@cleocode/cleo 2026.5.113 → 2026.5.114

package/dist/cli/index.js

@@ -12317,6 +12317,7 @@ var init_src2 = __esm({
     init_operations();
     init_nexus_scope_map();
     init_params();
+    init_tasks();
     init_peer();
     init_evidence_atoms();
     init_plan();
@@ -26224,8 +26225,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot53();
+    const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot54();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -26269,8 +26270,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot53();
+  const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot54();
   return {
     async dispatch(input2) {
       try {
@@ -26460,8 +26461,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot53();
+              const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot54();
             } catch {
               projectRoot = void 0;
             }
@@ -26525,14 +26526,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot53()
+            projectRoot: getProjectRoot54()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -26896,16 +26897,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync18, readdirSync: readdirSync3, existsSync: existsSync17 } = await import("node:fs");
-    const { join: join34 } = await import("node:path");
+    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync19 } = await import("node:fs");
+    const { join: join37 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync17(workflowsDir)) {
+    if (existsSync19(workflowsDir)) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync18(join34(workflowsDir, file), "utf-8");
+          const src = readFileSync21(join37(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -26920,12 +26921,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join34(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync17(localCantDir)) {
+    const localCantDir = join37(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync19(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync18(join34(localCantDir, file), "utf-8");
+          const src = readFileSync21(join37(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27117,11 +27118,11 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
     };
   }
 }
-async function handleWorktreeComplete(taskId, projectRoot, resolve7) {
+async function handleWorktreeComplete(taskId, projectRoot, resolve8) {
   try {
     const { completeWorktreeForTask } = await import("@cleocode/core/internal");
     const result = completeWorktreeForTask(taskId, projectRoot, {
-      resolve: resolve7 ?? "auto"
+      resolve: resolve8 ?? "auto"
     });
     if (result.outcome === "conflict") {
       return {
@@ -27798,10 +27799,10 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const rawResolve = params.resolve;
-              const resolve7 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
+              const resolve8 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
               const p = {
                 taskId: params.taskId,
-                ...resolve7 !== void 0 ? { resolve: resolve7 } : {}
+                ...resolve8 !== void 0 ? { resolve: resolve8 } : {}
               };
               return wrapResult(
                 await coreOps2["worktree.complete"](p),
@@ -32320,11 +32321,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot53) {
+function createSanitizer(getProjectRoot54) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot53 ? getProjectRoot53() : void 0;
+        const root = getProjectRoot54 ? getProjectRoot54() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -32857,18 +32858,77 @@ var init_adapter = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/collect-input.ts
+import { readFile as readFile2 } from "node:fs/promises";
+function wrapParseError(rawInput, parseErr, sourceLabel) {
+  const snippet2 = rawInput.length > PARSE_ERROR_SNIPPET_MAX_LENGTH ? `${rawInput.slice(0, PARSE_ERROR_SNIPPET_MAX_LENGTH)}\u2026` : rawInput;
+  return new Error(`Invalid JSON in ${sourceLabel}: ${parseErr.message} (got: ${snippet2})`);
+}
+function readStdinJson(stdin) {
+  return new Promise((resolve8, reject) => {
+    const chunks = [];
+    stdin.on("data", (chunk) => {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    stdin.on("error", (err) => {
+      reject(err);
+    });
+    stdin.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      try {
+        resolve8(JSON.parse(raw));
+      } catch (err) {
+        reject(wrapParseError(raw, err, "stdin"));
+      }
+    });
+  });
+}
+async function collectMutateInput(args, stdin) {
+  if (typeof args.params === "string" && args.params.length > 0) {
+    try {
+      return JSON.parse(args.params);
+    } catch (err) {
+      throw wrapParseError(args.params, err, "--params");
+    }
+  }
+  if (typeof args.file === "string" && args.file.length > 0) {
+    const raw = await readFile2(args.file, "utf8");
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      throw wrapParseError(raw, err, `--file ${args.file}`);
+    }
+  }
+  if (stdin.isTTY !== true) {
+    return readStdinJson(stdin);
+  }
+  if (args.positional !== void 0 && args.positional.length > 0) {
+    return args.positional;
+  }
+  return void 0;
+}
+var PARSE_ERROR_SNIPPET_MAX_LENGTH;
+var init_collect_input = __esm({
+  "packages/cleo/src/cli/lib/collect-input.ts"() {
+    "use strict";
+    PARSE_ERROR_SNIPPET_MAX_LENGTH = 80;
+  }
+});
+
 // packages/cleo/src/cli/commands/add-batch.ts
 var add_batch_exports = {};
 __export(add_batch_exports, {
   addBatchCommand: () => addBatchCommand
 });
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
+import { INPUT_CONTRACTS, validateOperationInput } from "@cleocode/core";
 var addBatchCommand;
 var init_add_batch = __esm({
   "packages/cleo/src/cli/commands/add-batch.ts"() {
     "use strict";
+    init_src2();
     init_dist();
     init_cli();
+    init_collect_input();
     init_renderers();
     addBatchCommand = defineCommand({
       meta: {
@@ -32876,9 +32936,13 @@ var init_add_batch = __esm({
         description: "Create multiple tasks in a single atomic transaction from a JSON file"
       },
       args: {
+        params: {
+          type: "string",
+          description: 'Inline JSON object: { "tasks": [...], "defaultParent"?: "...", "dryRun"?: bool } (T9917)'
+        },
         file: {
           type: "string",
-          description: "Path to JSON file (array of task objects). Use - for stdin."
+          description: "Path to JSON file (array of task objects, or full payload). Use - for stdin."
         },
         parent: {
           type: "string",
@@ -32890,66 +32954,86 @@ var init_add_batch = __esm({
         }
       },
       async run({ args }) {
-        const filePath = args.file;
         const defaultParent = args.parent;
-        const dryRun = args["dry-run"];
+        const dryRunFlag = args["dry-run"];
+        const paramsArg = args.params;
+        const fileArg = args.file;
+        const collectArgs = {};
+        if (paramsArg !== void 0) collectArgs.params = paramsArg;
+        if (fileArg !== void 0 && fileArg !== "-") collectArgs.file = fileArg;
         let raw;
-        if (!filePath || filePath === "-") {
-          const chunks = [];
-          for await (const chunk of process.stdin) chunks.push(chunk);
-          raw = Buffer.concat(chunks).toString("utf-8");
-          if (!raw.trim()) {
-            cliError(
-              "No input provided. Pass --file <path> or pipe JSON to stdin.",
-              "E_VALIDATION",
-              { name: "E_VALIDATION", fix: "cleo add-batch --file tasks.json" },
-              { operation: "tasks.add-batch" }
-            );
-            process.exitCode = 2;
-            return;
-          }
+        try {
+          raw = await collectMutateInput(
+            collectArgs,
+            process.stdin
+          );
+        } catch (err) {
+          cliError(
+            err.message,
+            6 /* VALIDATION_ERROR */,
+            {
+              name: "E_VALIDATION_FAILED",
+              fix: "Verify the JSON syntax of your --params / --file / stdin input"
+            },
+            { operation: "tasks.add-batch" }
+          );
+          process.exitCode = 6 /* VALIDATION_ERROR */;
+          return;
+        }
+        if (raw === void 0) {
+          cliError(
+            "No input provided. Pass --params <json>, --file <path>, or pipe JSON to stdin.",
+            6 /* VALIDATION_ERROR */,
+            {
+              name: "E_VALIDATION_FAILED",
+              fix: "cleo add-batch --file tasks.json"
+            },
+            { operation: "tasks.add-batch" }
+          );
+          process.exitCode = 6 /* VALIDATION_ERROR */;
+          return;
+        }
+        let payload;
+        if (Array.isArray(raw)) {
+          payload = { tasks: raw };
+        } else if (raw !== null && typeof raw === "object" && Array.isArray(raw["tasks"])) {
+          payload = { ...raw };
         } else {
-          if (!existsSync6(filePath)) {
-            cliError(
-              `File not found: ${filePath}`,
-              "E_NOT_FOUND",
-              { name: "E_NOT_FOUND", fix: `Verify the file path exists: ${filePath}` },
-              { operation: "tasks.add-batch" }
-            );
-            process.exitCode = 2;
-            return;
-          }
-          raw = readFileSync8(filePath, "utf-8");
+          payload = { tasks: [raw] };
         }
-        let tasks;
-        try {
-          const parsed = JSON.parse(raw);
-          tasks = Array.isArray(parsed) ? parsed : [parsed];
-        } catch {
+        if (defaultParent !== void 0 && payload["defaultParent"] === void 0) {
+          payload["defaultParent"] = defaultParent;
+        }
+        if (dryRunFlag === true && payload["dryRun"] === void 0) {
+          payload["dryRun"] = true;
+        }
+        const contract = INPUT_CONTRACTS["tasks.add-batch"];
+        if (!contract) {
           cliError(
-            "Invalid JSON input. Expected an array of task objects.",
-            "E_VALIDATION",
-            { name: "E_VALIDATION", fix: "Ensure the input is a valid JSON array of task objects" },
+            "tasks.add-batch contract missing from INPUT_CONTRACTS registry",
+            1 /* GENERAL_ERROR */,
+            { name: "E_INTERNAL", fix: "This is a CLI bug \u2014 file an issue" },
             { operation: "tasks.add-batch" }
           );
-          process.exitCode = 2;
+          process.exitCode = 1 /* GENERAL_ERROR */;
           return;
         }
-        if (tasks.length === 0) {
+        const result = validateOperationInput(contract, payload);
+        if (!result.ok) {
           cliError(
-            "No tasks in input.",
-            "E_VALIDATION",
-            { name: "E_VALIDATION", fix: "Provide at least one task object in the JSON array" },
+            "tasks.add-batch failed: validation",
+            6 /* VALIDATION_ERROR */,
+            {
+              name: "E_VALIDATION_FAILED",
+              fix: result.errors[0]?.fix ?? "Inspect the errors[] payload and correct the input",
+              details: { errors: result.errors }
+            },
             { operation: "tasks.add-batch" }
           );
-          process.exitCode = 2;
+          process.exitCode = 6 /* VALIDATION_ERROR */;
           return;
         }
-        const response = await dispatchRaw("mutate", "tasks", "add-batch", {
-          tasks,
-          ...defaultParent && { defaultParent },
-          ...dryRun && { dryRun: true }
-        });
+        const response = await dispatchRaw("mutate", "tasks", "add-batch", payload);
         if (!response.success) {
           cliError(
             response.error?.message ?? "Batch creation failed",
@@ -32977,7 +33061,9 @@ __export(add_exports, {
 import {
   appendSignedSeverityAttestation,
   getProjectRoot as getProjectRoot23,
-  inferTaskAddParams
+  INPUT_CONTRACTS as INPUT_CONTRACTS2,
+  inferTaskAddParams,
+  validateOperationInput as validateOperationInput2
 } from "@cleocode/core";
 var addCommand;
 var init_add = __esm({
@@ -32986,6 +33072,7 @@ var init_add = __esm({
     init_src2();
     init_dist();
     init_cli();
+    init_collect_input();
     init_renderers();
     addCommand = defineCommand({
       meta: {
@@ -32994,6 +33081,28 @@ var init_add = __esm({
 For 2+ tasks at once: cleo add-batch --file tasks.json (single transaction, atomic rollback)`
       },
       args: {
+        /**
+         * Schema-first input — supersedes all flag-based args when present.
+         *
+         * Accepts a JSON object that matches `INPUT_CONTRACTS['tasks.add']`.
+         * When provided, the command short-circuits the flag-mapping path
+         * entirely and goes straight to validate→dispatch.
+         *
+         * @task T9917
+         */
+        params: {
+          type: "string",
+          description: 'Inline JSON object matching INPUT_CONTRACTS["tasks.add"] (T9917). Overrides positional + flags.'
+        },
+        /**
+         * Schema-first input from a JSON file. Same semantics as --params.
+         *
+         * @task T9917
+         */
+        "params-file": {
+          type: "string",
+          description: 'Path to JSON file matching INPUT_CONTRACTS["tasks.add"] (T9917).'
+        },
         title: {
           type: "positional",
           description: "Task title (3\u2013500 characters)",
@@ -33156,6 +33265,72 @@ For 2+ tasks at once: cleo add-batch --file tasks.json (single transaction, atom
         }
       },
       async run({ args, cmd }) {
+        const paramsArg = args.params;
+        const paramsFileArg = args["params-file"];
+        if (paramsArg !== void 0 || paramsFileArg !== void 0) {
+          const collectArgs = {};
+          if (paramsArg !== void 0) collectArgs.params = paramsArg;
+          if (paramsFileArg !== void 0) collectArgs.file = paramsFileArg;
+          let raw;
+          try {
+            raw = await collectMutateInput(
+              collectArgs,
+              process.stdin
+            );
+          } catch (err) {
+            cliError(
+              err.message,
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION_FAILED",
+                fix: "Verify the JSON syntax of your --params / --params-file input"
+              },
+              { operation: "tasks.add" }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+            return;
+          }
+          const contract = INPUT_CONTRACTS2["tasks.add"];
+          if (!contract) {
+            cliError(
+              "tasks.add contract missing from INPUT_CONTRACTS registry",
+              1 /* GENERAL_ERROR */,
+              { name: "E_INTERNAL", fix: "This is a CLI bug \u2014 file an issue" },
+              { operation: "tasks.add" }
+            );
+            process.exit(1 /* GENERAL_ERROR */);
+            return;
+          }
+          const validation = validateOperationInput2(contract, raw);
+          if (!validation.ok) {
+            cliError(
+              "tasks.add failed: validation",
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION_FAILED",
+                fix: validation.errors[0]?.fix ?? "Inspect errors[] and correct the input",
+                details: { errors: validation.errors }
+              },
+              { operation: "tasks.add" }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+            return;
+          }
+          const validatedPayload = raw;
+          const response2 = await dispatchRaw("mutate", "tasks", "add", validatedPayload);
+          if (!response2.success) {
+            handleRawError(response2, { command: "add", operation: "tasks.add" });
+          }
+          const data2 = response2.data;
+          const dataWarnings2 = data2?.warnings;
+          if (dataWarnings2?.length) {
+            for (const w of dataWarnings2) {
+              humanWarn(`\u26A0 ${w}`);
+            }
+          }
+          cliOutput(data2, { command: "add", operation: "tasks.add" });
+          return;
+        }
         if (!args.title) {
           await showUsage(cmd);
           return;
@@ -33930,13 +34105,13 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync17, mkdirSync: mkdirSync5, writeFileSync: writeFileSync5 } = await import("node:fs");
-          const { join: join34 } = await import("node:path");
-          const cantDir = join34(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join34(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync19, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join37 } = await import("node:path");
+          const cantDir = join37(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join37(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync17(cantPath)) {
-            mkdirSync5(cantDir, { recursive: true });
+          if (!existsSync19(cantPath)) {
+            mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
 kind: agent
@@ -33986,7 +34161,7 @@ agent ${agentId}:
   enforcement:
     1: TODO \u2014 what does this agent push back on?
 `;
-            writeFileSync5(cantPath, cantContent, "utf-8");
+            writeFileSync7(cantPath, cantContent, "utf-8");
             cantScaffolded = true;
           }
           cliOutput(
@@ -33995,7 +34170,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync17(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync19(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -34114,8 +34289,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync17, readFileSync: readFileSync18 } = await import("node:fs");
-          const { join: join34 } = await import("node:path");
+          const { existsSync: existsSync19, readFileSync: readFileSync21 } = await import("node:fs");
+          const { join: join37 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34135,9 +34310,9 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join34(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync17(cantPath)) {
-            profile = readFileSync18(cantPath, "utf-8");
+          const cantPath = args.cant ?? join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync19(cantPath)) {
+            profile = readFileSync21(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
@@ -34660,8 +34835,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync17 } = await import("node:fs");
-          const { join: join34 } = await import("node:path");
+          const { existsSync: existsSync19 } = await import("node:fs");
+          const { join: join37 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34678,8 +34853,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join34(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync17(cantPath);
+          const cantPath = join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync19(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -35475,10 +35650,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync17 } = await import("node:fs");
-          const { basename, resolve: resolve7 } = await import("node:path");
-          const resolvedPath = resolve7(args.path);
-          if (!existsSync17(resolvedPath)) {
+          const { existsSync: existsSync19 } = await import("node:fs");
+          const { basename, resolve: resolve8 } = await import("node:path");
+          const resolvedPath = resolve8(args.path);
+          if (!existsSync19(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -35603,11 +35778,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync17, statSync } = await import("node:fs");
-          const { resolve: resolve7, basename, dirname: dirname10 } = await import("node:path");
+          const { existsSync: existsSync19, statSync } = await import("node:fs");
+          const { resolve: resolve8, basename, dirname: dirname12 } = await import("node:path");
           const { execFileSync: execFileSync4 } = await import("node:child_process");
-          const resolvedDir = resolve7(args.dir);
-          if (!existsSync17(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          const resolvedDir = resolve8(args.dir);
+          if (!existsSync19(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -35621,9 +35796,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join34 } = await import("node:path");
-          const personaPath = join34(resolvedDir, "persona.cant");
-          if (!existsSync17(personaPath)) {
+          const { join: join37 } = await import("node:path");
+          const personaPath = join37(resolvedDir, "persona.cant");
+          if (!existsSync19(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -35639,8 +35814,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
-          const archivePath = resolve7(archiveName);
-          const parentDir = dirname10(resolvedDir);
+          const archivePath = resolve8(archiveName);
+          const parentDir = dirname12(resolvedDir);
           try {
             execFileSync4("zip", ["-r", archivePath, agentName], {
               cwd: parentDir,
@@ -35670,7 +35845,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join34(dirPath, entry.name));
+                countFiles(join37(dirPath, entry.name));
               }
             }
           };
@@ -35918,18 +36093,18 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync17, readFileSync: readFileSync18, mkdirSync: mkdirSync5 } = await import("node:fs");
-          const { resolve: resolve7, join: join34 } = await import("node:path");
-          const specPath = resolve7(args.spec);
-          if (!existsSync17(specPath)) {
+          const { existsSync: existsSync19, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve8, join: join37 } = await import("node:path");
+          const specPath = resolve8(args.spec);
+          if (!existsSync19(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
-          const specContent = readFileSync18(specPath, "utf-8");
+          const specContent = readFileSync21(specPath, "utf-8");
           const projectRoot = getProjectRoot24();
-          const outputDir = args["output-dir"] ? resolve7(args["output-dir"]) : join34(projectRoot, ".cleo", "cant", "agents");
-          mkdirSync5(outputDir, { recursive: true });
+          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join37(projectRoot, ".cleo", "cant", "agents");
+          mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
               {
@@ -36529,7 +36704,7 @@ var init_consent = __esm({
 });
 
 // packages/cleo/src/cli/commands/auth/list.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join9 } from "node:path";
 function formatExpiry(expiresAt) {
@@ -36609,7 +36784,7 @@ var init_list2 = __esm({
           return p !== 0 ? p : a2.label.localeCompare(b.label);
         });
         const claudeCredsPath = join9(homedir2(), ".claude", ".credentials.json");
-        const hint = existsSync7(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
+        const hint = existsSync6(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
         cliOutput(
           { entries, ...hint !== null ? { hint } : {} },
           {
@@ -36623,7 +36798,7 @@ var init_list2 = __esm({
 });
 
 // packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join10 } from "node:path";
 import { createInterface } from "node:readline";
 function resolveProjectRootArg(arg) {
@@ -36679,8 +36854,8 @@ function detectAuthType(provider, token) {
 async function promptYesNo(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve7) => {
-      rl.question(question, (a) => resolve7(a));
+    const answer = await new Promise((resolve8) => {
+      rl.question(question, (a) => resolve8(a));
     });
     const clean = answer.trim().toLowerCase();
     return clean === "y" || clean === "yes";
@@ -36690,7 +36865,7 @@ async function promptYesNo(question) {
 }
 async function runMigrateProjectSecrets(opts) {
   const configPath = projectConfigPath(opts.projectRoot);
-  if (!existsSync8(configPath)) {
+  if (!existsSync7(configPath)) {
     return {
       configPath,
       backupPath: null,
@@ -36699,7 +36874,7 @@ async function runMigrateProjectSecrets(opts) {
       dryRun: opts.dryRun
     };
   }
-  const raw = readFileSync9(configPath, "utf-8");
+  const raw = readFileSync8(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -37616,12 +37791,12 @@ async function promptPassphrase() {
       "Cannot prompt for passphrase: stdin is not a TTY. Set the CLEO_BACKUP_PASSPHRASE environment variable for non-interactive use."
     );
   }
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     process.stdout.write("Passphrase: ");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("", (answer) => {
       rl.close();
-      resolve7(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
@@ -37757,9 +37932,9 @@ var init_backup = __esm({
       async run({ args }) {
         const scope = args.scope;
         const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
-        const { getProjectRoot: getProjectRoot53 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot53() : void 0;
+        const projectRoot = includesProject ? getProjectRoot54() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -37835,12 +38010,12 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const { getProjectRoot: getProjectRoot53, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot54, getCleoHome: getCleoHome6, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot53();
+        const projectRoot = getProjectRoot54();
         if (args.force !== true) {
           const existing = checkForExistingData(projectRoot, getCleoHome6());
           if (existing.length > 0) {
@@ -38442,7 +38617,7 @@ var briefing_exports = {};
 __export(briefing_exports, {
   briefingCommand: () => briefingCommand
 });
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
 import { join as join11 } from "node:path";
 import { pushWarning as pushWarning2 } from "@cleocode/core";
 import { resolveLegacyCleoDir } from "@cleocode/paths";
@@ -38475,7 +38650,7 @@ function renderForAdapter(sectionName, content, format) {
 }
 async function runBriefingInject(sectionName, formatStr) {
   const templatePath = resolveInjectionTemplatePath();
-  if (!existsSync9(templatePath)) {
+  if (!existsSync8(templatePath)) {
     pushWarning2({
       code: "W_TEMPLATE_INJECT_FAILED",
       message: `CLEO-INJECTION.md not found at ${templatePath}`
@@ -38492,7 +38667,7 @@ async function runBriefingInject(sectionName, formatStr) {
     process.exitCode = 1;
     return;
   }
-  const content = readFileSync10(templatePath, "utf-8");
+  const content = readFileSync9(templatePath, "utf-8");
   const section = extractSection(content, sectionName);
   if (section === null) {
     const available = INJECTION_SECTION_NAMES.join(", ");
@@ -38731,15 +38906,15 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync17 } = await import("node:fs");
-          const { readFile: readFile7 } = await import("node:fs/promises");
+          const { existsSync: existsSync19 } = await import("node:fs");
+          const { readFile: readFile8 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync17(filePath)) {
+            if (!existsSync19(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
-            const content = await readFile7(filePath, "utf-8");
+            const content = await readFile8(filePath, "utf-8");
             const blocks = parseCaampBlocks(content);
             const uniqueContents = new Set(blocks.map((b) => b.content));
             const wouldRemove = blocks.length - uniqueContents.size;
@@ -38833,13 +39008,13 @@ var cant_exports = {};
 __export(cant_exports, {
   cantCommand: () => cantCommand
 });
-import { existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname4, isAbsolute, join as join13, resolve as resolve3 } from "node:path";
 function resolveFilePath(file) {
   return isAbsolute(file) ? file : resolve3(process.cwd(), file);
 }
 function ensureExists(filePath, operation) {
-  if (existsSync10(filePath)) return true;
+  if (existsSync9(filePath)) return true;
   cliError(`File not found: ${filePath}`, "E_FILE_READ");
   process.exitCode = 3;
   if (process.env["CLEO_DEBUG"]) humanWarn(`(operation: ${operation})`);
@@ -38989,7 +39164,7 @@ var init_cant = __esm({
         if (!ensureExists(filePath, "cant.migrate")) return;
         try {
           const mod = await loadMigrateEngine();
-          const content = readFileSync11(filePath, "utf-8");
+          const content = readFileSync10(filePath, "utf-8");
           const result = mod.migrateMarkdown(content, filePath, {
             write: isWrite,
             verbose: isVerbose,
@@ -39055,7 +39230,7 @@ var chain_exports = {};
 __export(chain_exports, {
   chainCommand: () => chainCommand
 });
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 var showCommand3, listCommand5, addCommand3, instantiateCommand, advanceCommand, chainCommand;
 var init_chain = __esm({
   "packages/cleo/src/cli/commands/chain.ts"() {
@@ -39097,7 +39272,7 @@ var init_chain = __esm({
         }
       },
       async run({ args }) {
-        const chainJson = JSON.parse(readFileSync12(args.file, "utf-8"));
+        const chainJson = JSON.parse(readFileSync11(args.file, "utf-8"));
         await dispatchFromCli(
           "mutate",
           "pipeline",
@@ -39178,7 +39353,7 @@ var changeset_exports = {};
 __export(changeset_exports, {
   changesetCommand: () => changesetCommand
 });
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { join as join14 } from "node:path";
 import {
   changesets,
@@ -39327,7 +39502,7 @@ var init_changeset = __esm({
       async run() {
         const projectRoot = getProjectRoot30();
         const dir = join14(projectRoot, ".changeset");
-        if (!existsSync11(dir)) {
+        if (!existsSync10(dir)) {
           const empty = { entries: [], count: 0, dir, note: "no .changeset/ dir" };
           if (isHumanOutput()) {
             humanLine("No changeset entries found (.changeset/ directory absent).");
@@ -39497,10 +39672,10 @@ var init_check2 = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync18 } = await import("node:fs");
+        const { readFileSync: readFileSync21 } = await import("node:fs");
         let chain;
         try {
-          chain = JSON.parse(readFileSync18(args.file, "utf8"));
+          chain = JSON.parse(readFileSync21(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse chain file: ${message}`, 2, {
@@ -39790,11 +39965,11 @@ var init_check2 = __esm({
       },
       async run({ args }) {
         const { spawnSync } = await import("node:child_process");
-        const { existsSync: existsSync17 } = await import("node:fs");
-        const { join: join34, resolve: resolve7 } = await import("node:path");
+        const { existsSync: existsSync19 } = await import("node:fs");
+        const { join: join37, resolve: resolve8 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
-        const repoRoot = resolve7(process.cwd());
+        const repoRoot = resolve8(process.cwd());
         const gates = [
           {
             id: "gate-1",
@@ -39831,8 +40006,8 @@ var init_check2 = __esm({
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join34(repoRoot, gate.script);
-          if (!existsSync17(scriptPath)) {
+          const scriptPath = join37(repoRoot, gate.script);
+          if (!existsSync19(scriptPath)) {
             results.push({
               id: gate.id,
               task: gate.task,
@@ -40147,9 +40322,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join34 } = await import("node:path");
+            const { join: join37 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join34(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -40240,9 +40415,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join34 } = await import("node:path");
+            const { join: join37 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join34(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -41924,7 +42099,7 @@ var daemon_exports = {};
 __export(daemon_exports, {
   daemonCommand: () => daemonCommand
 });
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
@@ -41992,7 +42167,7 @@ async function showDaemonStatus(cleoDir, projectRoot) {
 function resolveDaemonInstallerScript() {
   const filePath = fileURLToPath3(import.meta.url);
   const candidate1 = join16(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
-  if (existsSync12(candidate1)) return candidate1;
+  if (existsSync11(candidate1)) return candidate1;
   const candidate2 = join16(
     filePath,
     "..",
@@ -42913,12 +43088,12 @@ var detect_drift_exports = {};
 __export(detect_drift_exports, {
   detectDriftCommand: () => detectDriftCommand
 });
-import { existsSync as existsSync13, readdirSync, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync12, readdirSync, readFileSync as readFileSync12 } from "node:fs";
 import { dirname as dirname5, join as join17 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
-    if (existsSync13(join17(currentDir, "package.json"))) {
+    if (existsSync12(join17(currentDir, "package.json"))) {
       return currentDir;
     }
     const parent = dirname5(currentDir);
@@ -42942,11 +43117,11 @@ var init_detect_drift = __esm({
       },
       async run() {
         const projectRoot = findProjectRoot();
-        const isCleoRepo = existsSync13(join17(projectRoot, "packages", "cleo", "src"));
+        const isCleoRepo = existsSync12(join17(projectRoot, "packages", "cleo", "src"));
         const cleoSrcRoot = isCleoRepo ? join17(projectRoot, "packages", "cleo", "src") : join17(projectRoot, "src");
         const safeRead = (filePath) => {
           try {
-            return readFileSync13(filePath, "utf-8");
+            return readFileSync12(filePath, "utf-8");
           } catch {
             return "";
           }
@@ -42958,7 +43133,7 @@ var init_detect_drift = __esm({
             recommendations: []
           };
           const injPath = join17(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (existsSync13(injPath)) {
+          if (existsSync12(injPath)) {
             const content = safeRead(injPath);
             userResult.checks.push({
               name: "Agent injection",
@@ -43012,7 +43187,7 @@ var init_detect_drift = __esm({
           const specPath = join17(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
           const registryPath = join17(cleoSrcRoot, "dispatch", "registry.ts");
           const dispatchDomainsDir = join17(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync13(specPath)) {
+          if (!existsSync12(specPath)) {
             addCheck("Gateway-to-spec sync", "fail", "CLEO-OPERATION-CONSTITUTION.md missing", [
               {
                 severity: "error",
@@ -43022,7 +43197,7 @@ var init_detect_drift = __esm({
                 recommendation: "Create docs/specs/CLEO-OPERATION-CONSTITUTION.md with canonical operation definitions"
               }
             ]);
-          } else if (!existsSync13(registryPath) || !existsSync13(dispatchDomainsDir)) {
+          } else if (!existsSync12(registryPath) || !existsSync12(dispatchDomainsDir)) {
             addCheck("Gateway-to-spec sync", "fail", "Dispatch registry or domains missing", [
               {
                 severity: "error",
@@ -43082,7 +43257,7 @@ var init_detect_drift = __esm({
         try {
           const cliDir = join17(cleoSrcRoot, "cli", "commands");
           const coreDir = isCleoRepo ? join17(projectRoot, "packages", "core", "src") : join17(projectRoot, "src", "core");
-          if (!existsSync13(cliDir)) {
+          if (!existsSync12(cliDir)) {
             addCheck("CLI-to-core sync", "fail", "CLI commands directory missing", [
               {
                 severity: "error",
@@ -43091,7 +43266,7 @@ var init_detect_drift = __esm({
                 recommendation: "Verify TypeScript source structure is intact"
               }
             ]);
-          } else if (!existsSync13(coreDir)) {
+          } else if (!existsSync12(coreDir)) {
             addCheck("CLI-to-core sync", "fail", "Core directory missing", [
               {
                 severity: "error",
@@ -43109,7 +43284,7 @@ var init_detect_drift = __esm({
         }
         try {
           const domainsDir = join17(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync13(domainsDir)) {
+          if (!existsSync12(domainsDir)) {
             addCheck("Domain handler coverage", "fail", "Dispatch domains directory missing", [
               {
                 severity: "error",
@@ -43127,7 +43302,7 @@ var init_detect_drift = __esm({
         }
         try {
           const matrixPath = join17(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
-          if (!existsSync13(matrixPath)) {
+          if (!existsSync12(matrixPath)) {
             addCheck("Capability matrix", "fail", "Capability matrix missing", [
               {
                 severity: "error",
@@ -43144,7 +43319,7 @@ var init_detect_drift = __esm({
         }
         try {
           const schemaPath = join17(projectRoot, "src", "store", "schema.ts");
-          if (!existsSync13(schemaPath)) {
+          if (!existsSync12(schemaPath)) {
             addCheck("Schema validation", "fail", "Schema definition missing", [
               {
                 severity: "error",
@@ -43181,7 +43356,7 @@ var init_detect_drift = __esm({
           const visionPath = join17(projectRoot, "docs", "concepts", "CLEO-VISION.md");
           const specPath = join17(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
           const issues = [];
-          if (!existsSync13(visionPath)) {
+          if (!existsSync12(visionPath)) {
             issues.push({
               severity: "error",
               category: "vision",
@@ -43190,7 +43365,7 @@ var init_detect_drift = __esm({
               recommendation: "Create docs/concepts/CLEO-VISION.md with project vision"
             });
           }
-          if (!existsSync13(specPath)) {
+          if (!existsSync12(specPath)) {
             issues.push({
               severity: "error",
               category: "spec",
@@ -43235,7 +43410,7 @@ var init_detect_drift = __esm({
         }
         try {
           const injectionPath = join17(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (!existsSync13(injectionPath)) {
+          if (!existsSync12(injectionPath)) {
             addCheck("Agent injection", "fail", "Agent injection template missing", [
               {
                 severity: "error",
@@ -43265,7 +43440,7 @@ var init_detect_drift = __esm({
         }
         try {
           const exitCodesPath = join17(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
-          if (!existsSync13(exitCodesPath)) {
+          if (!existsSync12(exitCodesPath)) {
             addCheck("Exit codes", "fail", "Exit codes definition missing", [
               {
                 severity: "error",
@@ -43612,7 +43787,7 @@ var init_strict_args = __esm({
 });
 
 // packages/cleo/src/viewer/pidfile.ts
-import { mkdir, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
+import { mkdir, readFile as readFile3, unlink, writeFile } from "node:fs/promises";
 import { dirname as dirname6, join as join18 } from "node:path";
 import { getCleoHome as getCleoHome2 } from "@cleocode/core/internal";
 function viewerPidFilePath() {
@@ -43626,7 +43801,7 @@ async function writeViewerPidFile(record) {
 }
 async function readViewerPidFile() {
   try {
-    const raw = await readFile2(viewerPidFilePath(), "utf8");
+    const raw = await readFile3(viewerPidFilePath(), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.pid === "number" && typeof parsed.port === "number" && typeof parsed.host === "string" && typeof parsed.projectRoot === "string" && typeof parsed.startedAt === "number") {
       return parsed;
@@ -44436,7 +44611,7 @@ var docs_exports = {};
 __export(docs_exports, {
   docsCommand: () => docsCommand
 });
-import { appendFile, mkdir as mkdir2, readdir, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { appendFile, mkdir as mkdir2, readdir, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join21, resolve as resolve5 } from "node:path";
 import {
   buildDocsGraph,
@@ -44510,7 +44685,7 @@ async function runGapCheck(_projectRoot, filterId) {
     for (const file of reviewFiles) {
       if (filterId && !file.includes(filterId)) continue;
       const filePath = join21(reviewDir, file);
-      const content = await readFile3(filePath, "utf-8");
+      const content = await readFile4(filePath, "utf-8");
       const taskMatch = file.match(/^(T\d+)/);
       const taskId = taskMatch ? taskMatch[1] : "UNKNOWN";
       const gaps = [];
@@ -44567,7 +44742,7 @@ var init_docs3 = __esm({
     addCommand5 = defineCommand({
       meta: {
         name: "add",
-        description: 'Attach a local file or remote URL to a CLEO entity (task, session, observation). Owner type is inferred from the ID prefix: T### \u2192 task, ses_* \u2192 session, O-* \u2192 observation. Use --slug to set a human-friendly alias (unique per project) (T9636).\n\nPositional arguments:\n  <owner-id>             Owner entity ID (T###, ses_*, O-*) \u2014 required\n  [file]                 Local file path to attach \u2014 optional when --url is set\n\nNamed arguments:\n  --url <url>            Remote URL to attach (instead of a local file)\n  --desc <text>          Free-text description of this attachment\n  --labels <csv>         Comma-separated labels (e.g. rfc,spec)\n  --attached-by <name>   Agent identity that created the attachment (default: "human")\n  --slug <kebab>         Human-friendly alias, unique per project (T9636)\n  --type <kind>          Taxonomy classification \u2014 run `cleo docs list-types` for kinds\n\nUnknown flags are rejected with E_UNKNOWN_FLAG + did-you-mean suggestions (T10359).'
+        description: 'Attach a local file or remote URL to a CLEO entity (task, session, observation). Owner type is inferred from the ID prefix: T### \u2192 task, ses_* \u2192 session, O-* \u2192 observation. Use --slug to set a human-friendly alias (unique per project) (T9636).\n\nPositional arguments:\n  <owner-id>             Owner entity ID (T###, ses_*, O-*) \u2014 required\n  [file]                 Local file path to attach \u2014 optional when --url is set\n\nNamed arguments:\n  --url <url>            Remote URL to attach (instead of a local file)\n  --desc <text>          Free-text description of this attachment\n  --labels <csv>         Comma-separated labels (e.g. rfc,spec)\n  --attached-by <name>   Agent identity that created the attachment (default: "human")\n  --slug <kebab>         Human-friendly alias, unique per project (T9636)\n  --type <kind>          Taxonomy classification \u2014 run `cleo docs list-types` for kinds\n  --allow-similar        Bypass the slug-similarity warn \u2014 every bypass is audited\n                         to .cleo/audit/similar-bypass.jsonl (T10361)\n  --strict               Enforce body-schema (requiredSections) \u2014 fail with\n                         E_DOC_SCHEMA_MISMATCH instead of warning (T10160)\n\nValidation behaviors:\n  \u2022 Unknown flags \u2192 E_UNKNOWN_FLAG with did-you-mean suggestions (T10359)\n  \u2022 Slug collision \u2192 E_SLUG_RESERVED + 3 alternative slugs (T10386)\n  \u2022 Near-duplicate slug \u2192 W_SLUG_SIMILAR warning unless --allow-similar (T10361)\n  \u2022 TODO(T10360): --type adr will auto-allocate adr-NNN-<title> from a --title flag.'
       },
       args: {
         "owner-id": {
@@ -46259,7 +46434,7 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync14 } from "node:fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
 import { join as join22 } from "node:path";
 import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
@@ -46282,13 +46457,13 @@ function extractAgentName(source) {
 function appendAuditLog(projectRoot, entry) {
   const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
   const auditDir = join22(auditPath, "..");
-  if (!existsSync14(auditDir)) {
+  if (!existsSync13(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync14(scanDir)) return;
+  if (!existsSync13(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -46304,7 +46479,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     let sourceBytes;
     let sourceText;
     try {
-      sourceBytes = readFileSync14(cantPath);
+      sourceBytes = readFileSync13(cantPath);
       sourceText = sourceBytes.toString("utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -46407,10 +46582,10 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
 }
 function readMigrationConflicts(projectRoot) {
   const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync14(auditPath)) return [];
+  if (!existsSync13(auditPath)) return [];
   let raw;
   try {
-    raw = readFileSync14(auditPath, "utf8");
+    raw = readFileSync13(auditPath, "utf8");
   } catch {
     return [];
   }
@@ -47439,8 +47614,8 @@ var init_event = __esm({
           }
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
-            const { readFileSync: readFileSync18 } = await import("node:fs");
-            const content = readFileSync18(join24(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync21 } = await import("node:fs");
+            const content = readFileSync21(join24(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -47535,8 +47710,8 @@ var init_event = __esm({
         const printAgentLog = async (file) => {
           const agentId = file.replace(".jsonl", "");
           try {
-            const { readFileSync: readFileSync18 } = await import("node:fs");
-            const content = readFileSync18(join24(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync21 } = await import("node:fs");
+            const content = readFileSync21(join24(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -49424,7 +49599,7 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir2,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
 import { join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
@@ -49440,9 +49615,9 @@ function getGitignoreTemplate() {
     const packageRoot = join26(thisFile, "..", "..", "..", "..");
     const localTemplatePath = join26(packageRoot, "templates", "cleo-gitignore");
     const monorepoTemplatePath = join26(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync15(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync15(templatePath)) {
-      return readFileSync15(templatePath, "utf-8");
+    const templatePath = existsSync14(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync14(templatePath)) {
+      return readFileSync14(templatePath, "utf-8");
     }
   } catch {
   }
@@ -50808,7 +50983,7 @@ async function _headlessPkceFlow(provider, authUrl) {
     `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
   `
   );
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.once("data", (chunk) => {
@@ -50820,7 +50995,7 @@ async function _headlessPkceFlow(provider, authUrl) {
           reject(new Error('Redirect URL is missing the "code" parameter'));
           return;
         }
-        resolve7(code);
+        resolve8(code);
       } catch {
         reject(new Error(`Invalid redirect URL: ${buf}`));
       }
@@ -50828,7 +51003,7 @@ async function _headlessPkceFlow(provider, authUrl) {
   });
 }
 async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const server = createServer2((req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       const code = url.searchParams.get("code");
@@ -50838,7 +51013,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (error) {
         res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
         server.close();
-        resolve7({
+        resolve8({
           error: {
             code: "E_PKCE_AUTH_DENIED",
             codeName: "E_PKCE_AUTH_DENIED",
@@ -50850,7 +51025,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (!code || state !== expectedState) {
         res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
         server.close();
-        resolve7({
+        resolve8({
           error: {
             code: "E_PKCE_INVALID_CALLBACK",
             codeName: "E_PKCE_INVALID_CALLBACK",
@@ -50861,7 +51036,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       }
       res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
       server.close();
-      resolve7({ code });
+      resolve8({ code });
     });
     server.listen(port, "localhost", () => {
       process.stderr.write("\n");
@@ -50994,7 +51169,7 @@ function _generateState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function _findFreePort() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const srv = createServer2();
     srv.listen(0, "localhost", () => {
       const addr = srv.address();
@@ -51004,7 +51179,7 @@ function _findFreePort() {
         return;
       }
       const port = addr.port;
-      srv.close(() => resolve7(port));
+      srv.close(() => resolve8(port));
     });
     srv.on("error", reject);
   });
@@ -51626,14 +51801,14 @@ async function readStdin() {
   if (process.stdin.isTTY) {
     return "";
   }
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve7(data.trim());
+      resolve8(data.trim());
     });
     process.stdin.on("error", reject);
   });
@@ -55202,13 +55377,13 @@ var init_nexus3 = __esm({
           if (!skipPrompt) {
             const { createInterface: createInterface4 } = await import("node:readline");
             const rl = createInterface4({ input: process.stdin, output: process.stdout });
-            const confirmed = await new Promise((resolve7) => {
+            const confirmed = await new Promise((resolve8) => {
               rl.question(
                 `
 [nexus] Delete ${matchCount} project(s) from the registry? [y/N] `,
                 (answer) => {
                   rl.close();
-                  resolve7(answer.trim().toLowerCase() === "y");
+                  resolve8(answer.trim().toLowerCase() === "y");
                 }
               );
             });
@@ -55358,8 +55533,8 @@ var init_nexus3 = __esm({
             projectFilter
           });
           if (outputFile) {
-            const { writeFileSync: writeFileSync5 } = await import("node:fs");
-            writeFileSync5(outputFile, result.content, "utf-8");
+            const { writeFileSync: writeFileSync7 } = await import("node:fs");
+            writeFileSync7(outputFile, result.content, "utf-8");
             const durationMs = Date.now() - startTime;
             cliOutput(
               { outputFile, nodeCount: result.nodeCount, edgeCount: result.edgeCount },
@@ -60386,7 +60561,7 @@ var revert_exports = {};
 __export(revert_exports, {
   revertCommand: () => revertCommand
 });
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile5 } from "node:fs/promises";
 import { join as join27 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
@@ -60412,7 +60587,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   let raw;
   if (attestationFilePath) {
     try {
-      raw = await readFile4(attestationFilePath, "utf-8");
+      raw = await readFile5(attestationFilePath, "utf-8");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       throw new Error(`Failed to read attestation file "${attestationFilePath}": ${message}`);
@@ -60442,7 +60617,7 @@ async function loadOwnerAttestation(attestationFilePath) {
 async function loadOwnerPubkeys(projectRoot) {
   const path6 = join27(projectRoot, OWNER_PUBKEYS_FILE);
   try {
-    const raw = await readFile4(path6, "utf-8");
+    const raw = await readFile5(path6, "utf-8");
     const parsed = JSON.parse(raw);
     if (Array.isArray(parsed)) {
       return new Set(parsed.filter((k) => typeof k === "string"));
@@ -61110,7 +61285,7 @@ __export(self_update_exports, {
   selfUpdateCommand: () => selfUpdateCommand
 });
 import { execFile } from "node:child_process";
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import { join as join28 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
@@ -61126,7 +61301,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome4();
   try {
-    const content = await readFile5(join28(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile6(join28(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -61218,11 +61393,11 @@ async function runPostUpdateDiagnostics(opts) {
         input: process.stdin,
         output: process.stdout
       });
-      shouldMigrate = await new Promise((resolve7) => {
+      shouldMigrate = await new Promise((resolve8) => {
         rl.question("  Do you want to run the upgrade now? [Y/n] ", (answer) => {
           rl.close();
           const clean = answer.trim().toLowerCase();
-          resolve7(clean === "" || clean === "y" || clean === "yes");
+          resolve8(clean === "" || clean === "y" || clean === "yes");
         });
       });
     }
@@ -62666,7 +62841,7 @@ async function promptOwnerAuthPassword(sessionName) {
     terminal: true
   });
   process.stderr.write(`[cleo] Enter owner-auth password for session "${sessionName}": `);
-  const password = await new Promise((resolve7) => {
+  const password = await new Promise((resolve8) => {
     if (process.stdin.setRawMode) {
       process.stdin.setRawMode(
         true
@@ -62684,10 +62859,10 @@ async function promptOwnerAuthPassword(sessionName) {
           );
         }
         process.stderr.write("\n");
-        resolve7(pw);
+        resolve8(pw);
       } else if (ch === "") {
         process.stderr.write("\n[cleo] Cancelled.\n");
-        resolve7("");
+        resolve8("");
       } else if (ch === "\x7F" || ch === "\b") {
         pw = pw.slice(0, -1);
       } else {
@@ -63067,8 +63242,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot53 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot53();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot54 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot54();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -64712,8 +64887,8 @@ var init_snapshot = __esm({
           handleRawError(response, { command: "snapshot", operation: "admin.export" });
           const data = response.data;
           if (data?.outputPath) {
-            const { readFile: readFile7 } = await import("node:fs/promises");
-            const content = await readFile7(data.outputPath, "utf-8");
+            const { readFile: readFile8 } = await import("node:fs/promises");
+            const content = await readFile8(data.outputPath, "utf-8");
             process.stdout.write(content);
             if (!content.endsWith("\n")) process.stdout.write("\n");
           }
@@ -65444,10 +65619,10 @@ var init_sync = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync18 } = await import("node:fs");
+        const { readFileSync: readFileSync21 } = await import("node:fs");
         let externalTasks;
         try {
-          externalTasks = JSON.parse(readFileSync18(args.file, "utf8"));
+          externalTasks = JSON.parse(readFileSync21(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse external tasks file: ${message}`, 2, {
@@ -65702,6 +65877,667 @@ var init_telemetry2 = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/templates/lib.ts
+import { readFileSync as readFileSync15 } from "node:fs";
+import { isAbsolute as isAbsolute3, resolve as resolve6 } from "node:path";
+import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
+function resolveProjectRoot7(raw) {
+  if (typeof raw === "string" && raw.length > 0) {
+    return isAbsolute3(raw) ? raw : resolve6(process.cwd(), raw);
+  }
+  return getProjectRoot50();
+}
+function readTemplateSource(entry) {
+  const sourceAbsolute = resolveSourcePathAbsolute(entry);
+  return readFileSync15(sourceAbsolute, "utf8");
+}
+function applySubstitution(entry, source) {
+  if (entry.substitution === "static") {
+    return { rendered: source, substituted: false };
+  }
+  return { rendered: source, substituted: false };
+}
+var init_lib = __esm({
+  "packages/cleo/src/cli/commands/templates/lib.ts"() {
+    "use strict";
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/diff.ts
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { join as join30 } from "node:path";
+import { getTemplateById } from "@cleocode/core/templates/registry";
+function unifiedDiff(a, b) {
+  const aLines = a.length === 0 ? [] : a.split("\n");
+  const bLines = b.length === 0 ? [] : b.split("\n");
+  const out = [];
+  const max = Math.max(aLines.length, bLines.length);
+  for (let i = 0; i < max; i += 1) {
+    const av = aLines[i];
+    const bv = bLines[i];
+    if (av === bv) {
+      if (av !== void 0) out.push(` ${av}`);
+      continue;
+    }
+    if (av !== void 0) out.push(`-${av}`);
+    if (bv !== void 0) out.push(`+${bv}`);
+  }
+  return out.join("\n");
+}
+var templatesDiffCommand;
+var init_diff = __esm({
+  "packages/cleo/src/cli/commands/templates/diff.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    init_lib();
+    templatesDiffCommand = defineCommand({
+      meta: {
+        name: "diff",
+        description: "Diff a template against its installed copy (exit 0 same, 1 different)"
+      },
+      args: {
+        id: {
+          type: "positional",
+          required: true,
+          description: "Template id (kebab-case)"
+        },
+        project: {
+          type: "string",
+          description: "Project root to diff against (default: detected project root)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const id = String(args["id"] ?? "").trim();
+        if (id.length === 0) {
+          cliError(`templates diff failed: <id> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_TEMPLATES_DIFF_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const entry = getTemplateById(id);
+        if (entry === void 0) {
+          cliError(`templates diff failed: id "${id}" not found`, 4 /* NOT_FOUND */, {
+            name: "E_NOT_FOUND",
+            details: { id }
+          });
+          process.exit(4 /* NOT_FOUND */);
+          return;
+        }
+        let projectRoot;
+        let installPath;
+        let rendered;
+        try {
+          projectRoot = resolveProjectRoot7(args["project"]);
+          installPath = join30(projectRoot, entry.installPath);
+          const source = readTemplateSource(entry);
+          rendered = applySubstitution(entry, source).rendered;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`templates diff failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_TEMPLATES_DIFF_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        if (!existsSync15(installPath)) {
+          const missingResult = {
+            id,
+            installPath,
+            same: false,
+            missing: true,
+            diff: `--- (missing) ${installPath}
++++ (rendered) ${id}
+${unifiedDiff("", rendered)}`
+          };
+          cliOutput(missingResult, {
+            command: "templates-diff",
+            operation: "templates.diff"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const current = readFileSync16(installPath, "utf8");
+        const same = current === rendered;
+        const result = {
+          id,
+          installPath,
+          same,
+          missing: false,
+          diff: same ? "" : unifiedDiff(current, rendered)
+        };
+        cliOutput(result, {
+          command: "templates-diff",
+          operation: "templates.diff"
+        });
+        if (!same) {
+          process.exit(1 /* GENERAL_ERROR */);
+        }
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/install.ts
+import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname9, join as join31 } from "node:path";
+import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
+var templatesInstallCommand;
+var init_install = __esm({
+  "packages/cleo/src/cli/commands/templates/install.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    init_lib();
+    templatesInstallCommand = defineCommand({
+      meta: {
+        name: "install",
+        description: "Install a template into a project root (default: current project), idempotent"
+      },
+      args: {
+        id: {
+          type: "positional",
+          required: true,
+          description: "Template id (kebab-case)"
+        },
+        project: {
+          type: "string",
+          description: "Project root to install into (default: detected project root)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const id = String(args["id"] ?? "").trim();
+        if (id.length === 0) {
+          cliError(`templates install failed: <id> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_TEMPLATES_INSTALL_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const entry = getTemplateById2(id);
+        if (entry === void 0) {
+          cliError(`templates install failed: id "${id}" not found`, 4 /* NOT_FOUND */, {
+            name: "E_NOT_FOUND",
+            details: { id }
+          });
+          process.exit(4 /* NOT_FOUND */);
+          return;
+        }
+        let projectRoot;
+        let installPath;
+        let rendered;
+        let substituted;
+        try {
+          projectRoot = resolveProjectRoot7(args["project"]);
+          installPath = join31(projectRoot, entry.installPath);
+          const source = readTemplateSource(entry);
+          const sub = applySubstitution(entry, source);
+          rendered = sub.rendered;
+          substituted = sub.substituted;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`templates install failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_TEMPLATES_INSTALL_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        if (existsSync16(installPath)) {
+          const current = readFileSync17(installPath, "utf8");
+          if (current === rendered) {
+            const noopResult = {
+              id,
+              installPath,
+              installed: false,
+              noop: true,
+              substituted
+            };
+            cliOutput(noopResult, {
+              command: "templates-install",
+              operation: "templates.install"
+            });
+            return;
+          }
+        }
+        try {
+          mkdirSync5(dirname9(installPath), { recursive: true });
+          writeFileSync5(installPath, rendered, "utf8");
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`templates install failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_TEMPLATES_INSTALL_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const result = {
+          id,
+          installPath,
+          installed: true,
+          noop: false,
+          substituted
+        };
+        cliOutput(result, {
+          command: "templates-install",
+          operation: "templates.install"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/list.ts
+import { getTemplateManifest, getTemplatesByKind } from "@cleocode/core/templates/registry";
+function parseTemplateKind(raw) {
+  if (raw === void 0 || raw === "") return null;
+  return TEMPLATE_KINDS.includes(raw) ? raw : null;
+}
+var templatesListCommand;
+var init_list4 = __esm({
+  "packages/cleo/src/cli/commands/templates/list.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    templatesListCommand = defineCommand({
+      meta: {
+        name: "list",
+        description: "List every template the registry knows about (optionally filtered by --kind)"
+      },
+      args: {
+        kind: {
+          type: "string",
+          description: `Optional kind filter: ${TEMPLATE_KINDS.join(" | ")}`
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const rawKind = args["kind"];
+        const kind = parseTemplateKind(typeof rawKind === "string" ? rawKind : void 0);
+        if (kind === null && rawKind !== void 0 && rawKind !== "") {
+          cliError(
+            `templates list failed: invalid --kind (must be ${TEMPLATE_KINDS.join("|")})`,
+            2 /* INVALID_INPUT */,
+            { name: "E_TEMPLATES_LIST_FAILED" }
+          );
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const entries = kind === null ? getTemplateManifest() : getTemplatesByKind(kind);
+        const result = { kind, entries };
+        cliOutput(result, {
+          command: "templates-list",
+          operation: "templates.list"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/show.ts
+import { getTemplateById as getTemplateById3 } from "@cleocode/core/templates/registry";
+var templatesShowCommand;
+var init_show3 = __esm({
+  "packages/cleo/src/cli/commands/templates/show.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    templatesShowCommand = defineCommand({
+      meta: {
+        name: "show",
+        description: "Print a single template manifest entry by id"
+      },
+      args: {
+        id: {
+          type: "positional",
+          required: true,
+          description: "Template id (kebab-case)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const id = String(args["id"] ?? "").trim();
+        if (id.length === 0) {
+          cliError(`templates show failed: <id> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_TEMPLATES_SHOW_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const entry = getTemplateById3(id);
+        if (entry === void 0) {
+          cliError(`templates show failed: id "${id}" not found`, 4 /* NOT_FOUND */, {
+            name: "E_NOT_FOUND",
+            details: { id }
+          });
+          process.exit(4 /* NOT_FOUND */);
+          return;
+        }
+        const result = { id, entry };
+        cliOutput(result, {
+          command: "templates-show",
+          operation: "templates.show"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/upgrade.ts
+import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join32 } from "node:path";
+import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
+var templatesUpgradeCommand;
+var init_upgrade2 = __esm({
+  "packages/cleo/src/cli/commands/templates/upgrade.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    init_diff();
+    init_lib();
+    templatesUpgradeCommand = defineCommand({
+      meta: {
+        name: "upgrade",
+        description: "Re-install a template respecting its updateStrategy (overwrite | diff-prompt | immutable | manifest-merge)"
+      },
+      args: {
+        id: {
+          type: "positional",
+          required: true,
+          description: "Template id (kebab-case)"
+        },
+        project: {
+          type: "string",
+          description: "Project root to upgrade against (default: detected project root)"
+        },
+        diff: {
+          type: "boolean",
+          description: "Preview-only \u2014 print the diff without writing"
+        },
+        accept: {
+          type: "boolean",
+          description: "Apply when strategy is diff-prompt (no-op otherwise)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const id = String(args["id"] ?? "").trim();
+        if (id.length === 0) {
+          cliError(`templates upgrade failed: <id> is required`, 2 /* INVALID_INPUT */, {
+            name: "E_TEMPLATES_UPGRADE_FAILED"
+          });
+          process.exit(2 /* INVALID_INPUT */);
+          return;
+        }
+        const entry = getTemplateById4(id);
+        if (entry === void 0) {
+          cliError(`templates upgrade failed: id "${id}" not found`, 4 /* NOT_FOUND */, {
+            name: "E_NOT_FOUND",
+            details: { id }
+          });
+          process.exit(4 /* NOT_FOUND */);
+          return;
+        }
+        let projectRoot;
+        let installPath;
+        let rendered;
+        try {
+          projectRoot = resolveProjectRoot7(args["project"]);
+          installPath = join32(projectRoot, entry.installPath);
+          const source = readTemplateSource(entry);
+          rendered = applySubstitution(entry, source).rendered;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`templates upgrade failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_TEMPLATES_UPGRADE_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const previewOnly = args["diff"] === true;
+        const accept = args["accept"] === true;
+        const current = existsSync17(installPath) ? readFileSync18(installPath, "utf8") : null;
+        const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
+        let outcome;
+        let reason;
+        let shouldWrite = false;
+        if (entry.updateStrategy === "manifest-merge") {
+          outcome = "not-supported";
+          reason = "manifest-merge upgrade is not yet supported (T9886-followup)";
+        } else if (entry.updateStrategy === "immutable") {
+          outcome = "skipped";
+          reason = current === null ? "immutable: not installed yet \u2014 use `install`" : "immutable: skipped per strategy";
+        } else if (current !== null && current === rendered) {
+          outcome = "noop";
+          reason = "already current";
+        } else if (entry.updateStrategy === "overwrite-on-bump") {
+          if (previewOnly) {
+            outcome = "skipped";
+            reason = "preview-only (--diff)";
+          } else {
+            outcome = "overwritten";
+            reason = current === null ? "fresh install" : "overwrite-on-bump";
+            shouldWrite = true;
+          }
+        } else {
+          if (previewOnly || !accept) {
+            outcome = "skipped";
+            reason = previewOnly ? "preview-only (--diff)" : "diff-prompt: pass --accept to apply";
+          } else {
+            outcome = "overwritten";
+            reason = "diff-prompt: accepted";
+            shouldWrite = true;
+          }
+        }
+        if (shouldWrite) {
+          try {
+            mkdirSync6(dirname10(installPath), { recursive: true });
+            writeFileSync6(installPath, rendered, "utf8");
+          } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            cliError(`templates upgrade failed: ${message}`, 1 /* GENERAL_ERROR */, {
+              name: "E_TEMPLATES_UPGRADE_FAILED"
+            });
+            process.exit(1 /* GENERAL_ERROR */);
+            return;
+          }
+        }
+        const result = {
+          id,
+          installPath,
+          updateStrategy: entry.updateStrategy,
+          outcome,
+          reason,
+          diff: diffBody
+        };
+        cliOutput(result, {
+          command: "templates-upgrade",
+          operation: "templates.upgrade"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/validate.ts
+import {
+  getInstalledStatus,
+  getTemplateById as getTemplateById5,
+  getTemplateManifest as getTemplateManifest2,
+  resolveSourcePathAbsolute as resolveSourcePathAbsolute2
+} from "@cleocode/core/templates/registry";
+var templatesValidateCommand;
+var init_validate3 = __esm({
+  "packages/cleo/src/cli/commands/templates/validate.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_renderers();
+    init_lib();
+    templatesValidateCommand = defineCommand({
+      meta: {
+        name: "validate",
+        description: "Validate every registry entry (or one --id) against the live filesystem"
+      },
+      args: {
+        id: {
+          type: "string",
+          description: "Validate a single entry by id (default: walk every entry)"
+        },
+        project: {
+          type: "string",
+          description: "Project root to probe install status against (default: detected)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        let projectRoot;
+        try {
+          projectRoot = resolveProjectRoot7(args["project"]);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`templates validate failed: ${message}`, 1 /* GENERAL_ERROR */, {
+            name: "E_TEMPLATES_VALIDATE_FAILED"
+          });
+          process.exit(1 /* GENERAL_ERROR */);
+          return;
+        }
+        const idFilter = typeof args["id"] === "string" && args["id"].length > 0 ? args["id"] : null;
+        let targets;
+        if (idFilter === null) {
+          targets = getTemplateManifest2();
+        } else {
+          const entry = getTemplateById5(idFilter);
+          if (entry === void 0) {
+            cliError(`templates validate failed: id "${idFilter}" not found`, 4 /* NOT_FOUND */, {
+              name: "E_NOT_FOUND",
+              details: { id: idFilter }
+            });
+            process.exit(4 /* NOT_FOUND */);
+            return;
+          }
+          targets = [entry];
+        }
+        const entries = targets.map((entry) => {
+          const issues = [];
+          let sourcePath = null;
+          let sourceExists = false;
+          try {
+            sourcePath = resolveSourcePathAbsolute2(entry);
+            sourceExists = true;
+          } catch (err) {
+            issues.push(`source: ${err instanceof Error ? err.message : String(err)}`);
+          }
+          let installed = false;
+          let installPath = null;
+          try {
+            const status = getInstalledStatus(entry.id, projectRoot);
+            installed = status.installed;
+            installPath = status.path;
+          } catch (err) {
+            issues.push(`install: ${err instanceof Error ? err.message : String(err)}`);
+          }
+          return {
+            id: entry.id,
+            kind: entry.kind,
+            sourceExists,
+            sourcePath,
+            installed,
+            installPath,
+            issues
+          };
+        });
+        const ok = entries.every((e) => e.issues.length === 0);
+        const result = {
+          ok,
+          count: entries.length,
+          entries
+        };
+        cliOutput(result, {
+          command: "templates-validate",
+          operation: "templates.validate"
+        });
+        if (!ok) {
+          process.exit(6 /* VALIDATION_ERROR */);
+        }
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/templates/index.ts
+var init_templates = __esm({
+  "packages/cleo/src/cli/commands/templates/index.ts"() {
+    "use strict";
+    init_diff();
+    init_install();
+    init_list4();
+    init_show3();
+    init_upgrade2();
+    init_validate3();
+  }
+});
+
+// packages/cleo/src/cli/commands/templates.ts
+var templates_exports = {};
+__export(templates_exports, {
+  templatesCommand: () => templatesCommand
+});
+var templatesCommand;
+var init_templates2 = __esm({
+  "packages/cleo/src/cli/commands/templates.ts"() {
+    "use strict";
+    init_dist();
+    init_define_cli_command();
+    init_templates();
+    templatesCommand = defineCommand({
+      meta: {
+        name: "templates",
+        description: "TemplateManifest SSoT registry surface (list, show, install, upgrade, diff, validate)"
+      },
+      subCommands: {
+        list: templatesListCommand,
+        show: templatesShowCommand,
+        install: templatesInstallCommand,
+        upgrade: templatesUpgradeCommand,
+        diff: templatesDiffCommand,
+        validate: templatesValidateCommand
+      },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/testing.ts
 var testing_exports = {};
 __export(testing_exports, {
@@ -65833,12 +66669,12 @@ var token_exports = {};
 __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
-import { readFileSync as readFileSync16 } from "node:fs";
-import { getProjectRoot as getProjectRoot50, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { getProjectRoot as getProjectRoot51, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
-  if (file) return readFileSync16(file, "utf-8");
+  if (file) return readFileSync19(file, "utf-8");
   return text;
 }
 var filterArgs, summaryCommand3, listCommand26, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
@@ -65998,7 +66834,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot50(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot51(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -66033,8 +66869,8 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join30 } from "node:path";
-import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
+import { join as join33 } from "node:path";
+import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -66064,7 +66900,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot51();
+            const projectRoot = getProjectRoot52();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -66087,7 +66923,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join30(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -66161,7 +66997,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot51();
+        const projectRoot = getProjectRoot52();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -66273,7 +67109,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot51();
+        const projectRoot = getProjectRoot52();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -66393,7 +67229,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join30(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -66454,10 +67290,12 @@ __export(update_exports, {
 });
 import {
   appendSignedSeverityAttestation as appendSignedSeverityAttestation2,
+  INPUT_CONTRACTS as INPUT_CONTRACTS3,
   isPipelineTransitionForward,
   isValidPipelineStage,
   parseAcceptanceCriteria as parseAcceptanceCriteria2,
-  TASK_PIPELINE_STAGES
+  TASK_PIPELINE_STAGES,
+  validateOperationInput as validateOperationInput3
 } from "@cleocode/core";
 var updateCommand2;
 var init_update = __esm({
@@ -66466,6 +67304,7 @@ var init_update = __esm({
     init_src2();
     init_dist();
     init_cli();
+    init_collect_input();
     init_renderers();
     updateCommand2 = defineCommand({
       meta: {
@@ -66473,6 +67312,28 @@ var init_update = __esm({
         description: "Update a task. Safe under concurrent invocation \u2014 retries on SQLITE_BUSY up to 4 attempts (gh#391)."
       },
       args: {
+        /**
+         * Schema-first input — supersedes all flag-based args when present.
+         *
+         * Accepts a JSON object matching `INPUT_CONTRACTS['tasks.update']`.
+         * The `taskId` MUST be present in the JSON payload (positional
+         * `taskId` arg is ignored in this path).
+         *
+         * @task T9917
+         */
+        params: {
+          type: "string",
+          description: 'Inline JSON object matching INPUT_CONTRACTS["tasks.update"] (T9917). Overrides positional + flags.'
+        },
+        /**
+         * Schema-first input from a JSON file. Same semantics as --params.
+         *
+         * @task T9917
+         */
+        "params-file": {
+          type: "string",
+          description: 'Path to JSON file matching INPUT_CONTRACTS["tasks.update"] (T9917).'
+        },
         taskId: {
           type: "positional",
           description: "Task ID to update",
@@ -66671,6 +67532,78 @@ var init_update = __esm({
         }
       },
       async run({ args, cmd }) {
+        const paramsArg = args.params;
+        const paramsFileArg = args["params-file"];
+        if (paramsArg !== void 0 || paramsFileArg !== void 0) {
+          const collectArgs = {};
+          if (paramsArg !== void 0) collectArgs.params = paramsArg;
+          if (paramsFileArg !== void 0) collectArgs.file = paramsFileArg;
+          let raw;
+          try {
+            raw = await collectMutateInput(
+              collectArgs,
+              process.stdin
+            );
+          } catch (err) {
+            cliError(
+              err.message,
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION_FAILED",
+                fix: "Verify the JSON syntax of your --params / --params-file input"
+              },
+              { operation: "tasks.update" }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+            return;
+          }
+          if (raw !== null && typeof raw === "object" && !Array.isArray(raw) && raw["taskId"] === void 0 && args.taskId !== void 0) {
+            raw["taskId"] = args.taskId;
+          }
+          const contract = INPUT_CONTRACTS3["tasks.update"];
+          if (!contract) {
+            cliError(
+              "tasks.update contract missing from INPUT_CONTRACTS registry",
+              1 /* GENERAL_ERROR */,
+              { name: "E_INTERNAL", fix: "This is a CLI bug \u2014 file an issue" },
+              { operation: "tasks.update" }
+            );
+            process.exit(1 /* GENERAL_ERROR */);
+            return;
+          }
+          const validation = validateOperationInput3(contract, raw);
+          if (!validation.ok) {
+            cliError(
+              "tasks.update failed: validation",
+              6 /* VALIDATION_ERROR */,
+              {
+                name: "E_VALIDATION_FAILED",
+                fix: validation.errors[0]?.fix ?? "Inspect errors[] and correct the input",
+                details: { errors: validation.errors }
+              },
+              { operation: "tasks.update" }
+            );
+            process.exit(6 /* VALIDATION_ERROR */);
+            return;
+          }
+          const validatedPayload = raw;
+          const response = await dispatchRaw("mutate", "tasks", "update", validatedPayload);
+          if (!response.success) {
+            cliError(
+              response.error?.message ?? "Update failed",
+              response.error?.code ?? "E_UPDATE_FAILED",
+              {
+                name: response.error?.code ?? "E_UPDATE_FAILED",
+                fix: response.error?.fix ?? "Check task fields and try again"
+              },
+              { operation: "tasks.update" }
+            );
+            process.exit(1);
+            return;
+          }
+          cliOutput(response.data, { command: "update", operation: "tasks.update" });
+          return;
+        }
         if (!args.taskId) {
           await showUsage(cmd);
           return;
@@ -66828,10 +67761,10 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 import { CleoError as CleoError10, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
 var workflowsSubcommand, upgradeCommand;
-var init_upgrade2 = __esm({
+var init_upgrade3 = __esm({
   "packages/cleo/src/cli/commands/upgrade.ts"() {
     "use strict";
     init_dist();
@@ -66868,7 +67801,7 @@ var init_upgrade2 = __esm({
           const dryRun = args["dry-run"] === true || args.check === true;
           const force = args.force === true && !dryRun;
           const result = await upgradeWorkflows2({
-            projectRoot: resolve6(process.cwd()),
+            projectRoot: resolve7(process.cwd()),
             templatesDir: getWorkflowTemplatesDir2(),
             dryRun,
             force
@@ -67128,16 +68061,16 @@ __export(web_exports, {
   webCommand: () => webCommand
 });
 import { execFileSync as execFileSync3, spawn as spawn3 } from "node:child_process";
-import { mkdir as mkdir4, open, readFile as readFile6, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join31 } from "node:path";
+import { mkdir as mkdir4, open, readFile as readFile7, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join34 } from "node:path";
 import { CleoError as CleoError11, formatError as formatError6, getCleoHome as getCleoHome5 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
-    pidFile: join31(cleoHome, "web-server.pid"),
-    configFile: join31(cleoHome, "web-server.json"),
-    logDir: join31(cleoHome, "logs"),
-    logFile: join31(cleoHome, "logs", "web-server.log")
+    pidFile: join34(cleoHome, "web-server.pid"),
+    configFile: join34(cleoHome, "web-server.json"),
+    logDir: join34(cleoHome, "logs"),
+    logFile: join34(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -67151,7 +68084,7 @@ function isProcessRunning(pid) {
 async function getStatus() {
   const { pidFile, configFile } = getWebPaths();
   try {
-    const pidStr = (await readFile6(pidFile, "utf-8")).trim();
+    const pidStr = (await readFile7(pidFile, "utf-8")).trim();
     const pid = Number.parseInt(pidStr, 10);
     if (Number.isNaN(pid) || !isProcessRunning(pid)) {
       return { running: false, pid: null, port: null, host: null, url: null };
@@ -67159,7 +68092,7 @@ async function getStatus() {
     let port = DEFAULT_PORT;
     let host = DEFAULT_HOST;
     try {
-      const config = JSON.parse(await readFile6(configFile, "utf-8"));
+      const config = JSON.parse(await readFile7(configFile, "utf-8"));
       port = config.port ?? DEFAULT_PORT;
       host = config.host ?? DEFAULT_HOST;
     } catch {
@@ -67176,7 +68109,7 @@ async function startWebServer(port, host) {
     throw new CleoError11(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join31(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join34(projectRoot, "packages", "studio", "build");
   await mkdir4(logDir, { recursive: true });
   await writeFile3(
     configFile,
@@ -67186,7 +68119,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join31(studioDir, "index.js");
+  const webIndexPath = join34(studioDir, "index.js");
   try {
     await stat2(webIndexPath);
   } catch {
@@ -67234,7 +68167,7 @@ Logs: ${logFile}`
       }
     } catch {
     }
-    await new Promise((resolve7) => setTimeout(resolve7, 500));
+    await new Promise((resolve8) => setTimeout(resolve8, 500));
   }
   if (!started) {
     try {
@@ -67311,7 +68244,7 @@ var init_web = __esm({
           }
           for (let i = 0; i < 60; i++) {
             if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve7) => setTimeout(resolve7, 500));
+            await new Promise((resolve8) => setTimeout(resolve8, 500));
           }
           if (isProcessRunning(status.pid)) {
             try {
@@ -67363,7 +68296,7 @@ var init_web = __esm({
             }
             for (let i = 0; i < 60; i++) {
               if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve7) => setTimeout(resolve7, 500));
+              await new Promise((resolve8) => setTimeout(resolve8, 500));
             }
             if (isProcessRunning(status.pid)) {
               try {
@@ -67459,14 +68392,14 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot52, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot53, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
-      resolve7(trimmed === "y" || trimmed === "yes");
+      resolve8(trimmed === "y" || trimmed === "yes");
     });
   });
 }
@@ -67564,7 +68497,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot53();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -67799,8 +68732,8 @@ var init_worktree3 = __esm({
 init_dist();
 init_field_context();
 init_format_context();
-import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname9, join as join33 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { dirname as dirname11, join as join36 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -68597,6 +69530,12 @@ var COMMAND_MANIFEST = [
     description: "Manage anonymous skills-usage telemetry (enable/disable/status)",
     load: async () => (await Promise.resolve().then(() => (init_telemetry2(), telemetry_exports))).telemetryCommand
   },
+  {
+    exportName: "templatesCommand",
+    name: "templates",
+    description: "TemplateManifest SSoT registry surface (list, show, install, upgrade, diff, validate)",
+    load: async () => (await Promise.resolve().then(() => (init_templates2(), templates_exports))).templatesCommand
+  },
   {
     exportName: "testingCommand",
     name: "testing",
@@ -68625,7 +69564,7 @@ var COMMAND_MANIFEST = [
     exportName: "upgradeCommand",
     name: "upgrade",
     description: "Unified project maintenance (storage migration, schema repair, structural fixes, doc refresh)",
-    load: async () => (await Promise.resolve().then(() => (init_upgrade2(), upgrade_exports))).upgradeCommand
+    load: async () => (await Promise.resolve().then(() => (init_upgrade3(), upgrade_exports))).upgradeCommand
   },
   {
     exportName: "verifyCommand",
@@ -68808,14 +69747,14 @@ function lazyCommand(meta, loader2) {
 init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync16 } from "node:fs";
-import { join as join32 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { join as join35 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join32(getCleoPlatformPaths().config, "config.json");
-  if (existsSync16(configPath)) return false;
+  const configPath = join35(getCleoPlatformPaths().config, "config.json");
+  if (existsSync18(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -68826,7 +69765,7 @@ async function detectFirstRun() {
   return true;
 }
 function waitForEnterOrTimeout(timeoutMs) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     let resolved = false;
     const finish = () => {
       if (resolved) return;
@@ -68838,7 +69777,7 @@ function waitForEnterOrTimeout(timeoutMs) {
         process.stdin.pause();
       } catch {
       }
-      resolve7();
+      resolve8();
     };
     const onData = (chunk) => {
       const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -68929,8 +69868,8 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join33(dirname9(fileURLToPath7(import.meta.url)), "../../package.json");
-  const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
+  const pkgPath = join36(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   return pkg.version;
 }
 var CLI_VERSION = getPackageVersion();
@@ -69082,7 +70021,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger21,
-    getProjectRoot: getProjectRoot53,
+    getProjectRoot: getProjectRoot54,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -69091,7 +70030,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot53();
+    projectRootForCleanup = getProjectRoot54();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -69111,7 +70050,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot53();
+      const _projectRootForMigration = getProjectRoot54();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {