@cleocode/cleo 2026.5.0 → 2026.5.2

package/bin/postinstall.js

@@ -154,6 +154,29 @@ async function runPostinstall() {
       console.error('CLEO: Bootstrap detail:', err);
     }
   }
+
+  // Register the CLEO daemon as a user-level system service (systemd / launchd).
+  // This is non-blocking and never fails the install — errors are caught and logged.
+  await installDaemonServiceFromScript();
+}
+
+/**
+ * Install the CLEO daemon as a user-level system service after global install.
+ *
+ * Delegates to the cross-platform installer in scripts/install-daemon-service.mjs.
+ * Always exits cleanly — installation failures are non-fatal.
+ */
+async function installDaemonServiceFromScript() {
+  try {
+    const scriptPath = join(getPackageRoot(), 'scripts', 'install-daemon-service.mjs');
+    const { installDaemonService } = await import(scriptPath);
+    await installDaemonService();
+  } catch (err) {
+    console.log('CLEO: Daemon service registration deferred (will retry on first "cleo daemon install")');
+    if (process.env.CLEO_DEBUG) {
+      console.error('CLEO: Daemon install detail:', err);
+    }
+  }
 }
 
 runPostinstall().catch((err) => {

package/dist/cli/commands/complete.d.ts

@@ -13,8 +13,13 @@
  * when a task touches symbols with CRITICAL impact risk. The acknowledgment is
  * audited to `.cleo/audit/nexus-risk-ack.jsonl`.
  *
+ * As of T1632, `cleo complete <epicId>` is REJECTED with E_EPIC_HAS_PENDING_CHILDREN
+ * when the epic has pending or active children. Pass `--override-reason "<reason>"`
+ * to bypass (audited to `.cleo/audit/premature-close.jsonl`).
+ *
  * @task T4461
  * @task T832
+ * @task T1632
  * @adr ADR-051
  * @epic T4454
  */
@@ -45,5 +50,9 @@ export declare const completeCommand: import("citty").CommandDef<{
         readonly type: "string";
         readonly description: "Reason for acknowledging CRITICAL impact risk (bypasses nexusImpact gate)";
     };
+    readonly 'override-reason': {
+        readonly type: "string";
+        readonly description: "Reason for bypassing E_EPIC_HAS_PENDING_CHILDREN guard (audited to .cleo/audit/premature-close.jsonl)";
+    };
 }>;
 //# sourceMappingURL=complete.d.ts.map

package/dist/cli/commands/complete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/complete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;EAwD1B,CAAC"}
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/complete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D1B,CAAC"}

package/dist/cli/index.js

@@ -416,6 +416,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["VERIFICATION_LOCKED"] = 46] = "VERIFICATION_LOCKED";
       ExitCode2[ExitCode2["ROUND_MISMATCH"] = 47] = "ROUND_MISMATCH";
       ExitCode2[ExitCode2["AC_LOCKED"] = 48] = "AC_LOCKED";
+      ExitCode2[ExitCode2["EPIC_HAS_PENDING_CHILDREN"] = 49] = "EPIC_HAS_PENDING_CHILDREN";
       ExitCode2[ExitCode2["CONTEXT_WARNING"] = 50] = "CONTEXT_WARNING";
       ExitCode2[ExitCode2["CONTEXT_CAUTION"] = 51] = "CONTEXT_CAUTION";
       ExitCode2[ExitCode2["CONTEXT_CRITICAL"] = 52] = "CONTEXT_CRITICAL";
@@ -465,6 +466,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["ALREADY_EXISTS"] = 101] = "ALREADY_EXISTS";
       ExitCode2[ExitCode2["NO_CHANGE"] = 102] = "NO_CHANGE";
       ExitCode2[ExitCode2["TESTS_SKIPPED"] = 103] = "TESTS_SKIPPED";
+      ExitCode2[ExitCode2["DUPLICATE_TASK_LIKELY"] = 105] = "DUPLICATE_TASK_LIKELY";
       ExitCode2[ExitCode2["LAFS_VIOLATION"] = 104] = "LAFS_VIOLATION";
       return ExitCode2;
     })(ExitCode || {});
@@ -24218,7 +24220,9 @@ var init_tasks3 = __esm({
             // T944: orthogonal axes — role is the canonical wire field (ADR-057 D2)
             role: params.role,
             scope: params.scope,
-            severity: params.severity
+            severity: params.severity,
+            // T1633: BRAIN duplicate-bypass flag
+            forceDuplicate: params.forceDuplicate
           }),
           "add"
         );
@@ -24260,7 +24264,11 @@ var init_tasks3 = __esm({
             "complete"
           );
         }
-        const result = await completeTaskStrict(projectRoot, params.taskId, params.notes);
+        const result = await completeTaskStrict(projectRoot, params.taskId, {
+          notes: params.notes,
+          overrideReason: params.overrideReason,
+          acknowledgeRisk: params.acknowledgeRisk
+        });
         setImmediate(async () => {
           try {
             const { trackMemoryUsage } = await import("@cleocode/core/internal");
@@ -25950,7 +25958,7 @@ var init_cli = __esm({
 // packages/cleo/src/cli/index.ts
 import { readFileSync as readFileSync13 } from "node:fs";
 import { dirname as dirname9, join as join19 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import {
   detectAndRemoveLegacyGlobalFiles,
   detectAndRemoveStrayProjectNexus,
@@ -26882,6 +26890,19 @@ var addCommand = defineCommand({
     severity: {
       type: "string",
       description: "Bug severity (P0|P1|P2|P3) \u2014 only valid with --role bug (T944)"
+    },
+    /**
+     * Bypass the E_DUPLICATE_TASK_LIKELY rejection guard.
+     *
+     * When passed, `cleo add` proceeds even if BRAIN similarity scoring
+     * determines the task is very likely a duplicate (score >= 0.92).
+     * The bypass is audited to `.cleo/audit/duplicate-bypass.jsonl`.
+     *
+     * @task T1633
+     */
+    "force-duplicate": {
+      type: "boolean",
+      description: "Bypass BRAIN duplicate-task rejection (audited to .cleo/audit/duplicate-bypass.jsonl) (T1633)"
     }
   },
   async run({ args, cmd }) {
@@ -26916,6 +26937,7 @@ var addCommand = defineCommand({
       params["role"] = params["role"] ?? args.kind;
     if (args.scope !== void 0) params["scope"] = args.scope;
     if (args.severity !== void 0) params["severity"] = args.severity;
+    if (args["force-duplicate"] !== void 0) params["forceDuplicate"] = args["force-duplicate"];
     const inferred = await inferTaskAddParams(getProjectRoot18(), {
       title: args.title,
       description: args.description ?? args.desc,
@@ -33013,6 +33035,10 @@ var completeCommand = defineCommand({
     "acknowledge-risk": {
       type: "string",
       description: "Reason for acknowledging CRITICAL impact risk (bypasses nexusImpact gate)"
+    },
+    "override-reason": {
+      type: "string",
+      description: "Reason for bypassing E_EPIC_HAS_PENDING_CHILDREN guard (audited to .cleo/audit/premature-close.jsonl)"
     }
   },
   async run({ args }) {
@@ -33021,7 +33047,8 @@ var completeCommand = defineCommand({
       notes: args.notes,
       changeset: args.changeset,
       verificationNote: args["verification-note"],
-      acknowledgeRisk: args["acknowledge-risk"]
+      acknowledgeRisk: args["acknowledge-risk"],
+      overrideReason: args["override-reason"]
     });
     if (!response.success) {
       handleRawError(response, { command: "complete", operation: "tasks.complete" });
@@ -33999,31 +34026,93 @@ var currentCommand = defineCommand({
 // packages/cleo/src/cli/commands/daemon.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
-async function showDaemonStatus(cleoDir, json2) {
+import {
+  bootstrapDaemon as bootstrapSentientDaemon,
+  getSentientDaemonStatus
+} from "@cleocode/core/sentient";
+async function showDaemonStatus(cleoDir, projectRoot, json2) {
   try {
-    const status = await getGCDaemonStatus(cleoDir);
-    const result = { success: true, data: status };
+    const gcStatus = await getGCDaemonStatus(cleoDir);
+    let hygieneLastRunAt = null;
+    let hygieneSummary = null;
+    let hygieneStats = {
+      projectsChecked: 0,
+      projectsHealthy: 0,
+      tempGcCandidates: 0,
+      duplicateEpicGroups: 0,
+      worktreesPruned: 0
+    };
+    try {
+      const sentientStatus = await getSentientDaemonStatus(projectRoot);
+      hygieneLastRunAt = sentientStatus.hygieneLastRunAt;
+      hygieneSummary = sentientStatus.hygieneSummary;
+      hygieneStats = sentientStatus.hygieneStats;
+    } catch {
+    }
+    const result = {
+      success: true,
+      data: {
+        gc: gcStatus,
+        hygiene: {
+          lastRunAt: hygieneLastRunAt,
+          summary: hygieneSummary,
+          stats: hygieneStats
+        }
+      }
+    };
     if (json2) {
       process.stdout.write(JSON.stringify(result) + "\n");
     } else {
-      const runningStr = status.running ? `running (PID ${status.pid})` : "stopped";
-      process.stdout.write(`Daemon:       ${runningStr}
+      const runningStr = gcStatus.running ? `running (PID ${gcStatus.pid})` : "stopped";
+      process.stdout.write(`GC Daemon:       ${runningStr}
 `);
-      process.stdout.write(`Started at:   ${status.startedAt ?? "never"}
+      process.stdout.write(`Started at:      ${gcStatus.startedAt ?? "never"}
 `);
-      process.stdout.write(`Last GC run:  ${status.lastRunAt ?? "never"}
+      process.stdout.write(`Last GC run:     ${gcStatus.lastRunAt ?? "never"}
 `);
-      const diskStr = status.lastDiskUsedPct !== null ? `${status.lastDiskUsedPct.toFixed(1)}%` : "unknown";
-      process.stdout.write(`Disk used:    ${diskStr}
+      const diskStr = gcStatus.lastDiskUsedPct !== null ? `${gcStatus.lastDiskUsedPct.toFixed(1)}%` : "unknown";
+      process.stdout.write(`Disk used:       ${diskStr}
 `);
-      if (status.escalationNeeded) {
+      if (gcStatus.escalationNeeded) {
         process.stdout.write(
           `
 WARNING: Disk threshold breached. Run 'cleo gc run' to reclaim space.
 `
         );
       }
+      process.stdout.write(`
+Hygiene Loop (cross-project):
+`);
+      process.stdout.write(`  Last run:        ${hygieneLastRunAt ?? "never"}
+`);
+      process.stdout.write(`  Summary:         ${hygieneSummary ?? "not yet run"}
+`);
+      if (hygieneStats.projectsChecked > 0) {
+        process.stdout.write(
+          `  Projects:        ${hygieneStats.projectsHealthy}/${hygieneStats.projectsChecked} healthy
+`
+        );
+        if (hygieneStats.tempGcCandidates > 0) {
+          process.stdout.write(
+            `  Temp GC:         ${hygieneStats.tempGcCandidates} candidate(s) pending approval
+`
+          );
+        }
+        if (hygieneStats.duplicateEpicGroups > 0) {
+          process.stdout.write(
+            `  Duplicate epics: ${hygieneStats.duplicateEpicGroups} group(s) detected
+`
+          );
+        }
+        if (hygieneStats.worktreesPruned > 0) {
+          process.stdout.write(
+            `  Worktrees:       ${hygieneStats.worktreesPruned} stale worktree(s) pruned
+`
+          );
+        }
+      }
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -34038,6 +34127,11 @@ WARNING: Disk threshold breached. Run 'cleo gc run' to reclaim space.
     process.exit(1);
   }
 }
+function resolveDaemonInstallerScript() {
+  const __filename = fileURLToPath3(import.meta.url);
+  const pkgRoot = join9(__filename, "..", "..", "..", "..");
+  return join9(pkgRoot, "scripts", "install-daemon-service.mjs");
+}
 var startCommand3 = defineCommand({
   meta: { name: "start", description: "Spawn the GC daemon as a detached background process" },
   args: {
@@ -34045,6 +34139,10 @@ var startCommand3 = defineCommand({
       type: "string",
       description: "Override .cleo/ directory path"
     },
+    foreground: {
+      type: "boolean",
+      description: "Run the sentient daemon in the foreground (used by systemd/launchd service units)"
+    },
     json: {
       type: "boolean",
       description: "Output result as JSON"
@@ -34053,6 +34151,16 @@ var startCommand3 = defineCommand({
   async run({ args }) {
     const cleoDir = args["cleo-dir"] ?? join9(homedir2(), ".cleo");
     const jsonMode = args.json ?? false;
+    const foreground = args.foreground ?? false;
+    if (foreground) {
+      const projectRoot = process.cwd();
+      process.stdout.write(
+        `[CLEO DAEMON] Starting sentient daemon in foreground mode (PID ${process.pid})
+`
+      );
+      await bootstrapSentientDaemon(projectRoot);
+      return;
+    }
     try {
       const status = await getGCDaemonStatus(cleoDir);
       if (status.running && status.pid) {
@@ -34144,7 +34252,7 @@ var stopCommand3 = defineCommand({
 var statusCommand4 = defineCommand({
   meta: {
     name: "status",
-    description: "Show daemon running state, PID, last GC run, and disk usage"
+    description: "Show daemon running state, PID, last GC run, disk usage, and cross-project hygiene summary"
   },
   args: {
     "cleo-dir": {
@@ -34158,7 +34266,87 @@ var statusCommand4 = defineCommand({
   },
   async run({ args }) {
     const cleoDir = args["cleo-dir"] ?? join9(homedir2(), ".cleo");
-    await showDaemonStatus(cleoDir, args.json ?? false);
+    await showDaemonStatus(cleoDir, process.cwd(), args.json ?? false);
+  }
+});
+var installCommand2 = defineCommand({
+  meta: {
+    name: "install",
+    description: "Register the CLEO daemon as a user-level system service (systemd / launchd)"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Output result as JSON"
+    }
+  },
+  async run({ args }) {
+    const jsonMode = args.json ?? false;
+    try {
+      const scriptPath = resolveDaemonInstallerScript();
+      const { installDaemonService } = await import(scriptPath);
+      await installDaemonService();
+      const result = {
+        success: true,
+        data: {
+          platform: process.platform,
+          message: "Daemon service installation complete."
+        }
+      };
+      if (jsonMode) {
+        process.stdout.write(JSON.stringify(result) + "\n");
+      } else {
+        process.stdout.write("CLEO: Daemon service installation complete.\n");
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const result = { success: false, error: { code: "E_INTERNAL", message } };
+      if (jsonMode) {
+        process.stdout.write(JSON.stringify(result) + "\n");
+      } else {
+        process.stderr.write(`Error installing daemon service: ${message}
+`);
+      }
+      process.exit(1);
+    }
+  }
+});
+var uninstallCommand = defineCommand({
+  meta: {
+    name: "uninstall",
+    description: "Disable and remove the user-level system service (systemd unit / launchd plist)"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Output result as JSON"
+    }
+  },
+  async run({ args }) {
+    const jsonMode = args.json ?? false;
+    try {
+      const scriptPath = resolveDaemonInstallerScript();
+      const { uninstallDaemonService } = await import(scriptPath);
+      const result = await uninstallDaemonService();
+      const envelope = { success: result.success, data: result };
+      if (jsonMode) {
+        process.stdout.write(JSON.stringify(envelope) + "\n");
+      } else {
+        process.stdout.write(`CLEO: ${result.message}
+`);
+      }
+      if (!result.success) process.exit(1);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const result = { success: false, error: { code: "E_INTERNAL", message } };
+      if (jsonMode) {
+        process.stdout.write(JSON.stringify(result) + "\n");
+      } else {
+        process.stderr.write(`Error uninstalling daemon service: ${message}
+`);
+      }
+      process.exit(1);
+    }
   }
 });
 var daemonCommand = defineCommand({
@@ -34179,12 +34367,14 @@ var daemonCommand = defineCommand({
   subCommands: {
     start: startCommand3,
     stop: stopCommand3,
-    status: statusCommand4
+    status: statusCommand4,
+    install: installCommand2,
+    uninstall: uninstallCommand
   },
   async run({ args, cmd, rawArgs }) {
     if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
     const cleoDir = args["cleo-dir"] ?? join9(homedir2(), ".cleo");
-    await showDaemonStatus(cleoDir, args.json ?? false);
+    await showDaemonStatus(cleoDir, process.cwd(), args.json ?? false);
   }
 });
 
@@ -34199,6 +34389,10 @@ var dashCommand = defineCommand({
     "blocked-limit": {
       type: "string",
       description: "Max blocked tasks to show"
+    },
+    "no-hygiene": {
+      type: "boolean",
+      description: "Suppress the hygiene section note"
     }
   },
   async run({ args }) {
@@ -34211,6 +34405,11 @@ var dashCommand = defineCommand({
       },
       { command: "dash" }
     );
+    if (!args["no-hygiene"]) {
+      process.stdout.write(
+        "\n--- Sentient Hygiene (T1636) ---\nBackground scan runs every 4h (dream cycle). Run `cleo memory digest --hygiene` to see the latest hygiene observations (orphan tasks, top-level tasks without an epic, content defects, premature-close leaks).\n"
+      );
+    }
   }
 });
 
@@ -40266,21 +40465,49 @@ var backfillCommand3 = defineCommand({
     await showUsage(cmd);
   }
 });
-var digestCommand = makeMemorySubcommand({
-  name: "digest",
-  description: "Summarized top-N brain observations for session briefing (T1006). Sorted by citation_count + quality_score.",
+var digestCommand = defineCommand({
+  meta: {
+    name: "digest",
+    description: "Summarized top-N brain observations for session briefing (T1006). Pass --hygiene to show latest hygiene scan results from the sentient background loop (T1636)."
+  },
   args: {
     limit: {
       type: "string",
       description: "Maximum number of observations to include (default: 10)."
+    },
+    hygiene: {
+      type: "boolean",
+      description: "Show only hygiene observations (hygiene:orphan, hygiene:top-level-orphan, hygiene:content-defect, hygiene:premature-close-leak) from the sentient background loop (T1636)."
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON"
     }
   },
-  gateway: "query",
-  operation: "digest",
-  output: { command: "memory-digest", operation: "memory.digest" },
-  paramBuilder: (args) => ({
-    ...args["limit"] !== void 0 && { limit: parseInt(args["limit"], 10) }
-  })
+  async run({ args }) {
+    if (args.hygiene) {
+      await dispatchFromCli(
+        "query",
+        "memory",
+        "find",
+        {
+          query: "hygiene:",
+          limit: args.limit !== void 0 ? parseInt(args.limit, 10) : 20
+        },
+        { command: "memory-hygiene-digest", operation: "memory.find" }
+      );
+    } else {
+      await dispatchFromCli(
+        "query",
+        "memory",
+        "digest",
+        {
+          ...args["limit"] !== void 0 && { limit: parseInt(args["limit"], 10) }
+        },
+        { command: "memory-digest", operation: "memory.digest" }
+      );
+    }
+  }
 });
 var recentCommand = makeMemorySubcommand({
   name: "recent",
@@ -48696,7 +48923,7 @@ async function runPostUpdateDiagnostics(opts) {
 import { join as join16 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import {
-  getSentientDaemonStatus,
+  getSentientDaemonStatus as getSentientDaemonStatus2,
   resumeSentientDaemon,
   SENTIENT_STATE_FILE,
   spawnSentientDaemon,
@@ -48754,7 +48981,7 @@ var startSub = defineCommand({
     const jsonMode = args.json === true;
     const dryRun = args["dry-run"] === true;
     try {
-      const existing = await getSentientDaemonStatus(projectRoot);
+      const existing = await getSentientDaemonStatus2(projectRoot);
       if (existing.running && existing.pid) {
         emitSuccess(
           { running: true, pid: existing.pid, message: "daemon already running" },
@@ -48822,7 +49049,7 @@ var statusSub = defineCommand({
     const projectRoot = resolveProjectRoot4(args.project);
     const jsonMode = args.json === true;
     try {
-      const status = await getSentientDaemonStatus(projectRoot);
+      const status = await getSentientDaemonStatus2(projectRoot);
       if (jsonMode) {
         process.stdout.write(`${JSON.stringify({ success: true, data: status })}
 `);
@@ -49334,7 +49561,7 @@ var sentientCommand = defineCommand({
     const projectRoot = resolveProjectRoot4(args.project);
     const jsonMode = args.json === true;
     try {
-      const status = await getSentientDaemonStatus(projectRoot);
+      const status = await getSentientDaemonStatus2(projectRoot);
       if (jsonMode) {
         process.stdout.write(`${JSON.stringify({ success: true, data: status })}
 `);
@@ -50121,7 +50348,7 @@ var infoCommand = defineCommand({
     );
   }
 });
-var installCommand2 = defineCommand({
+var installCommand3 = defineCommand({
   meta: { name: "install", description: "Install skill to agent directory" },
   args: {
     "skill-name": {
@@ -50147,7 +50374,7 @@ var installCommand2 = defineCommand({
     );
   }
 });
-var uninstallCommand = defineCommand({
+var uninstallCommand2 = defineCommand({
   meta: { name: "uninstall", description: "Uninstall a skill" },
   args: {
     "skill-name": {
@@ -50348,8 +50575,8 @@ var skillsCommand2 = defineCommand({
     search: searchCommand3,
     validate: validateCommand7,
     info: infoCommand,
-    install: installCommand2,
-    uninstall: uninstallCommand,
+    install: installCommand3,
+    uninstall: uninstallCommand2,
     enable: enableCommand2,
     disable: disableCommand2,
     refresh: refreshCommand,
@@ -52516,7 +52743,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join19(dirname9(fileURLToPath3(import.meta.url)), "../../package.json");
+  const pkgPath = join19(dirname9(fileURLToPath4(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
   return pkg.version;
 }