@cleocode/cleo 2026.11.1-canary.6 → 2026.11.1-canary.7

package/dist/.source-stamp.json

@@ -1,4 +1,4 @@
 {
   "schema": 2,
-  "sourceHash": "62330ec040fd895b9360e41c8df17c0103a334c04cee1f236e2a91583e49363b"
+  "sourceHash": "f726c3cd1265f58d99a1dd33b581255040176c4c498448827752cd742f0a50f4"
 }

package/dist/cli/{adapter-AAV6DQAU.js → adapter-ZOOB5CZG.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-YY66LFZF.js";
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -28,7 +28,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/adapter.ts
 var listCommand = defineCommand({
@@ -156,4 +156,4 @@ var adapterCommand = defineCommand({
 export {
   adapterCommand
 };
-//# sourceMappingURL=adapter-AAV6DQAU.js.map
+//# sourceMappingURL=adapter-ZOOB5CZG.js.map

package/dist/cli/{add-4A7NEPOT.js → add-C3DLUUIU.js}

@@ -20,7 +20,7 @@ import {
   dispatchRaw,
   handleRawError,
   maybeEmitDescribe
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -36,7 +36,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/add.ts
 import { TASK_SEVERITIES } from "@cleocode/contracts/enums.js";
@@ -440,4 +440,4 @@ For 2+ tasks at once: cleo add-batch --file tasks.json (single transaction, atom
 export {
   addCommand
 };
-//# sourceMappingURL=add-4A7NEPOT.js.map
+//# sourceMappingURL=add-C3DLUUIU.js.map

package/dist/cli/{add-batch-PAFSKHP6.js → add-batch-UFIKHAW5.js}

@@ -19,7 +19,7 @@ import {
 import {
   dispatchRaw,
   maybeEmitDescribe
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -32,7 +32,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/add-batch.ts
 import { ExitCode } from "@cleocode/contracts/exit-codes.js";
@@ -161,4 +161,4 @@ var addBatchCommand = defineCommand({
 export {
   addBatchCommand
 };
-//# sourceMappingURL=add-batch-PAFSKHP6.js.map
+//# sourceMappingURL=add-batch-UFIKHAW5.js.map

package/dist/cli/{admin-22CR6TJQ.js → admin-LIQHGIOG.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-4VASFLUW.js";
 import {
   lazyOperation
-} from "./chunk-6WPQM7YS.js";
+} from "./chunk-QL3A56SV.js";
 import {
   defineTypedHandler,
   lafsError,
@@ -195,7 +195,7 @@ var SMOKE_PROBES = [
   { domain: "adapter", operation: "list" }
 ];
 async function runSystemSmoke() {
-  const { dispatchRaw } = await import("./cli-E7S4RFPU.js");
+  const { dispatchRaw } = await import("./cli-FTOVE3YE.js");
   const totalStart = Date.now();
   const probes = [];
   for (const probe of SMOKE_PROBES) {
@@ -1466,4 +1466,4 @@ var AdminHandler = class {
 export {
   AdminHandler
 };
-//# sourceMappingURL=admin-22CR6TJQ.js.map
+//# sourceMappingURL=admin-LIQHGIOG.js.map

package/dist/cli/{admin-6YIR23XG.js → admin-PXU5J2VQ.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -28,7 +28,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/admin.ts
 import { pushWarning } from "@cleocode/core/output";
@@ -349,4 +349,4 @@ var adminCommand = defineCommand({
 export {
   adminCommand
 };
-//# sourceMappingURL=admin-6YIR23XG.js.map
+//# sourceMappingURL=admin-PXU5J2VQ.js.map

package/dist/cli/{adr-NQZPOOVK.js → adr-K7LB7YMG.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -26,7 +26,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/adr.ts
 var validateCommand = defineCommand({
@@ -169,4 +169,4 @@ var adrCommand = defineCommand({
 export {
   adrCommand
 };
-//# sourceMappingURL=adr-NQZPOOVK.js.map
+//# sourceMappingURL=adr-K7LB7YMG.js.map

package/dist/cli/{analyze-F3QZ5UU4.js → analyze-KVZVQBIH.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/analyze.ts
 var analyzeCommand = defineCommand({
@@ -46,4 +46,4 @@ var analyzeCommand = defineCommand({
 export {
   analyzeCommand
 };
-//# sourceMappingURL=analyze-F3QZ5UU4.js.map
+//# sourceMappingURL=analyze-KVZVQBIH.js.map

package/dist/cli/{archive-2IPS2LRK.js → archive-G2SH5I2O.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/archive.ts
 var archiveCommand = defineCommand({
@@ -62,4 +62,4 @@ var archiveCommand = defineCommand({
 export {
   archiveCommand
 };
-//# sourceMappingURL=archive-2IPS2LRK.js.map
+//# sourceMappingURL=archive-G2SH5I2O.js.map

package/dist/cli/{archive-stats-UQA2MK37.js → archive-stats-CO7ZUN5T.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/archive-stats.ts
 import { analyzeArchive } from "@cleocode/core/internal";
@@ -98,4 +98,4 @@ export {
   archiveStatsCommand,
   analyzeArchive as getArchiveStats
 };
-//# sourceMappingURL=archive-stats-UQA2MK37.js.map
+//# sourceMappingURL=archive-stats-CO7ZUN5T.js.map

package/dist/cli/{attention-D4Z4U67V.js → attention-U6WMFTGI.js}

@@ -18,7 +18,7 @@ import {
   dispatchFromCli,
   dispatchRaw,
   handleRawError
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -32,7 +32,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/attention.ts
 import { ExitCode } from "@cleocode/contracts/exit-codes.js";
@@ -165,4 +165,4 @@ var attentionCommand = defineCommand({
 export {
   attentionCommand
 };
-//# sourceMappingURL=attention-D4Z4U67V.js.map
+//# sourceMappingURL=attention-U6WMFTGI.js.map

package/dist/cli/{backup-QHWBRY5N.js → backup-FX5CKWOQ.js}

@@ -26,7 +26,7 @@ import {
 } from "./chunk-YY66LFZF.js";
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import {
   CLEO_DIR_NAME,
@@ -48,7 +48,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/backup.ts
 import crypto from "node:crypto";
@@ -183,9 +183,37 @@ var listCommand = defineCommand({
       type: "string",
       description: "Filter by backup scope: project, global, or all (default: all)",
       default: "all"
+    },
+    rotation: {
+      type: "boolean",
+      description: "Preview the backup byte cap: every snapshot set it would remove, with its covering snapshot per store role. Read-only (T14278)",
+      default: false
     }
   },
   async run({ args }) {
+    if (args.rotation === true) {
+      const [{ getProjectRoot: getProjectRoot2 }, { resolveStoreCleoDir }, { applyBackupByteCap }] = await Promise.all([
+        import("@cleocode/core/project-scope"),
+        import("@cleocode/core/paths.js"),
+        import("@cleocode/core/store/backup-sidecar")
+      ]);
+      const backupDir = path.join(resolveStoreCleoDir(getProjectRoot2()), "backups", "sqlite");
+      const plan = fs.existsSync(backupDir) ? applyBackupByteCap(backupDir, { dryRun: true }) : null;
+      if (plan === null) {
+        cliError(`No byte cap could be computed for ${backupDir} (no store or no backups).`, 1);
+        process.exit(1);
+        return;
+      }
+      cliOutput(
+        { backupDir, ...plan },
+        {
+          command: "backup",
+          operation: "backup.rotation",
+          message: `Byte cap ${plan.maxBytes} bytes; ${plan.totalBefore} now. Would remove ${plan.removed.length} set(s) (${plan.totalBefore - plan.totalAfter} bytes)` + (plan.kept.length > 0 ? `; ${plan.kept.length} older set(s) kept with a reason.` : ".")
+        }
+      );
+      return;
+    }
     const scope = args.scope || "all";
     await dispatchFromCli(
       "query",
@@ -590,4 +618,4 @@ function sha256OfMachineKey(cleoHome) {
 export {
   backupCommand
 };
-//# sourceMappingURL=backup-QHWBRY5N.js.map
+//# sourceMappingURL=backup-FX5CKWOQ.js.map

package/dist/cli/{blockers-L5LZQIVV.js → blockers-52X3RD7U.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/blockers.ts
 var blockersCommand = defineCommand({
@@ -52,4 +52,4 @@ var blockersCommand = defineCommand({
 export {
   blockersCommand
 };
-//# sourceMappingURL=blockers-L5LZQIVV.js.map
+//# sourceMappingURL=blockers-52X3RD7U.js.map

package/dist/cli/{briefing-PJA35NQI.js → briefing-SX35UC4D.js}

@@ -18,7 +18,7 @@ import {
 } from "./chunk-YY66LFZF.js";
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -31,7 +31,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/briefing.ts
 import { pushWarning } from "@cleocode/core/output";
@@ -210,4 +210,4 @@ var briefingCommand = defineCommand({
 export {
   briefingCommand
 };
-//# sourceMappingURL=briefing-PJA35NQI.js.map
+//# sourceMappingURL=briefing-SX35UC4D.js.map

package/dist/cli/{cancel-EZVNKQ5R.js → cancel-UA5FV76M.js}

@@ -15,7 +15,7 @@
 })();
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -25,7 +25,7 @@ import "./chunk-QKMBWYAS.js";
 import "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/cancel.ts
 var cancelCommand = defineCommand({
@@ -60,6 +60,14 @@ var cancelCommand = defineCommand({
     cascadeThreshold: {
       type: "string",
       description: "Maximum descendant count allowed for cascade without --force (default: 10)"
+    },
+    kind: {
+      type: "string",
+      description: "Why (T14267): abandoned, superseded, duplicate or obsolete. A superseded or duplicate child whose --replaced-by task is done needs no --waive-cancelled-children on its parent"
+    },
+    "replaced-by": {
+      type: "string",
+      description: "The task that replaced this one (with --kind superseded or duplicate)"
     }
   },
   async run({ args }) {
@@ -73,7 +81,9 @@ var cancelCommand = defineCommand({
         children: args.children,
         reparentTo: typeof args.to === "string" && args.to.length > 0 ? args.to : void 0,
         force: args.force === true,
-        cascadeThreshold: typeof args.cascadeThreshold === "string" && args.cascadeThreshold.length > 0 ? Number.parseInt(args.cascadeThreshold, 10) : void 0
+        cascadeThreshold: typeof args.cascadeThreshold === "string" && args.cascadeThreshold.length > 0 ? Number.parseInt(args.cascadeThreshold, 10) : void 0,
+        kind: typeof args.kind === "string" && args.kind.length > 0 ? args.kind : void 0,
+        replacedBy: typeof args["replaced-by"] === "string" && args["replaced-by"].length > 0 ? args["replaced-by"] : void 0
       },
       { command: "cancel", operation: "tasks.cancel" }
     );
@@ -82,4 +92,4 @@ var cancelCommand = defineCommand({
 export {
   cancelCommand
 };
-//# sourceMappingURL=cancel-EZVNKQ5R.js.map
+//# sourceMappingURL=cancel-UA5FV76M.js.map

package/dist/cli/{check-NFBULBE5.js → check-WLBL76VA.js}

@@ -15,7 +15,7 @@
 })();
 import {
   lazyOperation
-} from "./chunk-6WPQM7YS.js";
+} from "./chunk-QL3A56SV.js";
 import {
   defineTypedHandler,
   lafsError,
@@ -634,7 +634,12 @@ var _checkTypedHandler = defineTypedHandler("check", {
   "gate.set": async (params) => {
     const projectRoot = resolveWorktreeRouting().canonicalRoot;
     if (!params.taskId) {
-      return lafsError("E_INVALID_INPUT", "taskId is required", "gate.set");
+      return lafsError(
+        "E_INVALID_INPUT",
+        "taskId is required",
+        "gate.set",
+        "cleo verify <taskId> --gate <gate> --evidence <atoms>"
+      );
     }
     if (params.criterion === true) {
       if (params.gate || params.all || params.reset || !params.evidence)
@@ -642,7 +647,8 @@ var _checkTypedHandler = defineTypedHandler("check", {
           // @sync-invariant none:input-shape contradictory receipt flags are refused before any read; nothing is written
           "E_INVALID_INPUT",
           "--criterion records a receipt for one criterion: it takes --evidence and excludes --gate/--all/--reset",
-          "gate.set"
+          "gate.set",
+          `cleo verify ${params.taskId} --criterion --evidence 'decision:<id>;satisfies:${params.taskId}#AC<n>'`
         );
       const receipt = await recordCriterionReceipt(projectRoot, {
         taskId: params.taskId,
@@ -676,7 +682,9 @@ var _checkTypedHandler = defineTypedHandler("check", {
       return lafsError(
         String(result.error?.code ?? "E_INTERNAL"),
         result.error?.message ?? "Unknown error",
-        "gate.set"
+        "gate.set",
+        // T14299: keep the verify refusal's own fix through the re-wrap.
+        result.error?.fix
       );
     }
     return lafsSuccess(
@@ -771,4 +779,4 @@ var CheckHandler = class {
 export {
   CheckHandler
 };
-//# sourceMappingURL=check-NFBULBE5.js.map
+//# sourceMappingURL=check-WLBL76VA.js.map

package/dist/cli/{check-GJIZJQON.js → check-X7CKPTJD.js}

@@ -22,7 +22,7 @@ import {
 } from "./chunk-47JYZAMS.js";
 import {
   dispatchFromCli
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import "./chunk-4VASFLUW.js";
 import "./chunk-2NXQCE4N.js";
 import {
@@ -35,7 +35,7 @@ import {
 } from "./chunk-ESI6Q4OS.js";
 import "./chunk-6JSJNYH2.js";
 import "./chunk-D7BAQNV2.js";
-import "./chunk-6WPQM7YS.js";
+import "./chunk-QL3A56SV.js";
 
 // packages/cleo/src/cli/commands/check.ts
 import { formatPrGateSummary, runPrGate } from "@cleocode/core/check/pr-gate";
@@ -768,6 +768,24 @@ var checkArchCommand = defineCommand({
         task: "T13126",
         script: "scripts/lint-no-contracts-barrel-value-imports.mjs",
         description: "No runtime value import from the @cleocode/contracts barrel"
+      },
+      {
+        // T14276 / T13924: every worktree removal goes through `disposeWorktree`
+        // (proof that nothing is lost, else keep; `destroy --force` archives
+        // first). No other source names the raw removals. Zero tolerance.
+        id: "gate-41",
+        task: "T14276",
+        script: "scripts/lint-no-raw-worktree-removal.mjs",
+        description: "No raw worktree removal outside the disposeWorktree engine"
+      },
+      {
+        // T14299: every refusal on the close, cancel, verify, done, review and
+        // docs-link paths carries a fix that runs against the CLI manifest.
+        // Pinned per file, may only fall; no --baseline mode.
+        id: "gate-42",
+        task: "T14299",
+        script: "scripts/lint-refusal-fixes.mjs",
+        description: "Every refusal on the closure paths carries a runnable fix"
       }
     ];
     const scriptArgs = strict ? ["--strict"] : ["--check"];
@@ -921,4 +939,4 @@ var checkCommand = defineCommand({
 export {
   checkCommand
 };
-//# sourceMappingURL=check-GJIZJQON.js.map
+//# sourceMappingURL=check-X7CKPTJD.js.map

package/dist/cli/{chunk-TVNXFYOJ.js → chunk-7L47UQJ6.js}

@@ -29,12 +29,12 @@ import {
 var doctorGlobalDeliveryCommand = defineCommand({
   meta: {
     name: "global-delivery",
-    description: "Check that ~/.cleo, the global hub reference and every harness CLEO skill install resolve. Read-only; --repair relinks them with a receipt (--dry-run to preview)."
+    description: "Check that ~/.cleo, the global hub reference and every harness CLEO skill install resolve, and that every managed instruction block hashes to the current template. Read-only; --repair relinks them and refreshes only stale managed blocks, with a receipt (--dry-run to preview)."
   },
   args: {
     repair: {
       type: "boolean",
-      description: "Relink ~/.cleo to the OS data dir and every dangling or ~/.cleo-routed skill entry to the physical skills dir (verified symlink, else copy). Appends a receipt."
+      description: "Relink ~/.cleo to the OS data dir and every dangling or ~/.cleo-routed skill entry to the physical skills dir (verified symlink, else copy), and rewrite only the stale CAAMP block of each provider instruction file. Appends a receipt."
     },
     "dry-run": {
       type: "boolean",
@@ -80,4 +80,4 @@ var doctorGlobalDeliveryCommand = defineCommand({
 export {
   doctorGlobalDeliveryCommand
 };
-//# sourceMappingURL=chunk-TVNXFYOJ.js.map
+//# sourceMappingURL=chunk-7L47UQJ6.js.map

package/dist/cli/{chunk-FMEF3JU7.js → chunk-A35TN6R2.js}

@@ -20,7 +20,7 @@ import {
   dispatchRaw,
   handleRawError,
   maybeEmitDescribe
-} from "./chunk-QPROUKS6.js";
+} from "./chunk-YOZKQEGA.js";
 import {
   defineCommand
 } from "./chunk-IVN46UST.js";
@@ -157,4 +157,4 @@ export {
   completeDispatchParams,
   completeCommand
 };
-//# sourceMappingURL=chunk-FMEF3JU7.js.map
+//# sourceMappingURL=chunk-A35TN6R2.js.map

package/dist/cli/{chunk-MLUCI3JC.js → chunk-CZ2VQUXN.js}

@@ -22,6 +22,7 @@ import {
 
 // packages/cleo/src/cli/commands/doctor-credentials.ts
 import { join } from "node:path";
+import { auditGlobalConfigModes } from "@cleocode/core/llm/global-config-migration.js";
 import { getCleoHome, getProjectRoot } from "@cleocode/core/paths.js";
 import {
   auditAgentRegistryKeys,
@@ -30,12 +31,12 @@ import {
 var doctorCredentialsCommand = defineCommand({
   meta: {
     name: "credentials",
-    description: "Report project credentials still encrypted under the legacy path-bound key (moving the project would strand them) and agent registry keys that are not recoverable. --fix re-keys project credentials to the project's identity in place and flags unrecoverable agent keys requires_reauth. Idempotent; never deletes. Unrecoverable credentials are listed with their re-entry command."
+    description: "Report project credentials still encrypted under the legacy path-bound key (moving the project would strand them), agent registry keys that are not recoverable, and a global config.json that group or others can read (it can hold provider keys). --fix re-keys project credentials to the project's identity in place, flags unrecoverable agent keys requires_reauth, and tightens the global config to 0600. Idempotent; never deletes. Unrecoverable credentials are listed with their re-entry command."
   },
   args: {
     fix: {
       type: "boolean",
-      description: "Re-key path-bound credentials in place (default: report only)."
+      description: "Re-key path-bound credentials in place and chmod an exposed global config.json to 0600 (default: report only)."
     },
     json: { type: "boolean", description: "Output as JSON" },
     human: { type: "boolean", description: "Force human-readable output" },
@@ -45,6 +46,7 @@ var doctorCredentialsCommand = defineCommand({
     const dryRun = args.fix !== true;
     const result = await migrateProjectCredentialsAtRoot(getProjectRoot(), { dryRun });
     const agents = await auditAgentRegistryKeys(join(getCleoHome(), "cleo.db"), { dryRun });
+    const globalConfig = auditGlobalConfigModes({ fix: !dryRun });
     cliOutput(
       {
         projectDbPath: result.projectDbPath,
@@ -58,11 +60,18 @@ var doctorCredentialsCommand = defineCommand({
           current: agents.current,
           requiresReentry: agents.reentry,
           flaggedRequiresReauth: agents.flagged
-        }
+        },
+        globalConfig: globalConfig.map((f) => ({
+          path: f.path,
+          mode: `0${f.mode.toString(8)}`,
+          readableByOthers: f.exposed,
+          fixed: f.fixed
+        }))
       },
       { command: "doctor", operation: "doctor.credentials.run" }
     );
-    const pending = result.dryRun && result.migrated.length > 0;
+    const exposedConfig = globalConfig.some((f) => f.exposed && !f.fixed);
+    const pending = result.dryRun && result.migrated.length > 0 || exposedConfig;
     const unrecoverable = result.reentry.length + agents.reentry.length;
     if ((pending || unrecoverable > 0) && (process.exitCode ?? 0) === 0) {
       process.exitCode = 1;
@@ -73,4 +82,4 @@ var doctorCredentialsCommand = defineCommand({
 export {
   doctorCredentialsCommand
 };
-//# sourceMappingURL=chunk-MLUCI3JC.js.map
+//# sourceMappingURL=chunk-CZ2VQUXN.js.map

package/dist/cli/{chunk-6WPQM7YS.js → chunk-QL3A56SV.js}

@@ -17,34 +17,34 @@
 // packages/cleo/src/dispatch/domains/lazy.ts
 import { OPERATIONS } from "@cleocode/contracts/dispatch/operations-registry.js";
 var DOMAIN_LOADERS = [
-  ["tasks", async () => new (await import("./tasks-6BTDR547.js")).TasksHandler()],
-  ["session", async () => new (await import("./session-A24655SW.js")).SessionHandler()],
+  ["tasks", async () => new (await import("./tasks-MDCK5T4C.js")).TasksHandler()],
+  ["session", async () => new (await import("./session-M6XJCWKY.js")).SessionHandler()],
   ["attention", async () => new (await import("./attention-BVRGUJJQ.js")).AttentionHandler()],
-  ["memory", async () => new (await import("./memory-ULDZHGNY.js")).MemoryHandler()],
+  ["memory", async () => new (await import("./memory-COC4SHLE.js")).MemoryHandler()],
   ["intelligence", async () => new (await import("./intelligence-SEARRRBF.js")).IntelligenceHandler()],
-  ["check", async () => new (await import("./check-NFBULBE5.js")).CheckHandler()],
-  ["pipeline", async () => new (await import("./pipeline-VZSLFYVK.js")).PipelineHandler()],
-  ["orchestrate", async () => new (await import("./orchestrate-T44CHZ37.js")).OrchestrateHandler()],
+  ["check", async () => new (await import("./check-WLBL76VA.js")).CheckHandler()],
+  ["pipeline", async () => new (await import("./pipeline-C7HZA3SK.js")).PipelineHandler()],
+  ["orchestrate", async () => new (await import("./orchestrate-37G7JSMX.js")).OrchestrateHandler()],
   ["tools", async () => new (await import("./tools-UM3OZKEH.js")).ToolsHandler()],
-  ["admin", async () => new (await import("./admin-22CR6TJQ.js")).AdminHandler()],
-  ["nexus", async () => new (await import("./nexus-HQTVW5QU.js")).NexusHandler()],
+  ["admin", async () => new (await import("./admin-LIQHGIOG.js")).AdminHandler()],
+  ["nexus", async () => new (await import("./nexus-UB5LHSKQ.js")).NexusHandler()],
   ["sticky", async () => new (await import("./sticky-EKL5FD2D.js")).StickyHandler()],
   ["diagnostics", async () => new (await import("./diagnostics-BT3HGJPT.js")).DiagnosticsHandler()],
-  ["docs", async () => new (await import("./docs-AJ5QSOG7.js")).DocsHandler()],
+  ["docs", async () => new (await import("./docs-ZST5BT6G.js")).DocsHandler()],
   ["focus", async () => new (await import("./focus-H5CBCFFV.js")).FocusHandler()],
   ["playbook", async () => new (await import("./playbook-YPGSNILZ.js")).PlaybookHandler()],
   ["conduit", async () => new (await import("./conduit-STEBYJTU.js")).ConduitHandler()],
   ["sentient", async () => new (await import("./sentient-Z7W7WO74.js")).SentientHandler()],
-  ["release", async () => new (await import("./release-HPEGXNXU.js")).ReleaseHandler()],
+  ["release", async () => new (await import("./release-EI72GMAM.js")).ReleaseHandler()],
   ["provenance", async () => new (await import("./provenance-3YCF7G7L.js")).ProvenanceHandler()],
-  ["selfimprove", async () => new (await import("./selfimprove-H3Y6URQY.js")).SelfimproveHandler()],
+  ["selfimprove", async () => new (await import("./selfimprove-OEIKYOPU.js")).SelfimproveHandler()],
   ["service", async () => new (await import("./service-5SQKAABN.js")).ServiceHandler()],
   ["llm", async () => new (await import("./llm-YVC5HL7D.js")).LlmHandler()],
   ["account", async () => new (await import("./entities-JYA4L2OV.js")).AccountHandler()],
   ["provider", async () => new (await import("./entities-JYA4L2OV.js")).ProviderHandler()],
   ["model", async () => new (await import("./entities-JYA4L2OV.js")).ModelHandler()],
   ["profile", async () => new (await import("./entities-JYA4L2OV.js")).ProfileHandler()],
-  ["worktree", async () => new (await import("./worktree-2UEPNBJC.js")).WorktreeHandler()],
+  ["worktree", async () => new (await import("./worktree-3B5JR6N7.js")).WorktreeHandler()],
   ["upgrade", async () => new (await import("./upgrade-27CBXUXH.js")).UpgradeHandler()]
 ];
 var LazyDomainHandler = class {
@@ -97,4 +97,4 @@ export {
   createLazyDomainHandlers,
   lazyOperation
 };
-//# sourceMappingURL=chunk-6WPQM7YS.js.map
+//# sourceMappingURL=chunk-QL3A56SV.js.map