@cleocode/cleo 2026.10.6 → 2026.10.7-rc.ci.674

package/dist/cli/{detect-ICA3K6DT.js → detect-FUC5Y647.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/detect.ts
 var detectCommand = defineCommand({
@@ -43,4 +43,4 @@ var detectCommand = defineCommand({
 export {
   detectCommand
 };
-//# sourceMappingURL=detect-ICA3K6DT.js.map
+//# sourceMappingURL=detect-FUC5Y647.js.map

package/dist/cli/{diagnostics-V5N6D4JO.js → diagnostics-SE2GUEIQ.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-47JYZAMS.js";
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -29,7 +29,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/diagnostics.ts
 var enableCommand = defineCommand({
@@ -130,4 +130,4 @@ var diagnosticsCommand = defineCommand({
 export {
   diagnosticsCommand
 };
-//# sourceMappingURL=diagnostics-V5N6D4JO.js.map
+//# sourceMappingURL=diagnostics-SE2GUEIQ.js.map

package/dist/cli/{docs-CIKVG5Q3.js → docs-CR46FNQN.js}

@@ -25,7 +25,7 @@ import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import {
   resolve
@@ -49,7 +49,7 @@ import {
 } from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/docs.ts
 import { appendFile, mkdir as mkdir3, readdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
@@ -2679,6 +2679,45 @@ var checkCommand = defineCommand({
     }
   }
 });
+function parseOlderThanDays(raw) {
+  if (raw === void 0) return void 0;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    cliError(`--older-than-days must be a non-negative number, got '${raw}'`, 6, {
+      name: "E_VALIDATION"
+    });
+    process.exit(6);
+  }
+  return Math.floor(parsed);
+}
+var doctorCommand = defineCommand({
+  meta: {
+    name: "doctor",
+    description: "Docs store health diagnostics + safe repairs: dangling local-file pointers, docVersion skew vs the audit log, empty topics/related_tasks provenance, docs_wikilinks drift, legacy store surfaces, stale drafts. Dry-run by default; --apply executes repairs (a fresh backup is created automatically first)."
+  },
+  args: {
+    apply: {
+      type: "boolean",
+      description: "Execute the repairs (default: dry-run plan only)"
+    },
+    "older-than-days": {
+      type: "string",
+      description: "Age threshold in days for the stale-drafts check (default 30)"
+    },
+    ...docsOutputArgs
+  },
+  async run({ args }) {
+    const apply = args.apply === true;
+    const olderThanDays = parseOlderThanDays(args["older-than-days"]);
+    await dispatchFromCli(
+      apply ? "mutate" : "query",
+      "docs",
+      "doctor",
+      { apply, ...olderThanDays !== void 0 ? { olderThanDays } : {} },
+      { command: "docs doctor" }
+    );
+  }
+});
 var syncCommand = defineCommand({
   meta: {
     name: "sync",
@@ -3048,6 +3087,8 @@ var docsCommand = defineCommand({
     // T11136 — Unified drift management (consolidates sync/status/gap-check)
     check: checkCommand,
     // Canonical six-verb path (add, update, fetch, list, remove, publish)
+    // T13447 — store health diagnostics + safe repairs
+    doctor: doctorCommand,
     add: addCommand,
     update: updateCommand,
     fetch: fetchCommand,
@@ -3095,4 +3136,4 @@ export {
   _llmOutputCommand,
   docsCommand
 };
-//# sourceMappingURL=docs-CIKVG5Q3.js.map
+//# sourceMappingURL=docs-CR46FNQN.js.map

package/dist/cli/{docs-RCKGENBN.js → docs-DNNQIKRX.js}

@@ -21,7 +21,7 @@ import {
 } from "./chunk-QWNKLLLG.js";
 import {
   lazyOperation
-} from "./chunk-2SE64OPI.js";
+} from "./chunk-YM7SWWQX.js";
 import {
   dispatchMeta,
   handleErrorResult,
@@ -31,7 +31,7 @@ import {
 // packages/cleo/src/dispatch/domains/docs.ts
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { DocKindRegistry } from "@cleocode/contracts/docs-taxonomy.js";
 import { LLM_OUTPUT_MODES } from "@cleocode/contracts/operations/docs";
 import { parseChangesetFrontmatter } from "@cleocode/core/changesets/parse-frontmatter";
@@ -101,6 +101,12 @@ var resolveAttachmentBackend = lazyOperation(
 var runDocsImport = lazyOperation(
   async () => (await import("@cleocode/core/docs/import/import-orchestrator")).runDocsImport
 );
+var runDocsDoctor = lazyOperation(
+  async () => (await import("@cleocode/core/docs/doctor")).runDocsDoctor
+);
+var createSystemBackup = lazyOperation(
+  async () => (await import("@cleocode/core/system/backup")).createBackup
+);
 var searchAllProjectDocs = lazyOperation(
   async () => (await import("@cleocode/core/docs/docs-ops")).searchAllProjectDocs
 );
@@ -516,6 +522,37 @@ var _docsTypedHandler = defineTypedHandler("docs", {
       "fetch"
     );
   },
+  // ── docs.doctor ────────────────────────────────────────────────────────────
+  doctor: async (params) => {
+    const apply = params.apply === true;
+    const projectRoot = getProjectRoot();
+    let backupReceiptPath;
+    if (apply) {
+      const backup = await createSystemBackup(projectRoot, {
+        type: "snapshot",
+        note: "docs doctor pre-repair (T13447)"
+      });
+      const STORE_FILE = "cleo.db";
+      if (!backup.files.includes(STORE_FILE)) {
+        return lafsError(
+          "E_DOCS_DOCTOR_BACKUP_FAILED",
+          // @sync-invariant none:input-shape a precondition refusal before any repair write; nothing was written
+          "backup did not capture the project store \u2014 refusing to apply repairs",
+          "doctor"
+        );
+      }
+      backupReceiptPath = join(backup.path, `${STORE_FILE}.${backup.backupId}`);
+    }
+    const result = await runDocsDoctor(projectRoot, {
+      apply,
+      ...params.olderThanDays !== void 0 ? { olderThanDays: params.olderThanDays } : {},
+      ...backupReceiptPath !== void 0 ? { backupReceiptPath } : {}
+    });
+    if (!result.ok) {
+      return lafsError(result.error.code, result.error.message, "doctor");
+    }
+    return lafsSuccess(result.report, "doctor");
+  },
   // ── docs.add ───────────────────────────────────────────────────────────────
   add: async (params) => {
     const {
@@ -1372,7 +1409,8 @@ var QUERY_OPS = /* @__PURE__ */ new Set([
   "rank",
   "versions",
   "status",
-  "audit"
+  "audit",
+  "doctor"
 ]);
 var MUTATE_OPS = /* @__PURE__ */ new Set([
   "add",
@@ -1382,7 +1420,8 @@ var MUTATE_OPS = /* @__PURE__ */ new Set([
   "publish",
   "publish-pr",
   "sync",
-  "import"
+  "import",
+  "doctor"
 ]);
 async function dispatchDocsLegacyQuery(operation, params) {
   const projectRoot = getProjectRoot();
@@ -1667,13 +1706,24 @@ var DocsHandler = class {
         "rank",
         "versions",
         "status",
-        "audit"
+        "audit",
+        "doctor"
       ],
-      mutate: ["add", "remove", "update", "supersede", "publish", "publish-pr", "sync", "import"]
+      mutate: [
+        "add",
+        "remove",
+        "update",
+        "supersede",
+        "publish",
+        "publish-pr",
+        "sync",
+        "import",
+        "doctor"
+      ]
     };
   }
 };
 export {
   DocsHandler
 };
-//# sourceMappingURL=docs-RCKGENBN.js.map
+//# sourceMappingURL=docs-DNNQIKRX.js.map

package/dist/cli/{doctor-G34EXNNN.js → doctor-5T4SOSJT.js}

@@ -16,6 +16,12 @@
 import {
   createDoctorProgress
 } from "./chunk-W3JLYKKY.js";
+import {
+  readMigrationConflicts
+} from "./chunk-IIOGUY3B.js";
+import {
+  doctorSplitBrainCommand
+} from "./chunk-7ACK4EIN.js";
 import {
   doctorSupersededStoreCommand
 } from "./chunk-U3RT24TC.js";
@@ -25,6 +31,9 @@ import {
 import {
   doctorSyncTriggersCommand
 } from "./chunk-ILWWL462.js";
+import {
+  doctorSystemCommand
+} from "./chunk-DICDL2YM.js";
 import {
   doctorToolLocksCommand
 } from "./chunk-LLDYX63U.js";
@@ -35,8 +44,8 @@ import {
   doctorWorktreeStoresCommand
 } from "./chunk-BQK6XTOH.js";
 import {
-  readMigrationConflicts
-} from "./chunk-IIOGUY3B.js";
+  doctorNexusResidencyCommand
+} from "./chunk-XA5WISNV.js";
 import {
   doctorProjectIdentityCommand
 } from "./chunk-PN4WW5VX.js";
@@ -59,8 +68,8 @@ import {
   doctorSkillFixturesCommand
 } from "./chunk-T6GZJYL3.js";
 import {
-  doctorSplitBrainCommand
-} from "./chunk-7ACK4EIN.js";
+  doctorGlobalDeliveryCommand
+} from "./chunk-HFLLZE6A.js";
 import {
   doctorHeavyCommandHookCommand
 } from "./chunk-COXFJ3PT.js";
@@ -83,8 +92,8 @@ import {
   doctorMigrationsCommand
 } from "./chunk-7UARFJYS.js";
 import {
-  doctorNexusResidencyCommand
-} from "./chunk-XA5WISNV.js";
+  doctorAcBindingsCommand
+} from "./chunk-CHGEDCKG.js";
 import {
   doctorAcceptanceDriftCommand
 } from "./chunk-TLQ37HRE.js";
@@ -106,12 +115,6 @@ import {
 import {
   doctorFkCheckCommand
 } from "./chunk-FSKN4DWC.js";
-import {
-  doctorGlobalDeliveryCommand
-} from "./chunk-HFLLZE6A.js";
-import {
-  doctorAcBindingsCommand
-} from "./chunk-CHGEDCKG.js";
 import "./chunk-47JYZAMS.js";
 import "./chunk-C3B7C43W.js";
 import {
@@ -120,7 +123,7 @@ import {
 import {
   dispatchFromCli,
   dispatchRaw
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -134,7 +137,7 @@ import {
 } from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/doctor.ts
 import { mkdirSync, writeFileSync } from "node:fs";
@@ -515,6 +518,8 @@ var doctorCommand = defineCommand({
     "worktree-stores": doctorWorktreeStoresCommand,
     // T12097 — machine-wide guard for test runs started OUTSIDE cleo verify
     "memory-guard": doctorMemoryGuardCommand,
+    // T13435 — machine + project health: ranked findings with exact remedies (read-only)
+    system: doctorSystemCommand,
     // T13124 — the heavy-command hook per agent harness in use (+ --fix installs it)
     "heavy-command-hook": doctorHeavyCommandHookCommand,
     // T12353 · T12716 — tracked .cleo/project.json / project-id vs project-info.json (+ --resolve migrate / re-key)
@@ -1267,4 +1272,4 @@ Dependency cycles: check skipped (${msg})`);
 export {
   doctorCommand
 };
-//# sourceMappingURL=doctor-G34EXNNN.js.map
+//# sourceMappingURL=doctor-5T4SOSJT.js.map

package/dist/cli/doctor-system-HN7KUBUO.js

@@ -0,0 +1,26 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  doctorSystemCommand
+} from "./chunk-DICDL2YM.js";
+import "./chunk-C3B7C43W.js";
+import "./chunk-PKKZPOOP.js";
+import "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+export {
+  doctorSystemCommand
+};
+//# sourceMappingURL=doctor-system-HN7KUBUO.js.map

package/dist/cli/{done-FKTAVLGO.js → done-ZSUWISRY.js}

@@ -16,11 +16,11 @@
 import {
   completeCommandArgs,
   completeDispatchParams
-} from "./chunk-WM5PF6U2.js";
+} from "./chunk-FWTSORSA.js";
 import "./chunk-C3B7C43W.js";
 import {
   dispatchRaw
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -35,7 +35,7 @@ import {
   withoutOutputPointer
 } from "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/done.ts
 async function batchEntry(taskId, result, args) {
@@ -193,4 +193,4 @@ var doneCommand = defineCommand({
 export {
   doneCommand
 };
-//# sourceMappingURL=done-FKTAVLGO.js.map
+//# sourceMappingURL=done-ZSUWISRY.js.map

package/dist/cli/{export-2TA24G2M.js → export-VUSCRB5H.js}

@@ -17,7 +17,7 @@ import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -27,7 +27,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/export.ts
 var exportCommand = defineCommand({
@@ -90,4 +90,4 @@ var exportCommand = defineCommand({
 export {
   exportCommand
 };
-//# sourceMappingURL=export-2TA24G2M.js.map
+//# sourceMappingURL=export-VUSCRB5H.js.map

package/dist/cli/{export-tasks-5CO3JHLZ.js → export-tasks-5OFFZTAW.js}

@@ -17,7 +17,7 @@ import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -27,7 +27,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/export-tasks.ts
 var exportTasksCommand = defineCommand({
@@ -94,4 +94,4 @@ var exportTasksCommand = defineCommand({
 export {
   exportTasksCommand
 };
-//# sourceMappingURL=export-tasks-5CO3JHLZ.js.map
+//# sourceMappingURL=export-tasks-5OFFZTAW.js.map

package/dist/cli/{find-O4MUQDEQ.js → find-IO57ZCAV.js}

@@ -17,7 +17,7 @@ import {
   dispatchRaw,
   handleRawError,
   maybeEmitDescribe
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -29,7 +29,7 @@ import {
 } from "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/find.ts
 import { ExitCode } from "@cleocode/contracts/exit-codes.js";
@@ -175,4 +175,4 @@ var findCommand = defineCommand({
 export {
   findCommand
 };
-//# sourceMappingURL=find-O4MUQDEQ.js.map
+//# sourceMappingURL=find-IO57ZCAV.js.map

package/dist/cli/{focus-PHQMGVNK.js → focus-BHZPAPVM.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/focus.ts
 var focusCommand = defineCommand({
@@ -53,4 +53,4 @@ var focusCommand = defineCommand({
 export {
   focusCommand
 };
-//# sourceMappingURL=focus-PHQMGVNK.js.map
+//# sourceMappingURL=focus-BHZPAPVM.js.map

package/dist/cli/{grade-Z3YNRWC3.js → grade-BTQY5Y66.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/grade.ts
 var gradeCommand = defineCommand({
@@ -54,4 +54,4 @@ var gradeCommand = defineCommand({
 export {
   gradeCommand
 };
-//# sourceMappingURL=grade-Z3YNRWC3.js.map
+//# sourceMappingURL=grade-BTQY5Y66.js.map

package/dist/cli/{graph-LQSRJ6T2.js → graph-6PQZQCM5.js}

@@ -16,7 +16,7 @@
 import {
   dispatchFromCli,
   dispatchRaw
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -34,7 +34,7 @@ import {
   setFormatContext
 } from "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/graph.ts
 import path from "node:path";
@@ -876,4 +876,4 @@ var graphCommand = defineCommand({
 export {
   graphCommand
 };
-//# sourceMappingURL=graph-LQSRJ6T2.js.map
+//# sourceMappingURL=graph-6PQZQCM5.js.map

package/dist/cli/{history-YZ2H73G4.js → history-B2FQPJ7F.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -26,7 +26,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/history.ts
 var logCommand = defineCommand({
@@ -135,4 +135,4 @@ var historyCommand = defineCommand({
 export {
   historyCommand
 };
-//# sourceMappingURL=history-YZ2H73G4.js.map
+//# sourceMappingURL=history-B2FQPJ7F.js.map

package/dist/cli/{hook-UF7J7R6D.js → hook-BNQLJ3IB.js}

@@ -37,13 +37,31 @@ var heavyCommandSubcommand = defineCommand({
     process.exitCode = await runHookCli(["heavy-command", "--provider", provider]);
   }
 });
+var askEnforceSubcommand = defineCommand({
+  meta: {
+    name: "ask-enforce",
+    description: "Stop hook (T13420): block a turn that ends asking the owner in prose without an ask-tool call, and tell the agent to re-ask with its ask tool. Reads the Stop JSON on stdin; prints the harness answer."
+  },
+  args: {
+    provider: {
+      type: "string",
+      description: "Harness protocol to answer in: claude-code (default), codex, copilot-cli, gemini-cli, cursor, opencode, kimi"
+    }
+  },
+  async run({ args }) {
+    const { runHookCli } = await import("./hook-entry.js");
+    const provider = typeof args.provider === "string" ? args.provider : "claude-code";
+    process.exitCode = await runHookCli(["ask-enforce", "--provider", provider]);
+  }
+});
 var hookCommand = defineCommand({
   meta: {
     name: "hook",
-    description: "Agent-harness hooks installed by cleo init/upgrade; stdout is the harness hook protocol, not LAFS: cleo hook heavy-command --provider claude-code|codex|kimi|opencode"
+    description: "Agent-harness hooks installed by cleo init/upgrade; stdout is the harness hook protocol, not LAFS: cleo hook heavy-command|ask-enforce --provider <harness>"
   },
   subCommands: {
-    "heavy-command": heavyCommandSubcommand
+    "heavy-command": heavyCommandSubcommand,
+    "ask-enforce": askEnforceSubcommand
   },
   async run({ cmd, rawArgs }) {
     const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -54,4 +72,4 @@ var hookCommand = defineCommand({
 export {
   hookCommand
 };
-//# sourceMappingURL=hook-UF7J7R6D.js.map
+//# sourceMappingURL=hook-BNQLJ3IB.js.map

package/dist/cli/hook-entry.js

@@ -546,15 +546,41 @@ function claudePreApprovalVerdict(command, cwd, env, core, ctx) {
   const verdict = core.claudePreApproval(command, rules.patterns, { cwd, workingDir: projectDir });
   return verdict.approved ? verdict : { approved: false, reason: `it is not pre-approved: ${verdict.reason}` };
 }
-var USAGE = "usage: cleo hook heavy-command [--provider claude-code|codex|kimi|opencode] < hook-input.json\n";
+var USAGE = "usage: cleo hook heavy-command [--provider claude-code|codex|kimi|opencode] < hook-input.json\n       cleo hook ask-enforce [--provider claude-code|codex|copilot-cli|gemini-cli|cursor|opencode|kimi] < stop-input.json\n";
+function providerArg(rest) {
+  const flag = rest.findIndex((a) => a === "--provider" || a.startsWith("--provider="));
+  return flag === -1 ? "claude-code" : rest[flag]?.split("=")[1] ?? rest[flag + 1];
+}
+async function runAskEnforce(rest, io) {
+  const entry = await import("./ask-enforce-entry-ZYO5MVS6.js");
+  const value = providerArg(rest);
+  const provider = entry.ASK_ENFORCE_PROVIDERS.find((p) => p === value);
+  if (provider === void 0) {
+    io.writeStderr(USAGE);
+    return 1;
+  }
+  try {
+    const lookup = await entry.caampAskToolLookup();
+    const answer = await entry.askEnforceHook(provider, await io.readStdin(), io.env, lookup);
+    if (answer.stdout !== "") io.writeStdout(answer.stdout);
+    if (answer.stderr !== "") io.writeStderr(answer.stderr);
+    return answer.exitCode;
+  } catch (err) {
+    io.writeStderr(
+      `[cleo hook] ask-enforce skipped: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return 0;
+  }
+}
 async function runHookCli(argv, io = processHookIo()) {
   const [name, ...rest] = argv;
+  if (name === "ask-enforce") return runAskEnforce(rest, io);
   if (name !== "heavy-command") {
     io.writeStderr(USAGE);
     return 1;
   }
-  const flag = rest.findIndex((a) => a === "--provider" || a.startsWith("--provider="));
-  const value = flag === -1 ? "claude-code" : rest[flag]?.split("=")[1] ?? rest[flag + 1];
+  const value = providerArg(rest);
   const provider = HEAVY_HOOK_PROVIDERS.find((p) => p === value);
   if (provider === void 0) {
     io.writeStderr(USAGE);

package/dist/cli/{import-FXDJYQ55.js → import-P3PCQ7RG.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-6C5WLJTV.js";
+} from "./chunk-V72T73VU.js";
 import "./chunk-6N6WGLXE.js";
 import "./chunk-4VASFLUW.js";
 import {
@@ -26,7 +26,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-4RGSNUUP.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-2SE64OPI.js";
+import "./chunk-YM7SWWQX.js";
 
 // packages/cleo/src/cli/commands/import.ts
 var importCommand = defineCommand({
@@ -86,4 +86,4 @@ var importCommand = defineCommand({
 export {
   importCommand
 };
-//# sourceMappingURL=import-FXDJYQ55.js.map
+//# sourceMappingURL=import-P3PCQ7RG.js.map