@cleocode/cleo 2026.4.161 → 2026.5.0

package/dist/cli/commands/revert.d.ts

@@ -0,0 +1,79 @@
+/**
+ * CLI command: `cleo revert` — Owner kill-switch revert walker.
+ *
+ * Walks the sentient audit chain from `--from <receiptId>` and squash-reverts
+ * all sentient merge commits back to that point. Requires an owner-signed
+ * attestation to proceed. After revert, sets the global pause flag
+ * (`pausedByRevert = true`) so all Tier 1/2/3 agents refuse to spawn until
+ * the owner runs `cleo sentient resume` with a valid attestation.
+ *
+ * ## Owner attestation
+ *
+ * The owner attestation must be a JSON object matching {@link OwnerRevertAttestation}
+ * provided via one of:
+ * - `--attestation-file <path>` — path to a JSON file on disk
+ * - `CLEO_OWNER_ATTESTATION` env var — JSON string
+ *
+ * ## One-time signing flow
+ *
+ * 1. Generate an Ed25519 keypair (owner key — NOT the daemon signing key).
+ * 2. Register the pubkey in `.cleo/owner-pubkeys.json` (hex-encoded, 64 chars).
+ * 3. Before issuing a revert, create the attestation payload:
+ *    ```json
+ *    {
+ *      "afterRevertReceiptId": "<receiptId>",
+ *      "issuedAt": "<ISO-8601 UTC>",
+ *      "ownerPubkey": "<hex-64>",
+ *      "sig": "<ed25519-sig-over-canonical-json-minus-sig>"
+ *    }
+ *    ```
+ * 4. Save to `.cleo/owner-attestations/<nonce>.sig` and pass via `--attestation-file`.
+ *
+ * ## Dry-run
+ *
+ * `--dry-run` prints the commits that would be reverted without executing
+ * any git operations or writing any events.
+ *
+ * ## JSON output
+ *
+ * `--json` wraps the result in a LAFS success envelope:
+ * `{ "success": true, "data": { "revertCommitSha", "revertedRange", "eventsReverted" } }`
+ *
+ * @task T1039
+ * @see packages/core/src/sentient/revert-walker.ts
+ * @see packages/core/src/sentient/revert-executor.ts
+ * @see packages/core/src/sentient/state.ts (pauseAllTiers / resumeAfterRevert)
+ */
+/**
+ * `cleo revert --from <receiptId>` — Owner kill-switch revert walker.
+ *
+ * Walks the sentient audit chain from a receipt ID and squash-reverts all
+ * sentient merge commits. Requires owner attestation. Sets global pause flag.
+ */
+export declare const revertCommand: import("citty").CommandDef<{
+    readonly from: {
+        readonly type: "string";
+        readonly description: "Receipt ID to revert from (inclusive)";
+    };
+    readonly 'attestation-file': {
+        readonly type: "string";
+        readonly description: "Path to owner attestation JSON file (alternatively set CLEO_OWNER_ATTESTATION env var)";
+    };
+    readonly 'include-human': {
+        readonly type: "boolean";
+        readonly description: "Allow reverting commits not authored by the sentient agent";
+    };
+    readonly 'dry-run': {
+        readonly type: "boolean";
+        readonly description: "Print commits that would be reverted without executing";
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Emit LAFS JSON envelope";
+    };
+    readonly project: {
+        readonly type: "string";
+        readonly description: "Project root (defaults to process cwd)";
+    };
+}>;
+//# sourceMappingURL=revert.d.ts.map

package/dist/cli/commands/revert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revert.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/revert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAsIH;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;EAyKxB,CAAC"}

package/dist/cli/commands/revert.js

@@ -0,0 +1,300 @@
+/**
+ * CLI command: `cleo revert` — Owner kill-switch revert walker.
+ *
+ * Walks the sentient audit chain from `--from <receiptId>` and squash-reverts
+ * all sentient merge commits back to that point. Requires an owner-signed
+ * attestation to proceed. After revert, sets the global pause flag
+ * (`pausedByRevert = true`) so all Tier 1/2/3 agents refuse to spawn until
+ * the owner runs `cleo sentient resume` with a valid attestation.
+ *
+ * ## Owner attestation
+ *
+ * The owner attestation must be a JSON object matching {@link OwnerRevertAttestation}
+ * provided via one of:
+ * - `--attestation-file <path>` — path to a JSON file on disk
+ * - `CLEO_OWNER_ATTESTATION` env var — JSON string
+ *
+ * ## One-time signing flow
+ *
+ * 1. Generate an Ed25519 keypair (owner key — NOT the daemon signing key).
+ * 2. Register the pubkey in `.cleo/owner-pubkeys.json` (hex-encoded, 64 chars).
+ * 3. Before issuing a revert, create the attestation payload:
+ *    ```json
+ *    {
+ *      "afterRevertReceiptId": "<receiptId>",
+ *      "issuedAt": "<ISO-8601 UTC>",
+ *      "ownerPubkey": "<hex-64>",
+ *      "sig": "<ed25519-sig-over-canonical-json-minus-sig>"
+ *    }
+ *    ```
+ * 4. Save to `.cleo/owner-attestations/<nonce>.sig` and pass via `--attestation-file`.
+ *
+ * ## Dry-run
+ *
+ * `--dry-run` prints the commits that would be reverted without executing
+ * any git operations or writing any events.
+ *
+ * ## JSON output
+ *
+ * `--json` wraps the result in a LAFS success envelope:
+ * `{ "success": true, "data": { "revertCommitSha", "revertedRange", "eventsReverted" } }`
+ *
+ * @task T1039
+ * @see packages/core/src/sentient/revert-walker.ts
+ * @see packages/core/src/sentient/revert-executor.ts
+ * @see packages/core/src/sentient/state.ts (pauseAllTiers / resumeAfterRevert)
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { cwd as processCwd } from 'node:process';
+import { E_RECEIPT_NOT_FOUND } from '@cleocode/core/sentient/chain-walker.js';
+import { SENTIENT_STATE_FILE } from '@cleocode/core/sentient/daemon.js';
+import { loadSigningIdentity } from '@cleocode/core/sentient/kms.js';
+import { executeSquashedRevert } from '@cleocode/core/sentient/revert-executor.js';
+import { collectMergeCommits } from '@cleocode/core/sentient/revert-walker.js';
+import { E_OWNER_ATTESTATION_REQUIRED, readSentientState, } from '@cleocode/core/sentient/state.js';
+import { defineCommand } from 'citty';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Path to the owner pubkeys allowlist (relative to projectRoot). */
+const OWNER_PUBKEYS_FILE = '.cleo/owner-pubkeys.json';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Resolve the project root from an arg or fall back to cwd. */
+function resolveProjectRoot(arg) {
+    return arg && arg.length > 0 ? arg : processCwd();
+}
+/** Emit a LAFS-shaped success envelope as JSON or human text. */
+function emitSuccess(payload, jsonMode, humanLine) {
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify({ success: true, data: payload })}\n`);
+    }
+    else {
+        process.stdout.write(`${humanLine}\n`);
+    }
+}
+/** Emit a LAFS-shaped failure envelope and exit 1. */
+function emitFailure(code, message, jsonMode) {
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify({ success: false, error: { code, message } })}\n`);
+    }
+    else {
+        process.stderr.write(`Error [${code}]: ${message}\n`);
+    }
+    process.exit(1);
+}
+/**
+ * Load the owner attestation from `--attestation-file` or
+ * `CLEO_OWNER_ATTESTATION` environment variable.
+ *
+ * @throws If neither is provided or the JSON is malformed.
+ */
+async function loadOwnerAttestation(attestationFilePath) {
+    let raw;
+    if (attestationFilePath) {
+        try {
+            raw = await readFile(attestationFilePath, 'utf-8');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`Failed to read attestation file "${attestationFilePath}": ${message}`);
+        }
+    }
+    else if (process.env['CLEO_OWNER_ATTESTATION']) {
+        raw = process.env['CLEO_OWNER_ATTESTATION'];
+    }
+    if (!raw) {
+        throw new Error('Owner attestation is required. Provide one of:\n' +
+            '  --attestation-file <path>   path to a JSON attestation file\n' +
+            '  CLEO_OWNER_ATTESTATION      JSON string in environment variable\n\n' +
+            'Attestation format:\n' +
+            '  { "afterRevertReceiptId": "<receiptId>",\n' +
+            '    "issuedAt": "<ISO-8601>",\n' +
+            '    "ownerPubkey": "<hex-64>",\n' +
+            '    "sig": "<ed25519-hex-128>" }');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('Owner attestation is not valid JSON');
+    }
+    const obj = parsed;
+    if (typeof obj['afterRevertReceiptId'] !== 'string' ||
+        typeof obj['issuedAt'] !== 'string' ||
+        typeof obj['ownerPubkey'] !== 'string' ||
+        typeof obj['sig'] !== 'string') {
+        throw new Error('Owner attestation is missing required fields: ' +
+            'afterRevertReceiptId, issuedAt, ownerPubkey, sig');
+    }
+    return obj;
+}
+/**
+ * Load the owner pubkeys allowlist from `.cleo/owner-pubkeys.json`.
+ *
+ * Returns an empty set if the file does not exist (fails open for
+ * dev environments; callers check the set is non-empty).
+ */
+async function loadOwnerPubkeys(projectRoot) {
+    const path = join(projectRoot, OWNER_PUBKEYS_FILE);
+    try {
+        const raw = await readFile(path, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return new Set(parsed.filter((k) => typeof k === 'string'));
+        }
+        return new Set();
+    }
+    catch {
+        return new Set();
+    }
+}
+// ---------------------------------------------------------------------------
+// Command definition
+// ---------------------------------------------------------------------------
+/**
+ * `cleo revert --from <receiptId>` — Owner kill-switch revert walker.
+ *
+ * Walks the sentient audit chain from a receipt ID and squash-reverts all
+ * sentient merge commits. Requires owner attestation. Sets global pause flag.
+ */
+export const revertCommand = defineCommand({
+    meta: {
+        name: 'revert',
+        description: 'Owner kill-switch: squash-revert all sentient merge commits from a receipt ID',
+    },
+    args: {
+        from: {
+            type: 'string',
+            description: 'Receipt ID to revert from (inclusive)',
+        },
+        'attestation-file': {
+            type: 'string',
+            description: 'Path to owner attestation JSON file (alternatively set CLEO_OWNER_ATTESTATION env var)',
+        },
+        'include-human': {
+            type: 'boolean',
+            description: 'Allow reverting commits not authored by the sentient agent',
+        },
+        'dry-run': {
+            type: 'boolean',
+            description: 'Print commits that would be reverted without executing',
+        },
+        json: {
+            type: 'boolean',
+            description: 'Emit LAFS JSON envelope',
+        },
+        project: {
+            type: 'string',
+            description: 'Project root (defaults to process cwd)',
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const dryRun = args['dry-run'] === true;
+        const includeHuman = args['include-human'] === true;
+        const fromReceiptId = args.from;
+        const attestationFile = args['attestation-file'];
+        // --from is required.
+        if (!fromReceiptId) {
+            emitFailure('E_MISSING_FLAG', '--from <receiptId> is required. Usage: cleo revert --from <receiptId>', jsonMode);
+        }
+        // Load owner attestation (not needed for dry-run — we skip auth check).
+        let attestation;
+        if (!dryRun) {
+            try {
+                attestation = await loadOwnerAttestation(attestationFile);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                emitFailure(E_OWNER_ATTESTATION_REQUIRED, message, jsonMode);
+            }
+        }
+        // Validate the attestation matches the requested receiptId.
+        if (attestation && attestation.afterRevertReceiptId !== fromReceiptId) {
+            emitFailure(E_OWNER_ATTESTATION_REQUIRED, `attestation.afterRevertReceiptId "${attestation.afterRevertReceiptId}" ` +
+                `does not match --from "${fromReceiptId}"`, jsonMode);
+        }
+        // Load owner pubkeys allowlist.
+        const allowedPubkeys = await loadOwnerPubkeys(projectRoot);
+        // Validate attestation pubkey is on allowlist (unless allowlist is empty = dev mode).
+        if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
+            emitFailure(E_OWNER_ATTESTATION_REQUIRED, `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist ` +
+                `at ${join(projectRoot, OWNER_PUBKEYS_FILE)}`, jsonMode);
+        }
+        // Walk the chain.
+        let commits;
+        let mergeEvents;
+        try {
+            const result = await collectMergeCommits(projectRoot, fromReceiptId);
+            commits = result.commits;
+            mergeEvents = result.events;
+        }
+        catch (err) {
+            const errCode = err.code === E_RECEIPT_NOT_FOUND
+                ? E_RECEIPT_NOT_FOUND
+                : 'E_CHAIN_WALK_FAILED';
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure(errCode, message, jsonMode);
+        }
+        if (commits.length === 0) {
+            emitSuccess({
+                receiptId: fromReceiptId,
+                commits: [],
+                message: 'No merge commits found starting from this receipt — nothing to revert',
+            }, jsonMode, `No merge commits found starting from receipt ${fromReceiptId}. Nothing to revert.`);
+            return;
+        }
+        // Dry-run: print and exit.
+        if (dryRun) {
+            const lines = commits.map((sha, i) => `  [${i + 1}] ${sha}`).join('\n');
+            emitSuccess({ dryRun: true, fromReceiptId, commits, count: commits.length }, jsonMode, `Dry-run: would revert ${commits.length} commit(s) from ${fromReceiptId}:\n${lines}`);
+            return;
+        }
+        // Load signing identity for the revert event.
+        let identity;
+        try {
+            identity = await loadSigningIdentity(projectRoot);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_KMS_LOAD', message, jsonMode);
+        }
+        // Execute the squashed revert.
+        try {
+            const result = await executeSquashedRevert({
+                cleoRoot: projectRoot,
+                commits,
+                mergeEvents,
+                fromReceiptId,
+                identity,
+                includeHuman,
+            });
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const state = await readSentientState(statePath);
+            emitSuccess({
+                revertCommitSha: result.revertCommitSha,
+                revertedRange: result.revertedRange,
+                eventsReverted: mergeEvents.length,
+                revertEventReceiptId: result.revertEventReceiptId,
+                humanCommitPresent: result.humanCommitPresent,
+                globalPauseSet: true,
+                pausedByRevert: state.pausedByRevert,
+            }, jsonMode, `Revert complete.\n` +
+                `  Reverted: ${result.revertedRange.length} commit(s)\n` +
+                `  Squash commit: ${result.revertCommitSha}\n` +
+                `  Revert event: ${result.revertEventReceiptId}\n` +
+                `  Global pause: ACTIVE (run 'cleo sentient resume' with owner attestation to clear)`);
+        }
+        catch (err) {
+            const errCode = err.code ?? 'E_REVERT_FAILED';
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure(errCode, message, jsonMode);
+        }
+    },
+});
+//# sourceMappingURL=revert.js.map

package/dist/cli/commands/revert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revert.js","sourceRoot":"","sources":["../../../src/cli/commands/revert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAE5B,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAEtC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,GAAuB;IACjD,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,OAAgB,EAAE,QAAiB,EAAE,SAAiB;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe,EAAE,QAAiB;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,OAAO,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,mBAAuC;IAEvC,IAAI,GAAuB,CAAC;IAE5B,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,oCAAoC,mBAAmB,MAAM,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACjD,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,iEAAiE;YACjE,uEAAuE;YACvE,uBAAuB;YACvB,8CAA8C;YAC9C,iCAAiC;YACjC,kCAAkC;YAClC,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IACE,OAAO,GAAG,CAAC,sBAAsB,CAAC,KAAK,QAAQ;QAC/C,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;QACnC,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ;QACtC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,OAAO,GAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;IACzC,IAAI,EAAE;QACJ,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+EAA+E;KAC7F;IACD,IAAI,EAAE;QACJ,IAAI,EAAE;YACJ,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,uCAAuC;SACrD;QACD,kBAAkB,EAAE;YAClB,IAAI,EAAE,QAAiB;YACvB,WAAW,EACT,wFAAwF;SAC3F;QACD,eAAe,EAAE;YACf,IAAI,EAAE,SAAkB;YACxB,WAAW,EAAE,4DAA4D;SAC1E;QACD,SAAS,EAAE;YACT,IAAI,EAAE,SAAkB;YACxB,WAAW,EAAE,wDAAwD;SACtE;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,SAAkB;YACxB,WAAW,EAAE,yBAAyB;SACvC;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAiB;YACvB,WAAW,EAAE,wCAAwC;SACtD;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAA6B,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,CAAC;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,IAA0B,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAuB,CAAC;QAEvE,sBAAsB;QACtB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,WAAW,CACT,gBAAgB,EAChB,uEAAuE,EACvE,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,IAAI,WAA+C,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,WAAW,CAAC,4BAA4B,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,WAAW,IAAI,WAAW,CAAC,oBAAoB,KAAK,aAAa,EAAE,CAAC;YACtE,WAAW,CACT,4BAA4B,EAC5B,qCAAqC,WAAW,CAAC,oBAAoB,IAAI;gBACvE,0BAA0B,aAAa,GAAG,EAC5C,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAE3D,sFAAsF;QACtF,IAAI,WAAW,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3F,WAAW,CACT,4BAA4B,EAC5B,uBAAuB,WAAW,CAAC,WAAW,kCAAkC;gBAC9E,MAAM,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,EAC/C,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,OAAiB,CAAC;QACtB,IAAI,WAAsE,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACrE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACV,GAA6B,CAAC,IAAI,KAAK,mBAAmB;gBACzD,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,qBAAqB,CAAC;YAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,WAAW,CACT;gBACE,SAAS,EAAE,aAAa;gBACxB,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,uEAAuE;aACjF,EACD,QAAQ,EACR,gDAAgD,aAAa,sBAAsB,CACpF,CAAC;YACF,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,WAAW,CACT,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAC/D,QAAQ,EACR,yBAAyB,OAAO,CAAC,MAAM,mBAAmB,aAAa,MAAM,KAAK,EAAE,CACrF,CAAC;YACF,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,QAAQ,EAAE,WAAW;gBACrB,OAAO;gBACP,WAAW;gBACX,aAAa;gBACb,QAAQ;gBACR,YAAY;aACb,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAEjD,WAAW,CACT;gBACE,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,cAAc,EAAE,WAAW,CAAC,MAAM;gBAClC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,EACD,QAAQ,EACR,oBAAoB;gBAClB,eAAe,MAAM,CAAC,aAAa,CAAC,MAAM,cAAc;gBACxD,oBAAoB,MAAM,CAAC,eAAe,IAAI;gBAC9C,mBAAmB,MAAM,CAAC,oBAAoB,IAAI;gBAClD,qFAAqF,CACxF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAI,GAA6B,CAAC,IAAI,IAAI,iBAAiB,CAAC;YACzE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/commands/roadmap.d.ts

@@ -0,0 +1,29 @@
+/**
+ * CLI roadmap command — roadmap generation from pending epics and changelog.
+ *
+ * Dispatches to `admin.roadmap` in the system engine, which calls
+ * `getRoadmap()` from core. Not wired via registry at CLI layer because
+ * roadmap is a pure query with no session dependency — calling core
+ * through the dispatch layer (admin.roadmap) is the correct pattern.
+ *
+ * @task T4538
+ * @epic T4454
+ */
+/**
+ * Native citty command for `cleo roadmap` — generates a project roadmap
+ * from task provenance with epics grouped by status and progress.
+ *
+ * @task T4538
+ * @epic T487
+ */
+export declare const roadmapCommand: import("citty").CommandDef<{
+    readonly 'include-history': {
+        readonly type: "boolean";
+        readonly description: "Include release history from CHANGELOG.md";
+    };
+    readonly 'upcoming-only': {
+        readonly type: "boolean";
+        readonly description: "Only show pending/upcoming epics (exclude completed)";
+    };
+}>;
+//# sourceMappingURL=roadmap.d.ts.map

package/dist/cli/commands/roadmap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roadmap.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/roadmap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;;EA4BzB,CAAC"}

package/dist/cli/commands/roadmap.js

@@ -0,0 +1,43 @@
+/**
+ * CLI roadmap command — roadmap generation from pending epics and changelog.
+ *
+ * Dispatches to `admin.roadmap` in the system engine, which calls
+ * `getRoadmap()` from core. Not wired via registry at CLI layer because
+ * roadmap is a pure query with no session dependency — calling core
+ * through the dispatch layer (admin.roadmap) is the correct pattern.
+ *
+ * @task T4538
+ * @epic T4454
+ */
+import { defineCommand } from 'citty';
+import { dispatchFromCli } from '../../dispatch/adapters/cli.js';
+/**
+ * Native citty command for `cleo roadmap` — generates a project roadmap
+ * from task provenance with epics grouped by status and progress.
+ *
+ * @task T4538
+ * @epic T487
+ */
+export const roadmapCommand = defineCommand({
+    meta: {
+        name: 'roadmap',
+        description: 'Generate project roadmap from task provenance — epics grouped by status with progress',
+    },
+    args: {
+        'include-history': {
+            type: 'boolean',
+            description: 'Include release history from CHANGELOG.md',
+        },
+        'upcoming-only': {
+            type: 'boolean',
+            description: 'Only show pending/upcoming epics (exclude completed)',
+        },
+    },
+    async run({ args }) {
+        await dispatchFromCli('query', 'admin', 'roadmap', {
+            includeHistory: args['include-history'],
+            upcomingOnly: args['upcoming-only'],
+        }, { command: 'roadmap', operation: 'admin.roadmap' });
+    },
+});
+//# sourceMappingURL=roadmap.js.map

package/dist/cli/commands/roadmap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roadmap.js","sourceRoot":"","sources":["../../../src/cli/commands/roadmap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;IAC1C,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,WAAW,EACT,uFAAuF;KAC1F;IACD,IAAI,EAAE;QACJ,iBAAiB,EAAE;YACjB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,2CAA2C;SACzD;QACD,eAAe,EAAE;YACf,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,sDAAsD;SACpE;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,eAAe,CACnB,OAAO,EACP,OAAO,EACP,SAAS,EACT;YACE,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;SACpC,EACD,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,CACnD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/commands/safestop.d.ts

@@ -0,0 +1,41 @@
+/**
+ * CLI safestop command - graceful shutdown for agents approaching context limits.
+ * Ported from scripts/safestop.sh
+ *
+ * @task T4551
+ * @epic T4545
+ * @task T4904
+ */
+/**
+ * cleo safestop — graceful shutdown for agents approaching context limits.
+ *
+ * Saves session state, optionally commits pending changes, and ends the
+ * current session with a handoff note.
+ */
+export declare const safestopCommand: import("citty").CommandDef<{
+    readonly reason: {
+        readonly type: "string";
+        readonly description: "Reason for stopping";
+        readonly required: false;
+    };
+    readonly commit: {
+        readonly type: "boolean";
+        readonly description: "Commit pending git changes with WIP message";
+        readonly default: false;
+    };
+    readonly handoff: {
+        readonly type: "string";
+        readonly description: "Generate handoff document (use - for stdout)";
+    };
+    readonly 'no-session-end': {
+        readonly type: "boolean";
+        readonly description: "Update notes but do not end session";
+        readonly default: false;
+    };
+    readonly 'dry-run': {
+        readonly type: "boolean";
+        readonly description: "Show actions without executing";
+        readonly default: false;
+    };
+}>;
+//# sourceMappingURL=safestop.d.ts.map

package/dist/cli/commands/safestop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safestop.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/safestop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;EAkD1B,CAAC"}

package/dist/cli/commands/safestop.js

@@ -0,0 +1,62 @@
+/**
+ * CLI safestop command - graceful shutdown for agents approaching context limits.
+ * Ported from scripts/safestop.sh
+ *
+ * @task T4551
+ * @epic T4545
+ * @task T4904
+ */
+import { defineCommand, showUsage } from 'citty';
+import { dispatchFromCli } from '../../dispatch/adapters/cli.js';
+/**
+ * cleo safestop — graceful shutdown for agents approaching context limits.
+ *
+ * Saves session state, optionally commits pending changes, and ends the
+ * current session with a handoff note.
+ */
+export const safestopCommand = defineCommand({
+    meta: {
+        name: 'safestop',
+        description: 'Graceful shutdown for agents approaching context limits',
+    },
+    args: {
+        reason: {
+            type: 'string',
+            description: 'Reason for stopping',
+            required: false,
+        },
+        commit: {
+            type: 'boolean',
+            description: 'Commit pending git changes with WIP message',
+            default: false,
+        },
+        handoff: {
+            type: 'string',
+            description: 'Generate handoff document (use - for stdout)',
+        },
+        'no-session-end': {
+            type: 'boolean',
+            description: 'Update notes but do not end session',
+            default: false,
+        },
+        'dry-run': {
+            type: 'boolean',
+            description: 'Show actions without executing',
+            default: false,
+        },
+    },
+    async run({ args, cmd }) {
+        if (!args.reason) {
+            await showUsage(cmd);
+            return;
+        }
+        await dispatchFromCli('mutate', 'admin', 'safestop', {
+            reason: args.reason,
+            commit: args.commit,
+            handoff: args.handoff,
+            noSessionEnd: args['no-session-end'],
+            dryRun: args['dry-run'],
+        }, { command: 'safestop', operation: 'admin.safestop' });
+    },
+});
+//# sourceMappingURL=safestop.js.map

package/dist/cli/commands/safestop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safestop.js","sourceRoot":"","sources":["../../../src/cli/commands/safestop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;IAC3C,IAAI,EAAE;QACJ,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,yDAAyD;KACvE;IACD,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,KAAK;SAChB;QACD,MAAM,EAAE;YACN,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE,KAAK;SACf;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,8CAA8C;SAC5D;QACD,gBAAgB,EAAE;YAChB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE,KAAK;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,KAAK;SACf;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,eAAe,CACnB,QAAQ,EACR,OAAO,EACP,UAAU,EACV;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAA6B;YAC3C,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACxB,EACD,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,EAAE,CACrD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/commands/schema.d.ts

@@ -0,0 +1,44 @@
+/**
+ * CLI `schema` command — operation introspection for agents.
+ *
+ * Allows agents to inspect the full parameter signature and declared precondition
+ * gates for any CLEO operation before calling it, replacing trial-and-error.
+ *
+ * Usage:
+ *   cleo schema <domain.operation>
+ *   cleo schema tasks.add
+ *   cleo schema tasks.add --format human
+ *   cleo schema tasks.add --include-examples
+ *
+ * @task T340
+ * @epic T335
+ */
+/**
+ * Native citty command for `cleo schema <operation>`.
+ *
+ * Does NOT dispatch through the main dispatcher — schema introspection is
+ * pure metadata over the registry and does not require a live session or DB.
+ */
+export declare const schemaCommand: import("citty").CommandDef<{
+    readonly operation: {
+        readonly type: "positional";
+        readonly description: "Operation key in domain.operation format (e.g. tasks.add)";
+        readonly required: false;
+    };
+    readonly format: {
+        readonly type: "string";
+        readonly description: "Output format: json (default) or human (pretty table)";
+        readonly default: "json";
+    };
+    readonly 'include-gates': {
+        readonly type: "boolean";
+        readonly description: "Include precondition gates in output (default: true)";
+        readonly default: true;
+    };
+    readonly 'include-examples': {
+        readonly type: "boolean";
+        readonly description: "Include usage examples in output (default: false)";
+        readonly default: false;
+    };
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/cli/commands/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyGH;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;EAmExB,CAAC"}