestPayload,
+      responsePayload: params.responsePayload,
+      metadata: params.metadata
+    });
+    return lafsSuccess(result, "token.mutate");
+  },
+  "context.inject": async (params) => {
+    const projectRoot = getProjectRoot();
+    const result = await sessionContextInject(
+      params.protocolType,
+      {
+        taskId: params.taskId,
+        variant: params.variant
+      },
+      projectRoot
+    );
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_INTERNAL"),
+        result.error?.message ?? "Unknown error",
+        "context.inject"
+      );
+    }
+    return lafsSuccess(result.data, "context.inject");
+  },
+  "map.mutate": async (params) => {
+    const projectRoot = getProjectRoot();
+    try {
+      const data = await mapCodebase(projectRoot, { focus: params.focus, storeToBrain: true });
+      return lafsSuccess(data, "map.mutate");
+    } catch (err) {
+      return lafsError("E_GENERAL", err instanceof Error ? err.message : String(err), "map.mutate");
+    }
+  },
+  "install.global": async (_params) => {
+    const [{ ensureGlobalScaffold }, { ensureGlobalTemplates }] = await Promise.all([
+      import("@cleocode/core/scaffold/global-scaffold"),
+      import("@cleocode/core/scaffold/ensure-templates")
+    ]);
+    const scaffoldResult = await ensureGlobalScaffold();
+    const templateResult = await ensureGlobalTemplates();
+    return lafsSuccess({ scaffold: scaffoldResult, templates: templateResult }, "install.global");
+  }
+});
+var QUERY_OPS = /* @__PURE__ */ new Set([
+  "version",
+  "health",
+  "config.show",
+  "config.presets",
+  "config.get",
+  "config.list",
+  "config.validate",
+  "stats",
+  "context",
+  "context.pull",
+  "runtime",
+  "paths",
+  "job",
+  "dash",
+  "log",
+  "sequence",
+  "help",
+  "token",
+  "adr.find",
+  "adr.show",
+  "backup",
+  "export",
+  "map",
+  "roadmap",
+  "smoke",
+  "smoke.provider",
+  "hooks.matrix"
+]);
+var MUTATE_OPS = /* @__PURE__ */ new Set([
+  "init",
+  "scaffold-hub",
+  "health",
+  "config.set",
+  "config.set-preset",
+  "config.unset",
+  "backup",
+  "migrate",
+  "cleanup",
+  "job.cancel",
+  "safestop",
+  "inject.generate",
+  "adr.sync",
+  "import",
+  "detect",
+  "token",
+  "context.inject",
+  "map",
+  "install.global"
+]);
+function queryKey(operation) {
+  return operation;
+}
+function mutateKey(operation) {
+  switch (operation) {
+    case "health":
+      return "health.mutate";
+    case "backup":
+      return "backup.mutate";
+    case "map":
+      return "map.mutate";
+    case "token":
+      return "token.mutate";
+    default:
+      return operation;
+  }
+}
+var AdminHandler = class {
+  // -----------------------------------------------------------------------
+  // Query
+  // -----------------------------------------------------------------------
+  /**
+   * Execute a read-only admin query operation.
+   *
+   * @param operation - The admin query op name (e.g. 'version', 'health').
+   * @param params - Raw params from the dispatcher (narrowed internally).
+   */
+  async query(operation, params) {
+    const startTime = Date.now();
+    if (!QUERY_OPS.has(operation)) {
+      return unsupportedOp("query", "admin", operation, startTime);
+    }
+    try {
+      const envelope = await typedDispatch(_adminTypedHandler, queryKey(operation), params ?? {});
+      return wrapResult(envelopeToEngineResult(envelope), "query", "admin", operation, startTime);
+    } catch (error) {
+      getLogger("domain:admin").error(
+        { gateway: "query", domain: "admin", operation, err: error },
+        error instanceof Error ? error.message : String(error)
+      );
+      return handleErrorResult("query", "admin", operation, error, startTime);
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Mutate
+  // -----------------------------------------------------------------------
+  /**
+   * Execute a state-modifying admin mutation operation.
+   *
+   * @param operation - The admin mutate op name (e.g. 'init', 'backup').
+   * @param params - Raw params from the dispatcher (narrowed internally).
+   */
+  async mutate(operation, params) {
+    const startTime = Date.now();
+    if (!MUTATE_OPS.has(operation)) {
+      return unsupportedOp("mutate", "admin", operation, startTime);
+    }
+    try {
+      const envelope = await typedDispatch(_adminTypedHandler, mutateKey(operation), params ?? {});
+      if (operation === "adr.sync") {
+        const data = envelope.success ? envelope.data : void 0;
+        if (data && "valid" in data && !data.valid) {
+          const errors = Array.isArray(data.errors) ? data.errors : [];
+          return {
+            meta: dispatchMeta("mutate", "admin", operation, startTime),
+            success: false,
+            data,
+            error: {
+              code: "E_ADR_VALIDATION",
+              message: `${errors.length} ADR validation error(s) found`
+            }
+          };
+        }
+        if (data && "errors" in data && Array.isArray(data.errors) && data.errors.length > 0) {
+          return {
+            meta: dispatchMeta("mutate", "admin", operation, startTime),
+            success: false,
+            data,
+            error: {
+              code: "E_ADR_SYNC",
+              message: `${data.errors.length} ADR sync error(s) occurred`
+            }
+          };
+        }
+      }
+      return wrapResult(envelopeToEngineResult(envelope), "mutate", "admin", operation, startTime);
+    } catch (error) {
+      getLogger("domain:admin").error(
+        { gateway: "mutate", domain: "admin", operation, err: error },
+        error instanceof Error ? error.message : String(error)
+      );
+      return handleErrorResult("mutate", "admin", operation, error, startTime);
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Supported operations
+  // -----------------------------------------------------------------------
+  /** Declared operations for introspection and validation. */
+  getSupportedOperations() {
+    return {
+      query: [
+        "version",
+        "health",
+        "config.show",
+        "config.presets",
+        "config.get",
+        "config.list",
+        "config.validate",
+        "stats",
+        "context",
+        "context.pull",
+        "runtime",
+        "paths",
+        "job",
+        "dash",
+        "log",
+        "sequence",
+        "help",
+        "token",
+        "adr.show",
+        "adr.find",
+        "backup",
+        "export",
+        "map",
+        "roadmap",
+        "smoke",
+        "smoke.provider",
+        "hooks.matrix"
+      ],
+      mutate: [
+        "init",
+        "scaffold-hub",
+        "config.set",
+        "config.set-preset",
+        "config.unset",
+        "backup",
+        "migrate",
+        "cleanup",
+        "job.cancel",
+        "safestop",
+        "inject.generate",
+        "install.global",
+        "token",
+        "adr.sync",
+        "health",
+        "context.inject",
+        "import",
+        "detect",
+        "map"
+      ]
+    };
+  }
+};
+export {
+  AdminHandler
+};
+//# sourceMappingURL=admin-L3F6CDYH.js.map