@cleocode/cleo 2026.4.161 → 2026.5.0

package/dist/cli/commands/sentient.js

@@ -0,0 +1,687 @@
+/**
+ * CLI command group: `cleo sentient` — Tier-1 and Tier-2 autonomous loop management.
+ *
+ * Subcommands:
+ *   cleo sentient start             — spawn detached daemon background process
+ *   cleo sentient stop              — flip killSwitch + send SIGTERM
+ *   cleo sentient status            — print pid / stats / killSwitch state
+ *   cleo sentient resume            — clear killSwitch (does NOT restart the process)
+ *   cleo sentient tick              — run a single tick in-process (for testing / owner verify)
+ *   cleo sentient propose list      — list all Tier-2 proposals (status='proposed')
+ *   cleo sentient propose accept    — accept a proposal (proposed → pending)
+ *   cleo sentient propose reject    — reject a proposal (proposed → cancelled)
+ *   cleo sentient propose diff      — show what a proposal would change (Tier-3 stub)
+ *   cleo sentient propose run       — manually trigger a propose tick in-process
+ *   cleo sentient propose enable    — enable Tier-2 proposal generation
+ *   cleo sentient propose disable   — disable Tier-2 proposal generation
+ *   cleo sentient baseline capture  — capture signed baseline event (Tier-3, pre-worktree)
+ *
+ * All subcommands emit LAFS-compliant envelopes when `--json` is set.
+ *
+ * Scoped OUT:
+ *   - `cleo sentient sandbox` (Tier-3 auto-merge — blocked on T992+T993+T995)
+ *
+ * @see packages/core/src/sentient/daemon.ts
+ * @see docs/sentient-loop.md
+ * @task T946
+ * @task T1008
+ * @task T1021
+ */
+import { join } from 'node:path';
+import { cwd as processCwd } from 'node:process';
+import { getSentientDaemonStatus, resumeSentientDaemon, SENTIENT_STATE_FILE, spawnSentientDaemon, stopSentientDaemon, } from '@cleocode/core/sentient/daemon.js';
+import { safeRunProposeTick } from '@cleocode/core/sentient/propose-tick.js';
+import { patchSentientState, readSentientState } from '@cleocode/core/sentient/state.js';
+import { safeRunTick } from '@cleocode/core/sentient/tick.js';
+import { defineCommand } from 'citty';
+import { isSubCommandDispatch } from '../lib/subcommand-guard.js';
+// ---------------------------------------------------------------------------
+// Shared arg spec
+// ---------------------------------------------------------------------------
+const projectArgs = {
+    project: {
+        type: 'string',
+        description: 'Project root (defaults to process cwd)',
+    },
+    json: {
+        type: 'boolean',
+        description: 'Emit LAFS JSON envelope',
+    },
+};
+/** Resolve the project root from the provided arg or fall back to cwd. */
+function resolveProjectRoot(arg) {
+    return arg && arg.length > 0 ? arg : processCwd();
+}
+/** Emit a LAFS-shaped success envelope as JSON or human text. */
+function emitSuccess(payload, jsonMode, humanLine) {
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify({ success: true, data: payload })}\n`);
+    }
+    else {
+        process.stdout.write(`${humanLine}\n`);
+    }
+}
+/** Emit a LAFS-shaped failure envelope. */
+function emitFailure(code, message, jsonMode) {
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify({ success: false, error: { code, message } })}\n`);
+    }
+    else {
+        process.stderr.write(`Error: ${message}\n`);
+    }
+    process.exit(1);
+}
+// ---------------------------------------------------------------------------
+// start
+// ---------------------------------------------------------------------------
+const startSub = defineCommand({
+    meta: {
+        name: 'start',
+        description: 'Spawn the sentient daemon as a detached background process',
+    },
+    args: {
+        ...projectArgs,
+        'dry-run': {
+            type: 'boolean',
+            description: 'Run a single in-process tick without spawning the daemon',
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const dryRun = args['dry-run'] === true;
+        try {
+            // Short-circuit if already running.
+            const existing = await getSentientDaemonStatus(projectRoot);
+            if (existing.running && existing.pid) {
+                emitSuccess({ running: true, pid: existing.pid, message: 'daemon already running' }, jsonMode, `Sentient daemon already running (pid ${existing.pid})`);
+                return;
+            }
+            if (dryRun) {
+                const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+                const outcome = await safeRunTick({ projectRoot, statePath, dryRun: true });
+                emitSuccess({ dryRun: true, outcome }, jsonMode, `Dry-run tick: ${outcome.kind} (task=${outcome.taskId ?? 'n/a'}) ${outcome.detail}`);
+                return;
+            }
+            const { pid, statePath, logPath } = await spawnSentientDaemon(projectRoot);
+            emitSuccess({ pid, statePath, logPath, message: 'sentient daemon started' }, jsonMode, `Sentient daemon started (pid ${pid})\nState: ${statePath}\nLogs:  ${logPath}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_START', message, jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// stop
+// ---------------------------------------------------------------------------
+const stopSub = defineCommand({
+    meta: {
+        name: 'stop',
+        description: 'Flip killSwitch=true and send SIGTERM to the daemon',
+    },
+    args: {
+        ...projectArgs,
+        reason: {
+            type: 'string',
+            description: 'Reason stored on sentient-state.json for diagnostics',
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const reason = args.reason ?? 'cleo sentient stop';
+        try {
+            const result = await stopSentientDaemon(projectRoot, reason);
+            emitSuccess(result, jsonMode, `Sentient stop: ${result.reason}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_STOP', message, jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// status
+// ---------------------------------------------------------------------------
+const statusSub = defineCommand({
+    meta: {
+        name: 'status',
+        description: 'Show daemon pid, stats, kill-switch state',
+    },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const status = await getSentientDaemonStatus(projectRoot);
+            if (jsonMode) {
+                process.stdout.write(`${JSON.stringify({ success: true, data: status })}\n`);
+                return;
+            }
+            process.stdout.write(`Daemon:       ${status.running ? `running (pid ${status.pid})` : 'stopped'}\n`);
+            process.stdout.write(`Started at:   ${status.startedAt ?? 'never'}\n`);
+            process.stdout.write(`Last tick:    ${status.lastTickAt ?? 'never'}\n`);
+            process.stdout.write(`Kill switch:  ${status.killSwitch ? 'ACTIVE' : 'inactive'}`);
+            if (status.killSwitchReason) {
+                process.stdout.write(` (${status.killSwitchReason})`);
+            }
+            process.stdout.write('\n');
+            process.stdout.write(`Active task:  ${status.activeTaskId ?? 'none'}\n`);
+            process.stdout.write(`Stuck tasks:  ${status.stuckCount}\n`);
+            process.stdout.write(`Stats:        picked=${status.stats.tasksPicked} ` +
+                `completed=${status.stats.tasksCompleted} ` +
+                `failed=${status.stats.tasksFailed} ` +
+                `ticks=${status.stats.ticksExecuted} ` +
+                `killed-ticks=${status.stats.ticksKilled}\n`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_STATUS', message, jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// resume
+// ---------------------------------------------------------------------------
+const resumeSub = defineCommand({
+    meta: {
+        name: 'resume',
+        description: 'Clear killSwitch so the cron schedule resumes execution',
+    },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const state = await resumeSentientDaemon(projectRoot);
+            emitSuccess({
+                killSwitch: state.killSwitch,
+                killSwitchReason: state.killSwitchReason,
+                message: 'killSwitch cleared',
+            }, jsonMode, 'Sentient kill-switch cleared. Daemon will resume ticks on next cron cadence.');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_RESUME', message, jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// tick
+// ---------------------------------------------------------------------------
+const tickSub = defineCommand({
+    meta: {
+        name: 'tick',
+        description: 'Run a single tick in-process (diagnostic / owner verify)',
+    },
+    args: {
+        ...projectArgs,
+        'dry-run': {
+            type: 'boolean',
+            description: 'Skip the actual worker spawn',
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const dryRun = args['dry-run'] === true;
+        try {
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
+            emitSuccess({ outcome, dryRun }, jsonMode, `Tick outcome: ${outcome.kind} (task=${outcome.taskId ?? 'n/a'}) ${outcome.detail}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_TICK', message, jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// propose subcommands (Tier-2 — T1008)
+// ---------------------------------------------------------------------------
+const proposeListSub = defineCommand({
+    meta: {
+        name: 'list',
+        description: 'List all Tier-2 proposals (status=proposed)',
+    },
+    args: {
+        ...projectArgs,
+        limit: { type: 'string', description: 'Maximum proposals to return (default 50)' },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const limit = args.limit ? Number.parseInt(args.limit, 10) : 50;
+        try {
+            const { Cleo } = await import('@cleocode/core/sdk');
+            const cleo = await Cleo.init(projectRoot);
+            const result = await cleo.dispatch?.('sentient', 'query', 'propose.list', { limit });
+            const data = result?.data ?? result;
+            emitSuccess(data, jsonMode, JSON.stringify(data, null, 2));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_PROPOSE_LIST', message, jsonMode);
+        }
+    },
+});
+const proposeAcceptSub = defineCommand({
+    meta: {
+        name: 'accept',
+        description: 'Accept a proposal — transition proposed → pending',
+    },
+    args: {
+        ...projectArgs,
+        id: { type: 'positional', description: 'Proposal task ID', required: true },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const id = args.id;
+        try {
+            const { getDb } = await import('@cleocode/core/internal');
+            const { tasks } = await import('@cleocode/core/store/tasks-schema');
+            const { and, eq, like } = await import('drizzle-orm');
+            const db = await getDb(projectRoot);
+            const now = new Date().toISOString();
+            const existing = await db
+                .select()
+                .from(tasks)
+                .where(and(eq(tasks.id, id), eq(tasks.status, 'proposed'), like(tasks.labelsJson, '%sentient-tier2%')))
+                .get();
+            if (!existing) {
+                emitFailure('E_NOT_FOUND', `Task ${id} is not a pending Tier-2 proposal`, jsonMode);
+                return;
+            }
+            await db
+                .update(tasks)
+                .set({ status: 'pending', updatedAt: now })
+                .where(eq(tasks.id, id))
+                .run();
+            // Update stats
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const state = await readSentientState(statePath);
+            await patchSentientState(statePath, {
+                tier2Stats: {
+                    ...state.tier2Stats,
+                    proposalsAccepted: state.tier2Stats.proposalsAccepted + 1,
+                },
+            });
+            emitSuccess({ id, status: 'pending', acceptedAt: now }, jsonMode, `Proposal ${id} accepted → pending`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_PROPOSE_ACCEPT', message, jsonMode);
+        }
+    },
+});
+const proposeRejectSub = defineCommand({
+    meta: {
+        name: 'reject',
+        description: 'Reject a proposal — transition proposed → cancelled',
+    },
+    args: {
+        ...projectArgs,
+        id: { type: 'positional', description: 'Proposal task ID', required: true },
+        reason: { type: 'string', description: 'Rejection reason' },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const id = args.id;
+        const reason = args.reason ?? 'rejected by owner';
+        try {
+            const { getDb } = await import('@cleocode/core/internal');
+            const { tasks } = await import('@cleocode/core/store/tasks-schema');
+            const { and, eq, like } = await import('drizzle-orm');
+            const db = await getDb(projectRoot);
+            const now = new Date().toISOString();
+            const existing = await db
+                .select()
+                .from(tasks)
+                .where(and(eq(tasks.id, id), eq(tasks.status, 'proposed'), like(tasks.labelsJson, '%sentient-tier2%')))
+                .get();
+            if (!existing) {
+                emitFailure('E_NOT_FOUND', `Task ${id} is not a pending Tier-2 proposal`, jsonMode);
+                return;
+            }
+            await db
+                .update(tasks)
+                .set({ status: 'cancelled', cancellationReason: reason, cancelledAt: now, updatedAt: now })
+                .where(eq(tasks.id, id))
+                .run();
+            // Update stats
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const state = await readSentientState(statePath);
+            await patchSentientState(statePath, {
+                tier2Stats: {
+                    ...state.tier2Stats,
+                    proposalsRejected: state.tier2Stats.proposalsRejected + 1,
+                },
+            });
+            emitSuccess({ id, status: 'cancelled', rejectedAt: now, reason }, jsonMode, `Proposal ${id} rejected → cancelled`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_PROPOSE_REJECT', message, jsonMode);
+        }
+    },
+});
+const proposeDiffSub = defineCommand({
+    meta: {
+        name: 'diff',
+        description: 'Show what a proposal would change (Tier-3 stub)',
+    },
+    args: {
+        ...projectArgs,
+        id: { type: 'positional', description: 'Proposal task ID', required: true },
+    },
+    async run({ args }) {
+        const jsonMode = args.json === true;
+        const id = args.id;
+        const msg = `Content diff is a Tier-3 feature (blocked on T992+T993+T995). ` +
+            `Proposal ${id} is a task-creation suggestion; no diff is available.`;
+        emitSuccess({ id, diff: null, message: msg }, jsonMode, msg);
+    },
+});
+const proposeRunSub = defineCommand({
+    meta: {
+        name: 'run',
+        description: 'Manually trigger a single propose tick in-process',
+    },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const outcome = await safeRunProposeTick({ projectRoot, statePath });
+            emitSuccess({ outcome }, jsonMode, `Propose tick: ${outcome.kind} (written=${outcome.written}, count=${outcome.count}) ${outcome.detail}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_PROPOSE_RUN', message, jsonMode);
+        }
+    },
+});
+const proposeEnableSub = defineCommand({
+    meta: { name: 'enable', description: 'Enable Tier-2 proposal generation' },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const updated = await patchSentientState(statePath, { tier2Enabled: true });
+            emitSuccess({ tier2Enabled: updated.tier2Enabled }, jsonMode, 'Tier-2 proposals enabled');
+        }
+        catch (err) {
+            emitFailure('E_SENTIENT_PROPOSE_ENABLE', err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+const proposeDisableSub = defineCommand({
+    meta: { name: 'disable', description: 'Disable Tier-2 proposal generation' },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const updated = await patchSentientState(statePath, { tier2Enabled: false });
+            emitSuccess({ tier2Enabled: updated.tier2Enabled }, jsonMode, 'Tier-2 proposals disabled');
+        }
+        catch (err) {
+            emitFailure('E_SENTIENT_PROPOSE_DISABLE', err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+/**
+ * `cleo sentient propose` — Tier-2 proposal queue management.
+ *
+ * @task T1008
+ */
+const proposeSub = defineCommand({
+    meta: {
+        name: 'propose',
+        description: 'Tier-2 proposal queue management (list/accept/reject/diff/run)',
+    },
+    args: projectArgs,
+    subCommands: {
+        list: proposeListSub,
+        accept: proposeAcceptSub,
+        reject: proposeRejectSub,
+        diff: proposeDiffSub,
+        run: proposeRunSub,
+        enable: proposeEnableSub,
+        disable: proposeDisableSub,
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const statePath = join(projectRoot, SENTIENT_STATE_FILE);
+            const state = await readSentientState(statePath);
+            emitSuccess({
+                tier2Enabled: state.tier2Enabled,
+                tier2Stats: state.tier2Stats,
+            }, jsonMode, `Tier-2 proposals: ${state.tier2Enabled ? 'enabled' : 'disabled'} | ` +
+                `generated=${state.tier2Stats.proposalsGenerated} ` +
+                `accepted=${state.tier2Stats.proposalsAccepted} ` +
+                `rejected=${state.tier2Stats.proposalsRejected}`);
+        }
+        catch (err) {
+            emitFailure('E_SENTIENT_PROPOSE', err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+// ---------------------------------------------------------------------------
+// baseline capture (Tier-3 — T1021)
+// ---------------------------------------------------------------------------
+const baselineCaptureSub = defineCommand({
+    meta: {
+        name: 'capture',
+        description: 'Capture a signed baseline event for a commit SHA (must predate experiment worktree creation)',
+    },
+    args: {
+        ...projectArgs,
+        sha: {
+            type: 'positional',
+            description: 'Git commit SHA to anchor the baseline to (40 hex chars)',
+            required: true,
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const commitSha = args.sha;
+        try {
+            const { captureBaseline } = await import('@cleocode/core/sentient/baseline.js');
+            const baseline = await captureBaseline(projectRoot, commitSha);
+            emitSuccess(baseline, jsonMode, `Baseline captured: receipt=${baseline.receiptId} commit=${baseline.commitSha} pub=${baseline.publicKey.slice(0, 16)}...`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_BASELINE_CAPTURE', message, jsonMode);
+        }
+    },
+});
+/**
+ * `cleo sentient baseline` — Tier-3 baseline management.
+ *
+ * @task T1021
+ */
+const baselineSub = defineCommand({
+    meta: {
+        name: 'baseline',
+        description: 'Tier-3 baseline management (capture signed pre-experiment baseline)',
+    },
+    args: projectArgs,
+    subCommands: {
+        capture: baselineCaptureSub,
+    },
+    async run({ args, cmd, rawArgs }) {
+        // Parent run() fires after subcommand per citty@0.2.x — skip default
+        // usage text so `cleo sentient baseline capture <sha>` stays clean. T1187-followup.
+        if (isSubCommandDispatch(rawArgs, cmd.subCommands))
+            return;
+        const jsonMode = args.json === true;
+        emitSuccess({ message: 'Use: cleo sentient baseline capture <sha>' }, jsonMode, 'Usage: cleo sentient baseline capture <sha>');
+    },
+});
+// ---------------------------------------------------------------------------
+// allowlist subcommands (Tier-3 — T1027)
+// ---------------------------------------------------------------------------
+const allowlistListSub = defineCommand({
+    meta: {
+        name: 'list',
+        description: 'Show the current ownerPubkeys allowlist',
+    },
+    args: projectArgs,
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const { getOwnerPubkeys } = await import('@cleocode/core/sentient/allowlist.js');
+            const pubkeys = await getOwnerPubkeys(projectRoot, { noCache: true });
+            const b64List = pubkeys.map((k) => Buffer.from(k).toString('base64'));
+            emitSuccess({ ownerPubkeys: b64List, count: b64List.length }, jsonMode, b64List.length === 0
+                ? 'No owner pubkeys configured (allowlist is empty)'
+                : `Owner pubkeys (${b64List.length}):\n${b64List.map((k, i) => `  ${i + 1}. ${k}`).join('\n')}`);
+        }
+        catch (err) {
+            emitFailure('E_SENTIENT_ALLOWLIST_LIST', err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+const allowlistAddSub = defineCommand({
+    meta: {
+        name: 'add',
+        description: 'Add a base64-encoded Ed25519 pubkey to the owner allowlist',
+    },
+    args: {
+        ...projectArgs,
+        pubkey: {
+            type: 'positional',
+            description: 'Base64-encoded Ed25519 public key (32 bytes)',
+            required: true,
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const pubkeyBase64 = args.pubkey;
+        try {
+            const { addOwnerPubkey } = await import('@cleocode/core/sentient/allowlist.js');
+            await addOwnerPubkey(projectRoot, pubkeyBase64);
+            emitSuccess({ added: pubkeyBase64 }, jsonMode, `Pubkey added to allowlist: ${pubkeyBase64.slice(0, 16)}...`);
+        }
+        catch (err) {
+            emitFailure('E_SENTIENT_ALLOWLIST_ADD', err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+const allowlistRemoveSub = defineCommand({
+    meta: {
+        name: 'remove',
+        description: 'Remove a base64-encoded Ed25519 pubkey from the owner allowlist',
+    },
+    args: {
+        ...projectArgs,
+        pubkey: {
+            type: 'positional',
+            description: 'Base64-encoded Ed25519 public key to remove',
+            required: true,
+        },
+    },
+    async run({ args }) {
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        const pubkeyBase64 = args.pubkey;
+        try {
+            const { removeOwnerPubkey } = await import('@cleocode/core/sentient/allowlist.js');
+            await removeOwnerPubkey(projectRoot, pubkeyBase64);
+            emitSuccess({ removed: pubkeyBase64 }, jsonMode, `Pubkey removed from allowlist: ${pubkeyBase64.slice(0, 16)}...`);
+        }
+        catch (err) {
+            const code = err.code === 'E_ALLOWLIST_KEY_NOT_FOUND'
+                ? 'E_ALLOWLIST_KEY_NOT_FOUND'
+                : 'E_SENTIENT_ALLOWLIST_REMOVE';
+            emitFailure(code, err instanceof Error ? err.message : String(err), jsonMode);
+        }
+    },
+});
+/**
+ * `cleo sentient allowlist` — Owner pubkey allowlist management (Tier-3).
+ *
+ * @task T1027
+ */
+const allowlistSub = defineCommand({
+    meta: {
+        name: 'allowlist',
+        description: 'Manage the owner pubkey allowlist for Tier-3 sentient operations',
+    },
+    args: projectArgs,
+    subCommands: {
+        list: allowlistListSub,
+        add: allowlistAddSub,
+        remove: allowlistRemoveSub,
+    },
+    async run({ args, cmd, rawArgs }) {
+        if (isSubCommandDispatch(rawArgs, cmd.subCommands))
+            return;
+        const jsonMode = args.json === true;
+        emitSuccess({ message: 'Use: cleo sentient allowlist list|add|remove' }, jsonMode, 'Usage: cleo sentient allowlist list|add <base64>|remove <base64>');
+    },
+});
+// ---------------------------------------------------------------------------
+// Root command
+// ---------------------------------------------------------------------------
+/**
+ * Root `cleo sentient` command. Running it without a subcommand prints the
+ * status snapshot (same as `cleo sentient status`).
+ */
+export const sentientCommand = defineCommand({
+    meta: {
+        name: 'sentient',
+        description: 'Manage the Tier-1 sentient autonomous loop daemon and Tier-2 proposals',
+    },
+    args: projectArgs,
+    subCommands: {
+        start: startSub,
+        stop: stopSub,
+        status: statusSub,
+        resume: resumeSub,
+        tick: tickSub,
+        propose: proposeSub,
+        baseline: baselineSub,
+        allowlist: allowlistSub,
+    },
+    async run({ args, cmd, rawArgs }) {
+        // Parent run() fires after subcommand per citty@0.2.x — skip default
+        // daemon-status print so `cleo sentient start` doesn't double-output. T1187-followup.
+        if (isSubCommandDispatch(rawArgs, cmd.subCommands))
+            return;
+        const projectRoot = resolveProjectRoot(args.project);
+        const jsonMode = args.json === true;
+        try {
+            const status = await getSentientDaemonStatus(projectRoot);
+            if (jsonMode) {
+                process.stdout.write(`${JSON.stringify({ success: true, data: status })}\n`);
+            }
+            else {
+                process.stdout.write(`Daemon: ${status.running ? `running (pid ${status.pid})` : 'stopped'} ` +
+                    `| killSwitch=${status.killSwitch ? 'ACTIVE' : 'inactive'} ` +
+                    `| picked=${status.stats.tasksPicked} ` +
+                    `completed=${status.stats.tasksCompleted} ` +
+                    `failed=${status.stats.tasksFailed}\n`);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            emitFailure('E_SENTIENT_STATUS', message, jsonMode);
+        }
+    },
+});
+//# sourceMappingURL=sentient.js.map