@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/audit-ICA2SEFN.js

@@ -0,0 +1,122 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import "./chunk-C3B7C43W.js";
+import {
+  isSubCommandDispatch
+} from "./chunk-YY66LFZF.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/audit.ts
+import { reconstructLineage } from "@cleocode/core/audit/reconstruct";
+import { getProjectRoot } from "@cleocode/core/project-scope";
+import { renderAuditReconstruct } from "@cleocode/core/render/orchestration/audit-reconstruct";
+var reconstructCommand = defineCommand({
+  meta: {
+    name: "reconstruct",
+    description: "Reconstruct git-backed lineage (commits + release tags) for a task"
+  },
+  args: {
+    taskId: {
+      type: "positional",
+      description: "Task ID to reconstruct (e.g. T991)",
+      required: true
+    },
+    json: {
+      type: "boolean",
+      description: "Emit raw JSON output instead of formatted summary",
+      default: false
+    },
+    "budget-ms": {
+      type: "string",
+      description: "Shared bounded assessment deadline in milliseconds",
+      default: "2000"
+    },
+    "max-output-bytes": {
+      type: "string",
+      description: "Combined Git capture byte ceiling",
+      default: "8388608"
+    },
+    "repo-root": {
+      type: "string",
+      description: "Path to the git repository root (defaults to current project root)"
+    }
+  },
+  async run({ args }) {
+    const taskId = args.taskId.toUpperCase();
+    const budgetMs = Number(args["budget-ms"]);
+    const maxOutputBytes = Number(args["max-output-bytes"]);
+    const deadlineAt = Date.now() + budgetMs;
+    if (!/^T\d+$/.test(taskId) || !/^\d+$/.test(args["budget-ms"]) || !/^\d+$/.test(args["max-output-bytes"]) || !Number.isSafeInteger(budgetMs) || !Number.isSafeInteger(maxOutputBytes) || !Number.isSafeInteger(deadlineAt)) {
+      cliError(
+        "Task ID must be T followed by digits; budget-ms and max-output-bytes must be nonnegative safe integers.",
+        1,
+        { name: "E_VALIDATION" },
+        { operation: "audit.reconstruct" }
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const repoRoot = args["repo-root"] ?? getProjectRoot(process.cwd()) ?? process.cwd();
+    const result = await reconstructLineage(taskId, repoRoot, {
+      execution: { deadlineAt },
+      maxOutputBytes
+    });
+    if (result.assessment?.coverage !== "current") {
+      process.exitCode = 1;
+      cliError(
+        renderAuditReconstruct({ ...result }, false),
+        1,
+        {
+          name: "E_AUDIT_INCOMPLETE",
+          details: result,
+          fix: "Inspect assessment diagnostics; request an explicit larger budget or restore missing evidence before retrying."
+        },
+        { operation: "audit.reconstruct" }
+      );
+      return;
+    }
+    cliOutput(result, {
+      command: "audit-reconstruct",
+      operation: "audit.reconstruct",
+      message: `Lineage for ${result.taskId}`
+    });
+  }
+});
+var auditCommand = defineCommand({
+  meta: {
+    name: "audit",
+    description: "Git-backed audit tooling (lineage reconstruction, integrity checks). Independent re-verification of task completion claims is handled by `cleo verify <taskId> --explain` which re-validates ADR-051 evidence atoms."
+  },
+  subCommands: {
+    reconstruct: reconstructCommand
+  },
+  async run({ cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  auditCommand
+};
+//# sourceMappingURL=audit-ICA2SEFN.js.map

package/dist/cli/auth-DXIG5OG7.js

@@ -0,0 +1,491 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  authRemoveCommand
+} from "./chunk-QWUFFDL3.js";
+import {
+  LOGIN_ARGS,
+  runLoginCommand
+} from "./chunk-UWCZY52R.js";
+import "./chunk-GZFVDR44.js";
+import "./chunk-GRU74UE4.js";
+import "./chunk-47JYZAMS.js";
+import "./chunk-C3B7C43W.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/auth/consent.ts
+var authConsentCommand = defineCommand({
+  meta: {
+    name: "consent",
+    description: "Manage consent gates for external credential sources (e.g. Claude Code OAuth). Use --enable-claude-code / --disable-claude-code to toggle, --status to inspect."
+  },
+  args: {
+    "enable-claude-code": {
+      type: "boolean",
+      description: "Grant consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=true in the global config and removes any suppression entry."
+    },
+    "disable-claude-code": {
+      type: "boolean",
+      description: "Revoke consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=false, adds a suppression entry, and purges all source:claude-code entries from the pool."
+    },
+    status: {
+      type: "boolean",
+      description: "Print the current state of all consent gates."
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const enableClaudeCode = a["enable-claude-code"] === true;
+    const disableClaudeCode = a["disable-claude-code"] === true;
+    const showStatus = a["status"] === true;
+    if (!enableClaudeCode && !disableClaudeCode && !showStatus) {
+      cliError("Specify one of --enable-claude-code, --disable-claude-code, or --status.", 6, {
+        name: "E_INVALID_INPUT",
+        fix: "Run `cleo auth consent --status` to see current consent state."
+      });
+      process.exit(6);
+    }
+    if (enableClaudeCode && disableClaudeCode) {
+      cliError("--enable-claude-code and --disable-claude-code are mutually exclusive.", 6, {
+        name: "E_INVALID_INPUT"
+      });
+      process.exit(6);
+    }
+    const configMod = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/config.js"
+    );
+    const getConfigValue = configMod.getConfigValue;
+    const setConfigValue = configMod.setConfigValue;
+    const { addSuppression, removeSuppression, isSuppressed } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credential-removal.js"
+    );
+    const CONSENT_KEY = "auth.claudeCodeConsentGiven";
+    const SOURCE_ID = "claude-code";
+    const PROVIDER = "anthropic";
+    if (showStatus) {
+      const resolved = await getConfigValue(CONSENT_KEY);
+      const consentEnabled = resolved.value === true;
+      const suppressed = isSuppressed(PROVIDER, SOURCE_ID);
+      const result2 = {
+        gates: [
+          {
+            gate: "claudeCode",
+            configKey: CONSENT_KEY,
+            enabled: consentEnabled,
+            suppressed
+          }
+        ]
+      };
+      cliOutput(result2, {
+        command: "auth-consent-status",
+        operation: "auth.consent.status"
+      });
+      return;
+    }
+    if (enableClaudeCode) {
+      await setConfigValue(CONSENT_KEY, true, void 0, { global: true });
+      const suppressionChanged2 = removeSuppression(PROVIDER, SOURCE_ID);
+      const result2 = {
+        action: "enabled",
+        gate: "claudeCode",
+        configKey: CONSENT_KEY,
+        value: true,
+        suppressionChanged: suppressionChanged2,
+        purgedCount: 0
+      };
+      cliOutput(result2, {
+        command: "auth-consent-enable",
+        operation: "auth.consent.enable"
+      });
+      return;
+    }
+    await setConfigValue(CONSENT_KEY, false, void 0, { global: true });
+    const wasAlreadySuppressed = isSuppressed(PROVIDER, SOURCE_ID);
+    addSuppression(PROVIDER, SOURCE_ID);
+    const suppressionChanged = !wasAlreadySuppressed;
+    const { listCredentials, removeCredential } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credentials-store.js"
+    );
+    const allEntries = await listCredentials();
+    const claudeCodeEntries = allEntries.filter((c) => c.source === SOURCE_ID);
+    let purgedCount = 0;
+    for (const entry of claudeCodeEntries) {
+      const removed = await removeCredential(entry.provider, entry.label);
+      if (removed) purgedCount++;
+    }
+    const result = {
+      action: "disabled",
+      gate: "claudeCode",
+      configKey: CONSENT_KEY,
+      value: false,
+      suppressionChanged,
+      purgedCount
+    };
+    cliOutput(result, {
+      command: "auth-consent-disable",
+      operation: "auth.consent.disable"
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/list.ts
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function formatExpiry(expiresAt) {
+  if (expiresAt == null) return "never";
+  const remaining = expiresAt - Date.now();
+  if (remaining <= 0) return "expired";
+  const minutes = Math.floor(remaining / 6e4);
+  if (minutes <= 90) return `expires in ${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours <= 36) return `expires in ${hours}h`;
+  const days = Math.floor(hours / 24);
+  return `expires in ${days}d`;
+}
+var authListCommand = defineCommand({
+  meta: {
+    name: "list",
+    description: "List ALL pool entries from ALL sources (env, claude-code, cleo-pkce, codex-cli, gemini-cli, gh-cli, manual). Tokens are never surfaced \u2014 use `cleo llm list` for the LLM-scoped view that mirrors the manual store only."
+  },
+  args: {
+    provider: {
+      type: "string",
+      description: "Filter to a single provider id (e.g. anthropic)"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const providerFilter = typeof a["provider"] === "string" && a["provider"] !== "" ? a["provider"] : null;
+    const { getCredentialPool } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credential-pool.js"
+    );
+    const pool = getCredentialPool();
+    await pool.seed();
+    const allStored = await pool.list();
+    const ghCliEntries = allStored.filter((c) => c.source === "gh-cli");
+    if (ghCliEntries.length > 0) {
+      const { removeCredential } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/llm/credentials-store.js"
+      );
+      const { addSuppression } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/llm/credential-removal.js"
+      );
+      for (const entry of ghCliEntries) {
+        await removeCredential(
+          entry.provider,
+          entry.label
+        );
+      }
+      addSuppression("openai", "gh-cli");
+    }
+    const stored = allStored.filter((c) => c.source !== "gh-cli");
+    const entries = stored.filter((c) => providerFilter ? c.provider === providerFilter : true).map((c) => ({
+      provider: c.provider,
+      label: c.label,
+      source: c.source ?? "manual",
+      authType: c.authType,
+      expiryStatus: formatExpiry(c.expiresAt),
+      // `current` is "is this entry not in active cooldown AND not disabled"
+      // — i.e. could it be served right now. A richer notion of "default
+      // credential per provider" would require resolver introspection,
+      // which lands in a follow-up task.
+      current: !c.disabled && (c.lastErrorResetAt == null || c.lastErrorResetAt <= Date.now())
+    })).sort((a2, b) => {
+      const p = a2.provider.localeCompare(b.provider);
+      return p !== 0 ? p : a2.label.localeCompare(b.label);
+    });
+    const claudeCredsPath = join(homedir(), ".claude", ".credentials.json");
+    const hint = existsSync(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
+    const { getNexusAccountStatus } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-auth.js"
+    );
+    const nexus = providerFilter === null || providerFilter === "nexus" ? await getNexusAccountStatus().catch(() => []) : [];
+    cliOutput(
+      { entries, nexus, ...hint !== null ? { hint } : {} },
+      {
+        command: "auth-list",
+        operation: "auth.list"
+      }
+    );
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/login.ts
+var authLoginCommand = defineCommand({
+  meta: {
+    name: "login",
+    description: "Log in to a Cleo Nexus account (auth login nexus) or to an LLM provider and bind a usable profile (alias of `cleo login`). Picks a provider + auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
+  },
+  args: LOGIN_ARGS,
+  async run({ args }) {
+    await runLoginCommand(args, "auth.login");
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts
+import { existsSync as existsSync2, readFileSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { createInterface } from "node:readline";
+function resolveProjectRootArg(arg) {
+  if (typeof arg === "string" && arg.length > 0) return arg;
+  return process.cwd();
+}
+function projectConfigPath(projectRoot) {
+  const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
+  return join2(projectRoot, cleoDir, "config.json");
+}
+function extractApiKeyEntries(config) {
+  if (!config || typeof config !== "object") return [];
+  const llm = config["llm"];
+  if (!llm || typeof llm !== "object") return [];
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return [];
+  const out = [];
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") continue;
+    const apiKey = raw["apiKey"];
+    if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+      out.push({ provider, apiKey: apiKey.trim() });
+    }
+  }
+  return out;
+}
+function stripApiKeysFromConfig(config) {
+  const clone = structuredClone(config);
+  const llm = clone["llm"];
+  if (!llm || typeof llm !== "object") return clone;
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return clone;
+  const cleanedProviders = {};
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") {
+      cleanedProviders[provider] = raw;
+      continue;
+    }
+    const entry = { ...raw };
+    delete entry["apiKey"];
+    if (Object.keys(entry).length > 0) {
+      cleanedProviders[provider] = entry;
+    }
+  }
+  llm["providers"] = cleanedProviders;
+  return clone;
+}
+function detectAuthType(provider, token) {
+  if (provider !== "anthropic") return "api_key";
+  if (token.startsWith("sk-ant-oat-") || token.startsWith("sk-ant-ort-")) return "oauth";
+  return "api_key";
+}
+async function promptYesNo(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(question, (a) => resolve(a));
+    });
+    const clean = answer.trim().toLowerCase();
+    return clean === "y" || clean === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runMigrateProjectSecrets(opts) {
+  const configPath = projectConfigPath(opts.projectRoot);
+  if (!existsSync2(configPath)) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  const raw = readFileSync(configPath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${configPath}: ${err instanceof Error ? err.message : String(err)}. Fix the JSON syntax error before running migrate-project-secrets.`
+    );
+  }
+  const entries = extractApiKeyEntries(parsed);
+  if (entries.length === 0) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  if (!opts.yes) {
+    process.stderr.write(
+      `Found ${entries.length} project-config secret(s) to migrate:
+` + entries.map((e) => `  - ${e.provider}
+`).join("") + `
+This will:
+  1. Back up ${configPath} -> ${configPath}.pre-migration-bak
+  2. Move each apiKey into the unified credential pool with label 'migrated-from-project-config'
+  3. Remove the apiKey fields from the project config
+
+`
+    );
+    const confirmed = await promptYesNo("Proceed? [y/N] ");
+    if (!confirmed) {
+      return {
+        configPath,
+        backupPath: null,
+        migrated: [],
+        cancelled: true,
+        dryRun: opts.dryRun
+      };
+    }
+  }
+  if (opts.dryRun) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: entries.map((e) => ({
+        provider: e.provider,
+        label: "migrated-from-project-config",
+        moved: false
+      })),
+      cancelled: false,
+      dryRun: true
+    };
+  }
+  const backupPath = `${configPath}.pre-migration-bak`;
+  writeFileSync(backupPath, raw, { mode: 384 });
+  const { addCredential } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/credentials-store.js"
+  );
+  const migrated = [];
+  for (const { provider, apiKey } of entries) {
+    await addCredential({
+      provider,
+      label: "migrated-from-project-config",
+      authType: detectAuthType(provider, apiKey),
+      accessToken: apiKey,
+      source: "manual"
+    });
+    migrated.push({ provider, label: "migrated-from-project-config", moved: true });
+  }
+  const stripped = stripApiKeysFromConfig(parsed);
+  writeFileSync(configPath, `${JSON.stringify(stripped, null, 2)}
+`, "utf-8");
+  return {
+    configPath,
+    backupPath,
+    migrated,
+    cancelled: false,
+    dryRun: false
+  };
+}
+var authMigrateProjectSecretsCommand = defineCommand({
+  meta: {
+    name: "migrate-project-secrets",
+    description: "Move every llm.providers.*.apiKey out of .cleo/config.json (project-scoped, often committed to git) and into the unified credential pool. Atomic: backs up the original config to .cleo/config.json.pre-migration-bak first."
+  },
+  args: {
+    "project-root": {
+      type: "string",
+      description: "Override the project root (default: cwd)"
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip the interactive confirmation prompt",
+      default: false
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Show what would be migrated without writing anything",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const projectRoot = resolveProjectRootArg(a["project-root"]);
+    const yes = Boolean(a["yes"]);
+    const dryRun = Boolean(a["dry-run"]);
+    let result;
+    try {
+      result = await runMigrateProjectSecrets({ projectRoot, yes, dryRun });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      cliError(message, 6, { name: "E_VALIDATION" });
+      process.exit(6);
+    }
+    cliOutput(result, {
+      command: "auth-migrate-project-secrets",
+      operation: "auth.migrate-project-secrets"
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth.ts
+var authCommand = defineCommand({
+  meta: {
+    name: "auth",
+    // ONE quoted literal, no backticks — see login.ts meta for the generator
+    // DESC_RE constraint.
+    description: "Unified credential surface: auth login (front-door provider login, alias of cleo login), auth list, auth remove, auth consent. (cleo llm list is the LLM-scoped sister command.)"
+  },
+  subCommands: {
+    consent: authConsentCommand,
+    list: authListCommand,
+    login: authLoginCommand,
+    remove: authRemoveCommand,
+    "migrate-project-secrets": authMigrateProjectSecretsCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  authCommand
+};
+//# sourceMappingURL=auth-DXIG5OG7.js.map