@cleocode/cleo 2026.10.4 → 2026.10.5-rc.ci.672

package/dist/cli/{restore-VEUOX7NF.js → restore-VBR5XNML.js}

@@ -13,32 +13,33 @@
     return _origEmitWarning.call(process, warning, type, code, ctor);
   };
 })();
-import {
-  defineCommand,
-  showUsage
-} from "./chunk-PKKZPOOP.js";
 import {
   dispatchRaw
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
+} from "./chunk-L7ONYSV6.js";
 import {
   CLEO_DIR_NAME,
   RESTORE_CONFLICTS_MD,
   RESTORE_DEFAULT_FILE
-} from "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
+} from "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
 import {
   cliError,
   cliOutput,
   humanLine
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/restore.ts
 import fs from "node:fs";
 import path from "node:path";
-import { ExitCode } from "@cleocode/contracts";
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
 import {
   CleoError,
   getProjectRoot,
@@ -126,12 +127,29 @@ var finalizeCommand = defineCommand({
     );
   }
 });
+var STORE_FILE_LABELS = /* @__PURE__ */ new Set(["tasks.db", "brain.db", "cleo.db"]);
 var backupSubCommand = defineCommand({
-  meta: { name: "backup", description: "Restore todo files from backup" },
+  meta: {
+    name: "backup",
+    description: "Restore the project store (.cleo/cleo.db: tasks and brain) from a named snapshot (--snapshot) or a backup id (--id): the snapshot is verified, live writers refuse it, and the replaced store is kept as a pre-restore backup. --file config.json restores a config file."
+  },
   args: {
+    snapshot: {
+      type: "string",
+      description: "A snapshot file of this project's store under .cleo/backups/ (e.g. cleo-identity-refill-*.db, tasks-*.db)"
+    },
+    id: {
+      type: "string",
+      description: "A backup id from `cleo backup list` (its store file is restored)"
+    },
+    "allow-external": {
+      type: "boolean",
+      description: "With --snapshot: accept a file outside this project's .cleo/backups/",
+      default: false
+    },
     file: {
       type: "string",
-      description: "Specific file to restore (tasks.db, config.json, etc.)"
+      description: "Config file to restore from the newest numbered backup (config.json). The store restores only through --snapshot or --id"
     },
     "dry-run": {
       type: "boolean",
@@ -140,7 +158,7 @@ var backupSubCommand = defineCommand({
     },
     scope: {
       type: "string",
-      description: "Backup scope to restore from: project or global (default: project)",
+      description: "With --snapshot/--id: project (.cleo/cleo.db, the default) or global (<CLEO_HOME>/cleo.db: the global brain, nexus, agent registry). A global restore needs every cleo process stopped (agent sessions, daemons, Studio): nearly all of them hold the global store open",
       default: "project"
     },
     "confirm-owner-store": {
@@ -151,8 +169,37 @@ var backupSubCommand = defineCommand({
   },
   async run({ args }) {
     try {
+      if (args.snapshot !== void 0 || args.id !== void 0) {
+        const { restoreStoreSnapshot } = await import("@cleocode/core/store/restore-store.js");
+        const scope2 = args.scope === "global" ? "global" : "project";
+        const result = await restoreStoreSnapshot({
+          scope: scope2,
+          projectRoot: scope2 === "global" ? process.cwd() : getProjectRoot(),
+          snapshot: args.snapshot,
+          backupId: args.id,
+          dryRun: args["dry-run"] === true,
+          allowExternal: args["allow-external"] === true,
+          confirmOwnerStore: args["confirm-owner-store"] === true,
+          cwd: process.cwd()
+        });
+        cliOutput(result, {
+          command: "restore",
+          operation: "admin.backup.restore-store",
+          ...result.dryRun ? { message: "Dry run - no changes made" } : {}
+        });
+        return;
+      }
       const fileName = args.file ?? RESTORE_DEFAULT_FILE;
       const scope = args.scope ?? "project";
+      if (STORE_FILE_LABELS.has(fileName)) {
+        throw new CleoError(
+          ExitCode.INVALID_INPUT,
+          `E_RESTORE_STORE_LABEL: --file ${fileName} cannot restore the live store (.cleo/cleo.db holds tasks and brain)`,
+          {
+            fix: "cleo backup list, then cleo restore backup --id <backupId> (or --snapshot <file>)"
+          }
+        );
+      }
       const response = await dispatchRaw("mutate", "admin", "backup", {
         action: "restore.file",
         file: fileName,
@@ -420,4 +467,4 @@ export {
   parseConflictReport2 as parseConflictReport,
   restoreCommand
 };
-//# sourceMappingURL=restore-VEUOX7NF.js.map
+//# sourceMappingURL=restore-VBR5XNML.js.map

package/dist/cli/{revert-3YF2IL5G.js → revert-32LDNSGP.js}

@@ -19,7 +19,7 @@ import {
 import {
   cliError,
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 
 // packages/cleo/src/cli/commands/revert.ts
@@ -237,4 +237,4 @@ ${lines}`
 export {
   revertCommand
 };
-//# sourceMappingURL=revert-3YF2IL5G.js.map
+//# sourceMappingURL=revert-32LDNSGP.js.map

package/dist/cli/{roadmap-7OOQLXKG.js → roadmap-LFU3AG7D.js}

@@ -13,18 +13,19 @@
     return _origEmitWarning.call(process, warning, type, code, ctor);
   };
 })();
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
 import {
   defineCommand
 } from "./chunk-PKKZPOOP.js";
-import {
-  dispatchFromCli
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
-import "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
-import "./chunk-3ZO3M37V.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/roadmap.ts
 var roadmapCommand = defineCommand({
@@ -58,4 +59,4 @@ var roadmapCommand = defineCommand({
 export {
   roadmapCommand
 };
-//# sourceMappingURL=roadmap-7OOQLXKG.js.map
+//# sourceMappingURL=roadmap-LFU3AG7D.js.map

package/dist/cli/{run-2U5NZV5Z.js → run-HXRILSR7.js}

@@ -20,7 +20,7 @@ import {
 import {
   cliError,
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 
 // packages/cleo/src/cli/commands/run.ts
@@ -29,16 +29,20 @@ import {
   RESOURCE_DEFERRED_CODE,
   RUN_COMMAND_FAILED_CODE,
   RUN_DEFERRED_EXIT_CODE
-} from "@cleocode/contracts";
+} from "@cleocode/contracts/resource-governor.js";
+import { planFootprintBytes } from "@cleocode/core/resources/admission-ledger.js";
 import {
   canonicalForClass,
   isWatchCommand,
+  isWholeSuiteTestRun,
+  namedTestFileCount,
   resolveRunClass
 } from "@cleocode/core/resources/run-admission.js";
 import {
   runGoverned
 } from "@cleocode/core/resources/run-governed.js";
 import { planHeavyToolEnv } from "@cleocode/core/tasks/heavy-tool-env.js";
+import { GovernedRunInTestRunnerError } from "@cleocode/core/tasks/tool-runner-guard.js";
 function commandAfterDashes(rawArgs) {
   const idx = rawArgs.indexOf("--");
   return idx === -1 ? [] : rawArgs.slice(idx + 1);
@@ -88,13 +92,18 @@ var runCommand = defineCommand({
     },
     wait: {
       type: "boolean",
-      description: "Join the FIFO queue for the class instead of returning E_RESOURCE_DEFERRED",
+      description: "Join the machine-wide FIFO admission queue instead of returning E_RESOURCE_DEFERRED",
       default: false
     },
     timeout: {
       type: "string",
       description: "With --wait: give up after this many seconds (default 1800)"
     },
+    "whole-suite": {
+      type: "boolean",
+      description: "Allow a whole-suite test run (a vitest run naming no file, directory, --project or -t filter, or a vitest test script without narrowing arguments): refused by default, since an empty file list is the usual cause",
+      default: false
+    },
     passthrough: {
       type: "boolean",
       description: "Give the command this process's stdin, stdout and stderr and exit with its code. cleo run then writes nothing to stdout (an explicit ADR-086 exception, like docs fetch --content): its own envelopes go to stderr, and it prints only a deferral (exit 75), an ungoverned run, a pause or a failure",
@@ -118,6 +127,13 @@ var runCommand = defineCommand({
         passthrough
       );
     }
+    if (args["whole-suite"] !== true && isWholeSuiteTestRun(argv, process.cwd())) {
+      invalid(
+        `cleo run refuses a test run that names no test file, directory, --project or -t filter: it would run the whole suite (${argv.join(" ")}). An empty generated file list is the usual cause`,
+        "Name what to run: cleo run -- pnpm exec vitest run path/to/a.test.ts (check a generated list is not empty), or pass test files to the script (pnpm test path/to/a.test.ts). For a deliberate whole-suite run: cleo run --whole-suite -- <cmd>",
+        passthrough
+      );
+    }
     let timeoutMs = 18e5;
     if (args.timeout !== void 0) {
       if (!args.wait)
@@ -147,7 +163,13 @@ var runCommand = defineCommand({
       process.stderr.write(`[cleo run] ${line}
 `);
     };
-    const { overlay, resources } = planHeavyToolEnv(canonicalForClass(cls));
+    const namedFiles = namedTestFileCount(cls, argv);
+    const { overlay, resources } = planHeavyToolEnv(
+      canonicalForClass(cls),
+      process.env,
+      void 0,
+      namedFiles ?? void 0
+    );
     if (resources !== null) {
       notice(
         `planned resources: ${resources.summary}`,
@@ -167,9 +189,21 @@ var runCommand = defineCommand({
         passthrough,
         // A terminal on stdin: keep the child in its foreground group.
         foreground: passthrough && process.stdin.isTTY === true,
-        notice
+        notice,
+        ...resources !== null ? { footprintBytes: planFootprintBytes(resources) } : {},
+        ...namedFiles !== null ? { scope: "narrowed" } : {}
       });
     } catch (err) {
+      if (err instanceof GovernedRunInTestRunnerError) {
+        cliError(
+          err.message,
+          err.codeName,
+          { name: err.codeName, fix: err.fix, details: err.details },
+          { operation: "resources.run" },
+          { stderr: passthrough }
+        );
+        process.exit(err.code);
+      }
       cliError(
         `cleo run failed: ${err instanceof Error ? err.message : String(err)}`,
         1,
@@ -208,4 +242,4 @@ export {
   runCommand,
   runExitCode
 };
-//# sourceMappingURL=run-2U5NZV5Z.js.map
+//# sourceMappingURL=run-HXRILSR7.js.map

package/dist/cli/{safestop-VR4VK56D.js → safestop-Z5UC7NGQ.js}

@@ -16,19 +16,20 @@
 import {
   negatedFlag
 } from "./chunk-47JYZAMS.js";
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
 import {
   defineCommand,
   showUsage
 } from "./chunk-PKKZPOOP.js";
-import {
-  dispatchFromCli
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
-import "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
-import "./chunk-3ZO3M37V.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/safestop.ts
 var safestopCommand = defineCommand({
@@ -85,4 +86,4 @@ var safestopCommand = defineCommand({
 export {
   safestopCommand
 };
-//# sourceMappingURL=safestop-VR4VK56D.js.map
+//# sourceMappingURL=safestop-Z5UC7NGQ.js.map

package/dist/cli/{saga-SEWPIOX2.js → saga-Y6FZS6AM.js}

@@ -13,23 +13,24 @@
     return _origEmitWarning.call(process, warning, type, code, ctor);
   };
 })();
-import {
-  defineCommand,
-  showUsage
-} from "./chunk-PKKZPOOP.js";
 import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
-import "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
 import {
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/saga.ts
 import { parseAcceptanceCriteria } from "@cleocode/core";
@@ -282,4 +283,4 @@ var sagaCommand = defineCommand({
 export {
   sagaCommand
 };
-//# sourceMappingURL=saga-SEWPIOX2.js.map
+//# sourceMappingURL=saga-Y6FZS6AM.js.map

package/dist/cli/{schema-C52WZ35V.js → schema-OOOKLWUE.js}

@@ -13,17 +13,17 @@
     return _origEmitWarning.call(process, warning, type, code, ctor);
   };
 })();
+import {
+  OPERATIONS
+} from "./chunk-4VASFLUW.js";
 import {
   defineCommand,
   showUsage
 } from "./chunk-PKKZPOOP.js";
-import {
-  OPERATIONS
-} from "./chunk-AWCQH2W5.js";
 import {
   cliError,
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import {
   setFormatContext
 } from "./chunk-6JSJNYH2.js";
@@ -192,4 +192,4 @@ var schemaCommand = defineCommand({
 export {
   schemaCommand
 };
-//# sourceMappingURL=schema-C52WZ35V.js.map
+//# sourceMappingURL=schema-OOOKLWUE.js.map

package/dist/cli/{self-update-GQIGUDPS.js → self-update-26SOTJMH.js}

@@ -27,7 +27,7 @@ import {
   cliOutput,
   humanInfo,
   humanWarn
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 
 // packages/cleo/src/cli/commands/self-update.ts
@@ -36,7 +36,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as readline from "node:readline";
 import { promisify } from "node:util";
-import { ExitCode } from "@cleocode/contracts";
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
 import {
   BUILD_CONFIG,
   CleoError,
@@ -501,4 +501,4 @@ async function runPostUpdateDiagnostics(opts) {
 export {
   selfUpdateCommand
 };
-//# sourceMappingURL=self-update-GQIGUDPS.js.map
+//# sourceMappingURL=self-update-26SOTJMH.js.map

package/dist/cli/{selfimprove-3Y5L4ECT.js → selfimprove-4SMOCLUV.js}

@@ -14,19 +14,20 @@
   };
 })();
 import "./chunk-C3B7C43W.js";
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
 import {
   defineCommand,
   showUsage
 } from "./chunk-PKKZPOOP.js";
-import {
-  dispatchFromCli
-} from "./chunk-3IOQVUO7.js";
-import "./chunk-AWCQH2W5.js";
-import "./chunk-OGV57L4J.js";
-import "./chunk-ZBISIPCK.js";
-import "./chunk-3ZO3M37V.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
-import "./chunk-QFFQSKRC.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
 
 // packages/cleo/src/cli/commands/selfimprove.ts
 var runCommand = defineCommand({
@@ -85,4 +86,4 @@ var selfimproveCommand = defineCommand({
 export {
   selfimproveCommand
 };
-//# sourceMappingURL=selfimprove-3Y5L4ECT.js.map
+//# sourceMappingURL=selfimprove-4SMOCLUV.js.map

package/dist/cli/selfimprove-EB4RQLP4.js

@@ -0,0 +1,139 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  errorResult,
+  unsupportedOp,
+  wrapResult
+} from "./chunk-XHRZ7OYZ.js";
+
+// packages/cleo/src/dispatch/domains/selfimprove.ts
+import { randomUUID } from "node:crypto";
+import {
+  buildProbePayload,
+  getLogger,
+  getProjectRoot,
+  runSelfImprove
+} from "@cleocode/core/internal";
+var log = getLogger("domain:selfimprove");
+var SelfimproveHandler = class {
+  /**
+   * Handle self-improvement query operations.
+   *
+   * Supported operations:
+   * - `probe` — return the probe payload from {@link buildProbePayload} (T11988).
+   *   Used by the `seeded-code-regression` scenario to expose a patchable code
+   *   bug (the probe version off-by-one) for end-to-end fix-gen proof.
+   */
+  async query(operation, _params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "probe":
+        return wrapResult(
+          { success: true, data: buildProbePayload() },
+          "query",
+          "selfimprove",
+          operation,
+          startTime
+        );
+      default:
+        return unsupportedOp("query", "selfimprove", operation, startTime);
+    }
+  }
+  /**
+   * Handle self-improvement mutations.
+   *
+   * Supported operations:
+   * - `run` — delegate to CORE `runSelfImprove`, supplying the in-process
+   *   `ReplayDispatch` port. DEFAULT OFF: mutation/egress require `execute`.
+   *
+   * Param validation runs FIRST: a missing `scenario` returns `E_INVALID_INPUT`
+   * before any engine call or dispatcher binding — so the registry-parity test
+   * (which invokes `run` with empty params) exercises the case without booting
+   * a sandbox.
+   */
+  async mutate(operation, params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "run": {
+        const scenario = typeof params?.scenario === "string" ? params.scenario : void 0;
+        if (!scenario) {
+          return errorResult(
+            "mutate",
+            "selfimprove",
+            operation,
+            "E_INVALID_INPUT",
+            "scenario is required",
+            startTime
+          );
+        }
+        const execute = params?.execute === true;
+        const dryRun = params?.dryRun === true;
+        const backend = normalizeBackend(params?.backend);
+        const { getCliDispatcher } = await import("./cli-A23Q335V.js");
+        const dispatcher = getCliDispatcher();
+        const dispatch = (op) => dispatcher.dispatch({
+          gateway: op.gateway,
+          domain: op.domain,
+          operation: op.operation,
+          ...op.params !== void 0 ? { params: op.params } : {},
+          source: "rpc",
+          requestId: randomUUID()
+        });
+        try {
+          const opts = {
+            scenario,
+            dispatch,
+            // `--dry-run` forces DRY-RUN even if `--execute` was also passed;
+            // the loop is default-OFF so omitting `--execute` already means dry.
+            execute: execute && !dryRun,
+            cwd: getProjectRoot(),
+            ...backend !== void 0 ? { backend } : {}
+          };
+          const result = await runSelfImprove(opts);
+          return wrapResult(
+            { success: true, data: result },
+            "mutate",
+            "selfimprove",
+            operation,
+            startTime
+          );
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          log.error({ scenario, err: message }, "selfimprove.run failed");
+          return errorResult("mutate", "selfimprove", operation, "E_INTERNAL", message, startTime);
+        }
+      }
+      default:
+        return unsupportedOp("mutate", "selfimprove", operation, startTime);
+    }
+  }
+  /** Return declared operations for introspection and registry validation. */
+  getSupportedOperations() {
+    return {
+      query: ["probe"],
+      mutate: ["run"]
+    };
+  }
+};
+function normalizeBackend(value) {
+  if (value === "gondolin") return "gondolin";
+  if (value === "in-process" || value === "guarded") return "in-process";
+  return void 0;
+}
+export {
+  SelfimproveHandler
+};
+//# sourceMappingURL=selfimprove-EB4RQLP4.js.map