@cleocode/cleo 2026.4.67 → 2026.4.68

package/dist/cli/index.js

@@ -1931,7 +1931,7 @@ var init_sql = __esm({
         return new SQL([new StringChunk(str)]);
       }
       _sql.raw = raw;
-      function join144(chunks, separator) {
+      function join146(chunks, separator) {
         const result = [];
         for (const [i, chunk] of chunks.entries()) {
           if (i > 0 && separator !== void 0) result.push(separator);
@@ -1939,7 +1939,7 @@ var init_sql = __esm({
         }
         return new SQL(result);
       }
-      _sql.join = join144;
+      _sql.join = join146;
       function identifier(value) {
         return new Name(value);
       }
@@ -6713,7 +6713,7 @@ var init_select2 = __esm({
           const baseTableName = this.tableName;
           const tableName = getTableLikeName(table);
           for (const item of extractUsedTable(table)) this.usedTables.add(item);
-          if (typeof tableName === "string" && this.config.joins?.some((join144) => join144.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins?.some((join146) => join146.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (!this.isPartialSelect) {
             if (Object.keys(this.joinsNotNullableMap).length === 1 && typeof baseTableName === "string") this.config.fields = { [baseTableName]: this.config.fields };
             if (typeof tableName === "string" && !is(table, SQL)) {
@@ -7998,7 +7998,7 @@ var init_dialect = __esm({
           if (!joins2) return;
           const withEntries = Object.entries(joins2).filter(([_2, v2]) => v2);
           if (!withEntries.length) return;
-          return sql.join(withEntries.map(([k2, join144]) => {
+          return sql.join(withEntries.map(([k2, join146]) => {
             const relation = tableConfig.relations[k2];
             const isSingle2 = is(relation, One3);
             const targetTable = aliasedTable(relation.targetTable, `d${currentDepth + 1}`);
@@ -8009,7 +8009,7 @@ var init_dialect = __esm({
               table: targetTable,
               mode: isSingle2 ? "first" : "many",
               schema,
-              queryConfig: join144,
+              queryConfig: join146,
               tableConfig: schema[relation.targetTableName],
               relationWhere: filter,
               isNested: true,
@@ -8023,7 +8023,7 @@ var init_dialect = __esm({
               key: k2,
               selection: innerQuery.selection,
               isArray: !isSingle2,
-              isOptional: (relation.optional ?? false) || join144 !== true && !!join144.where
+              isOptional: (relation.optional ?? false) || join146 !== true && !!join146.where
             });
             const jsonColumns = sql.join(innerQuery.selection.map((s3) => {
               return sql`${sql.raw(this.escapeString(s3.key))}, ${s3.selection ? sql`${jsonb2}(${sql.identifier(s3.key)})` : sql.identifier(s3.key)}`;
@@ -8422,7 +8422,7 @@ var init_update = __esm({
       createJoin(joinType) {
         return ((table, on) => {
           const tableName = getTableLikeName(table);
-          if (typeof tableName === "string" && this.config.joins.some((join144) => join144.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
+          if (typeof tableName === "string" && this.config.joins.some((join146) => join146.alias === tableName)) throw new Error(`Alias "${tableName}" is already used in this query`);
           if (typeof on === "function") {
             const from = this.config.from ? is(table, SQLiteTable) ? table[Table.Symbol.Columns] : is(table, Subquery) ? table._.selectedFields : is(table, SQLiteViewBase) ? table[ViewBaseConfig].selectedFields : void 0 : void 0;
             on = on(new Proxy(this.config.table[Table.Symbol.Columns], new SelectionProxyHandler({
@@ -15396,6 +15396,7 @@ function runBrainMigrations(nativeDb, db) {
   reconcileJournal(nativeDb, migrationsFolder, "brain_decisions", "brain");
   migrateWithRetry(db, migrationsFolder, nativeDb, "brain_decisions", "brain");
   if (tableExists(nativeDb, "brain_page_edges")) {
+    ensureColumns(nativeDb, "brain_page_edges", [{ name: "provenance", ddl: "text" }], "brain");
     nativeDb.prepare(
       `UPDATE brain_page_edges
          SET edge_type = 'co_retrieved'
@@ -66796,10 +66797,10 @@ async function readProjectMeta(projectPath) {
 }
 async function readProjectId(projectPath) {
   try {
-    const { readFileSync: readFileSync108, existsSync: existsSync136 } = await import("node:fs");
+    const { readFileSync: readFileSync110, existsSync: existsSync137 } = await import("node:fs");
     const infoPath = join65(projectPath, ".cleo", "project-info.json");
-    if (!existsSync136(infoPath)) return "";
-    const data = JSON.parse(readFileSync108(infoPath, "utf-8"));
+    if (!existsSync137(infoPath)) return "";
+    const data = JSON.parse(readFileSync110(infoPath, "utf-8"));
     return typeof data.projectId === "string" ? data.projectId : "";
   } catch {
     return "";
@@ -78436,8 +78437,8 @@ async function initializeSpawnAdapters(manifests) {
     if (!manifest.capabilities?.supportsSpawn) continue;
     if (spawnRegistry.hasAdapterForProvider(manifest.provider)) continue;
     try {
-      const { join: join144 } = await import("node:path");
-      const modulePath = join144(manifest.packagePath, manifest.entryPoint);
+      const { join: join146 } = await import("node:path");
+      const modulePath = join146(manifest.packagePath, manifest.entryPoint);
       const adapterModule = await import(modulePath);
       let SpawnProviderClass;
       for (const [exportName, exportValue] of Object.entries(adapterModule)) {
@@ -118807,6 +118808,17 @@ var init_registry5 = __esm({
         sessionRequired: false,
         requiredParams: ["chain"]
       },
+      // T646: Canon drift detection — CI gate
+      {
+        gateway: "query",
+        domain: "check",
+        operation: "canon",
+        description: "check.canon (query) \u2014 CI gate: detects canon drift between docs and live code (CANONICAL_DOMAINS count, forbidden phrases, required assertions)",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: []
+      },
       // T065: Agent workflow compliance telemetry
       {
         gateway: "query",
@@ -120539,6 +120551,24 @@ var init_registry5 = __esm({
         sessionRequired: false,
         requiredParams: []
       },
+      {
+        gateway: "query",
+        domain: "admin",
+        operation: "smoke.provider",
+        description: "admin.smoke.provider (query) \u2014 ADR-049 harness sovereignty probe: verify adapter shape, DB locality, hooks, spawn, and agent folder for a named provider",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["provider"],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider ID to probe (claude-code | claude-sdk | codex | cursor | gemini-cli | kimi | openai-sdk | opencode | pi)"
+          }
+        ]
+      },
       {
         gateway: "query",
         domain: "admin",
@@ -124045,10 +124075,10 @@ async function systemLog(projectRoot, filters) {
 }
 async function queryAuditLogSqlite(projectRoot, filters) {
   try {
-    const { join: join144 } = await import("node:path");
-    const { existsSync: existsSync136 } = await import("node:fs");
-    const dbPath = join144(projectRoot, ".cleo", "tasks.db");
-    if (!existsSync136(dbPath)) {
+    const { join: join146 } = await import("node:path");
+    const { existsSync: existsSync137 } = await import("node:fs");
+    const dbPath = join146(projectRoot, ".cleo", "tasks.db");
+    if (!existsSync137(dbPath)) {
       const offset = filters?.offset ?? 0;
       const limit = filters?.limit ?? 20;
       return {
@@ -126160,6 +126190,210 @@ var init_job_manager_accessor = __esm({
   }
 });
 
+// packages/cleo/src/dispatch/domains/admin/smoke-provider.ts
+var smoke_provider_exports = {};
+__export(smoke_provider_exports, {
+  smokeProvider: () => smokeProvider
+});
+import { existsSync as existsSync129, readFileSync as readFileSync99 } from "node:fs";
+import { join as join126 } from "node:path";
+function isLocal(dbPath, projectCleoDir, cleoHome) {
+  return dbPath.startsWith(projectCleoDir) || dbPath.startsWith(cleoHome);
+}
+function classifySpawn(spawnSrcPath) {
+  if (!existsSync129(spawnSrcPath)) return "no";
+  let src;
+  try {
+    src = readFileSync99(spawnSrcPath, "utf-8");
+  } catch {
+    return "no";
+  }
+  const hasImpl = /\bspawn\b|\bexec\b|\bfork\b|\bchild_process\b|\bspawnSync\b/.test(src);
+  if (!hasImpl && /\bthrow\b/.test(src)) return "stub";
+  return "yes";
+}
+function countHookEvents(hooksSrcPath, canonicalEvents) {
+  if (!existsSync129(hooksSrcPath)) return 0;
+  let src;
+  try {
+    src = readFileSync99(hooksSrcPath, "utf-8");
+  } catch {
+    return 0;
+  }
+  let count5 = 0;
+  for (const event of canonicalEvents) {
+    if (src.includes(event)) count5++;
+  }
+  return count5;
+}
+function buildReport(partial2) {
+  const sep3 = "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550";
+  const lines = [
+    `CLEO Smoke Probe \u2014 provider: ${partial2.providerId}`,
+    sep3,
+    `  Adapter loaded:       ${partial2.adapterLoaded ? "yes" : "no"}`
+  ];
+  for (const db of partial2.dbChecks) {
+    const label = `  ${db.name} local:`.padEnd(24);
+    lines.push(`${label}${db.local ? "yes" : "NO"} (${db.path})`);
+  }
+  lines.push(`  Hooks declared:       ${partial2.hooksDeclared}`);
+  lines.push(`  Spawn implementation: ${partial2.spawnStatus}`);
+  lines.push(`  Agent folder:         ${partial2.agentFolder ?? "(none \u2014 unknown provider)"}`);
+  lines.push("");
+  lines.push(
+    partial2.passed ? "Result: PASS" : `Result: FAIL (${partial2.failureReason ?? "invariant violated"})`
+  );
+  return lines.join("\n");
+}
+async function smokeProvider(providerId) {
+  if (!VALID_PROVIDER_IDS.includes(providerId)) {
+    return engineError(
+      "E_INVALID_INPUT",
+      `Unknown provider ID: "${providerId}". Valid IDs: ${VALID_PROVIDER_IDS.join(", ")}`
+    );
+  }
+  const coreInternal = await Promise.resolve().then(() => (init_internal(), internal_exports));
+  const projectRoot = (() => {
+    try {
+      return coreInternal.getProjectRoot();
+    } catch {
+      return process.env["CLEO_ROOT"] ?? process.cwd();
+    }
+  })();
+  const monorepoRoot = projectRoot;
+  const adapterDistPath = join126(
+    monorepoRoot,
+    "packages",
+    "adapters",
+    "dist",
+    "providers",
+    providerId,
+    "index.js"
+  );
+  let adapterLoaded = false;
+  if (existsSync129(adapterDistPath)) {
+    try {
+      const mod = await import(adapterDistPath);
+      const defaultExport = mod["default"];
+      if (typeof defaultExport === "function") {
+        const ctor = defaultExport;
+        try {
+          const instance = new ctor();
+          adapterLoaded = typeof instance.id === "string" && typeof instance.name === "string" && typeof instance.version === "string";
+        } catch {
+          adapterLoaded = existsSync129(adapterDistPath);
+        }
+      } else {
+        adapterLoaded = typeof mod["id"] === "string" && typeof mod["name"] === "string";
+      }
+    } catch {
+      adapterLoaded = false;
+    }
+  }
+  const cleoHome = coreInternal.getCleoHome();
+  const projectCleoDir = join126(projectRoot, ".cleo");
+  const taskDbPath = coreInternal.getTaskPath(projectRoot);
+  const brainPath = join126(projectCleoDir, "brain.db");
+  const conduitDbPath = coreInternal.getConduitDbPath(projectRoot);
+  const nexusDbPath = coreInternal.getNexusDbPath();
+  const dbChecks = [
+    { name: "brain.db", local: isLocal(brainPath, projectCleoDir, cleoHome), path: brainPath },
+    { name: "nexus.db", local: isLocal(nexusDbPath, projectCleoDir, cleoHome), path: nexusDbPath },
+    {
+      name: "conduit.db",
+      local: isLocal(conduitDbPath, projectCleoDir, cleoHome),
+      path: conduitDbPath
+    },
+    { name: "tasks.db", local: isLocal(taskDbPath, projectCleoDir, cleoHome), path: taskDbPath }
+  ];
+  let canonicalEvents = [];
+  try {
+    const caamp = await import("@cleocode/caamp");
+    canonicalEvents = caamp.CANONICAL_HOOK_EVENTS;
+  } catch {
+    canonicalEvents = [];
+  }
+  const hooksSrcPath = join126(
+    monorepoRoot,
+    "packages",
+    "adapters",
+    "src",
+    "providers",
+    providerId,
+    "hooks.ts"
+  );
+  const hooksDeclared = countHookEvents(hooksSrcPath, canonicalEvents);
+  const spawnSrcPath = join126(
+    monorepoRoot,
+    "packages",
+    "adapters",
+    "src",
+    "providers",
+    providerId,
+    "spawn.ts"
+  );
+  const spawnStatus = classifySpawn(spawnSrcPath);
+  let agentFolder = null;
+  try {
+    const { getProviderAgentFolder } = await import("@cleocode/caamp");
+    agentFolder = getProviderAgentFolder(providerId);
+  } catch {
+    agentFolder = null;
+  }
+  const dbsLocal = dbChecks.every((c) => c.local);
+  const failReasons = [];
+  if (!adapterLoaded) failReasons.push("adapter did not load or missing id/name/version");
+  if (!dbsLocal) {
+    const nonLocal = dbChecks.filter((c) => !c.local).map((c) => c.name).join(", ");
+    failReasons.push(`non-local DB paths: ${nonLocal}`);
+  }
+  if (agentFolder === null) failReasons.push("agent folder unresolvable (unknown provider)");
+  const passed = failReasons.length === 0;
+  const partial2 = {
+    providerId,
+    adapterLoaded,
+    dbChecks,
+    hooksDeclared,
+    spawnStatus,
+    agentFolder,
+    passed,
+    ...passed ? {} : { failureReason: failReasons.join("; ") }
+  };
+  const report = buildReport(partial2);
+  const result = { ...partial2, report };
+  if (!passed) {
+    return {
+      success: false,
+      data: result,
+      error: {
+        code: "E_SMOKE_PROVIDER_FAIL",
+        message: `ADR-049 probe FAILED for provider "${providerId}": ${partial2.failureReason}`,
+        exitCode: 1
+      }
+    };
+  }
+  return engineSuccess(result);
+}
+var VALID_PROVIDER_IDS;
+var init_smoke_provider = __esm({
+  "packages/cleo/src/dispatch/domains/admin/smoke-provider.ts"() {
+    "use strict";
+    init_error3();
+    VALID_PROVIDER_IDS = [
+      "claude-code",
+      "claude-sdk",
+      "codex",
+      "cursor",
+      "gemini-cli",
+      "kimi",
+      "openai-sdk",
+      "opencode",
+      "pi"
+    ];
+  }
+});
+
 // packages/cleo/src/dispatch/domains/admin.ts
 var AdminHandler;
 var init_admin2 = __esm({
@@ -126655,6 +126889,22 @@ var init_admin2 = __esm({
               const result = await systemSmoke();
               return wrapResult(result, "query", "admin", operation, startTime);
             }
+            case "smoke.provider": {
+              const providerIdParam = params?.provider;
+              if (!providerIdParam || typeof providerIdParam !== "string") {
+                return errorResult(
+                  "query",
+                  "admin",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "provider is required (e.g. claude-code, pi, opencode)",
+                  startTime
+                );
+              }
+              const { smokeProvider: smokeProvider2 } = await Promise.resolve().then(() => (init_smoke_provider(), smoke_provider_exports));
+              const result = await smokeProvider2(providerIdParam);
+              return wrapResult(result, "query", "admin", operation, startTime);
+            }
             case "hooks.matrix": {
               const result = await systemHooksMatrix({
                 providerIds: params?.providerIds,
@@ -127161,6 +127411,7 @@ var init_admin2 = __esm({
             "map",
             "roadmap",
             "smoke",
+            "smoke.provider",
             "hooks.matrix"
           ],
           mutate: [
@@ -127189,6 +127440,139 @@ var init_admin2 = __esm({
   }
 });
 
+// packages/cleo/src/dispatch/domains/check/canon.ts
+var canon_exports = {};
+__export(canon_exports, {
+  runCanonCheck: () => runCanonCheck
+});
+import { readFileSync as readFileSync100 } from "node:fs";
+import { join as join127 } from "node:path";
+function readLines(filePath) {
+  try {
+    return readFileSync100(filePath, "utf8").split("\n");
+  } catch {
+    return [];
+  }
+}
+function scanForbiddenPhrases(filePath, lines) {
+  const results = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line2 = lines[i];
+    for (const phrase of FORBIDDEN_PHRASES) {
+      if (line2.includes(phrase)) {
+        results.push({ file: filePath, line: i + 1, phrase });
+      }
+    }
+  }
+  return results;
+}
+function countCanonicalDomains(typesFilePath) {
+  const lines = readLines(typesFilePath);
+  let inArray8 = false;
+  let count5 = 0;
+  for (const line2 of lines) {
+    if (!inArray8) {
+      if (line2.includes("CANONICAL_DOMAINS") && line2.includes("[")) {
+        inArray8 = true;
+      }
+      continue;
+    }
+    if (line2.includes("] as const")) {
+      break;
+    }
+    const trimmed = line2.trim();
+    if (trimmed.startsWith("'") && trimmed.includes("'")) {
+      count5++;
+    }
+  }
+  return count5;
+}
+function countOperations(registryFilePath) {
+  const lines = readLines(registryFilePath);
+  let count5 = 0;
+  for (const line2 of lines) {
+    if (/^\s*gateway:/.test(line2)) {
+      count5++;
+    }
+  }
+  return count5;
+}
+function runCanonCheck(params) {
+  const { projectRoot } = params;
+  const typesFile = join127(projectRoot, "packages/cleo/src/dispatch/types.ts");
+  const registryFile = join127(projectRoot, "packages/cleo/src/dispatch/registry.ts");
+  const archGuide = join127(projectRoot, "docs/concepts/CLEO-ARCHITECTURE-GUIDE.md");
+  const visionDoc = join127(projectRoot, "docs/concepts/CLEO-VISION.md");
+  const constitution = join127(projectRoot, "docs/specs/CLEO-OPERATION-CONSTITUTION.md");
+  const domainsInCode = countCanonicalDomains(typesFile);
+  const operationsInCode = countOperations(registryFile);
+  const excludedSet = new Set(EXCLUDED_FILENAMES);
+  const auditedDocs = [archGuide, visionDoc, constitution].filter((f2) => {
+    const basename19 = f2.split("/").pop() ?? "";
+    return !excludedSet.has(basename19);
+  });
+  const allViolations = [];
+  for (const docPath of auditedDocs) {
+    const lines = readLines(docPath);
+    allViolations.push(...scanForbiddenPhrases(docPath, lines));
+  }
+  const assertions = [];
+  const archLines = readLines(archGuide);
+  const archText = archLines.join("\n");
+  assertions.push({
+    file: archGuide,
+    assertion: 'Contains "Six Great Systems"',
+    passed: archText.includes("Six Great Systems")
+  });
+  assertions.push({
+    file: archGuide,
+    assertion: 'Contains "Circle of Eleven"',
+    passed: archText.includes("Circle of Eleven")
+  });
+  const visionLines = readLines(visionDoc);
+  const visionText = visionLines.join("\n");
+  assertions.push({
+    file: visionDoc,
+    assertion: "Contains reference to six systems",
+    passed: visionText.includes("six systems") || visionText.includes("Six systems") || visionText.includes("6 systems") || visionText.includes("six canonical systems")
+  });
+  const constLines = readLines(constitution);
+  const constText = constLines.join("\n");
+  assertions.push({
+    file: constitution,
+    assertion: 'Contains "11 canonical domains"',
+    passed: constText.includes("11 canonical domains") || constText.includes("eleven canonical domains")
+  });
+  const allAssertionsPassed = assertions.every((a) => a.passed);
+  const passed = allViolations.length === 0 && allAssertionsPassed;
+  return {
+    domainsInCode,
+    operationsInCode,
+    violations: allViolations,
+    assertions,
+    passed
+  };
+}
+var FORBIDDEN_PHRASES, EXCLUDED_FILENAMES;
+var init_canon = __esm({
+  "packages/cleo/src/dispatch/domains/check/canon.ts"() {
+    "use strict";
+    FORBIDDEN_PHRASES = [
+      "Four Great Systems",
+      "Four systems",
+      "Circle of Ten",
+      "exactly 10 domains",
+      "exactly ten domains"
+    ];
+    EXCLUDED_FILENAMES = [
+      "CLEO-CANT.md",
+      "CLEO-AWAKENING-STORY.md",
+      "CLEO-FOUNDING-STORY.md",
+      "CLEO-MANIFESTO.md"
+    ];
+  }
+});
+
 // packages/cleo/src/dispatch/domains/check.ts
 var CheckHandler;
 var init_check = __esm({
@@ -127538,6 +127922,22 @@ var init_check = __esm({
                 page: page.page
               };
             }
+            // T646: Canon drift detection — compares docs to live code
+            case "canon": {
+              const { runCanonCheck: runCanonCheck2 } = await Promise.resolve().then(() => (init_canon(), canon_exports));
+              const result = runCanonCheck2({ projectRoot });
+              return {
+                meta: dispatchMeta("query", "check", operation, startTime),
+                success: result.passed,
+                data: result,
+                ...!result.passed ? {
+                  error: {
+                    code: "E_CANON_DRIFT",
+                    message: `Canon drift detected: ${result.violations.length} forbidden phrase(s), ${result.assertions.filter((a) => !a.passed).length} failed assertion(s)`
+                  }
+                } : {}
+              };
+            }
             // T065: Workflow compliance telemetry — WF-001 through WF-005
             case "workflow.compliance": {
               const since = params?.since;
@@ -127666,7 +128066,8 @@ var init_check = __esm({
             "archive.stats",
             "grade",
             "grade.list",
-            "chain.validate"
+            "chain.validate",
+            "canon"
           ],
           mutate: ["compliance.record", "compliance.sync", "test.run", "gate.set"]
         };
@@ -129654,16 +130055,16 @@ var init_nexus2 = __esm({
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir: getCleoCantWorkflowsDir2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
-    const { readFileSync: readFileSync108, readdirSync: readdirSync43, existsSync: existsSync136 } = await import("node:fs");
-    const { join: join144 } = await import("node:path");
+    const { readFileSync: readFileSync110, readdirSync: readdirSync43, existsSync: existsSync137 } = await import("node:fs");
+    const { join: join146 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir2();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync136(workflowsDir)) {
+    if (existsSync137(workflowsDir)) {
       const files = readdirSync43(workflowsDir).filter((f2) => f2.endsWith(".cant"));
       for (const file2 of files) {
         try {
-          const src = readFileSync108(join144(workflowsDir, file2), "utf-8");
+          const src = readFileSync110(join146(workflowsDir, file2), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -129678,12 +130079,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join144(projectRoot, ".cleo", "workflows");
-    if (existsSync136(localCantDir)) {
+    const localCantDir = join146(projectRoot, ".cleo", "workflows");
+    if (existsSync137(localCantDir)) {
       const files = readdirSync43(localCantDir).filter((f2) => f2.endsWith(".cant"));
       for (const file2 of files) {
         try {
-          const src = readFileSync108(join144(localCantDir, file2), "utf-8");
+          const src = readFileSync110(join146(localCantDir, file2), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -132391,7 +132792,7 @@ var init_tasks4 = __esm({
 });
 
 // packages/cleo/src/dispatch/engines/code-engine.ts
-import { join as join126 } from "node:path";
+import { join as join128 } from "node:path";
 async function codeOutline(params) {
   const { smartOutline: smartOutline2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
   const filePath = params?.file;
@@ -132401,7 +132802,7 @@ async function codeOutline(params) {
       error: { code: "E_INVALID_INPUT", message: "file parameter required" }
     };
   const root = getProjectRoot();
-  const absPath = filePath.startsWith("/") ? filePath : join126(root, filePath);
+  const absPath = filePath.startsWith("/") ? filePath : join128(root, filePath);
   return { success: true, data: smartOutline2(absPath, root) };
 }
 async function codeSearch(params) {
@@ -132433,7 +132834,7 @@ async function codeUnfold(params) {
       error: { code: "E_INVALID_INPUT", message: "file and symbol parameters required" }
     };
   const root = getProjectRoot();
-  const absPath = filePath.startsWith("/") ? filePath : join126(root, filePath);
+  const absPath = filePath.startsWith("/") ? filePath : join128(root, filePath);
   return { success: true, data: smartUnfold2(absPath, symbol2, root) };
 }
 async function codeParse(params) {
@@ -132445,7 +132846,7 @@ async function codeParse(params) {
       error: { code: "E_INVALID_INPUT", message: "file parameter required" }
     };
   const root = getProjectRoot();
-  const absPath = filePath.startsWith("/") ? filePath : join126(root, filePath);
+  const absPath = filePath.startsWith("/") ? filePath : join128(root, filePath);
   return { success: true, data: parseFile3(absPath, root) };
 }
 var init_code_engine = __esm({
@@ -133608,8 +134009,8 @@ var init_defaults = __esm({
 });
 
 // packages/cleo/src/dispatch/lib/config-loader.ts
-import { existsSync as existsSync129, readFileSync as readFileSync99 } from "fs";
-import { join as join127 } from "path";
+import { existsSync as existsSync130, readFileSync as readFileSync101 } from "fs";
+import { join as join129 } from "path";
 function loadFromEnv(key) {
   const envKey = `${ENV_PREFIX}${key.toUpperCase()}`;
   return process.env[envKey];
@@ -133630,12 +134031,12 @@ function parseEnvValue2(key, value) {
 }
 function loadFromFile(projectRoot) {
   const root = projectRoot || process.cwd();
-  const configPath = join127(root, ".cleo", "config.json");
-  if (!existsSync129(configPath)) {
+  const configPath = join129(root, ".cleo", "config.json");
+  if (!existsSync130(configPath)) {
     return {};
   }
   try {
-    const content = readFileSync99(configPath, "utf-8");
+    const content = readFileSync101(configPath, "utf-8");
     const config2 = JSON.parse(content);
     const result = {};
     if (config2.lifecycleEnforcement) {
@@ -134085,9 +134486,9 @@ __export(cli_exports, {
   resetCliDispatcher: () => resetCliDispatcher
 });
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync130 } from "node:fs";
+import { existsSync as existsSync131 } from "node:fs";
 import { createRequire as createRequire19 } from "node:module";
-import { dirname as dirname27, join as join128 } from "node:path";
+import { dirname as dirname27, join as join130 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { catalog as catalog4, registerSkillLibraryFromPath } from "@cleocode/caamp";
 function ensureCaampLibrary() {
@@ -134098,16 +134499,16 @@ function ensureCaampLibrary() {
       const req = createRequire19(import.meta.url);
       const skillsPkgJson = req.resolve("@cleocode/skills/package.json");
       const candidate = dirname27(skillsPkgJson);
-      if (existsSync130(join128(candidate, "skills.json"))) {
+      if (existsSync131(join130(candidate, "skills.json"))) {
         skillsRoot = candidate;
       }
     } catch {
     }
     if (!skillsRoot) {
       const thisFile = fileURLToPath7(import.meta.url);
-      const packageRoot = join128(dirname27(thisFile), "..", "..", "..", "..", "..");
-      const candidate = join128(packageRoot, "packages", "skills");
-      if (existsSync130(join128(candidate, "skills.json"))) {
+      const packageRoot = join130(dirname27(thisFile), "..", "..", "..", "..", "..");
+      const candidate = join130(packageRoot, "packages", "skills");
+      if (existsSync131(join130(candidate, "skills.json"))) {
         skillsRoot = candidate;
       }
     }
@@ -134328,8 +134729,8 @@ var init_cli = __esm({
 
 // packages/cleo/src/cli/index.ts
 init_internal();
-import { readFileSync as readFileSync107 } from "node:fs";
-import { dirname as dirname32, join as join143 } from "node:path";
+import { readFileSync as readFileSync109 } from "node:fs";
+import { dirname as dirname32, join as join145 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 
 // node_modules/.pnpm/citty@0.2.1/node_modules/citty/dist/_chunks/libs/scule.mjs
@@ -135486,7 +135887,7 @@ function registerAddCommand(program) {
 // packages/cleo/src/cli/commands/add-batch.ts
 init_cli();
 init_renderers();
-import { existsSync as existsSync131, readFileSync as readFileSync100 } from "node:fs";
+import { existsSync as existsSync132, readFileSync as readFileSync102 } from "node:fs";
 function registerAddBatchCommand(program) {
   program.command("add-batch").description("Create multiple tasks atomically from a JSON file").option("--file <path>", "Path to JSON file (array of task objects). Use - for stdin.").option("--parent <parentId>", "Default parent for all tasks (overridden by per-task parent)").option("--dry-run", "Preview what would be created without making changes").action(async (opts) => {
     const filePath = opts["file"];
@@ -135513,7 +135914,7 @@ function registerAddBatchCommand(program) {
         return;
       }
     } else {
-      if (!existsSync131(filePath)) {
+      if (!existsSync132(filePath)) {
         cliError(
           `File not found: ${filePath}`,
           "E_NOT_FOUND",
@@ -135526,7 +135927,7 @@ function registerAddBatchCommand(program) {
         process.exit(2);
         return;
       }
-      raw = readFileSync100(filePath, "utf-8");
+      raw = readFileSync102(filePath, "utf-8");
     }
     let tasks2;
     try {
@@ -135646,8 +136047,24 @@ function registerAdminCommand(program) {
       { command: "admin" }
     );
   });
-  admin.command("smoke").description("Run operational smoke tests across all domains").action(async () => {
-    await dispatchFromCli("query", "admin", "smoke", {}, { command: "admin" });
+  admin.command("smoke").description(
+    "Run operational smoke tests across all domains, or probe ADR-049 invariants for a named provider (--provider)"
+  ).option(
+    "--provider <id>",
+    "Probe harness sovereignty invariants for a specific provider adapter (ADR-049)"
+  ).action(async (opts) => {
+    const provider = opts["provider"];
+    if (provider) {
+      await dispatchFromCli(
+        "query",
+        "admin",
+        "smoke.provider",
+        { provider },
+        { command: "admin smoke", operation: "admin.smoke.provider" }
+      );
+    } else {
+      await dispatchFromCli("query", "admin", "smoke", {}, { command: "admin" });
+    }
   });
   admin.command("paths").description("Report all CleoOS paths (project + global hub) and scaffolding status").action(async () => {
     await dispatchFromCli("query", "admin", "paths", {}, { command: "admin" });
@@ -135831,12 +136248,12 @@ function registerAgentCommand(program) {
         transportConfig: {},
         isActive: true
       });
-      const { existsSync: existsSync136, mkdirSync: mkdirSync36, writeFileSync: writeFileSync27 } = await import("node:fs");
-      const { join: join144 } = await import("node:path");
-      const cantDir = join144(".cleo", "agents");
-      const cantPath = join144(cantDir, `${agentId}.cant`);
+      const { existsSync: existsSync137, mkdirSync: mkdirSync36, writeFileSync: writeFileSync27 } = await import("node:fs");
+      const { join: join146 } = await import("node:path");
+      const cantDir = join146(".cleo", "agents");
+      const cantPath = join146(cantDir, `${agentId}.cant`);
       let cantScaffolded = false;
-      if (!existsSync136(cantPath)) {
+      if (!existsSync137(cantPath)) {
         mkdirSync36(cantDir, { recursive: true });
         const role = classification ?? "specialist";
         const cantContent = `---
@@ -135896,7 +136313,7 @@ agent ${agentId}:
           data: {
             agentId: credential.agentId,
             displayName: credential.displayName,
-            cantFile: cantScaffolded ? cantPath : existsSync136(cantPath) ? cantPath : null,
+            cantFile: cantScaffolded ? cantPath : existsSync137(cantPath) ? cantPath : null,
             cantScaffolded
           }
         },
@@ -135976,8 +136393,8 @@ agent ${agentId}:
     try {
       const { AgentRegistryAccessor: AgentRegistryAccessor2, getDb: getDb4 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
       const { createRuntime } = await import("@cleocode/runtime");
-      const { existsSync: existsSync136, readFileSync: readFileSync108 } = await import("node:fs");
-      const { join: join144 } = await import("node:path");
+      const { existsSync: existsSync137, readFileSync: readFileSync110 } = await import("node:fs");
+      const { join: join146 } = await import("node:path");
       await getDb4();
       const registry2 = new AgentRegistryAccessor2(process.cwd());
       const credential = await registry2.get(agentId);
@@ -135997,9 +136414,9 @@ agent ${agentId}:
       }
       let profile = null;
       let cantValidation = null;
-      const cantPath = opts["cant"] ?? join144(".cleo", "agents", `${agentId}.cant`);
-      if (existsSync136(cantPath)) {
-        profile = readFileSync108(cantPath, "utf-8");
+      const cantPath = opts["cant"] ?? join146(".cleo", "agents", `${agentId}.cant`);
+      if (existsSync137(cantPath)) {
+        profile = readFileSync110(cantPath, "utf-8");
         try {
           const cantModule = await import("@cleocode/cant");
           const validate = "validate" in cantModule ? cantModule.validate : null;
@@ -136394,8 +136811,8 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
     try {
       const { AgentRegistryAccessor: AgentRegistryAccessor2, getDb: getDb4 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
       const { createRuntime } = await import("@cleocode/runtime");
-      const { existsSync: existsSync136 } = await import("node:fs");
-      const { join: join144 } = await import("node:path");
+      const { existsSync: existsSync137 } = await import("node:fs");
+      const { join: join146 } = await import("node:path");
       const { execFile: execFile9 } = await import("node:child_process");
       const { promisify: promisify9 } = await import("node:util");
       const execFileAsync6 = promisify9(execFile9);
@@ -136415,8 +136832,8 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
       }
       await registry2.update(agentId, { isActive: true });
       await registry2.markUsed(agentId);
-      const cantPath = join144(".cleo", "agents", `${agentId}.cant`);
-      const hasProfile = existsSync136(cantPath);
+      const cantPath = join146(".cleo", "agents", `${agentId}.cant`);
+      const hasProfile = existsSync137(cantPath);
       const runtime = await createRuntime(registry2, {
         agentId,
         pollIntervalMs: 5e3,
@@ -137039,12 +137456,12 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
   });
   agent.command("install <path>").description("Install an agent from a .cantz archive or agent directory").option("--global", "Install to global tier (~/.local/share/cleo/cant/agents/)").action(async (sourcePath, opts) => {
     try {
-      const { existsSync: existsSync136, mkdirSync: mkdirSync36, cpSync, readFileSync: readFileSync108, rmSync: rmSync2, statSync: statSync22 } = await import("node:fs");
-      const { join: join144, basename: basename19, resolve: resolve17 } = await import("node:path");
+      const { existsSync: existsSync137, mkdirSync: mkdirSync36, cpSync, readFileSync: readFileSync110, rmSync: rmSync2, statSync: statSync22 } = await import("node:fs");
+      const { join: join146, basename: basename19, resolve: resolve17 } = await import("node:path");
       const { homedir: homedir15 } = await import("node:os");
       const { tmpdir: tmpdir2 } = await import("node:os");
       const resolvedPath = resolve17(sourcePath);
-      if (!existsSync136(resolvedPath)) {
+      if (!existsSync137(resolvedPath)) {
         cliOutput(
           {
             success: false,
@@ -137064,7 +137481,7 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
       const isCantzArchive = resolvedPath.endsWith(".cantz") && statSync22(resolvedPath).isFile();
       if (isCantzArchive) {
         const { execFileSync: execFileSync19 } = await import("node:child_process");
-        tempDir = join144(tmpdir2(), `cleo-agent-install-${Date.now()}`);
+        tempDir = join146(tmpdir2(), `cleo-agent-install-${Date.now()}`);
         mkdirSync36(tempDir, { recursive: true });
         try {
           execFileSync19("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
@@ -137088,7 +137505,7 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
         }
         const { readdirSync: readdirSync43 } = await import("node:fs");
         const topLevel = readdirSync43(tempDir).filter((entry) => {
-          const entryPath = join144(tempDir, entry);
+          const entryPath = join146(tempDir, entry);
           return statSync22(entryPath).isDirectory();
         });
         if (topLevel.length !== 1) {
@@ -137107,7 +137524,7 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
           return;
         }
         agentName = topLevel[0];
-        agentDir = join144(tempDir, agentName);
+        agentDir = join146(tempDir, agentName);
       } else if (statSync22(resolvedPath).isDirectory()) {
         agentDir = resolvedPath;
         agentName = basename19(resolvedPath);
@@ -137125,8 +137542,8 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
         process.exitCode = 6;
         return;
       }
-      const personaPath = join144(agentDir, "persona.cant");
-      if (!existsSync136(personaPath)) {
+      const personaPath = join146(agentDir, "persona.cant");
+      if (!existsSync137(personaPath)) {
         if (tempDir) rmSync2(tempDir, { recursive: true, force: true });
         cliOutput(
           {
@@ -137145,12 +137562,12 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
       let targetRoot;
       if (isGlobal) {
         const home = homedir15();
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join144(home, ".local", "share");
-        targetRoot = join144(xdgData, "cleo", "cant", "agents");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join146(home, ".local", "share");
+        targetRoot = join146(xdgData, "cleo", "cant", "agents");
       } else {
-        targetRoot = join144(process.cwd(), ".cleo", "cant", "agents");
+        targetRoot = join146(process.cwd(), ".cleo", "cant", "agents");
       }
-      const targetDir = join144(targetRoot, agentName);
+      const targetDir = join146(targetRoot, agentName);
       mkdirSync36(targetRoot, { recursive: true });
       cpSync(agentDir, targetDir, { recursive: true, force: true });
       if (tempDir) {
@@ -137158,7 +137575,7 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
       }
       let registered = false;
       try {
-        const persona = readFileSync108(join144(targetDir, "persona.cant"), "utf-8");
+        const persona = readFileSync110(join146(targetDir, "persona.cant"), "utf-8");
         const descMatch = persona.match(/description:\s*"([^"]+)"/);
         const displayName = descMatch?.[1] ?? agentName;
         const { AgentRegistryAccessor: AgentRegistryAccessor2, getDb: getDb4 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
@@ -137205,11 +137622,11 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
   });
   agent.command("pack <dir>").description("Package an agent directory as a .cantz archive").action(async (dir) => {
     try {
-      const { existsSync: existsSync136, statSync: statSync22 } = await import("node:fs");
+      const { existsSync: existsSync137, statSync: statSync22 } = await import("node:fs");
       const { resolve: resolve17, basename: basename19, dirname: dirname33 } = await import("node:path");
       const { execFileSync: execFileSync19 } = await import("node:child_process");
       const resolvedDir = resolve17(dir);
-      if (!existsSync136(resolvedDir) || !statSync22(resolvedDir).isDirectory()) {
+      if (!existsSync137(resolvedDir) || !statSync22(resolvedDir).isDirectory()) {
         cliOutput(
           {
             success: false,
@@ -137223,9 +137640,9 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
         process.exitCode = 4;
         return;
       }
-      const { join: join144 } = await import("node:path");
-      const personaPath = join144(resolvedDir, "persona.cant");
-      if (!existsSync136(personaPath)) {
+      const { join: join146 } = await import("node:path");
+      const personaPath = join146(resolvedDir, "persona.cant");
+      if (!existsSync137(personaPath)) {
         cliOutput(
           {
             success: false,
@@ -137272,7 +137689,7 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
           if (entry.isFile()) {
             fileCount++;
           } else if (entry.isDirectory()) {
-            countFiles2(join144(dirPath, entry.name));
+            countFiles2(join146(dirPath, entry.name));
           }
         }
       };
@@ -137299,8 +137716,8 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
   });
   agent.command("create").description("Scaffold a new agent package with persona.cant and manifest.json").requiredOption("--name <name>", "Agent name (kebab-case)").requiredOption("--role <role>", "Agent role: orchestrator, lead, worker, or docs-worker").option("--tier <tier>", "Agent tier: low, mid, or high (defaults based on role)").option("--team <teamName>", "Team this agent belongs to").option("--domain <description>", "Domain description for file permissions and context").option("--global", "Create in global tier (~/.local/share/cleo/cant/agents/)").option("--seed-brain", "Create expertise/mental-model-seed.md and seed a BRAIN observation").option("--parent <parentAgent>", "Parent agent name in the hierarchy").action(async (opts) => {
     try {
-      const { existsSync: existsSync136, mkdirSync: mkdirSync36, writeFileSync: writeFileSync27 } = await import("node:fs");
-      const { join: join144 } = await import("node:path");
+      const { existsSync: existsSync137, mkdirSync: mkdirSync36, writeFileSync: writeFileSync27 } = await import("node:fs");
+      const { join: join146 } = await import("node:path");
       const { homedir: homedir15 } = await import("node:os");
       const name2 = opts["name"];
       const role = opts["role"];
@@ -137360,13 +137777,13 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
       let targetRoot;
       if (isGlobal) {
         const home = homedir15();
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join144(home, ".local", "share");
-        targetRoot = join144(xdgData, "cleo", "cant", "agents");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join146(home, ".local", "share");
+        targetRoot = join146(xdgData, "cleo", "cant", "agents");
       } else {
-        targetRoot = join144(process.cwd(), ".cleo", "cant", "agents");
+        targetRoot = join146(process.cwd(), ".cleo", "cant", "agents");
       }
-      const agentDir = join144(targetRoot, name2);
-      if (existsSync136(agentDir)) {
+      const agentDir = join146(targetRoot, name2);
+      if (existsSync137(agentDir)) {
         cliOutput(
           {
             success: false,
@@ -137390,29 +137807,29 @@ Task ${taskId} reassigned to you by ${active.agentId}. Run: cleo show ${taskId}
         domain: domain2,
         parent
       });
-      writeFileSync27(join144(agentDir, "persona.cant"), personaContent, "utf-8");
+      writeFileSync27(join146(agentDir, "persona.cant"), personaContent, "utf-8");
       const manifest = generateManifest2({ name: name2, role, tier, domain: domain2 });
       writeFileSync27(
-        join144(agentDir, "manifest.json"),
+        join146(agentDir, "manifest.json"),
         `${JSON.stringify(manifest, null, 2)}
 `,
         "utf-8"
       );
       const createdFiles = [
-        join144(agentDir, "persona.cant"),
-        join144(agentDir, "manifest.json")
+        join146(agentDir, "persona.cant"),
+        join146(agentDir, "manifest.json")
       ];
       if (team) {
         const teamConfigContent = generateTeamConfig(name2, role, team);
-        writeFileSync27(join144(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
-        createdFiles.push(join144(agentDir, "team-config.cant"));
+        writeFileSync27(join146(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
+        createdFiles.push(join146(agentDir, "team-config.cant"));
       }
       if (seedBrain) {
-        const expertiseDir = join144(agentDir, "expertise");
+        const expertiseDir = join146(agentDir, "expertise");
         mkdirSync36(expertiseDir, { recursive: true });
         const seedContent = generateMentalModelSeed(name2, role, domain2);
-        writeFileSync27(join144(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
-        createdFiles.push(join144(expertiseDir, "mental-model-seed.md"));
+        writeFileSync27(join146(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
+        createdFiles.push(join146(expertiseDir, "mental-model-seed.md"));
         try {
           const { execFile: execFile9 } = await import("node:child_process");
           const { promisify: promisify9 } = await import("node:util");
@@ -139042,8 +139459,8 @@ function registerCancelCommand(program) {
 
 // packages/cleo/src/cli/commands/cant.ts
 init_renderers();
-import { existsSync as existsSync132, mkdirSync as mkdirSync33, readFileSync as readFileSync101, writeFileSync as writeFileSync24 } from "node:fs";
-import { dirname as dirname28, isAbsolute as isAbsolute3, join as join129, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync133, mkdirSync as mkdirSync33, readFileSync as readFileSync103, writeFileSync as writeFileSync24 } from "node:fs";
+import { dirname as dirname28, isAbsolute as isAbsolute3, join as join131, resolve as resolve16 } from "node:path";
 function registerCantCommand(program) {
   const cant = program.command("cant").description("CANT DSL tooling");
   cant.command("parse <file>").description("Parse a .cant file and emit the AST").action(async (file2) => {
@@ -139111,7 +139528,7 @@ function registerCantCommand(program) {
       if (!ensureExists(filePath, "cant.migrate")) return;
       try {
         const mod = await loadMigrateEngine();
-        const content = readFileSync101(filePath, "utf-8");
+        const content = readFileSync103(filePath, "utf-8");
         const result = mod.migrateMarkdown(content, filePath, {
           write: isWrite,
           verbose: isVerbose,
@@ -139121,7 +139538,7 @@ function registerCantCommand(program) {
           const projectRoot = process.cwd();
           let written = 0;
           for (const outputFile of result.outputFiles) {
-            const outputPath = isAbsolute3(outputFile.path) ? outputFile.path : join129(projectRoot, outputFile.path);
+            const outputPath = isAbsolute3(outputFile.path) ? outputFile.path : join131(projectRoot, outputFile.path);
             mkdirSync33(dirname28(outputPath), { recursive: true });
             writeFileSync24(outputPath, outputFile.content, "utf-8");
             written++;
@@ -139162,7 +139579,7 @@ function resolveFilePath(file2) {
   return isAbsolute3(file2) ? file2 : resolve16(process.cwd(), file2);
 }
 function ensureExists(filePath, operation) {
-  if (existsSync132(filePath)) return true;
+  if (existsSync133(filePath)) return true;
   cliError(`File not found: ${filePath}`, "E_FILE_READ");
   process.exitCode = 3;
   if (process.env["CLEO_DEBUG"]) {
@@ -139204,7 +139621,7 @@ async function loadMigrateEngine() {
 
 // packages/cleo/src/cli/commands/chain.ts
 init_cli();
-import { readFileSync as readFileSync102 } from "node:fs";
+import { readFileSync as readFileSync104 } from "node:fs";
 function registerChainCommand(program) {
   const chain = program.command("chain").description("WarpChain pipeline management (tier-2 orchestrator)");
   chain.command("show <chainId>").description("Show details for a WarpChain definition").action(async (chainId) => {
@@ -139214,7 +139631,7 @@ function registerChainCommand(program) {
     await dispatchFromCli("query", "pipeline", "chain.list", {}, { command: "chain" });
   });
   chain.command("add <file>").description("Add a new WarpChain definition from a JSON file").action(async (file2) => {
-    const chainJson = JSON.parse(readFileSync102(file2, "utf-8"));
+    const chainJson = JSON.parse(readFileSync104(file2, "utf-8"));
     await dispatchFromCli(
       "mutate",
       "pipeline",
@@ -139283,10 +139700,10 @@ function registerCheckCommand(program) {
     );
   });
   check2.command("chain-validate <file>").description("Validate a WarpChain definition from a JSON file").action(async (file2) => {
-    const { readFileSync: readFileSync108 } = await import("node:fs");
+    const { readFileSync: readFileSync110 } = await import("node:fs");
     let chain;
     try {
-      chain = JSON.parse(readFileSync108(file2, "utf8"));
+      chain = JSON.parse(readFileSync110(file2, "utf8"));
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       console.error(`Failed to read or parse chain file: ${message}`);
@@ -139300,6 +139717,9 @@ function registerCheckCommand(program) {
       { command: "check", operation: "check.chain.validate" }
     );
   });
+  check2.command("canon").description("CI gate: detect canon drift between docs and live code").action(async () => {
+    await dispatchFromCli("query", "check", "canon", {}, { command: "check" });
+  });
   check2.command("protocol <protocolType>").description(
     `Validate any of the 12 RCASD-IVTR+C protocols: ${SUPPORTED_PROTOCOL_TYPES.join(", ")}`
   ).option("--task-id <id>", "Task ID to validate (mode=task, default)").option("--manifest-file <file>", "Manifest file to validate (mode=manifest)").option("--strict", "Exit with error code on violations").option("--voting-matrix-file <file>", "consensus: voting matrix JSON file").option("--epic-id <id>", "decomposition: parent epic ID").option("--sibling-count <n>", "decomposition: actual sibling count", Number).option("--max-siblings <n>", "decomposition: configured max siblings", Number).option("--spec-file <file>", "specification: path to spec markdown").option("--has-code-changes", "research: code changes detected (forbidden)").option("--has-task-tags", "implementation: @task tags present in code").option("--has-contribution-tags", "contribution: @contribution tags present").option("--version <v>", "release: target version (semver/calver)").option("--has-changelog", "release: changelog updated").option(
@@ -139805,20 +140225,20 @@ function registerCurrentCommand(program) {
 
 // packages/cleo/src/cli/commands/daemon.ts
 import { homedir as homedir10 } from "node:os";
-import { join as join133 } from "node:path";
+import { join as join135 } from "node:path";
 
 // packages/cleo/src/gc/daemon.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir20 } from "node:fs/promises";
-import { join as join132 } from "node:path";
+import { join as join134 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import cron from "node-cron";
 
 // packages/cleo/src/gc/runner.ts
 import { lstat as lstat2, readdir as readdir4, rm as rm3, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { join as join131 } from "node:path";
+import { join as join133 } from "node:path";
 
 // node_modules/.pnpm/check-disk-space@3.4.0/node_modules/check-disk-space/dist/check-disk-space.mjs
 import { execFile as execFile7 } from "node:child_process";
@@ -139957,7 +140377,7 @@ function checkDiskSpace(directoryPath, dependencies = {
 
 // packages/cleo/src/gc/state.ts
 import { mkdir as mkdir19, readFile as readFile22, rename as rename2, writeFile as writeFile14 } from "node:fs/promises";
-import { dirname as dirname29, join as join130 } from "node:path";
+import { dirname as dirname29, join as join132 } from "node:path";
 var GC_STATE_SCHEMA_VERSION = "1.0";
 var DEFAULT_GC_STATE = {
   schemaVersion: GC_STATE_SCHEMA_VERSION,
@@ -139985,7 +140405,7 @@ async function readGCState(statePath) {
 async function writeGCState(statePath, state) {
   const dir = dirname29(statePath);
   await mkdir19(dir, { recursive: true });
-  const tmpPath = join130(dir, `.gc-state-${process.pid}.tmp`);
+  const tmpPath = join132(dir, `.gc-state-${process.pid}.tmp`);
   const json3 = JSON.stringify(state, null, 2);
   await writeFile14(tmpPath, json3, "utf-8");
   await rename2(tmpPath, statePath);
@@ -140034,7 +140454,7 @@ async function getPathBytes(targetPath) {
     const entries = await readdir4(targetPath, { withFileTypes: true });
     let total = 0;
     for (const entry of entries) {
-      total += await getPathBytes(join131(targetPath, entry.name));
+      total += await getPathBytes(join133(targetPath, entry.name));
     }
     return total;
   } catch {
@@ -140051,7 +140471,7 @@ async function idempotentRm(targetPath) {
   }
 }
 async function gatherPruneCandidates(maxAgeMs, projectsDir) {
-  const resolvedProjectsDir = projectsDir ?? join131(homedir9(), ".claude", "projects");
+  const resolvedProjectsDir = projectsDir ?? join133(homedir9(), ".claude", "projects");
   const candidates = [];
   const now2 = Date.now();
   let projectSlugs;
@@ -140062,7 +140482,7 @@ async function gatherPruneCandidates(maxAgeMs, projectsDir) {
     return candidates;
   }
   for (const slug of projectSlugs) {
-    const slugDir = join131(resolvedProjectsDir, slug);
+    const slugDir = join133(resolvedProjectsDir, slug);
     let slugEntries;
     try {
       slugEntries = await readdir4(slugDir, { withFileTypes: true });
@@ -140070,7 +140490,7 @@ async function gatherPruneCandidates(maxAgeMs, projectsDir) {
       continue;
     }
     for (const entry of slugEntries) {
-      const entryPath = join131(slugDir, entry.name);
+      const entryPath = join133(slugDir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".jsonl")) {
         try {
           const info = await stat4(entryPath);
@@ -140095,8 +140515,8 @@ async function gatherPruneCandidates(maxAgeMs, projectsDir) {
   return candidates;
 }
 async function runGC(opts = {}) {
-  const cleoDir = opts.cleoDir ?? join131(homedir9(), ".cleo");
-  const statePath = join131(cleoDir, "gc-state.json");
+  const cleoDir = opts.cleoDir ?? join133(homedir9(), ".cleo");
+  const statePath = join133(cleoDir, "gc-state.json");
   const dryRun = opts.dryRun ?? false;
   const projectsDir = opts.projectsDir;
   const initialState = await readGCState(statePath);
@@ -140169,13 +140589,13 @@ async function runGC(opts = {}) {
 // packages/cleo/src/gc/daemon.ts
 var GC_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 async function spawnGCDaemon(cleoDir) {
-  const logsDir = join132(cleoDir, "logs");
+  const logsDir = join134(cleoDir, "logs");
   await mkdir20(logsDir, { recursive: true });
-  const logPath = join132(logsDir, "gc.log");
-  const errPath = join132(logsDir, "gc.err");
+  const logPath = join134(logsDir, "gc.log");
+  const errPath = join134(logsDir, "gc.err");
   const outStream = createWriteStream2(logPath, { flags: "a" });
   const errStream = createWriteStream2(errPath, { flags: "a" });
-  const daemonEntry = join132(fileURLToPath8(import.meta.url), "..", "daemon-entry.js");
+  const daemonEntry = join134(fileURLToPath8(import.meta.url), "..", "daemon-entry.js");
   const child = spawn2(process.execPath, [daemonEntry, cleoDir], {
     detached: true,
     stdio: ["ignore", outStream, errStream],
@@ -140183,14 +140603,14 @@ async function spawnGCDaemon(cleoDir) {
   });
   child.unref();
   const pid = child.pid ?? 0;
-  await patchGCState(join132(cleoDir, "gc-state.json"), {
+  await patchGCState(join134(cleoDir, "gc-state.json"), {
     daemonPid: pid,
     daemonStartedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   return pid;
 }
 async function stopGCDaemon(cleoDir) {
-  const statePath = join132(cleoDir, "gc-state.json");
+  const statePath = join134(cleoDir, "gc-state.json");
   const state = await readGCState(statePath);
   const pid = state.daemonPid;
   if (!pid) {
@@ -140216,7 +140636,7 @@ async function stopGCDaemon(cleoDir) {
   }
 }
 async function getGCDaemonStatus(cleoDir) {
-  const state = await readGCState(join132(cleoDir, "gc-state.json"));
+  const state = await readGCState(join134(cleoDir, "gc-state.json"));
   const pid = state.daemonPid;
   let running = false;
   if (pid) {
@@ -140241,7 +140661,7 @@ async function getGCDaemonStatus(cleoDir) {
 function registerDaemonCommand(program) {
   const daemon = program.command("daemon").description("Manage the CLEO GC sidecar daemon for autonomous transcript cleanup");
   daemon.command("start").description("Spawn the GC daemon as a detached background process").option("--cleo-dir <path>", "Override .cleo/ directory path").option("--json", "Output result as JSON").action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join133(homedir10(), ".cleo");
+    const cleoDir = opts.cleoDir ?? join135(homedir10(), ".cleo");
     try {
       const status = await getGCDaemonStatus(cleoDir);
       if (status.running && status.pid) {
@@ -140271,7 +140691,7 @@ function registerDaemonCommand(program) {
       } else {
         process.stdout.write(`GC daemon started (PID ${pid})
 `);
-        process.stdout.write(`Logs: ${join133(cleoDir, "logs", "gc.log")}
+        process.stdout.write(`Logs: ${join135(cleoDir, "logs", "gc.log")}
 `);
       }
     } catch (err) {
@@ -140287,7 +140707,7 @@ function registerDaemonCommand(program) {
     }
   });
   daemon.command("stop").description("Stop the GC daemon by sending SIGTERM to its PID").option("--cleo-dir <path>", "Override .cleo/ directory path").option("--json", "Output result as JSON").action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join133(homedir10(), ".cleo");
+    const cleoDir = opts.cleoDir ?? join135(homedir10(), ".cleo");
     try {
       const stopResult = await stopGCDaemon(cleoDir);
       const result = {
@@ -140316,11 +140736,11 @@ function registerDaemonCommand(program) {
     }
   });
   daemon.command("status").description("Show daemon running state, PID, last GC run, and disk usage").option("--cleo-dir <path>", "Override .cleo/ directory path").option("--json", "Output result as JSON").action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join133(homedir10(), ".cleo");
+    const cleoDir = opts.cleoDir ?? join135(homedir10(), ".cleo");
     await showDaemonStatus(cleoDir, opts.json ?? false);
   });
   daemon.action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join133(homedir10(), ".cleo");
+    const cleoDir = opts.cleoDir ?? join135(homedir10(), ".cleo");
     await showDaemonStatus(cleoDir, opts.json ?? false);
   });
 }
@@ -140510,12 +140930,12 @@ function registerDetectCommand(program) {
 // packages/cleo/src/cli/commands/detect-drift.ts
 init_src();
 init_renderers();
-import { existsSync as existsSync133, readdirSync as readdirSync41, readFileSync as readFileSync103 } from "node:fs";
-import { dirname as dirname30, join as join134 } from "node:path";
+import { existsSync as existsSync134, readdirSync as readdirSync41, readFileSync as readFileSync105 } from "node:fs";
+import { dirname as dirname30, join as join136 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
-    if (existsSync133(join134(currentDir, "package.json"))) {
+    if (existsSync134(join136(currentDir, "package.json"))) {
       return currentDir;
     }
     const parent = dirname30(currentDir);
@@ -140527,11 +140947,11 @@ function findProjectRoot() {
 function registerDetectDriftCommand(program) {
   program.command("detect-drift").description("Detect documentation drift against TypeScript source of truth").action(async () => {
     const projectRoot = findProjectRoot();
-    const isCleoRepo = existsSync133(join134(projectRoot, "packages", "cleo", "src"));
-    const cleoSrcRoot = isCleoRepo ? join134(projectRoot, "packages", "cleo", "src") : join134(projectRoot, "src");
+    const isCleoRepo = existsSync134(join136(projectRoot, "packages", "cleo", "src"));
+    const cleoSrcRoot = isCleoRepo ? join136(projectRoot, "packages", "cleo", "src") : join136(projectRoot, "src");
     const safeRead = (filePath) => {
       try {
-        return readFileSync103(filePath, "utf-8");
+        return readFileSync105(filePath, "utf-8");
       } catch {
         return "";
       }
@@ -140542,8 +140962,8 @@ function registerDetectDriftCommand(program) {
         checks: [],
         recommendations: []
       };
-      const injPath = join134(projectRoot, ".cleo", "templates", "CLEO-INJECTION.md");
-      if (existsSync133(injPath)) {
+      const injPath = join136(projectRoot, ".cleo", "templates", "CLEO-INJECTION.md");
+      if (existsSync134(injPath)) {
         const content = safeRead(injPath);
         userResult.checks.push({
           name: "Agent injection",
@@ -140594,10 +141014,10 @@ function registerDetectDriftCommand(program) {
       }
     };
     try {
-      const specPath = join134(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
-      const registryPath = join134(cleoSrcRoot, "dispatch", "registry.ts");
-      const dispatchDomainsDir = join134(cleoSrcRoot, "dispatch", "domains");
-      if (!existsSync133(specPath)) {
+      const specPath = join136(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
+      const registryPath = join136(cleoSrcRoot, "dispatch", "registry.ts");
+      const dispatchDomainsDir = join136(cleoSrcRoot, "dispatch", "domains");
+      if (!existsSync134(specPath)) {
         addCheck("Gateway-to-spec sync", "fail", "CLEO-OPERATION-CONSTITUTION.md missing", [
           {
             severity: "error",
@@ -140607,7 +141027,7 @@ function registerDetectDriftCommand(program) {
             recommendation: "Create docs/specs/CLEO-OPERATION-CONSTITUTION.md with canonical operation definitions"
           }
         ]);
-      } else if (!existsSync133(registryPath) || !existsSync133(dispatchDomainsDir)) {
+      } else if (!existsSync134(registryPath) || !existsSync134(dispatchDomainsDir)) {
         addCheck("Gateway-to-spec sync", "fail", "Dispatch registry or domains missing", [
           {
             severity: "error",
@@ -140671,9 +141091,9 @@ function registerDetectDriftCommand(program) {
       ]);
     }
     try {
-      const cliDir = join134(cleoSrcRoot, "cli", "commands");
-      const coreDir = isCleoRepo ? join134(projectRoot, "packages", "core", "src") : join134(projectRoot, "src", "core");
-      if (!existsSync133(cliDir)) {
+      const cliDir = join136(cleoSrcRoot, "cli", "commands");
+      const coreDir = isCleoRepo ? join136(projectRoot, "packages", "core", "src") : join136(projectRoot, "src", "core");
+      if (!existsSync134(cliDir)) {
         addCheck("CLI-to-core sync", "fail", "CLI commands directory missing", [
           {
             severity: "error",
@@ -140682,7 +141102,7 @@ function registerDetectDriftCommand(program) {
             recommendation: "Verify TypeScript source structure is intact"
           }
         ]);
-      } else if (!existsSync133(coreDir)) {
+      } else if (!existsSync134(coreDir)) {
         addCheck("CLI-to-core sync", "fail", "Core directory missing", [
           {
             severity: "error",
@@ -140701,8 +141121,8 @@ function registerDetectDriftCommand(program) {
       addCheck("CLI-to-core sync", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const domainsDir = join134(cleoSrcRoot, "dispatch", "domains");
-      if (!existsSync133(domainsDir)) {
+      const domainsDir = join136(cleoSrcRoot, "dispatch", "domains");
+      if (!existsSync134(domainsDir)) {
         addCheck("Domain handler coverage", "fail", "Dispatch domains directory missing", [
           {
             severity: "error",
@@ -140719,8 +141139,8 @@ function registerDetectDriftCommand(program) {
       addCheck("Domain handler coverage", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const matrixPath = join134(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
-      if (!existsSync133(matrixPath)) {
+      const matrixPath = join136(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
+      if (!existsSync134(matrixPath)) {
         addCheck("Capability matrix", "fail", "Capability matrix missing", [
           {
             severity: "error",
@@ -140736,8 +141156,8 @@ function registerDetectDriftCommand(program) {
       addCheck("Capability matrix", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const schemaPath = join134(projectRoot, "src", "store", "schema.ts");
-      if (!existsSync133(schemaPath)) {
+      const schemaPath = join136(projectRoot, "src", "store", "schema.ts");
+      if (!existsSync134(schemaPath)) {
         addCheck("Schema validation", "fail", "Schema definition missing", [
           {
             severity: "error",
@@ -140771,10 +141191,10 @@ function registerDetectDriftCommand(program) {
       addCheck("Schema validation", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const visionPath = join134(projectRoot, "docs", "concepts", "CLEO-VISION.md");
-      const specPath = join134(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
+      const visionPath = join136(projectRoot, "docs", "concepts", "CLEO-VISION.md");
+      const specPath = join136(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
       const issues = [];
-      if (!existsSync133(visionPath)) {
+      if (!existsSync134(visionPath)) {
         issues.push({
           severity: "error",
           category: "vision",
@@ -140783,7 +141203,7 @@ function registerDetectDriftCommand(program) {
           recommendation: "Create docs/concepts/CLEO-VISION.md with project vision"
         });
       }
-      if (!existsSync133(specPath)) {
+      if (!existsSync134(specPath)) {
         issues.push({
           severity: "error",
           category: "spec",
@@ -140827,8 +141247,8 @@ function registerDetectDriftCommand(program) {
       addCheck("Canonical identity", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const injectionPath = join134(projectRoot, ".cleo", "templates", "CLEO-INJECTION.md");
-      if (!existsSync133(injectionPath)) {
+      const injectionPath = join136(projectRoot, ".cleo", "templates", "CLEO-INJECTION.md");
+      if (!existsSync134(injectionPath)) {
         addCheck("Agent injection", "fail", "Agent injection template missing", [
           {
             severity: "error",
@@ -140857,8 +141277,8 @@ function registerDetectDriftCommand(program) {
       addCheck("Agent injection", "fail", `Error: ${getErrorMessage(e)}`);
     }
     try {
-      const exitCodesPath = join134(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
-      if (!existsSync133(exitCodesPath)) {
+      const exitCodesPath = join136(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
+      if (!existsSync134(exitCodesPath)) {
         addCheck("Exit codes", "fail", "Exit codes definition missing", [
           {
             severity: "error",
@@ -140935,9 +141355,9 @@ function registerDiagnosticsCommand(program) {
 init_internal();
 init_renderers();
 import { readdir as readdir5, readFile as readFile23 } from "node:fs/promises";
-import { join as join135 } from "node:path";
+import { join as join137 } from "node:path";
 async function getScriptNames(projectRoot) {
-  const scriptsDir = join135(projectRoot, "scripts");
+  const scriptsDir = join137(projectRoot, "scripts");
   try {
     const files = await readdir5(scriptsDir);
     return files.filter((f2) => f2.endsWith(".sh")).map((f2) => f2.replace(".sh", "")).sort();
@@ -140946,7 +141366,7 @@ async function getScriptNames(projectRoot) {
   }
 }
 async function getIndexedCommands(projectRoot) {
-  const indexPath = join135(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
+  const indexPath = join137(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
   const index2 = await readJson(indexPath);
   if (!index2) return [];
   return index2.commands.map((c) => c.name).sort();
@@ -140979,7 +141399,7 @@ async function runGapCheck(_projectRoot, filterId) {
     const reviewFiles = files.filter((f2) => f2.endsWith(".md"));
     for (const file2 of reviewFiles) {
       if (filterId && !file2.includes(filterId)) continue;
-      const filePath = join135(reviewDir, file2);
+      const filePath = join137(reviewDir, file2);
       const content = await readFile23(filePath, "utf-8");
       const taskMatch = file2.match(/^(T\d+)/);
       const taskId = taskMatch ? taskMatch[1] : "UNKNOWN";
@@ -141528,11 +141948,11 @@ function registerFindCommand(program) {
 
 // packages/cleo/src/cli/commands/gc.ts
 import { homedir as homedir11 } from "node:os";
-import { join as join136 } from "node:path";
+import { join as join138 } from "node:path";
 function registerGCCommand(program) {
   const gc = program.command("gc").description("Transcript garbage collection: manual trigger and status");
   gc.command("run").description("Run GC immediately (blocking). Prunes old transcripts based on disk pressure.").option("--cleo-dir <path>", "Override .cleo/ directory path").option("--dry-run", "Report what would be pruned without deleting anything").option("--json", "Output result as JSON").action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join136(homedir11(), ".cleo");
+    const cleoDir = opts.cleoDir ?? join138(homedir11(), ".cleo");
     const dryRun = opts.dryRun ?? false;
     try {
       const gcResult = await runGC({ cleoDir, dryRun });
@@ -141570,8 +141990,8 @@ WARNING: ${gcResult.escalationReason}
     }
   });
   gc.command("status").description("Show last GC run stats, disk usage, and escalation state").option("--cleo-dir <path>", "Override .cleo/ directory path").option("--json", "Output result as JSON").action(async (opts) => {
-    const cleoDir = opts.cleoDir ?? join136(homedir11(), ".cleo");
-    const statePath = join136(cleoDir, "gc-state.json");
+    const cleoDir = opts.cleoDir ?? join138(homedir11(), ".cleo");
+    const statePath = join138(cleoDir, "gc-state.json");
     try {
       const state = await readGCState(statePath);
       const result = { success: true, data: state };
@@ -141624,12 +142044,12 @@ init_src();
 init_src3();
 init_renderers();
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync134, mkdirSync as mkdirSync34, readFileSync as readFileSync104, writeFileSync as writeFileSync25 } from "node:fs";
-import { dirname as dirname31, join as join137 } from "node:path";
+import { existsSync as existsSync135, mkdirSync as mkdirSync34, readFileSync as readFileSync106, writeFileSync as writeFileSync25 } from "node:fs";
+import { dirname as dirname31, join as join139 } from "node:path";
 function getChangelogSource(cwd) {
   const configPath = getConfigPath(cwd);
   try {
-    const config2 = JSON.parse(readFileSync104(configPath, "utf-8"));
+    const config2 = JSON.parse(readFileSync106(configPath, "utf-8"));
     return config2?.release?.changelog?.source ?? "CHANGELOG.md";
   } catch {
     return "CHANGELOG.md";
@@ -141638,7 +142058,7 @@ function getChangelogSource(cwd) {
 function getEnabledPlatforms(cwd) {
   const configPath = getConfigPath(cwd);
   try {
-    const config2 = JSON.parse(readFileSync104(configPath, "utf-8"));
+    const config2 = JSON.parse(readFileSync106(configPath, "utf-8"));
     const outputs = config2?.release?.changelog?.outputs ?? [];
     return outputs.filter((o) => o.enabled);
   } catch {
@@ -141763,11 +142183,11 @@ function registerGenerateChangelogCommand(program) {
       const targetPlatform = opts["platform"];
       const dryRun = !!opts["dryRun"];
       const sourceFile = getChangelogSource();
-      const sourcePath = join137(getProjectRoot(), sourceFile);
-      if (!existsSync134(sourcePath)) {
+      const sourcePath = join139(getProjectRoot(), sourceFile);
+      if (!existsSync135(sourcePath)) {
         throw new CleoError(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
       }
-      const sourceContent = readFileSync104(sourcePath, "utf-8");
+      const sourceContent = readFileSync106(sourcePath, "utf-8");
       const repoSlug = getGitHubRepoSlug();
       const results = [];
       if (targetPlatform) {
@@ -141776,7 +142196,7 @@ function registerGenerateChangelogCommand(program) {
         const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
         const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
         if (!dryRun) {
-          const fullPath = join137(getProjectRoot(), outputPath);
+          const fullPath = join139(getProjectRoot(), outputPath);
           mkdirSync34(dirname31(fullPath), { recursive: true });
           writeFileSync25(fullPath, content, "utf-8");
         }
@@ -141797,7 +142217,7 @@ function registerGenerateChangelogCommand(program) {
             limit
           );
           if (!dryRun) {
-            const fullPath = join137(getProjectRoot(), platformConfig.path);
+            const fullPath = join139(getProjectRoot(), platformConfig.path);
             mkdirSync34(dirname31(fullPath), { recursive: true });
             writeFileSync25(fullPath, content, "utf-8");
           }
@@ -142384,9 +142804,9 @@ init_internal();
 init_cli();
 init_renderers();
 import { createHash as createHash20 } from "node:crypto";
-import { existsSync as existsSync135, mkdirSync as mkdirSync35, readdirSync as readdirSync42, readFileSync as readFileSync105, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync136, mkdirSync as mkdirSync35, readdirSync as readdirSync42, readFileSync as readFileSync107, writeFileSync as writeFileSync26 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
-import { join as join138 } from "node:path";
+import { join as join140 } from "node:path";
 function parseMemoryFileFrontmatter(raw) {
   const lines = raw.split("\n");
   if (!lines[0]?.trim().startsWith("---")) {
@@ -142419,8 +142839,8 @@ ${body}`).digest("hex").slice(0, 16);
 }
 function loadImportHashes(stateFile) {
   try {
-    if (!existsSync135(stateFile)) return /* @__PURE__ */ new Set();
-    const raw = readFileSync105(stateFile, "utf-8");
+    if (!existsSync136(stateFile)) return /* @__PURE__ */ new Set();
+    const raw = readFileSync107(stateFile, "utf-8");
     const parsed = JSON.parse(raw);
     return new Set(parsed.hashes);
   } catch {
@@ -142429,7 +142849,7 @@ function loadImportHashes(stateFile) {
 }
 function saveImportHashes(stateFile, hashes) {
   const dir = stateFile.slice(0, stateFile.lastIndexOf("/"));
-  if (!existsSync135(dir)) mkdirSync35(dir, { recursive: true });
+  if (!existsSync136(dir)) mkdirSync35(dir, { recursive: true });
   writeFileSync26(stateFile, JSON.stringify({ hashes: [...hashes] }, null, 2), "utf-8");
 }
 function registerMemoryBrainCommand(program) {
@@ -143128,12 +143548,12 @@ Found ${totalDups} duplicate rows across ${groups.length} groups:`);
     "--from <dir>",
     "Source directory containing *.md memory files (default: ~/.claude/projects/-mnt-projects-cleocode/memory)"
   ).option("--dry-run", "Print what would be imported without writing to brain.db").option("--json", "Output results as JSON").action(async (opts) => {
-    const sourceDir = opts.from ?? join138(homedir12(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
+    const sourceDir = opts.from ?? join140(homedir12(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
     const isDryRun = !!opts.dryRun;
     const isJson = !!opts.json;
     const projectRoot = getProjectRoot();
-    const stateFile = join138(projectRoot, ".cleo", "migrate-memory-hashes.json");
-    if (!existsSync135(sourceDir)) {
+    const stateFile = join140(projectRoot, ".cleo", "migrate-memory-hashes.json");
+    if (!existsSync136(sourceDir)) {
       const msg = `Source directory not found: ${sourceDir}`;
       if (isJson) {
         console.log(JSON.stringify({ success: false, error: msg }));
@@ -143142,7 +143562,7 @@ Found ${totalDups} duplicate rows across ${groups.length} groups:`);
       }
       process.exit(1);
     }
-    const files = readdirSync42(sourceDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md").map((f2) => join138(sourceDir, f2));
+    const files = readdirSync42(sourceDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md").map((f2) => join140(sourceDir, f2));
     const importedHashes = isDryRun ? /* @__PURE__ */ new Set() : loadImportHashes(stateFile);
     const stats2 = { total: files.length, imported: 0, skipped: 0, errors: 0 };
     const importedEntries = [];
@@ -143157,7 +143577,7 @@ Found ${totalDups} duplicate rows across ${groups.length} groups:`);
     for (const filePath of files) {
       const fileName = filePath.split("/").pop() ?? filePath;
       try {
-        const raw = readFileSync105(filePath, "utf-8");
+        const raw = readFileSync107(filePath, "utf-8");
         if (!raw.trim()) {
           stats2.skipped++;
           skippedEntries.push({ file: fileName, reason: "empty file" });
@@ -145097,11 +145517,11 @@ function registerNexusCommand(program) {
     const rawRoots = typeof opts["roots"] === "string" && opts["roots"].trim().length > 0 ? opts["roots"].split(",").map((r) => r.trim()).filter((r) => r.length > 0).map(
       (r) => r.startsWith("~") ? path10.join(home, r.slice(1)) : path10.resolve(r)
     ) : defaultRoots;
-    const { existsSync: existsSync136, readdirSync: readdirSync43, statSync: statSync22 } = await import("node:fs");
+    const { existsSync: existsSync137, readdirSync: readdirSync43, statSync: statSync22 } = await import("node:fs");
     const { Dirent } = await import("node:fs");
     const roots = rawRoots.filter((r) => {
       try {
-        return existsSync136(r) && statSync22(r).isDirectory();
+        return existsSync137(r) && statSync22(r).isDirectory();
       } catch {
         return false;
       }
@@ -147518,7 +147938,7 @@ init_src();
 init_internal();
 import { execFile as execFile8 } from "node:child_process";
 import { readFile as readFile24 } from "node:fs/promises";
-import { join as join139 } from "node:path";
+import { join as join141 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify as promisify8 } from "node:util";
 init_renderers();
@@ -147527,7 +147947,7 @@ var GITHUB_REPO = BUILD_CONFIG.repository.fullName;
 async function getCurrentVersion() {
   const cleoHome = getCleoHome();
   try {
-    const content = await readFile24(join139(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile24(join141(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -147581,7 +148001,7 @@ async function writeRuntimeVersionMetadata(mode, source, version2) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile16, mkdir: mkdir22 }) => mkdir22(cleoHome, { recursive: true }).then(
-      () => writeFile16(join139(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile16(join141(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -148634,10 +149054,10 @@ function registerSyncCommand(program) {
     "How to resolve conflicts: keep-cleo, keep-external, or newest (default: keep-cleo)",
     "keep-cleo"
   ).action(async (file2, opts) => {
-    const { readFileSync: readFileSync108 } = await import("node:fs");
+    const { readFileSync: readFileSync110 } = await import("node:fs");
     let externalTasks;
     try {
-      externalTasks = JSON.parse(readFileSync108(file2, "utf8"));
+      externalTasks = JSON.parse(readFileSync110(file2, "utf8"));
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       console.error(`Failed to read or parse external tasks file: ${message}`);
@@ -148733,11 +149153,11 @@ function registerTestingCommand(program) {
 init_internal();
 init_cli();
 init_renderers();
-import { readFileSync as readFileSync106 } from "node:fs";
+import { readFileSync as readFileSync108 } from "node:fs";
 function readPayload(opts, textKey, fileKey) {
   const text3 = opts[textKey];
   const file2 = opts[fileKey];
-  if (file2) return readFileSync106(file2, "utf-8");
+  if (file2) return readFileSync108(file2, "utf-8");
   return text3;
 }
 function registerTokenCommand(program) {
@@ -148839,12 +149259,12 @@ function registerTokenCommand(program) {
 // packages/cleo/src/cli/commands/transcript.ts
 init_src3();
 import { homedir as homedir14 } from "node:os";
-import { join as join141 } from "node:path";
+import { join as join143 } from "node:path";
 
 // packages/cleo/src/gc/transcript.ts
 import { lstat as lstat3, readdir as readdir6, stat as stat5 } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
-import { join as join140 } from "node:path";
+import { join as join142 } from "node:path";
 var HOT_MAX_MS = 24 * 60 * 60 * 1e3;
 var WARM_MAX_MS = 7 * 24 * 60 * 60 * 1e3;
 function classifyTranscriptTier(ageMs) {
@@ -148856,7 +149276,7 @@ function parseSessionId(filename) {
   return filename.replace(/\.jsonl$/, "");
 }
 async function scanTranscripts(projectsDir) {
-  const resolvedProjectsDir = projectsDir ?? join140(homedir13(), ".claude", "projects");
+  const resolvedProjectsDir = projectsDir ?? join142(homedir13(), ".claude", "projects");
   const now2 = Date.now();
   const hot = [];
   const warm = [];
@@ -148869,7 +149289,7 @@ async function scanTranscripts(projectsDir) {
     return { totalSessions: 0, hot, warm, totalBytes, projectsDir: resolvedProjectsDir };
   }
   for (const slug of slugs) {
-    const slugDir = join140(resolvedProjectsDir, slug);
+    const slugDir = join142(resolvedProjectsDir, slug);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -148878,7 +149298,7 @@ async function scanTranscripts(projectsDir) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-      const jsonlPath = join140(slugDir, entry.name);
+      const jsonlPath = join142(slugDir, entry.name);
       const sessionId = parseSessionId(entry.name);
       let fileInfo;
       try {
@@ -148890,7 +149310,7 @@ async function scanTranscripts(projectsDir) {
       const ageMs = now2 - mtimeMs;
       const tier = classifyTranscriptTier(ageMs);
       const bytes = fileInfo.size;
-      const candidateSessionDir = join140(slugDir, sessionId);
+      const candidateSessionDir = join142(slugDir, sessionId);
       let sessionDir = null;
       let sessionDirBytes = 0;
       try {
@@ -148932,7 +149352,7 @@ async function pruneTranscripts(opts) {
   const deletedPaths = [];
   let bytesFreed = 0;
   let pruned = 0;
-  const resolvedProjectsDir = projectsDir ?? join140(homedir13(), ".claude", "projects");
+  const resolvedProjectsDir = projectsDir ?? join142(homedir13(), ".claude", "projects");
   let slugs;
   try {
     const entries = await readdir6(resolvedProjectsDir, { withFileTypes: true });
@@ -148941,7 +149361,7 @@ async function pruneTranscripts(opts) {
     return { pruned: 0, bytesFreed: 0, deletedPaths: [], dryRun };
   }
   for (const slug of slugs) {
-    const slugDir = join140(resolvedProjectsDir, slug);
+    const slugDir = join142(resolvedProjectsDir, slug);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -148950,7 +149370,7 @@ async function pruneTranscripts(opts) {
     }
     for (const entry of entries) {
       if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-      const jsonlPath = join140(slugDir, entry.name);
+      const jsonlPath = join142(slugDir, entry.name);
       let fileInfo;
       try {
         fileInfo = await stat5(jsonlPath);
@@ -148960,7 +149380,7 @@ async function pruneTranscripts(opts) {
       const ageMs = now2 - fileInfo.mtimeMs;
       if (ageMs <= effectiveMaxAgeMs) continue;
       const sessionId = parseSessionId(entry.name);
-      const sessionDir = join140(slugDir, sessionId);
+      const sessionDir = join142(slugDir, sessionId);
       const jsonlBytes = fileInfo.size;
       let sessionDirBytes = 0;
       try {
@@ -149049,7 +149469,7 @@ function registerTranscriptCommand(program) {
       }
       return;
     }
-    const projectsDir = opts.projectsDir ?? join141(homedir14(), ".claude", "projects");
+    const projectsDir = opts.projectsDir ?? join143(homedir14(), ".claude", "projects");
     try {
       const result = await scanTranscripts(projectsDir);
       const envelope = {
@@ -149356,7 +149776,7 @@ Tier breakdown:
         process.exit(2);
         return;
       }
-      const projectsDir = opts.projectsDir ?? join141(homedir14(), ".claude", "projects");
+      const projectsDir = opts.projectsDir ?? join143(homedir14(), ".claude", "projects");
       try {
         const pruneResult = await pruneTranscripts({
           olderThanMs,
@@ -149567,16 +149987,16 @@ init_src3();
 init_renderers();
 import { execFileSync as execFileSync18, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir21, open, readFile as readFile25, rm as rm4, stat as stat6, writeFile as writeFile15 } from "node:fs/promises";
-import { join as join142 } from "node:path";
+import { join as join144 } from "node:path";
 var DEFAULT_PORT = 3456;
 var DEFAULT_HOST = "127.0.0.1";
 function getWebPaths() {
   const cleoHome = getCleoHome();
   return {
-    pidFile: join142(cleoHome, "web-server.pid"),
-    configFile: join142(cleoHome, "web-server.json"),
-    logDir: join142(cleoHome, "logs"),
-    logFile: join142(cleoHome, "logs", "web-server.log")
+    pidFile: join144(cleoHome, "web-server.pid"),
+    configFile: join144(cleoHome, "web-server.json"),
+    logDir: join144(cleoHome, "logs"),
+    logFile: join144(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -149615,7 +150035,7 @@ async function startWebServer(port, host) {
     throw new CleoError(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join142(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join144(projectRoot, "packages", "studio", "build");
   await mkdir21(logDir, { recursive: true });
   await writeFile15(
     configFile,
@@ -149625,7 +150045,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join142(studioDir, "index.js");
+  const webIndexPath = join144(studioDir, "index.js");
   try {
     await stat6(webIndexPath);
   } catch {
@@ -149855,9 +150275,9 @@ var codeCommand = defineCommand({
       async run({ args }) {
         await requireTreeSitter();
         const { smartOutline: smartOutline2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
-        const { join: join144 } = await import("node:path");
+        const { join: join146 } = await import("node:path");
         const root = process.cwd();
-        const absPath = args.file.startsWith("/") ? args.file : join144(root, args.file);
+        const absPath = args.file.startsWith("/") ? args.file : join146(root, args.file);
         const result = smartOutline2(absPath, root);
         if (result.errors.length > 0 && result.symbols.length === 0) {
           console.error(`Error: ${result.errors.join(", ")}`);
@@ -149923,9 +150343,9 @@ var codeCommand = defineCommand({
       async run({ args }) {
         await requireTreeSitter();
         const { smartUnfold: smartUnfold2 } = await Promise.resolve().then(() => (init_internal(), internal_exports));
-        const { join: join144 } = await import("node:path");
+        const { join: join146 } = await import("node:path");
         const root = process.cwd();
-        const absPath = args.file.startsWith("/") ? args.file : join144(root, args.file);
+        const absPath = args.file.startsWith("/") ? args.file : join146(root, args.file);
         const result = smartUnfold2(absPath, args.symbol, root);
         if (!result.found) {
           console.error(`Symbol "${args.symbol}" not found in ${args.file}`);
@@ -149944,8 +150364,8 @@ var codeCommand = defineCommand({
 
 // packages/cleo/src/cli/index.ts
 function getPackageVersion() {
-  const pkgPath = join143(dirname32(fileURLToPath9(import.meta.url)), "../../package.json");
-  const pkg = JSON.parse(readFileSync107(pkgPath, "utf-8"));
+  const pkgPath = join145(dirname32(fileURLToPath9(import.meta.url)), "../../package.json");
+  const pkg = JSON.parse(readFileSync109(pkgPath, "utf-8"));
   return pkg.version;
 }
 var CLI_VERSION = getPackageVersion();