@cleocode/cleo 2026.5.120 → 2026.5.121

package/dist/cli/index.js

@@ -1730,7 +1730,7 @@ var init_branch_lock = __esm({
 
 // packages/contracts/src/changesets.ts
 import { z as z3 } from "zod";
-var CHANGESET_KINDS, TASK_ID_RE, ChangesetEntrySchema;
+var CHANGESET_KINDS, CHANGESET_RELEASE_NOTE_SECTIONS, CHANGESET_RELEASE_NOTE_AUDIENCES, CHANGESET_RELEASE_NOTE_SCOPES, nonEmptyReleaseNoteText, nonEmptyReleaseNoteList, ChangesetReleaseNotesMetadataSchema, TASK_ID_RE, ChangesetEntrySchema;
 var init_changesets = __esm({
   "packages/contracts/src/changesets.ts"() {
     "use strict";
@@ -1744,10 +1744,60 @@ var init_changesets = __esm({
       "chore",
       "breaking"
     ];
+    CHANGESET_RELEASE_NOTE_SECTIONS = [
+      "added",
+      "changed",
+      "fixed",
+      "deprecated",
+      "removed",
+      "security",
+      "breaking"
+    ];
+    CHANGESET_RELEASE_NOTE_AUDIENCES = [
+      "users",
+      "operators",
+      "developers",
+      "maintainers"
+    ];
+    CHANGESET_RELEASE_NOTE_SCOPES = [
+      "project",
+      "package",
+      "component",
+      "docs",
+      "ops",
+      "security"
+    ];
+    nonEmptyReleaseNoteText = z3.string().min(1, "release-note metadata text must be non-empty");
+    nonEmptyReleaseNoteList = z3.array(nonEmptyReleaseNoteText).min(1, "release-note metadata list must contain at least one item");
+    ChangesetReleaseNotesMetadataSchema = z3.object({
+      /** Keep-a-Changelog style section/category override. */
+      section: z3.enum(CHANGESET_RELEASE_NOTE_SECTIONS).optional(),
+      /** Intended readers for the note. */
+      audience: z3.array(z3.enum(CHANGESET_RELEASE_NOTE_AUDIENCES)).min(1).optional(),
+      /** Release-note scope. */
+      scope: z3.enum(CHANGESET_RELEASE_NOTE_SCOPES).optional(),
+      /** Package/project/component targets affected by this entry. */
+      targets: nonEmptyReleaseNoteList.optional(),
+      /** User- or operator-visible impact statement. */
+      impact: nonEmptyReleaseNoteText.optional(),
+      /** Deterministic migration/action text, separate from breaking changes. */
+      migration: nonEmptyReleaseNoteText.optional(),
+      /** Deprecation detail for Deprecated sections. */
+      deprecation: nonEmptyReleaseNoteText.optional(),
+      /** Security detail for Security sections. */
+      security: nonEmptyReleaseNoteText.optional(),
+      /** Operator-facing rollout/verification note. */
+      operatorNotes: nonEmptyReleaseNoteText.optional(),
+      /** Explicit inclusion toggle for future release-scope filters. */
+      includeInChangelog: z3.boolean().optional()
+    }).strict();
     TASK_ID_RE = /^(T\d+(-[A-Z][A-Za-z0-9]*)?|E-\d+(-[A-Z][A-Za-z0-9]*)?)$/;
     ChangesetEntrySchema = z3.object({
-      /** Filename slug (without the `.md` extension). */
-      id: z3.string().min(1, "id must be non-empty").regex(/^[a-z0-9][a-z0-9-]*$/, "id must be kebab-case (lowercase, digits, hyphens)"),
+      /** Filename identifier (without the `.md` extension); lowercase kebab-case for new files, legacy uppercase task IDs accepted. */
+      id: z3.string().min(1, "id must be non-empty").regex(
+        /^[A-Za-z0-9][A-Za-z0-9-]*$/,
+        "id must contain only ASCII letters, digits, and hyphens"
+      ),
       /** One or more CLEO task IDs this change is anchored to. */
       tasks: z3.array(z3.string().regex(TASK_ID_RE, "task ID must match T#### or E-#### format")).min(1, "tasks must contain at least one task ID"),
       /** Type of change. */
@@ -1759,7 +1809,9 @@ var init_changesets = __esm({
       /** Markdown body — longer-form explanation. */
       notes: z3.string().optional(),
       /** Migration note. Required iff `kind === 'breaking'`. */
-      breaking: z3.string().optional()
+      breaking: z3.string().optional(),
+      /** Structured author-provided metadata for deterministic release notes. */
+      releaseNotes: ChangesetReleaseNotesMetadataSchema.optional()
     }).refine((entry) => entry.kind !== "breaking" || (entry.breaking?.length ?? 0) > 0, {
       message: "breaking entries must include a non-empty `breaking` migration note",
       path: ["breaking"]
@@ -9367,6 +9419,35 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // release query: validate-changelog (T9937 / Saga T9862 — canonical CHANGELOG
+      // header validator that replaces the brittle inline grep step in
+      // .github/workflows/release.yml). Read-only — exposed only under the query
+      // gateway because no DB or filesystem mutation occurs.
+      {
+        gateway: "query",
+        domain: "release",
+        operation: "validate-changelog",
+        description: "release.validate-changelog (query) \u2014 validate that CHANGELOG.md contains the canonical `## [VERSION]` header per ADR-028 \xA72.5. Replaces the brittle inline grep in .github/workflows/release.yml (T9937 / Saga T9862).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+            cli: { positional: true }
+          },
+          {
+            name: "changelogPath",
+            type: "string",
+            required: false,
+            description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)"
+          }
+        ]
+      },
       // ---------------------------------------------------------------------------
       // Provenance domain — `cleo provenance` CLI surface (T9528 · Phase 2 of T9493)
       // ---------------------------------------------------------------------------
@@ -10546,7 +10627,7 @@ var init_errors = __esm({
 
 // packages/contracts/src/evidence-atom-schema.ts
 import { z as z6 } from "zod";
-var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS;
+var commitAtomSchema, filesAtomSchema, testRunAtomSchema, toolAtomSchema, urlAtomSchema, noteAtomSchema, decisionAtomSchema, prAtomSchema, locDropAtomSchema, callsiteCoverageAtomSchema, EvidenceAtomSchema, GATE_EVIDENCE_REQUIREMENTS, ATOM_EXAMPLES;
 var init_evidence_atom_schema = __esm({
   "packages/contracts/src/evidence-atom-schema.ts"() {
     "use strict";
@@ -10621,6 +10702,18 @@ var init_evidence_atom_schema = __esm({
       cleanupDone: { oneOf: [["note"]] },
       nexusImpact: { oneOf: [["tool"], ["note"]] }
     });
+    ATOM_EXAMPLES = Object.freeze({
+      commit: "commit:<sha>",
+      files: "files:path/a.ts,path/b.ts",
+      "test-run": "test-run:/tmp/vitest-out.json",
+      tool: "tool:test",
+      url: "url:https://example.com/docs",
+      note: "note:<short description>",
+      decision: "decision:D-arch-001",
+      pr: "pr:357",
+      "loc-drop": "loc-drop:<fromLines>:<toLines>",
+      "callsite-coverage": "callsite-coverage:<symbolName>:<relativeSourcePath>"
+    });
   }
 });
 
@@ -13807,6 +13900,7 @@ __export(engine_exports, {
   taskWorkHistory: () => taskWorkHistory,
   tasksAddBatchOp: () => tasksAddBatchOp,
   validateBatchValidate: () => coreBatchValidate,
+  validateChangelog: () => validateChangelog,
   validateCoherenceCheck: () => coreCoherenceCheck,
   validateComplianceRecord: () => coreComplianceRecord,
   validateComplianceSummary: () => coreComplianceSummary,
@@ -14032,6 +14126,7 @@ import {
   taskUnclaim,
   taskUpdate,
   taskWorkHistory,
+  validateChangelog,
   validateGateVerify,
   validateProtocolArchitectureDecision,
   validateProtocolArtifactPublish,
@@ -27401,16 +27496,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync19 } = await import("node:fs");
-    const { join: join37 } = await import("node:path");
+    const { readFileSync: readFileSync21, readdirSync: readdirSync3, existsSync: existsSync20 } = await import("node:fs");
+    const { join: join38 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync19(workflowsDir)) {
+    if (existsSync20(workflowsDir)) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(workflowsDir, file), "utf-8");
+          const src = readFileSync21(join38(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27425,12 +27520,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join37(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync19(localCantDir)) {
+    const localCantDir = join38(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync20(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync21(join37(localCantDir, file), "utf-8");
+          const src = readFileSync21(join38(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -27622,11 +27717,11 @@ async function orchestrateAnalyzeParallelSafety(taskIds, projectRoot) {
     };
   }
 }
-async function handleWorktreeComplete(taskId, projectRoot, resolve8) {
+async function handleWorktreeComplete(taskId, projectRoot, resolve9) {
   try {
     const { completeWorktreeForTask } = await import("@cleocode/core/internal");
     const result = completeWorktreeForTask(taskId, projectRoot, {
-      resolve: resolve8 ?? "auto"
+      resolve: resolve9 ?? "auto"
     });
     if (result.outcome === "conflict") {
       return {
@@ -28306,10 +28401,10 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const rawResolve = params.resolve;
-              const resolve8 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
+              const resolve9 = rawResolve === "manual" ? "manual" : rawResolve === "auto" ? "auto" : void 0;
               const p = {
                 taskId: params.taskId,
-                ...resolve8 !== void 0 ? { resolve: resolve8 } : {}
+                ...resolve9 !== void 0 ? { resolve: resolve9 } : {}
               };
               return wrapResult(
                 await coreOps2["worktree.complete"](p),
@@ -29450,6 +29545,65 @@ var init_release2 = __esm({
                 startTime
               );
             }
+            // release.validate-changelog — canonical CHANGELOG.md header validator
+            // (T9937 / Saga T9862). Replaces the brittle `grep -qF "## [VERSION]"`
+            // step in .github/workflows/release.yml. Read-only.
+            //
+            // The core verb returns a plain `ValidateChangelogResult` envelope
+            // (NOT an EngineResult discriminated union) so direct SDK consumers
+            // can branch on `result.valid`. At the dispatch boundary we translate
+            // `valid=false` into `E_CHANGELOG_MISSING_SECTION` so the CLI emits a
+            // non-zero exit code — exactly the behaviour CI workflows depend on
+            // (the legacy `grep -qF "## [VERSION]" || exit 1` had the same
+            // contract).
+            case "validate-changelog": {
+              const version = typeof params?.version === "string" ? params.version : void 0;
+              if (!version)
+                return errorResult(
+                  "query",
+                  "release",
+                  operation,
+                  "E_INVALID_INPUT",
+                  "version is required",
+                  startTime
+                );
+              const typed = {
+                version,
+                projectRoot: getProjectRoot14(),
+                ...typeof params?.changelogPath === "string" ? { changelogPath: params.changelogPath } : {}
+              };
+              const validation = await validateChangelog(typed);
+              if (validation.valid) {
+                return wrapResult(
+                  { success: true, data: validation },
+                  "query",
+                  "release",
+                  operation,
+                  startTime
+                );
+              }
+              return wrapResult(
+                {
+                  success: false,
+                  error: {
+                    code: "E_CHANGELOG_MISSING_SECTION",
+                    message: validation.reason ?? `CHANGELOG.md missing canonical header for v${validation.normalizedVersion}`,
+                    details: {
+                      version: validation.version,
+                      normalizedVersion: validation.normalizedVersion,
+                      changelogPath: validation.changelogPath,
+                      headerFound: validation.headerFound
+                    },
+                    fix: `Run \`cleo release plan v${validation.normalizedVersion}\` locally to write the section, then re-push.`,
+                    exitCode: 1
+                  }
+                },
+                "query",
+                "release",
+                operation,
+                startTime
+              );
+            }
             default:
               return unsupportedOp("query", "release", operation, startTime);
           }
@@ -29617,7 +29771,7 @@ var init_release2 = __esm({
       /** Return declared operations for introspection and registry validation. */
       getSupportedOperations() {
         return {
-          query: ["gate", "ivtr-suggest"],
+          query: ["gate", "ivtr-suggest", "validate-changelog"],
           mutate: ["gate", "ivtr-suggest", "reconcile", "plan", "open"]
         };
       }
@@ -30769,7 +30923,13 @@ var init_tasks2 = __esm({
             // T944/T9072: kind filter
             kind: params.kind,
             // T9905: unified urgency surface
-            urgent: params.urgent
+            urgent: params.urgent,
+            // T9904: label filter — `cleo find --label <name>` (closes GH#393).
+            label: params.label,
+            // T10108: parent filter — `cleo find --parent <id>`. Saga-aware via
+            // resolveSagaMemberIds (ADR-073 §1) so saga members surface through
+            // the same routing as `cleo list --parent`.
+            parent: params.parent
           }),
           "find"
         );
@@ -33500,7 +33660,7 @@ function wrapParseError(rawInput, parseErr, sourceLabel) {
   return new Error(`Invalid JSON in ${sourceLabel}: ${parseErr.message} (got: ${snippet2})`);
 }
 function readStdinJson(stdin2) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const chunks = [];
     stdin2.on("data", (chunk) => {
       chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
@@ -33511,7 +33671,7 @@ function readStdinJson(stdin2) {
     stdin2.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf8");
       try {
-        resolve8(JSON.parse(raw));
+        resolve9(JSON.parse(raw));
       } catch (err) {
         reject(wrapParseError(raw, err, "stdin"));
       }
@@ -34740,12 +34900,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync19, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
-          const cantDir = join37(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join37(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync20, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
+          const cantDir = join38(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join38(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync19(cantPath)) {
+          if (!existsSync20(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -34805,7 +34965,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync19(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync20(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -34924,8 +35084,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19, readFileSync: readFileSync21 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20, readFileSync: readFileSync21 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -34945,8 +35105,8 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync19(cantPath)) {
+          const cantPath = args.cant ?? join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync20(cantPath)) {
             profile = readFileSync21(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -35470,8 +35630,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { join: join37 } = await import("node:path");
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { join: join38 } = await import("node:path");
           await openCleoDb("tasks");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
           const credential = await registry.get(args.agentId);
@@ -35488,8 +35648,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join37(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync19(cantPath);
+          const cantPath = join38(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync20(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -36285,10 +36445,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync19 } = await import("node:fs");
-          const { basename, resolve: resolve8 } = await import("node:path");
-          const resolvedPath = resolve8(args.path);
-          if (!existsSync19(resolvedPath)) {
+          const { existsSync: existsSync20 } = await import("node:fs");
+          const { basename, resolve: resolve9 } = await import("node:path");
+          const resolvedPath = resolve9(args.path);
+          if (!existsSync20(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -36413,11 +36573,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, statSync } = await import("node:fs");
-          const { resolve: resolve8, basename, dirname: dirname12 } = await import("node:path");
+          const { existsSync: existsSync20, statSync } = await import("node:fs");
+          const { resolve: resolve9, basename, dirname: dirname12 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
-          const resolvedDir = resolve8(args.dir);
-          if (!existsSync19(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          const resolvedDir = resolve9(args.dir);
+          if (!existsSync20(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -36431,9 +36591,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join37 } = await import("node:path");
-          const personaPath = join37(resolvedDir, "persona.cant");
-          if (!existsSync19(personaPath)) {
+          const { join: join38 } = await import("node:path");
+          const personaPath = join38(resolvedDir, "persona.cant");
+          if (!existsSync20(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -36449,7 +36609,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const agentName = basename(resolvedDir);
           const archiveName = `${agentName}.cantz`;
-          const archivePath = resolve8(archiveName);
+          const archivePath = resolve9(archiveName);
           const parentDir = dirname12(resolvedDir);
           try {
             execFileSync5("zip", ["-r", archivePath, agentName], {
@@ -36480,7 +36640,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join37(dirPath, entry.name));
+                countFiles(join38(dirPath, entry.name));
               }
             }
           };
@@ -36728,17 +36888,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync19, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve8, join: join37 } = await import("node:path");
-          const specPath = resolve8(args.spec);
-          if (!existsSync19(specPath)) {
+          const { existsSync: existsSync20, readFileSync: readFileSync21, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve9, join: join38 } = await import("node:path");
+          const specPath = resolve9(args.spec);
+          if (!existsSync20(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
           const specContent = readFileSync21(specPath, "utf-8");
           const projectRoot = getProjectRoot24();
-          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join37(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve9(args["output-dir"]) : join38(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -37489,8 +37649,8 @@ function detectAuthType(provider, token) {
 async function promptYesNo(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    const answer = await new Promise((resolve8) => {
-      rl.question(question, (a) => resolve8(a));
+    const answer = await new Promise((resolve9) => {
+      rl.question(question, (a) => resolve9(a));
     });
     const clean = answer.trim().toLowerCase();
     return clean === "y" || clean === "yes";
@@ -38426,12 +38586,12 @@ async function promptPassphrase() {
       "Cannot prompt for passphrase: stdin is not a TTY. Set the CLEO_BACKUP_PASSPHRASE environment variable for non-interactive use."
     );
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     process.stdout.write("Passphrase: ");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("", (answer) => {
       rl.close();
-      resolve8(answer.trim());
+      resolve9(answer.trim());
     });
   });
 }
@@ -39541,11 +39701,11 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync19 } = await import("node:fs");
+          const { existsSync: existsSync20 } = await import("node:fs");
           const { readFile: readFile8 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync19(filePath)) {
+            if (!existsSync20(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -40600,11 +40760,11 @@ var init_check2 = __esm({
       },
       async run({ args }) {
         const { spawnSync } = await import("node:child_process");
-        const { existsSync: existsSync19 } = await import("node:fs");
-        const { join: join37, resolve: resolve8 } = await import("node:path");
+        const { existsSync: existsSync20 } = await import("node:fs");
+        const { join: join38, resolve: resolve9 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
-        const repoRoot = resolve8(process.cwd());
+        const repoRoot = resolve9(process.cwd());
         const gates = [
           {
             id: "gate-1",
@@ -40641,8 +40801,8 @@ var init_check2 = __esm({
         const results = [];
         let anyFailed = false;
         for (const gate of gates) {
-          const scriptPath = join37(repoRoot, gate.script);
-          if (!existsSync19(scriptPath)) {
+          const scriptPath = join38(repoRoot, gate.script);
+          if (!existsSync20(scriptPath)) {
             results.push({
               id: gate.id,
               task: gate.task,
@@ -40957,9 +41117,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -41050,9 +41210,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join37 } = await import("node:path");
+            const { join: join38 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join37(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join38(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -47343,6 +47503,254 @@ ${this.prefix}: \u2717 ${message}
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-release-readiness.ts
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join22, resolve as resolve6 } from "node:path";
+async function runCheck(name, cmd, args, cwd) {
+  const { spawnSync } = await import("node:child_process");
+  const start = Date.now();
+  const result = spawnSync(cmd, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    cwd
+  });
+  const durationMs = Date.now() - start;
+  const passed = result.status === 0;
+  return {
+    name,
+    status: passed ? "pass" : "fail",
+    exitCode: result.status,
+    durationMs,
+    stdout: (result.stdout ?? "").trim(),
+    stderr: (result.stderr ?? "").trim()
+  };
+}
+var doctorReleaseReadinessCommand;
+var init_doctor_release_readiness = __esm({
+  "packages/cleo/src/cli/commands/doctor-release-readiness.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorReleaseReadinessCommand = defineCommand({
+      meta: {
+        name: "release-readiness",
+        description: "Pre-flight release readiness check \u2014 lint matrix + changelog + changeset + npm OIDC + tag-trigger sanity (T10458)"
+      },
+      args: {
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run({ args }) {
+        const isHuman = args.human === true || !!process.stdout.isTTY && args.json !== true;
+        const repoRoot = resolve6(process.cwd());
+        const startTotal = Date.now();
+        const checks = [];
+        const biomePath = join22(repoRoot, "node_modules", ".bin", "biome");
+        const biomeAvailable = existsSync13(biomePath);
+        if (biomeAvailable) {
+          checks.push(await runCheck("biome-lint", biomePath, ["ci", "."], repoRoot));
+        } else {
+          checks.push({
+            name: "biome-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "biome not found in node_modules/.bin \u2014 skipping"
+          });
+        }
+        const changesetLintScript = join22(repoRoot, "scripts", "lint-changesets.mjs");
+        if (existsSync13(changesetLintScript)) {
+          checks.push(await runCheck("changeset-lint", "node", [changesetLintScript], repoRoot));
+        } else {
+          checks.push({
+            name: "changeset-lint",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "scripts/lint-changesets.mjs not found \u2014 skipping"
+          });
+        }
+        const changelogPath = join22(repoRoot, "CHANGELOG.md");
+        const changelogExists = existsSync13(changelogPath);
+        const changelogCheck = {
+          name: "changelog-exists",
+          status: changelogExists ? "pass" : "fail",
+          exitCode: changelogExists ? 0 : 1,
+          durationMs: 0,
+          stdout: changelogExists ? `Found ${changelogPath}` : "",
+          stderr: changelogExists ? "" : `CHANGELOG.md not found at ${changelogPath}`
+        };
+        checks.push(changelogCheck);
+        const packageJsonPath = join22(repoRoot, "package.json");
+        let oidcCheck;
+        if (existsSync13(packageJsonPath)) {
+          try {
+            const pkg = JSON.parse(
+              await import("node:fs").then((m) => m.readFileSync(packageJsonPath, "utf8"))
+            );
+            const hasPublishConfig = typeof pkg.publishConfig === "object" && pkg.publishConfig !== null;
+            const accessPublic = hasPublishConfig && pkg.publishConfig.access === "public";
+            oidcCheck = {
+              name: "npm-oidc-sanity",
+              status: accessPublic ? "pass" : "fail",
+              exitCode: accessPublic ? 0 : 1,
+              durationMs: 0,
+              stdout: accessPublic ? "package.json has publishConfig.access=public" : "",
+              stderr: accessPublic ? "" : "package.json missing publishConfig.access=public \u2014 required for npm OIDC Trusted Publishing"
+            };
+          } catch {
+            oidcCheck = {
+              name: "npm-oidc-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to parse package.json"
+            };
+          }
+        } else {
+          oidcCheck = {
+            name: "npm-oidc-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: "package.json not found"
+          };
+        }
+        checks.push(oidcCheck);
+        const tagWorkflowPath = join22(repoRoot, ".github", "workflows", "auto-tag-on-release-merge.yml");
+        const tagWorkflowExists = existsSync13(tagWorkflowPath);
+        let tagTriggerCheck;
+        if (tagWorkflowExists) {
+          try {
+            const content = await import("node:fs").then(
+              (m) => m.readFileSync(tagWorkflowPath, "utf8")
+            );
+            const hasName = content.includes("name:");
+            const hasOnTrigger = content.includes("on:") || content.includes("pull_request:");
+            const valid = hasName && hasOnTrigger;
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: valid ? "pass" : "fail",
+              exitCode: valid ? 0 : 1,
+              durationMs: 0,
+              stdout: valid ? `Valid workflow at ${tagWorkflowPath}` : "",
+              stderr: valid ? "" : "auto-tag-on-release-merge.yml appears malformed"
+            };
+          } catch {
+            tagTriggerCheck = {
+              name: "tag-trigger-sanity",
+              status: "fail",
+              exitCode: 1,
+              durationMs: 0,
+              stdout: "",
+              stderr: "Failed to read auto-tag-on-release-merge.yml"
+            };
+          }
+        } else {
+          tagTriggerCheck = {
+            name: "tag-trigger-sanity",
+            status: "fail",
+            exitCode: 1,
+            durationMs: 0,
+            stdout: "",
+            stderr: `.github/workflows/auto-tag-on-release-merge.yml not found`
+          };
+        }
+        checks.push(tagTriggerCheck);
+        const tsconfigPath = join22(repoRoot, "tsconfig.json");
+        if (existsSync13(tsconfigPath)) {
+          const tscPath = join22(repoRoot, "node_modules", ".bin", "tsc");
+          if (existsSync13(tscPath)) {
+            checks.push(await runCheck("typecheck", tscPath, ["--noEmit"], repoRoot));
+          } else {
+            checks.push({
+              name: "typecheck",
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: "tsc not found in node_modules/.bin \u2014 skipping"
+            });
+          }
+        } else {
+          checks.push({
+            name: "typecheck",
+            status: "skip",
+            exitCode: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: "tsconfig.json not found \u2014 skipping"
+          });
+        }
+        const fastLintScripts = [
+          { name: "contracts-dep-lint", script: "scripts/lint-contracts-dep.mjs" },
+          { name: "format-error-lint", script: "scripts/lint-format-error-misuse.mjs" },
+          { name: "json-stream-lint", script: "scripts/lint-json-stream-hygiene.mjs" }
+        ];
+        for (const lint of fastLintScripts) {
+          const scriptPath = join22(repoRoot, lint.script);
+          if (existsSync13(scriptPath)) {
+            checks.push(await runCheck(lint.name, "node", [scriptPath], repoRoot));
+          } else {
+            checks.push({
+              name: lint.name,
+              status: "skip",
+              exitCode: null,
+              durationMs: 0,
+              stdout: "",
+              stderr: `${lint.script} not found \u2014 skipping`
+            });
+          }
+        }
+        const passCount = checks.filter((c) => c.status === "pass").length;
+        const failCount = checks.filter((c) => c.status === "fail").length;
+        const skipCount = checks.filter((c) => c.status === "skip").length;
+        const totalDurationMs = Date.now() - startTotal;
+        const ready = failCount === 0;
+        const result = {
+          ready,
+          checks,
+          summary: {
+            pass: passCount,
+            fail: failCount,
+            skip: skipCount,
+            total: checks.length,
+            durationMs: totalDurationMs
+          }
+        };
+        if (isHuman && args.json !== true) {
+          humanLine("\nRelease Readiness Check (T10458)\n");
+          humanLine(`${"\u2500".repeat(60)}`);
+          for (const c of checks) {
+            const icon = c.status === "pass" ? "PASS" : c.status === "fail" ? "FAIL" : "SKIP";
+            humanLine(`  [${icon}] ${c.name} (${c.durationMs}ms)`);
+            if (c.status === "fail" && c.stderr) {
+              const lines = c.stderr.split("\n").slice(0, 3);
+              for (const line of lines) {
+                humanLine(`         ${line}`);
+              }
+            }
+          }
+          humanLine(`${"\u2500".repeat(60)}`);
+          humanLine(`  Result: ${passCount} passed, ${failCount} failed, ${skipCount} skipped`);
+          humanLine(`  Total time: ${totalDurationMs}ms`);
+          humanLine(`  Ready: ${ready ? "YES" : "NO"}
+`);
+        }
+        cliOutput(result, { command: "doctor", operation: "doctor.release-readiness" });
+        if (!ready) {
+          process.exitCode = 1;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/migrate-agents-v2.ts
 var migrate_agents_v2_exports = {};
 __export(migrate_agents_v2_exports, {
@@ -47353,8 +47761,8 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync13 } from "node:fs";
+import { join as join23 } from "node:path";
 import { getProjectRoot as getProjectRoot41, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb as openCleoDb2 } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
@@ -47374,15 +47782,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join22(auditPath, "..");
-  if (!existsSync13(auditDir)) {
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join23(auditPath, "..");
+  if (!existsSync14(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync13(scanDir)) return;
+  if (!existsSync14(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -47393,7 +47801,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join22(scanDir, filename);
+    const cantPath = join23(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -47490,9 +47898,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const { db: _sdDb } = await openCleoDb2("signaldock");
   const db = _sdDb;
   try {
-    const canonicalDir = join22(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join23(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join22(projectRoot, ".cleo", "agents");
+    const legacyDir = join23(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -47500,8 +47908,8 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join22(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync13(auditPath)) return [];
+  const auditPath = join23(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync14(auditPath)) return [];
   let raw;
   try {
     raw = readFileSync13(auditPath, "utf8");
@@ -47585,7 +47993,7 @@ __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { getProjectRoot as getProjectRoot42, pushWarning as pushWarning4 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
@@ -47625,8 +48033,8 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join23(projectRoot, ".cleo");
-  const quarantineDir = join23(
+  const cleoDir = join24(projectRoot, ".cleo");
+  const quarantineDir = join24(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
@@ -47634,7 +48042,7 @@ async function quarantineTestFixtures(projectRoot, matches) {
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
   writeFileSync4(
-    join23(quarantineDir, "manifest.jsonl"),
+    join24(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
   const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
@@ -47705,6 +48113,7 @@ var init_doctor = __esm({
     init_doctor_db_substrate();
     init_doctor_legacy_backups();
     init_doctor_projects();
+    init_doctor_release_readiness();
     init_migrate_agents_v2();
     FIXTURE_ID_PATTERNS = [/^E\d+$/, /^T\d+EP$/];
     FIXTURE_TITLE_KEYWORDS = [
@@ -47719,7 +48128,9 @@ var init_doctor = __esm({
         // T10307 / Saga T10281 / Epic T10282 — DB-substrate walker
         "db-substrate": doctorDbSubstrateCommand,
         // T10309 / Saga T10281 / Epic T10282 — Legacy-backup walker
-        "legacy-backups": doctorLegacyBackupsCommand
+        "legacy-backups": doctorLegacyBackupsCommand,
+        // T10458 / Saga T10431 / Epic T10436 — Release-readiness preflight
+        "release-readiness": doctorReleaseReadinessCommand
       },
       args: {
         detailed: {
@@ -48208,8 +48619,8 @@ var init_doctor = __esm({
               );
               return;
             }
-            const archiveDir = join23(projectRoot, ".cleo", "backups");
-            const auditLogPath = join23(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
+            const archiveDir = join24(projectRoot, ".cleo", "backups");
+            const auditLogPath = join24(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
             const result = await pruneWorktreeOrphans(orphans, {
               archiveDir,
               auditLogPath,
@@ -48373,7 +48784,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot3(arg) {
@@ -48496,7 +48907,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -48534,7 +48945,7 @@ var init_event = __esm({
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -48604,7 +49015,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join24(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join25(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -48630,7 +49041,7 @@ var init_event = __esm({
           const agentId = file.replace(".jsonl", "");
           try {
             const { readFileSync: readFileSync21 } = await import("node:fs");
-            const content = readFileSync21(join24(eventsDir, file), "utf-8");
+            const content = readFileSync21(join25(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -49109,6 +49520,33 @@ var init_find = __esm({
           type: "boolean",
           description: "Surface urgent work across both axes: priority IN (critical,high) OR severity IN (P0,P1) (T9905)",
           alias: "u"
+        },
+        /**
+         * Filter by label — `cleo find --label <name>` returns every task
+         * whose `labels[]` includes the given value. Closes GH#393 and gives
+         * `find` parity with the positional `cleo labels <name>` surface.
+         * @task T9904
+         */
+        label: {
+          type: "string",
+          description: "Filter by label \u2014 return tasks whose labels[] includes this value (T9904)"
+        },
+        /**
+         * Filter by parent task ID — `cleo find --parent <id>` returns only
+         * tasks whose `parentId` matches. Mirrors the `--parent` axis on
+         * `cleo list`. When the parent target is a Saga (Epic with
+         * `label='saga'`), routing goes through `task_relations.type='groups'`
+         * member IDs (ADR-073 §1) — same path as `cleo list --parent`.
+         *
+         * Closes T10108 — pre-fix the flag was missing entirely AND empty-string
+         * queries bypassed every filter via `fuzzyScore('', '<title>')===80`.
+         *
+         * @task T10108
+         * @saga T9862
+         */
+        parent: {
+          type: "string",
+          description: "Filter by parent task ID \u2014 Saga-aware via task_relations groups (ADR-073 \xA71) (T10108)"
         }
       },
       async run({ args }) {
@@ -49127,6 +49565,8 @@ var init_find = __esm({
         if (args.verbose !== void 0) params["verbose"] = args.verbose;
         if (args.kind !== void 0) params["kind"] = args.kind;
         if (args.urgent !== void 0) params["urgent"] = args.urgent;
+        if (args.label !== void 0) params["label"] = args.label;
+        if (args.parent !== void 0) params["parent"] = args.parent;
         const response = await dispatchRaw("query", "tasks", "find", params);
         if (!response.success) {
           handleRawError(response, { command: "find", operation: "tasks.find" });
@@ -49193,7 +49633,7 @@ __export(gc_exports, {
   gcCommand: () => gcCommand
 });
 import { homedir as homedir4, tmpdir } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -49276,7 +49716,7 @@ var init_gc = __esm({
       },
       async run({ args }) {
         const cleoDir = resolveLegacyCleoDir3(args["cleo-dir"]);
-        const statePath = join25(cleoDir, "gc-state.json");
+        const statePath = join26(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -49329,8 +49769,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join25(homedir4(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join25(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join26(homedir4(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join26(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -50542,8 +50982,8 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir2,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import {
   CleoError as CleoError4,
@@ -50556,11 +50996,11 @@ import { getTemplatesByKind } from "@cleocode/core/templates/registry";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath6(import.meta.url);
-    const packageRoot = join26(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join26(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join26(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync14(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync14(templatePath)) {
+    const packageRoot = join27(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join27(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join27(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync15(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync15(templatePath)) {
       return readFileSync14(templatePath, "utf-8");
     }
   } catch {
@@ -51172,7 +51612,17 @@ var init_labels = __esm({
     labelsCommand = defineCommand({
       meta: {
         name: "labels",
-        description: "List all labels with counts or show tasks with specific label"
+        description: "List all labels (no args), or show tasks for a label (cleo labels <name>)"
+      },
+      args: {
+        // Optional positional — when present, dispatches to tasks.list with the
+        // label filter; when absent, falls through to the legacy label.list path.
+        // Required:false keeps the bare `cleo labels` invocation working.
+        name: {
+          type: "positional",
+          description: "Label name to filter tasks by (omit to list all labels)",
+          required: false
+        }
       },
       subCommands: {
         list: listCommand10,
@@ -51180,9 +51630,16 @@ var init_labels = __esm({
         stats: statsCommand2
       },
       async run(ctx) {
-        if (!ctx.rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
-          await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
+        const rawArgs = ctx.rawArgs ?? [];
+        if (rawArgs.some((a) => ["list", "show", "stats"].includes(a))) {
+          return;
+        }
+        const name = ctx.args.name;
+        if (typeof name === "string" && name.length > 0) {
+          await dispatchFromCli("query", "tasks", "list", { label: name }, { command: "labels" });
+          return;
         }
+        await dispatchFromCli("query", "tasks", "label.list", {}, { command: "labels" });
       }
     });
   }
@@ -51960,7 +52417,7 @@ async function _headlessPkceFlow(provider, authUrl) {
     `  After approving, paste the full redirect URL (http://localhost?code=\u2026&state=\u2026):
   `
   );
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.once("data", (chunk) => {
@@ -51972,7 +52429,7 @@ async function _headlessPkceFlow(provider, authUrl) {
           reject(new Error('Redirect URL is missing the "code" parameter'));
           return;
         }
-        resolve8(code);
+        resolve9(code);
       } catch {
         reject(new Error(`Invalid redirect URL: ${buf}`));
       }
@@ -51980,7 +52437,7 @@ async function _headlessPkceFlow(provider, authUrl) {
   });
 }
 async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const server = createServer2((req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${port}`);
       const code = url.searchParams.get("code");
@@ -51990,7 +52447,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (error) {
         res.end(`<h1>Authorization failed</h1><p>${error}</p><p>You may close this tab.</p>`);
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_AUTH_DENIED",
             codeName: "E_PKCE_AUTH_DENIED",
@@ -52002,7 +52459,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       if (!code || state !== expectedState) {
         res.end("<h1>Invalid callback</h1><p>You may close this tab.</p>");
         server.close();
-        resolve8({
+        resolve9({
           error: {
             code: "E_PKCE_INVALID_CALLBACK",
             codeName: "E_PKCE_INVALID_CALLBACK",
@@ -52013,7 +52470,7 @@ async function _localCallbackPkceFlow(provider, authUrl, expectedState, port) {
       }
       res.end("<h1>Authorized</h1><p>You may close this tab and return to your terminal.</p>");
       server.close();
-      resolve8({ code });
+      resolve9({ code });
     });
     server.listen(port, "localhost", () => {
       process.stderr.write("\n");
@@ -52146,7 +52603,7 @@ function _generateState() {
   return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function _findFreePort() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const srv = createServer2();
     srv.listen(0, "localhost", () => {
       const addr = srv.address();
@@ -52156,7 +52613,7 @@ function _findFreePort() {
         return;
       }
       const port = addr.port;
-      srv.close(() => resolve8(port));
+      srv.close(() => resolve9(port));
     });
     srv.on("error", reject);
   });
@@ -52778,14 +53235,14 @@ async function readStdin() {
   if (process.stdin.isTTY) {
     return "";
   }
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
     process.stdin.on("end", () => {
-      resolve8(data.trim());
+      resolve9(data.trim());
     });
     process.stdin.on("error", reject);
   });
@@ -56354,13 +56811,13 @@ var init_nexus3 = __esm({
           if (!skipPrompt) {
             const { createInterface: createInterface5 } = await import("node:readline");
             const rl = createInterface5({ input: process.stdin, output: process.stdout });
-            const confirmed = await new Promise((resolve8) => {
+            const confirmed = await new Promise((resolve9) => {
               rl.question(
                 `
 [nexus] Delete ${matchCount} project(s) from the registry? [y/N] `,
                 (answer) => {
                   rl.close();
-                  resolve8(answer.trim().toLowerCase() === "y");
+                  resolve9(answer.trim().toLowerCase() === "y");
                 }
               );
             });
@@ -60032,7 +60489,7 @@ __export(release_exports, {
   releaseCommand: () => releaseCommand
 });
 import { release as release3 } from "@cleocode/core";
-var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
+var listCommand19, showCommand10, cancelCommand2, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, validateChangelogCommand, planCommand3, openCommand2, reconcileCommand4, releaseCommand;
 var init_release3 = __esm({
   "packages/cleo/src/cli/commands/release.ts"() {
     "use strict";
@@ -60181,6 +60638,36 @@ var init_release3 = __esm({
         await dispatchFromCli("query", "pipeline", "release.channel.show", {}, { command: "release" });
       }
     });
+    validateChangelogCommand = defineCommand({
+      meta: {
+        name: "validate-changelog",
+        description: "Validate that CHANGELOG.md contains the canonical `## [VERSION]` header (T9937)"
+      },
+      args: {
+        version: {
+          type: "positional",
+          description: "Release version (accepts v2026.5.94 or 2026.5.94)",
+          required: true
+        },
+        path: {
+          type: "string",
+          description: "Override the CHANGELOG file path (default: <projectRoot>/CHANGELOG.md)",
+          required: false
+        }
+      },
+      async run({ args }) {
+        await dispatchFromCli(
+          "query",
+          "release",
+          "validate-changelog",
+          {
+            version: args.version,
+            ...typeof args.path === "string" && args.path.length > 0 ? { changelogPath: args.path } : {}
+          },
+          { command: "release" }
+        );
+      }
+    });
     planCommand3 = defineCommand({
       meta: {
         name: "plan",
@@ -60221,9 +60708,17 @@ var init_release3 = __esm({
         "no-changelog": {
           type: "boolean",
           description: "Skip CHANGELOG.md auto-write (default: write/replace the ## [<version>] section). (T9838)"
+        },
+        "skip-readiness": {
+          type: "boolean",
+          description: "Skip the release-readiness preflight check (default: run check). Use only in emergency. (T10459)"
         }
       },
       async run({ args }) {
+        if (args["skip-readiness"] !== true) {
+          const { runSpawnReadinessHygieneCli } = await import("@cleocode/core/hygiene/validate-spawn-readiness.js");
+          await runSpawnReadinessHygieneCli();
+        }
         await dispatchFromCli(
           "mutate",
           "release",
@@ -60344,7 +60839,9 @@ var init_release3 = __esm({
         cancel: cancelCommand2,
         "pr-status": prStatusCommand,
         channel: channelCommand,
-        "rollback-full": rollbackFullCommand
+        "rollback-full": rollbackFullCommand,
+        // T9937 — canonical CHANGELOG.md header validator (Saga T9862).
+        "validate-changelog": validateChangelogCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -61572,7 +62069,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -61625,7 +62122,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join27(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join28(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile5(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -61709,7 +62206,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join27(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join28(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -61762,7 +62259,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join27(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join28(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -62296,7 +62793,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile6 } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -62311,7 +62808,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome4();
   try {
-    const content = await readFile6(join28(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile6(join29(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -62365,7 +62862,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile4, mkdir: mkdir5 }) => mkdir5(cleoHome, { recursive: true }).then(
-      () => writeFile4(join28(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile4(join29(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -62403,11 +62900,11 @@ async function runPostUpdateDiagnostics(opts) {
         input: process.stdin,
         output: process.stdout
       });
-      shouldMigrate = await new Promise((resolve8) => {
+      shouldMigrate = await new Promise((resolve9) => {
         rl.question("  Do you want to run the upgrade now? [Y/n] ", (answer) => {
           rl.close();
           const clean = answer.trim().toLowerCase();
-          resolve8(clean === "" || clean === "y" || clean === "yes");
+          resolve9(clean === "" || clean === "y" || clean === "yes");
         });
       });
     }
@@ -62778,7 +63275,7 @@ __export(sentient_exports, {
   promptAcceptExecution: () => promptAcceptExecution,
   sentientCommand: () => sentientCommand
 });
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 import { cwd as processCwd3, stdin, stdout } from "node:process";
 import { createInterface as createInterface3 } from "node:readline/promises";
 import {
@@ -62867,7 +63364,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join29(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join30(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -62983,7 +63480,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -63075,7 +63572,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -63171,7 +63668,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -63216,7 +63713,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -63236,7 +63733,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -63255,7 +63752,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -63286,7 +63783,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join29(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join30(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -63934,7 +64431,7 @@ async function promptOwnerAuthPassword(sessionName) {
     terminal: true
   });
   process.stderr.write(`[cleo] Enter owner-auth password for session "${sessionName}": `);
-  const password = await new Promise((resolve8) => {
+  const password = await new Promise((resolve9) => {
     if (process.stdin.setRawMode) {
       process.stdin.setRawMode(
         true
@@ -63952,10 +64449,10 @@ async function promptOwnerAuthPassword(sessionName) {
           );
         }
         process.stderr.write("\n");
-        resolve8(pw);
+        resolve9(pw);
       } else if (ch === "") {
         process.stderr.write("\n[cleo] Cancelled.\n");
-        resolve8("");
+        resolve9("");
       } else if (ch === "\x7F" || ch === "\b") {
         pw = pw.slice(0, -1);
       } else {
@@ -66990,12 +67487,12 @@ var init_telemetry2 = __esm({
 
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync15 } from "node:fs";
-import { isAbsolute as isAbsolute3, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute3, resolve as resolve7 } from "node:path";
 import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot7(raw) {
   if (typeof raw === "string" && raw.length > 0) {
-    return isAbsolute3(raw) ? raw : resolve6(process.cwd(), raw);
+    return isAbsolute3(raw) ? raw : resolve7(process.cwd(), raw);
   }
   return getProjectRoot50();
 }
@@ -67016,8 +67513,8 @@ var init_lib = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/diff.ts
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "node:fs";
+import { join as join31 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
   const aLines = a.length === 0 ? [] : a.split("\n");
@@ -67087,7 +67584,7 @@ var init_diff = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join30(projectRoot, entry.installPath);
+          installPath = join31(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -67098,7 +67595,7 @@ var init_diff = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (!existsSync15(installPath)) {
+        if (!existsSync16(installPath)) {
           const missingResult = {
             id,
             installPath,
@@ -67137,8 +67634,8 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname9, join as join31 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname9, join as join32 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
 var init_install = __esm({
@@ -67192,7 +67689,7 @@ var init_install = __esm({
         let substituted;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join31(projectRoot, entry.installPath);
+          installPath = join32(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           const sub = applySubstitution(entry, source);
           rendered = sub.rendered;
@@ -67205,7 +67702,7 @@ var init_install = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (existsSync16(installPath)) {
+        if (existsSync17(installPath)) {
           const current = readFileSync17(installPath, "utf8");
           if (current === rendered) {
             const noopResult = {
@@ -67354,8 +67851,8 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname10, join as join32 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname10, join as join33 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
 var init_upgrade2 = __esm({
@@ -67417,7 +67914,7 @@ var init_upgrade2 = __esm({
         let rendered;
         try {
           projectRoot = resolveProjectRoot7(args["project"]);
-          installPath = join32(projectRoot, entry.installPath);
+          installPath = join33(projectRoot, entry.installPath);
           const source = readTemplateSource(entry);
           rendered = applySubstitution(entry, source).rendered;
         } catch (err) {
@@ -67430,7 +67927,7 @@ var init_upgrade2 = __esm({
         }
         const previewOnly = args["diff"] === true;
         const accept = args["accept"] === true;
-        const current = existsSync17(installPath) ? readFileSync18(installPath, "utf8") : null;
+        const current = existsSync18(installPath) ? readFileSync18(installPath, "utf8") : null;
         const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
         let outcome;
         let reason;
@@ -67980,7 +68477,7 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir6 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import {
   parseDurationMs,
@@ -68034,7 +68531,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -68340,7 +68837,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join33(homedir6(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join34(homedir6(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -68872,7 +69369,7 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgradeCommand: () => upgradeCommand
 });
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 import { CleoError as CleoError10, diagnoseUpgrade, runUpgrade as runUpgrade2, upgradeWorkflows as upgradeWorkflows2 } from "@cleocode/core/internal";
 var workflowsSubcommand, upgradeCommand;
 var init_upgrade3 = __esm({
@@ -68912,7 +69409,7 @@ var init_upgrade3 = __esm({
           const dryRun = args["dry-run"] === true || args.check === true;
           const force = args.force === true && !dryRun;
           const result = await upgradeWorkflows2({
-            projectRoot: resolve7(process.cwd()),
+            projectRoot: resolve8(process.cwd()),
             templatesDir: getWorkflowTemplatesDir2(),
             dryRun,
             force
@@ -69173,15 +69670,15 @@ __export(web_exports, {
 });
 import { execFileSync as execFileSync4, spawn as spawn3 } from "node:child_process";
 import { mkdir as mkdir4, open, readFile as readFile7, rm, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 import { CleoError as CleoError11, formatError as formatError5, getCleoHome as getCleoHome5 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome5();
   return {
-    pidFile: join34(cleoHome, "web-server.pid"),
-    configFile: join34(cleoHome, "web-server.json"),
-    logDir: join34(cleoHome, "logs"),
-    logFile: join34(cleoHome, "logs", "web-server.log")
+    pidFile: join35(cleoHome, "web-server.pid"),
+    configFile: join35(cleoHome, "web-server.json"),
+    logDir: join35(cleoHome, "logs"),
+    logFile: join35(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -69220,7 +69717,7 @@ async function startWebServer(port, host) {
     throw new CleoError11(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join34(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join35(projectRoot, "packages", "studio", "build");
   await mkdir4(logDir, { recursive: true });
   await writeFile3(
     configFile,
@@ -69230,7 +69727,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join34(studioDir, "index.js");
+  const webIndexPath = join35(studioDir, "index.js");
   try {
     await stat2(webIndexPath);
   } catch {
@@ -69278,7 +69775,7 @@ Logs: ${logFile}`
       }
     } catch {
     }
-    await new Promise((resolve8) => setTimeout(resolve8, 500));
+    await new Promise((resolve9) => setTimeout(resolve9, 500));
   }
   if (!started) {
     try {
@@ -69355,7 +69852,7 @@ var init_web = __esm({
           }
           for (let i = 0; i < 60; i++) {
             if (!isProcessRunning(status.pid)) break;
-            await new Promise((resolve8) => setTimeout(resolve8, 500));
+            await new Promise((resolve9) => setTimeout(resolve9, 500));
           }
           if (isProcessRunning(status.pid)) {
             try {
@@ -69407,7 +69904,7 @@ var init_web = __esm({
             }
             for (let i = 0; i < 60; i++) {
               if (!isProcessRunning(status.pid)) break;
-              await new Promise((resolve8) => setTimeout(resolve8, 500));
+              await new Promise((resolve9) => setTimeout(resolve9, 500));
             }
             if (isProcessRunning(status.pid)) {
               try {
@@ -69505,12 +70002,12 @@ __export(worktree_exports, {
 import readline4 from "node:readline";
 import { getProjectRoot as getProjectRoot53, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
-      resolve8(trimmed === "y" || trimmed === "yes");
+      resolve9(trimmed === "y" || trimmed === "yes");
     });
   });
 }
@@ -69844,7 +70341,7 @@ init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync20 } from "node:fs";
-import { dirname as dirname11, join as join36 } from "node:path";
+import { dirname as dirname11, join as join37 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -70290,7 +70787,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "labelsCommand",
     name: "labels",
-    description: "List all labels with counts or show tasks with specific label",
+    description: "List all labels (no args), or show tasks for a label (cleo labels <name>)",
     load: async () => (await Promise.resolve().then(() => (init_labels(), labels_exports))).labelsCommand
   },
   {
@@ -70858,14 +71355,14 @@ function lazyCommand(meta, loader2) {
 init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join36 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join35(getCleoPlatformPaths().config, "config.json");
-  if (existsSync18(configPath)) return false;
+  const configPath = join36(getCleoPlatformPaths().config, "config.json");
+  if (existsSync19(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -70876,7 +71373,7 @@ async function detectFirstRun() {
   return true;
 }
 function waitForEnterOrTimeout(timeoutMs) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let resolved = false;
     const finish = () => {
       if (resolved) return;
@@ -70888,7 +71385,7 @@ function waitForEnterOrTimeout(timeoutMs) {
         process.stdin.pause();
       } catch {
       }
-      resolve8();
+      resolve9();
     };
     const onData = (chunk) => {
       const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -70984,7 +71481,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join36(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
+  const pkgPath = join37(dirname11(fileURLToPath7(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
   return pkg.version;
 }