@cleocode/cleo 2026.10.4 → 2026.10.5

package/dist/cli/{chunk-AYA6F4ZT.js → chunk-PSJ33WVO.js}

@@ -18,11 +18,11 @@ import {
 } from "./chunk-PKKZPOOP.js";
 import {
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/doctor-malformed-ids.ts
-import { getProjectRoot } from "@cleocode/core";
 import { scanMalformedTaskIds } from "@cleocode/core/doctor/malformed-task-ids.js";
+import { getProjectRoot } from "@cleocode/core/project-scope";
 var doctorMalformedIdsCommand = defineCommand({
   meta: {
     name: "malformed-ids",
@@ -53,4 +53,4 @@ var doctorMalformedIdsCommand = defineCommand({
 export {
   doctorMalformedIdsCommand
 };
-//# sourceMappingURL=chunk-AYA6F4ZT.js.map
+//# sourceMappingURL=chunk-PSJ33WVO.js.map

package/dist/cli/{chunk-FORFDPP5.js → chunk-QJJWWCIC.js}

@@ -20,14 +20,14 @@ import {
   cliError,
   cliOutput,
   humanLine
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/backup-inspect.ts
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import zlib from "node:zlib";
-import { ExitCode } from "@cleocode/contracts";
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
 import {
   BackupObservationInspectionError,
   detectEncryption,
@@ -285,4 +285,4 @@ var backupInspectSubCommand = defineCommand({
 export {
   backupInspectSubCommand
 };
-//# sourceMappingURL=chunk-FORFDPP5.js.map
+//# sourceMappingURL=chunk-QJJWWCIC.js.map

package/dist/cli/{chunk-ZBISIPCK.js → chunk-QKMBWYAS.js}

@@ -57,6 +57,20 @@ function extractIdempotencyKeyArg(argv) {
   return { argv: sanitized, idempotencyKey };
 }
 
+// packages/cleo/src/cli/lib/settle-then-exit.ts
+async function settleThenExit(code, settle = settleWithCore, exit = (c) => process.exit(c)) {
+  process.exitCode = code;
+  try {
+    await settle();
+  } catch {
+  }
+  return exit(code);
+}
+async function settleWithCore() {
+  const { settleBeforeExit } = await import("@cleocode/core/shutdown");
+  return settleBeforeExit();
+}
+
 // packages/cleo/src/cli/projection-context.ts
 var currentOptOut = false;
 function setProjectionOptOut(optOut) {
@@ -72,7 +86,8 @@ export {
   setIdempotencyKeyContext,
   getIdempotencyKeyContext,
   extractIdempotencyKeyArg,
+  settleThenExit,
   setProjectionOptOut,
   getProjectionOptOut
 };
-//# sourceMappingURL=chunk-ZBISIPCK.js.map
+//# sourceMappingURL=chunk-QKMBWYAS.js.map

package/dist/cli/chunk-QWNKLLLG.js

@@ -0,0 +1,84 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/dispatch/adapters/typed.ts
+async function typedDispatch(handler, op, rawParams) {
+  return handler.operations[op](rawParams);
+}
+function defineTypedHandler(domain, operations) {
+  return { domain, operations };
+}
+function lafsSuccess(data, _operation, extra) {
+  return {
+    success: true,
+    data,
+    ...extra?.page ? { page: extra.page } : {}
+  };
+}
+function lafsError(code, message, _operation, fix, details) {
+  const error = { code, message };
+  if (fix !== void 0) error.fix = fix;
+  if (details !== void 0) error.details = details;
+  return {
+    success: false,
+    error
+  };
+}
+function wrapCoreResult(result, opName, fallback) {
+  if (!result.success) {
+    const e = result.error;
+    const errorObj = {
+      code: String(e?.code ?? "E_INTERNAL"),
+      message: e?.message ?? "Unknown error"
+    };
+    if (e?.exitCode !== void 0) errorObj.exitCode = e.exitCode;
+    if (e?.details !== void 0) errorObj.details = e.details;
+    if (e?.fix !== void 0) errorObj.fix = e.fix;
+    if (e?.alternatives) {
+      errorObj.alternatives = e.alternatives;
+    }
+    if (e?.problemDetails !== void 0) errorObj.problemDetails = e.problemDetails;
+    return { success: false, error: errorObj };
+  }
+  return lafsSuccess(result.data ?? fallback, opName);
+}
+async function wrapConduitImpl(fn, opName) {
+  try {
+    const result = await fn();
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_CONDUIT"),
+        result.error?.message ?? "Unknown error",
+        opName
+      );
+    }
+    return lafsSuccess(result.data ?? {}, opName);
+  } catch (error) {
+    if (!(error instanceof Error)) return lafsError("E_CONDUIT", String(error), opName);
+    const code = "code" in error && typeof error.code === "string" ? error.code : "";
+    return lafsError(/^E_[A-Z0-9_]+$/.test(code) ? code : "E_CONDUIT", error.message, opName);
+  }
+}
+
+export {
+  typedDispatch,
+  defineTypedHandler,
+  lafsSuccess,
+  lafsError,
+  wrapCoreResult,
+  wrapConduitImpl
+};
+//# sourceMappingURL=chunk-QWNKLLLG.js.map

package/dist/cli/{chunk-7INMKEAD.js → chunk-QWUFFDL3.js}

@@ -19,7 +19,7 @@ import {
 import {
   cliError,
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/auth/remove.ts
 function emitLlmCredentialRemoval(outcome, command, operation) {
@@ -82,4 +82,4 @@ export {
   emitLlmCredentialRemoval,
   authRemoveCommand
 };
-//# sourceMappingURL=chunk-7INMKEAD.js.map
+//# sourceMappingURL=chunk-QWUFFDL3.js.map

package/dist/cli/chunk-QY76BRUZ.js

@@ -0,0 +1,35 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/dispatch/domains/_routing.ts
+function routeByParam(params, paramName, routes, defaultRoute) {
+  const value = params?.[paramName] ?? defaultRoute;
+  if (!value) {
+    const available = Object.keys(routes).join(", ");
+    throw new Error(`Missing required param '${paramName}'. Available: ${available}`);
+  }
+  const handler = routes[value];
+  if (!handler) {
+    const available = Object.keys(routes).join(", ");
+    throw new Error(`Unknown ${paramName} '${value}'. Available: ${available}`);
+  }
+  return handler();
+}
+
+export {
+  routeByParam
+};
+//# sourceMappingURL=chunk-QY76BRUZ.js.map

package/dist/cli/chunk-R45KVF5Y.js

@@ -0,0 +1,117 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/doctor-tool-locks.ts
+import {
+  admissionCapacityBytes,
+  entryLiveness,
+  readForeignEntries,
+  readLedger,
+  reapLedger,
+  removeLedgerEntry
+} from "@cleocode/core/resources/admission-ledger.js";
+import { CANONICAL_TOOLS } from "@cleocode/core/tasks/tool-resolver.js";
+var doctorToolLocksCommand = defineCommand({
+  meta: {
+    name: "tool-locks",
+    description: "Inspect the machine-wide admission ledger: which heavy runs hold the memory budget or wait for it, by which pid, and whether that pid is still alive. Read-only; --reap drops entries whose holder is provably gone; --remove <id> drops one entry."
+  },
+  args: {
+    reap: {
+      type: "boolean",
+      description: "Drop entries whose holder process and tool process groups are gone. Fails safe: an unreadable probe or a fresh heartbeat counts as ALIVE and is never reaped."
+    },
+    remove: {
+      type: "string",
+      description: "Drop the entry with this id whatever its liveness (an entry whose holder cannot be identified is otherwise kept until its heartbeat is 10 minutes old)."
+    },
+    tool: {
+      type: "string",
+      description: "Restrict to one canonical tool (test, build, lint, typecheck, \u2026)."
+    },
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const requested = typeof args.tool === "string" && args.tool.length > 0 ? args.tool : null;
+    if (requested && !CANONICAL_TOOLS.some((t) => t === requested)) {
+      cliOutput(
+        { error: `Unknown canonical tool "${requested}"`, known: [...CANONICAL_TOOLS] },
+        { command: "doctor", operation: "doctor.tool-locks.run" }
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const reaped = args.reap === true ? await reapLedger() : [];
+    const removeId = typeof args.remove === "string" && args.remove.length > 0 ? args.remove : null;
+    const removed = removeId === null ? null : await removeLedgerEntry(removeId);
+    const now = Date.now();
+    const entries = readLedger().filter((e) => requested === null || e.label === `tool:${requested}`).map((e) => {
+      const alive = entryLiveness(e, now) === "alive";
+      return {
+        id: e.id,
+        label: e.label,
+        state: e.state,
+        pid: e.pid,
+        host: e.host,
+        command: e.command,
+        cwd: e.cwd,
+        footprintBytes: e.footprintBytes,
+        // T13132: what the run covers (`full` = a whole-suite run) and its task.
+        scope: e.scope ?? null,
+        task: e.task ?? null,
+        enqueuedAt: new Date(e.enqueuedAtMs).toISOString(),
+        admittedAt: e.admittedAtMs === null ? null : new Date(e.admittedAtMs).toISOString(),
+        toolGroups: e.toolGroups,
+        alive,
+        orphaned: !alive
+      };
+    });
+    const orphaned = entries.filter((e) => e.orphaned);
+    const held = entries.filter((e) => e.state === "admitted");
+    const foreignEntries = requested === null ? readForeignEntries() : [];
+    cliOutput(
+      {
+        capacityBytes: admissionCapacityBytes(),
+        usedBytes: held.reduce((n, e) => n + e.footprintBytes, 0),
+        entries,
+        heldCount: held.length,
+        waitingCount: entries.length - held.length,
+        orphanedCount: orphaned.length,
+        foreignEntries,
+        reaped,
+        reapApplied: args.reap === true,
+        ...removeId === null ? {} : { removeId, removed }
+      },
+      { command: "doctor", operation: "doctor.tool-locks.run" }
+    );
+    if ((orphaned.length > 0 || removed === false) && (process.exitCode ?? 0) === 0) {
+      process.exitCode = 1;
+    }
+  }
+});
+
+export {
+  doctorToolLocksCommand
+};
+//# sourceMappingURL=chunk-R45KVF5Y.js.map

package/dist/cli/{chunk-W33Q3FBH.js → chunk-RRKP7HLU.js}

@@ -15,10 +15,10 @@
 })();
 import {
   OPERATIONS
-} from "./chunk-AWCQH2W5.js";
+} from "./chunk-4VASFLUW.js";
 
 // packages/cleo/src/cli/lib/registry-args.ts
-import { paramsToCittyArgs } from "@cleocode/contracts";
+import { paramsToCittyArgs } from "@cleocode/contracts/operations/params.js";
 var IDEMPOTENCY_KEY_PARAM = {
   name: "idempotencyKey",
   type: "string",
@@ -63,4 +63,4 @@ export {
   registryParamsToDispatchPayload,
   paramsToCittyArgs
 };
-//# sourceMappingURL=chunk-W33Q3FBH.js.map
+//# sourceMappingURL=chunk-RRKP7HLU.js.map

package/dist/cli/{chunk-YUZJI67I.js → chunk-T6GZJYL3.js}

@@ -19,7 +19,7 @@ import {
 import {
   cliError,
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/doctor-skill-fixtures.ts
 import {
@@ -105,4 +105,4 @@ var doctorSkillFixturesCommand = defineCommand({
 export {
   doctorSkillFixturesCommand
 };
-//# sourceMappingURL=chunk-YUZJI67I.js.map
+//# sourceMappingURL=chunk-T6GZJYL3.js.map

package/dist/cli/{chunk-LWQBJQSE.js → chunk-TLQ37HRE.js}

@@ -18,14 +18,14 @@ import {
 } from "./chunk-PKKZPOOP.js";
 import {
   cliOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/doctor-acceptance-drift.ts
-import { getProjectRoot } from "@cleocode/core";
 import {
   scanAcceptanceDrift,
   writeAcceptanceDriftBaseline
 } from "@cleocode/core/doctor/acceptance-drift.js";
+import { getProjectRoot } from "@cleocode/core/project-scope";
 var doctorAcceptanceDriftCommand = defineCommand({
   meta: {
     name: "acceptance-drift",
@@ -64,4 +64,4 @@ var doctorAcceptanceDriftCommand = defineCommand({
 export {
   doctorAcceptanceDriftCommand
 };
-//# sourceMappingURL=chunk-LWQBJQSE.js.map
+//# sourceMappingURL=chunk-TLQ37HRE.js.map

package/dist/cli/chunk-TPTNEJZJ.js

@@ -0,0 +1,52 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/doctor-sync-journal.ts
+import { runSyncRepair } from "@cleocode/core/doctor/sync-repair.js";
+import { getProjectRoot } from "@cleocode/core/paths.js";
+var doctorSyncJournalCommand = defineCommand({
+  meta: {
+    name: "sync-journal",
+    description: "Plan the repair diff of the project store's suspect tables (rows written uncaptured). --repair emits the repair ops, seals them, verifies each table and clears its suspect mark."
+  },
+  args: {
+    repair: {
+      type: "boolean",
+      description: "Seal pending captures, emit I/U/D repair ops for every row of each suspect table in a repair frame, seal them, verify (clean rescan, ledger equals count) and clear the suspect mark. Opens the store like any cleo command, so pending migrations are applied"
+    },
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const result = await runSyncRepair(getProjectRoot(), { repair: args.repair === true });
+    cliOutput(result, { command: "doctor", operation: "doctor.sync-journal.run" });
+    if (args.repair === true && (result.report.refused !== null || result.suspect.length > 0)) {
+      process.exitCode = 1;
+    }
+  }
+});
+
+export {
+  doctorSyncJournalCommand
+};
+//# sourceMappingURL=chunk-TPTNEJZJ.js.map

package/dist/cli/chunk-TYC7G5LF.js

@@ -0,0 +1,100 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/dispatch/domains/lazy.ts
+import { OPERATIONS } from "@cleocode/contracts/dispatch/operations-registry.js";
+var DOMAIN_LOADERS = [
+  ["tasks", async () => new (await import("./tasks-C24KHTFF.js")).TasksHandler()],
+  ["session", async () => new (await import("./session-N5ISU56W.js")).SessionHandler()],
+  ["attention", async () => new (await import("./attention-7JBDCRZX.js")).AttentionHandler()],
+  ["memory", async () => new (await import("./memory-IAEYKXG6.js")).MemoryHandler()],
+  ["intelligence", async () => new (await import("./intelligence-OFFNQGHE.js")).IntelligenceHandler()],
+  ["check", async () => new (await import("./check-C67YAU7W.js")).CheckHandler()],
+  ["pipeline", async () => new (await import("./pipeline-TCZPOEDR.js")).PipelineHandler()],
+  ["orchestrate", async () => new (await import("./orchestrate-CZ2J6W3L.js")).OrchestrateHandler()],
+  ["tools", async () => new (await import("./tools-BI74W7VE.js")).ToolsHandler()],
+  ["admin", async () => new (await import("./admin-L3F6CDYH.js")).AdminHandler()],
+  ["nexus", async () => new (await import("./nexus-FPQV2EAF.js")).NexusHandler()],
+  ["sticky", async () => new (await import("./sticky-VSTQ2I2O.js")).StickyHandler()],
+  ["diagnostics", async () => new (await import("./diagnostics-GN5CVD3N.js")).DiagnosticsHandler()],
+  ["docs", async () => new (await import("./docs-CLQKEEUK.js")).DocsHandler()],
+  ["focus", async () => new (await import("./focus-6AH4KLRO.js")).FocusHandler()],
+  ["playbook", async () => new (await import("./playbook-NJVO4R6P.js")).PlaybookHandler()],
+  ["conduit", async () => new (await import("./conduit-EY54WTZA.js")).ConduitHandler()],
+  ["sentient", async () => new (await import("./sentient-QPETVE53.js")).SentientHandler()],
+  ["release", async () => new (await import("./release-G2DPSG5M.js")).ReleaseHandler()],
+  ["provenance", async () => new (await import("./provenance-3TUWVBFR.js")).ProvenanceHandler()],
+  ["selfimprove", async () => new (await import("./selfimprove-EB4RQLP4.js")).SelfimproveHandler()],
+  ["service", async () => new (await import("./service-GLOMZWPQ.js")).ServiceHandler()],
+  ["llm", async () => new (await import("./llm-H7LZWQKX.js")).LlmHandler()],
+  ["account", async () => new (await import("./entities-3JIHDIOK.js")).AccountHandler()],
+  ["provider", async () => new (await import("./entities-3JIHDIOK.js")).ProviderHandler()],
+  ["model", async () => new (await import("./entities-3JIHDIOK.js")).ModelHandler()],
+  ["profile", async () => new (await import("./entities-3JIHDIOK.js")).ProfileHandler()],
+  ["worktree", async () => new (await import("./worktree-ZJ6JTQNG.js")).WorktreeHandler()],
+  ["upgrade", async () => new (await import("./upgrade-E2MJAPC7.js")).UpgradeHandler()]
+];
+var LazyDomainHandler = class {
+  /**
+   * @param domain - Canonical domain name.
+   * @param load - Loads and constructs the real handler.
+   */
+  constructor(domain, load) {
+    this.domain = domain;
+    this.load = load;
+  }
+  domain;
+  load;
+  handler = null;
+  /** The real handler, loaded once. A failed load is retried on the next call. */
+  resolve() {
+    this.handler ??= this.load().catch((err) => {
+      this.handler = null;
+      throw err;
+    });
+    return this.handler;
+  }
+  /** @inheritdoc */
+  async query(operation, params) {
+    return (await this.resolve()).query(operation, params);
+  }
+  /** @inheritdoc */
+  async mutate(operation, params) {
+    return (await this.resolve()).mutate(operation, params);
+  }
+  /** @inheritdoc */
+  getSupportedOperations() {
+    const ops = OPERATIONS.filter((op) => op.domain === this.domain);
+    return {
+      query: ops.filter((op) => op.gateway === "query").map((op) => op.operation),
+      mutate: ops.filter((op) => op.gateway === "mutate").map((op) => op.operation)
+    };
+  }
+};
+function createLazyDomainHandlers() {
+  return new Map(
+    DOMAIN_LOADERS.map(([domain, load]) => [domain, new LazyDomainHandler(domain, load)])
+  );
+}
+function lazyOperation(load) {
+  return async (...args) => await (await load())(...args);
+}
+
+export {
+  createLazyDomainHandlers,
+  lazyOperation
+};
+//# sourceMappingURL=chunk-TYC7G5LF.js.map

package/dist/cli/{chunk-J3ZFM3UQ.js → chunk-UWCZY52R.js}

@@ -22,11 +22,12 @@ import {
   failNexus,
   nexusLoginSummary,
   runNexusLogin,
+  terminalSafe,
   writeDeviceCodeApproved,
   writeDeviceCodeInterrupted,
   writeDeviceCodePending,
   writeDeviceCodePrompt
-} from "./chunk-ULN4OKQQ.js";
+} from "./chunk-GRU74UE4.js";
 import {
   defineCommand
 } from "./chunk-PKKZPOOP.js";
@@ -35,10 +36,11 @@ import {
   cliOutput,
   humanLine,
   isHumanOutput
-} from "./chunk-3ZO3M37V.js";
+} from "./chunk-4RGSNUUP.js";
 
 // packages/cleo/src/cli/commands/login.ts
-import { NEXUS_LOGIN_TARGET, WHOAMI_ROLE_IDS } from "@cleocode/contracts";
+import { WHOAMI_ROLE_IDS } from "@cleocode/contracts/llm/system-of-use.js";
+import { NEXUS_LOGIN_TARGET } from "@cleocode/contracts/nexus-account.js";
 
 // packages/cleo/src/cli/lib/nexus-first-run-cli.ts
 var STEP_LINES = {
@@ -47,10 +49,11 @@ var STEP_LINES = {
   restore: "Restoring its backup from Cleo Nexus...",
   projects: "Looking up your Cleo Nexus projects..."
 };
-function consentOf(args) {
+function consentOf(args, env = process.env, tty = process.stdin.isTTY === true && process.stderr.isTTY === true) {
   if (args["yes"] === true) return "yes";
-  const ci = (process.env["CI"] ?? "") !== "" && process.env["CI"] !== "false";
-  return process.stdin.isTTY && process.stderr.isTTY && !ci ? "prompt" : "never";
+  const ci = (env["CI"] ?? "") !== "" && env["CI"] !== "false";
+  if (ci) return "never";
+  return tty ? "prompt" : "unattended";
 }
 async function runNexusFirstRunCli(args, login) {
   const { nexusFirstRunResult, runNexusFirstRun } = await import(
@@ -137,7 +140,8 @@ async function runNexusLoginCommand(args, operation, openBrowser) {
     failNexus(err, operation);
   }
   const firstRun = await runNexusFirstRunCli(args, login);
-  for (const w of firstRun.warnings) process.stderr.write(`warning: ${w.message} (${w.code})
+  for (const w of firstRun.warnings)
+    process.stderr.write(`warning: ${terminalSafe(w.message)} (${w.code})
 `);
   if (!isHumanOutput()) {
     if (firstRun.nextCommand) process.stderr.write(`next: ${firstRun.nextCommand}
@@ -611,9 +615,16 @@ var NEXUS_PICKER_LABEL = "Cleo Nexus account";
 function loginPickerOptions(providerNames) {
   return [NEXUS_PICKER_LABEL, ...[...providerNames].sort()];
 }
-async function resolveLoginTarget(args) {
+var LLM_ONLY_FLAGS = ["api-key", "api-key-stdin", "model", "role", "auth", "label"];
+function nonInteractiveLoginTarget(args, operation) {
+  if (operation !== "login.run") return void 0;
+  const llmIntent = LLM_ONLY_FLAGS.some((f) => args[f] !== void 0 && args[f] !== false);
+  return llmIntent ? void 0 : NEXUS_LOGIN_TARGET;
+}
+async function resolveLoginTarget(args, operation) {
   const given = typeof args["provider"] === "string" ? args["provider"] : "";
-  if (given || !process.stdin.isTTY) return given || void 0;
+  if (given) return given;
+  if (!process.stdin.isTTY) return nonInteractiveLoginTarget(args, operation);
   const names = (await (await providerRegistry()).listProviders()).map((p) => p.name);
   const io = new ReadlineWizardIO(process.stdin, process.stderr);
   try {
@@ -626,7 +637,7 @@ async function resolveLoginTarget(args) {
 async function runLoginCommand(args, operation) {
   let target;
   try {
-    target = await resolveLoginTarget(args);
+    target = await resolveLoginTarget(args, operation);
   } catch (err) {
     failLogin(err, operation);
   }
@@ -696,7 +707,7 @@ var LOGIN_ARGS = {
   },
   yes: {
     type: "boolean",
-    description: "nexus: inside a CLEO project this machine has not linked, link it and take the first encrypted backup without asking (or, when Cleo Nexus already backs it up from another device and this copy never synced, restore that backup here). Without it a terminal is asked, and a non-interactive run only prints the next command."
+    description: "nexus: inside a CLEO project this machine has not linked, link it and take the first encrypted backup without asking (or, when Cleo Nexus already backs it up from another device and this copy never synced, restore that backup here). Without it a terminal is asked; a non-interactive run outside CI (an agent) links and backs up unattended but never restores unasked; CI only prints the next command."
   },
   auth: {
     type: "string",
@@ -733,7 +744,7 @@ var loginCommand = defineCommand({
     // ONE quoted literal, no backticks: the manifest generator's DESC_RE
     // captures only the first plain string literal (concatenations + backticks
     // truncate the `cleo --help` text mid-sentence).
-    description: "Log in to a Cleo Nexus account (cleo login nexus: device code, --api-url, --no-browser) or to an LLM provider, binding a usable profile in one step. The picker lists the Cleo Nexus account first, then the providers. After a Cleo Nexus sign-in inside an unlinked CLEO project it offers to link the project and back it up (--yes does it; a non-interactive run prints the next command); outside a project it lists your projects with the cleo cloud restore command for each. For a provider it picks an auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json."
+    description: "Log in to a Cleo Nexus account (cleo login nexus: device code, --api-url, --no-browser) or to an LLM provider, binding a usable profile in one step. The picker lists the Cleo Nexus account first, then the providers. Without a terminal and no target, cleo login signs in to Cleo Nexus (an agent needs no extra word). After a Cleo Nexus sign-in inside an unlinked CLEO project it links the project and backs it up: a terminal is asked, --yes or a non-interactive run (an agent) does it, a restore over this copy is never done unasked, and CI only prints the next command; outside a project it lists your projects with the cleo cloud restore command for each. For a provider it picks an auth method (browser OAuth or API key), selects a model, binds it, and validates the binding. cleo auth login and cleo llm login resolve to this same flow. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped / --json."
   },
   args: LOGIN_ARGS,
   async run({ args }) {
@@ -746,9 +757,10 @@ export {
   runLoginFrontDoor,
   NEXUS_PICKER_LABEL,
   loginPickerOptions,
+  nonInteractiveLoginTarget,
   runLoginCommand,
   emitLoginResult,
   LOGIN_ARGS,
   loginCommand
 };
-//# sourceMappingURL=chunk-J3ZFM3UQ.js.map
+//# sourceMappingURL=chunk-UWCZY52R.js.map

package/dist/cli/{chunk-V5GBGOGM.js → chunk-VB3LDPL5.js}

@@ -32,7 +32,7 @@ import {
   statusColor,
   statusSymbol,
   YELLOW
-} from "@cleocode/core";
+} from "@cleocode/core/render/colors";
 
 export {
   BOLD,
@@ -43,4 +43,4 @@ export {
   RED,
   YELLOW
 };
-//# sourceMappingURL=chunk-V5GBGOGM.js.map
+//# sourceMappingURL=chunk-VB3LDPL5.js.map