@cleocode/cleo 2026.5.20 → 2026.5.22

package/dist/cli/index.js

@@ -15781,13 +15781,19 @@ var init_memory2 = __esm({
                   startTime
                 );
               }
+              const confirmationStateRaw = paramString(params, "confirmationState");
+              const decidedByRaw = paramString(params, "decidedBy");
               const result = await memoryDecisionStore(
                 {
                   decision,
                   rationale,
                   alternatives: paramStringArray(params, "alternatives"),
                   taskId: paramString(params, "taskId"),
-                  sessionId: paramString(params, "sessionId")
+                  sessionId: paramString(params, "sessionId"),
+                  adrPath: paramString(params, "adrPath"),
+                  supersedes: paramString(params, "supersedes"),
+                  confirmationState: confirmationStateRaw === "proposed" || confirmationStateRaw === "accepted" || confirmationStateRaw === "superseded" ? confirmationStateRaw : void 0,
+                  decidedBy: decidedByRaw === "owner" || decidedByRaw === "council" || decidedByRaw === "agent" ? decidedByRaw : void 0
                 },
                 projectRoot
               );
@@ -22047,8 +22053,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot32 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot32();
+  const { getProjectRoot: getProjectRoot33 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot33();
   return {
     async dispatch(input) {
       try {
@@ -22266,14 +22272,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot32 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot33 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot32()
+            projectRoot: getProjectRoot33()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -27132,11 +27138,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot32) {
+function createSanitizer(getProjectRoot33) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot32 ? getProjectRoot32() : void 0;
+        const root = getProjectRoot33 ? getProjectRoot33() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -27508,9 +27514,10 @@ import {
   ensureGlobalSignaldockDb,
   getGlobalSalt,
   getLogger as getLogger17,
-  getProjectRoot as getProjectRoot31,
+  getProjectRoot as getProjectRoot32,
   migrateSignaldockToConduit,
   needsSignaldockToConduitMigration,
+  runWithWorktreeScopeFromEnv,
   validateGlobalSalt
 } from "@cleocode/core/internal";
 
@@ -27605,11 +27612,11 @@ var CLIError = class extends Error {
 function parseRawArgs(args = [], opts = {}) {
   const booleans = new Set(opts.boolean || []);
   const strings = new Set(opts.string || []);
-  const aliasMap2 = opts.alias || {};
+  const aliasMap = opts.alias || {};
   const defaults = opts.default || {};
   const aliasToMain = /* @__PURE__ */ new Map();
   const mainToAliases = /* @__PURE__ */ new Map();
-  for (const [key, value] of Object.entries(aliasMap2)) {
+  for (const [key, value] of Object.entries(aliasMap)) {
     const targets = value;
     for (const target of targets) {
       aliasToMain.set(key, target);
@@ -27630,15 +27637,15 @@ function parseRawArgs(args = [], opts = {}) {
   const allOptions = /* @__PURE__ */ new Set([
     ...booleans,
     ...strings,
-    ...Object.keys(aliasMap2),
-    ...Object.values(aliasMap2).flat(),
+    ...Object.keys(aliasMap),
+    ...Object.values(aliasMap).flat(),
     ...Object.keys(defaults)
   ]);
   for (const name of allOptions) if (!options[name]) options[name] = {
     type: getType(name),
     default: defaults[name]
   };
-  for (const [alias, main2] of aliasToMain.entries()) if (alias.length === 1 && options[main2] && !options[main2].short) options[main2].short = alias;
+  for (const [alias, main] of aliasToMain.entries()) if (alias.length === 1 && options[main] && !options[main].short) options[main].short = alias;
   const processedArgs = [];
   const negatedFlags = {};
   for (let i = 0; i < args.length; i++) {
@@ -27678,9 +27685,9 @@ function parseRawArgs(args = [], opts = {}) {
     const aliases = mainToAliases.get(name);
     if (aliases) for (const alias of aliases) out[alias] = false;
   }
-  for (const [alias, main2] of aliasToMain.entries()) {
-    if (out[alias] !== void 0 && out[main2] === void 0) out[main2] = out[alias];
-    if (out[main2] !== void 0 && out[alias] === void 0) out[alias] = out[main2];
+  for (const [alias, main] of aliasToMain.entries()) {
+    if (out[alias] !== void 0 && out[main] === void 0) out[main] = out[alias];
+    if (out[main] !== void 0 && out[alias] === void 0) out[alias] = out[main];
   }
   return out;
 }
@@ -28035,15 +28042,15 @@ function getShortDescription(desc) {
   const firstLine = desc.split("\n").find((l) => l.trim().length > 0);
   return firstLine?.trim() ?? desc.trim();
 }
-function renderGroupedHelp(version, subCommands2, aliasMap2) {
+function renderGroupedHelp(version, subCommands2, aliasMap) {
   const descMap = /* @__PURE__ */ new Map();
   for (const [key, def] of Object.entries(subCommands2)) {
-    if (aliasMap2.has(key)) continue;
+    if (aliasMap.has(key)) continue;
     const meta = resolveMeta(def);
     descMap.set(key, getShortDescription(meta.description));
   }
   const cmdAliases = /* @__PURE__ */ new Map();
-  for (const [alias, primary] of aliasMap2) {
+  for (const [alias, primary] of aliasMap) {
     const existing = cmdAliases.get(primary) ?? [];
     existing.push(alias);
     cmdAliases.set(primary, existing);
@@ -28052,7 +28059,7 @@ function renderGroupedHelp(version, subCommands2, aliasMap2) {
   const allGroupedCmds = COMMAND_GROUPS.flatMap((g) => g.commands);
   const allCmds = [.../* @__PURE__ */ new Set([...allGroupedCmds, ...descMap.keys()])];
   for (const cmd of allCmds) {
-    if (!descMap.has(cmd) || aliasMap2.has(cmd)) continue;
+    if (!descMap.has(cmd) || aliasMap.has(cmd)) continue;
     const aliases = cmdAliases.get(cmd);
     const display = aliases && aliases.length > 0 ? `${cmd} (${aliases.join(", ")})` : cmd;
     if (display.length > maxCmdWidth) maxCmdWidth = display.length;
@@ -28081,7 +28088,7 @@ function renderGroupedHelp(version, subCommands2, aliasMap2) {
   }
   const ungrouped = [];
   for (const key of descMap.keys()) {
-    if (!rendered.has(key) && !aliasMap2.has(key)) {
+    if (!rendered.has(key) && !aliasMap.has(key)) {
       ungrouped.push(key);
     }
   }
@@ -28098,12 +28105,12 @@ function renderGroupedHelp(version, subCommands2, aliasMap2) {
   lines.push(`Use ${cyan2("cleo <command> --help")} for more information about a command.`);
   return lines.join("\n");
 }
-function createCustomShowUsage(version, subCommands2, aliasMap2) {
+function createCustomShowUsage(version, subCommands2, aliasMap) {
   return async (cmd, parent) => {
     if (!parent) {
       const meta = await (typeof cmd.meta === "function" ? cmd.meta() : cmd.meta);
       if (meta?.name === "cleo") {
-        console.log(renderGroupedHelp(version, subCommands2, aliasMap2) + "\n");
+        console.log(renderGroupedHelp(version, subCommands2, aliasMap) + "\n");
         return;
       }
     }
@@ -28445,6 +28452,21 @@ var addCommand = defineCommand({
     "force-duplicate": {
       type: "boolean",
       description: "Bypass BRAIN duplicate-task rejection (audited to .cleo/audit/duplicate-bypass.jsonl) (T1633)"
+    },
+    /**
+     * Waiver for the critical-priority dependency declaration requirement.
+     *
+     * Critical-priority tasks without declared dependencies silently break
+     * wave-order spawning when downstream work assumes they are load-bearing.
+     * Provide a justification string to waive the `--depends` requirement.
+     * The waiver is stored in task metadata for auditability.
+     *
+     * @task T1856
+     * @epic T1855
+     */
+    "depends-waiver": {
+      type: "string",
+      description: "Justification for creating a critical-priority task without --depends (T1856). Records waiver in task metadata."
     }
   },
   async run({ args, cmd }) {
@@ -28480,6 +28502,20 @@ var addCommand = defineCommand({
     if (args.scope !== void 0) params["scope"] = args.scope;
     if (args.severity !== void 0) params["severity"] = args.severity;
     if (args["force-duplicate"] !== void 0) params["forceDuplicate"] = args["force-duplicate"];
+    if (args.priority === "critical" && !args.depends && args["depends-waiver"] === void 0) {
+      cliError(
+        'Critical-priority tasks must declare at least one dependency (--depends) or provide a waiver (--depends-waiver "<reason>").',
+        "E_VALIDATION",
+        {
+          name: "E_VALIDATION",
+          fix: 'Add --depends <taskId> to declare a dependency, or use --depends-waiver "<reason>" to waive the requirement. Use `cleo find "<topic>"` to discover candidate dependencies.'
+        },
+        { operation: "tasks.add" }
+      );
+      process.exit(6);
+      return;
+    }
+    if (args["depends-waiver"] !== void 0) params["dependsWaiver"] = args["depends-waiver"];
     const inferred = await inferTaskAddParams(getProjectRoot18(), {
       title: args.title,
       description: args.description ?? args.desc,
@@ -32657,9 +32693,9 @@ var exportCommand = defineCommand({
   },
   async run({ args }) {
     const scope = args.scope;
-    const { packBundle, getProjectRoot: getProjectRoot32 } = await import("@cleocode/core/internal");
+    const { packBundle, getProjectRoot: getProjectRoot33 } = await import("@cleocode/core/internal");
     const includesProject = scope === "project" || scope === "all";
-    const projectRoot = includesProject ? getProjectRoot32() : void 0;
+    const projectRoot = includesProject ? getProjectRoot33() : void 0;
     let passphrase;
     if (args.encrypt === true) {
       passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -37356,6 +37392,7 @@ var docsCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/doctor.ts
+import { getProjectRoot as getProjectRoot23, quarantineRogueCleoDir, scanRogueCleoDirs } from "@cleocode/core/internal";
 init_cli();
 
 // packages/cleo/src/cli/progress.ts
@@ -37653,6 +37690,37 @@ Provider Hook Matrix (CAAMP ${caampVersion} canonical taxonomy)
 
 `);
 }
+function renderRogueReportHuman(report) {
+  const totalKb = (report.totalSize / 1024).toFixed(1);
+  process.stdout.write(`
+  Package: ${report.packageName}
+`);
+  process.stdout.write(`  Path:    ${report.path}
+`);
+  process.stdout.write(`  Size:    ${totalKb} KB (${report.fileManifest.length} files)
+`);
+  process.stdout.write(
+    `  Marker:  ${report.hasProjectInfoMarker ? "has project-info.json (unexpected!)" : "no project-info.json (rogue)"}
+`
+  );
+  const { tasks, brain_observations, brain_decisions } = report.dbRowCounts;
+  if (tasks !== void 0 || brain_observations !== void 0) {
+    const parts = [];
+    if (tasks !== void 0) parts.push(`tasks=${tasks}`);
+    if (brain_observations !== void 0) parts.push(`brain_observations=${brain_observations}`);
+    if (brain_decisions !== void 0) parts.push(`brain_decisions=${brain_decisions}`);
+    process.stdout.write(`  DB rows: ${parts.join(", ")}
+`);
+  }
+  if (report.drizzleMigrations.length > 0) {
+    process.stdout.write(`  Migrations (${report.drizzleMigrations.length}):
+`);
+    for (const m of report.drizzleMigrations) {
+      process.stdout.write(`    [${m.id}] ${m.name ?? m.hash.slice(0, 16)}
+`);
+    }
+  }
+}
 var doctorCommand2 = defineCommand({
   meta: { name: "doctor", description: "Run system diagnostics and health checks" },
   args: {
@@ -37688,6 +37756,18 @@ var doctorCommand2 = defineCommand({
       type: "boolean",
       description: "When used with --all-projects, exit 1 instead of 2 on unreachable projects"
     },
+    "scan-rogue-cleo-dirs": {
+      type: "boolean",
+      description: "Scan for rogue .cleo/ directories inside sub-packages and print forensic report"
+    },
+    "quarantine-rogue-cleo-dirs": {
+      type: "boolean",
+      description: "Move all rogue .cleo/ sub-package directories to .cleo/quarantine/ (never deletes)"
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "With --quarantine-rogue-cleo-dirs: print what would be moved without moving"
+    },
     // Global output format flags — read directly from args (no optsWithGlobals in citty)
     json: {
       type: "boolean",
@@ -37781,6 +37861,105 @@ var doctorCommand2 = defineCommand({
           { command: "doctor", operation: "admin.health" }
         );
         progress.complete("Comprehensive diagnostics complete");
+      } else if (args["scan-rogue-cleo-dirs"]) {
+        progress.step(0, "Scanning for rogue .cleo/ directories");
+        const projectRoot = getProjectRoot23();
+        const reports = scanRogueCleoDirs(projectRoot);
+        progress.complete(
+          `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
+        );
+        if (args.json) {
+          process.stdout.write(JSON.stringify({ success: true, data: reports }, null, 2) + "\n");
+        } else {
+          if (reports.length === 0) {
+            process.stdout.write("\nNo rogue .cleo/ directories found.\n");
+          } else {
+            process.stdout.write(`
+Rogue .cleo/ directories (${reports.length}):
+`);
+            for (const report of reports) {
+              renderRogueReportHuman(report);
+            }
+            process.stdout.write("\n");
+          }
+        }
+      } else if (args["quarantine-rogue-cleo-dirs"]) {
+        const isDryRun = args["dry-run"] === true;
+        progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
+        const projectRoot = getProjectRoot23();
+        const reports = scanRogueCleoDirs(projectRoot);
+        if (reports.length === 0) {
+          progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
+          if (!args.json) {
+            process.stdout.write("\nNo rogue .cleo/ directories found.\n");
+          } else {
+            process.stdout.write(
+              JSON.stringify({ success: true, data: { quarantined: [] } }, null, 2) + "\n"
+            );
+          }
+          return;
+        }
+        const quarantined = [];
+        const errors = [];
+        for (const report of reports) {
+          if (isDryRun) {
+            const timestamp2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const targetPath = `${projectRoot}/.cleo/quarantine/${report.packageName}-${timestamp2}`;
+            quarantined.push({
+              packageName: report.packageName,
+              from: report.path,
+              to: targetPath
+            });
+          } else {
+            try {
+              const { quarantinePath } = quarantineRogueCleoDir(report, projectRoot);
+              quarantined.push({
+                packageName: report.packageName,
+                from: report.path,
+                to: quarantinePath
+              });
+            } catch (err) {
+              errors.push({
+                packageName: report.packageName,
+                path: report.path,
+                error: err instanceof Error ? err.message : String(err)
+              });
+            }
+          }
+        }
+        const verb = isDryRun ? "Would quarantine" : "Quarantined";
+        progress.complete(
+          `${verb} ${quarantined.length} director${quarantined.length === 1 ? "y" : "ies"}${errors.length > 0 ? `, ${errors.length} failed` : ""}`
+        );
+        if (args.json) {
+          process.stdout.write(
+            JSON.stringify(
+              { success: errors.length === 0, data: { dryRun: isDryRun, quarantined, errors } },
+              null,
+              2
+            ) + "\n"
+          );
+        } else {
+          process.stdout.write(`
+${verb}:
+`);
+          for (const q of quarantined) {
+            process.stdout.write(`  ${q.packageName}: ${q.from}
+    -> ${q.to}
+`);
+          }
+          if (errors.length > 0) {
+            process.stdout.write(`
+Errors (${errors.length}):
+`);
+            for (const e of errors) {
+              process.stdout.write(`  ${e.packageName}: ${e.error}
+`);
+            }
+            process.exitCode = 1;
+          }
+          process.stdout.write("\n");
+        }
       } else {
         progress.step(0, "Checking CLEO directory");
         await dispatchFromCli(
@@ -38149,7 +38328,7 @@ init_src();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname8, join as join13 } from "node:path";
-import { CleoError as CleoError4, formatError as formatError6, getConfigPath as getConfigPath2, getProjectRoot as getProjectRoot23 } from "@cleocode/core";
+import { CleoError as CleoError4, formatError as formatError6, getConfigPath as getConfigPath2, getProjectRoot as getProjectRoot24 } from "@cleocode/core";
 init_renderers();
 function getChangelogSource(cwd) {
   const configPath = getConfigPath2(cwd);
@@ -38181,7 +38360,7 @@ function getDefaultOutputPath(platform) {
   }
 }
 function getGitHubRepoSlug(cwd) {
-  const projectRoot = getProjectRoot23(cwd);
+  const projectRoot = getProjectRoot24(cwd);
   try {
     const remoteUrl = execFileSync2("git", ["remote", "get-url", "origin"], {
       cwd: projectRoot,
@@ -38307,7 +38486,7 @@ var generateChangelogCommand = defineCommand({
       const targetPlatform = args.platform;
       const dryRun = args["dry-run"] === true;
       const sourceFile = getChangelogSource();
-      const sourcePath = join13(getProjectRoot23(), sourceFile);
+      const sourcePath = join13(getProjectRoot24(), sourceFile);
       if (!existsSync10(sourcePath)) {
         throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
       }
@@ -38320,7 +38499,7 @@ var generateChangelogCommand = defineCommand({
         const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
         const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
         if (!dryRun) {
-          const fullPath = join13(getProjectRoot23(), outputPath);
+          const fullPath = join13(getProjectRoot24(), outputPath);
           mkdirSync3(dirname8(fullPath), { recursive: true });
           writeFileSync3(fullPath, content, "utf-8");
         }
@@ -38341,7 +38520,7 @@ var generateChangelogCommand = defineCommand({
             limit
           );
           if (!dryRun) {
-            const fullPath = join13(getProjectRoot23(), platformConfig.path);
+            const fullPath = join13(getProjectRoot24(), platformConfig.path);
             mkdirSync3(dirname8(fullPath), { recursive: true });
             writeFileSync3(fullPath, content, "utf-8");
           }
@@ -39765,7 +39944,7 @@ import { join as join14 } from "node:path";
 import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
-  getProjectRoot as getProjectRoot24,
+  getProjectRoot as getProjectRoot25,
   runConsolidation,
   triggerManualDream
 } from "@cleocode/core/internal";
@@ -40166,6 +40345,26 @@ var decisionStoreCommand = defineCommand({
       type: "string",
       description: "Task ID to associate with this decision"
     },
+    "adr-path": {
+      type: "string",
+      description: "Path to the ADR document on disk (e.g. docs/adr/ADR-027.md)"
+    },
+    supersedes: {
+      type: "string",
+      description: "Decision ID that this decision supersedes (e.g. D001)"
+    },
+    "superseded-by": {
+      type: "string",
+      description: "Decision ID that has superseded this decision (e.g. D002)"
+    },
+    "confirmation-state": {
+      type: "string",
+      description: "Lifecycle state: proposed | accepted | superseded (default: proposed)"
+    },
+    "decided-by": {
+      type: "string",
+      description: "Who originated this decision: owner | council | agent (default: agent)"
+    },
     json: {
       type: "boolean",
       description: "Output as JSON"
@@ -40180,7 +40379,14 @@ var decisionStoreCommand = defineCommand({
         decision: args.decision,
         rationale: args.rationale,
         ...args.alternatives !== void 0 && { alternatives: args.alternatives },
-        ...args["linked-task"] !== void 0 && { taskId: args["linked-task"] }
+        ...args["linked-task"] !== void 0 && { taskId: args["linked-task"] },
+        ...args["adr-path"] !== void 0 && { adrPath: args["adr-path"] },
+        ...args.supersedes !== void 0 && { supersedes: args.supersedes },
+        ...args["superseded-by"] !== void 0 && { supersededBy: args["superseded-by"] },
+        ...args["confirmation-state"] !== void 0 && {
+          confirmationState: args["confirmation-state"]
+        },
+        ...args["decided-by"] !== void 0 && { decidedBy: args["decided-by"] }
       },
       { command: "memory", operation: "memory.decision.store" }
     );
@@ -40671,7 +40877,7 @@ var consolidateCommand = defineCommand({
   },
   args: {},
   async run() {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     try {
       const result = await runConsolidation(root);
       cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -40689,7 +40895,7 @@ var dreamCommand = defineCommand({
   },
   args: {},
   async run() {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     try {
       const result = await triggerManualDream(root);
       cliOutput(result, { command: "memory-dream", operation: "memory.dream" });
@@ -40712,7 +40918,7 @@ var reflectCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     try {
       const { runObserver, runReflector } = await import("@cleocode/core/internal");
       const observerResult = await runObserver(root, args.session, {
@@ -40752,7 +40958,7 @@ var dedupScanCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     try {
       const { getBrainDb: getBrainDbInner, getBrainNativeDb: getBrainNativeDbInner } = await import("@cleocode/core/internal");
       await getBrainDbInner(root);
@@ -40850,7 +41056,7 @@ var importCommand3 = defineCommand({
   async run({ args }) {
     const sourceDir = args.from ?? join14(homedir4(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
     const isDryRun = !!args["dry-run"];
-    const projectRoot = getProjectRoot24();
+    const projectRoot = getProjectRoot25();
     const stateFile = join14(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
     if (!existsSync11(sourceDir)) {
       cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -41063,7 +41269,7 @@ var tierStatsCommand = defineCommand({
   },
   args: {},
   async run() {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     try {
       await getBrainDb2(root);
       const nativeDb = getBrainNativeDb3();
@@ -41162,7 +41368,7 @@ var tierPromoteCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     const targetTier = args.to;
     const reason = args.reason;
     const validTiers = ["medium", "long"];
@@ -41266,7 +41472,7 @@ var tierDemoteCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot24();
+    const root = getProjectRoot25();
     const targetTier = args.to;
     const reason = args.reason;
     const validTiers = ["short", "medium"];
@@ -41791,7 +41997,7 @@ var memoryCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/migrate-claude-mem.ts
-import { getProjectRoot as getProjectRoot25, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot26, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 init_cli();
@@ -41848,7 +42054,7 @@ var claudeMemCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const root = getProjectRoot25();
+    const root = getProjectRoot26();
     try {
       const result = await migrateClaudeMem(root, {
         sourcePath: args.source,
@@ -41897,7 +42103,7 @@ var manifestIngestCommand = defineCommand({
     }
   },
   async run({ args }) {
-    const projectRoot = getProjectRoot25();
+    const projectRoot = getProjectRoot26();
     try {
       const db = await getDb2(projectRoot);
       const rcasdFlag = Boolean(args.rcasd);
@@ -42812,7 +43018,7 @@ var analyzeCommand3 = defineCommand({
       );
     }
     try {
-      const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot32 }, { eq: eq2 }] = await Promise.all([
+      const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot33 }, { eq: eq2 }] = await Promise.all([
         import("@cleocode/core/store/nexus-sqlite"),
         import("@cleocode/nexus/pipeline"),
         import("@cleocode/core/internal"),
@@ -42904,7 +43110,7 @@ var analyzeCommand3 = defineCommand({
           extensions: { duration_ms: durationMs }
         }
       );
-      void getProjectRoot32;
+      void getProjectRoot33;
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       cliError(
@@ -46268,14 +46474,14 @@ var reconcileCommand2 = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/refresh-memory.ts
-import { getProjectRoot as getProjectRoot26 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot27 } from "@cleocode/core";
 var refreshMemoryCommand = defineCommand({
   meta: {
     name: "refresh-memory",
     description: "Regenerate .cleo/memory-bridge.md from brain.db"
   },
   async run() {
-    const projectDir = getProjectRoot26();
+    const projectDir = getProjectRoot27();
     const { writeMemoryBridge } = await import("@cleocode/core/internal");
     const result = await writeMemoryBridge(projectDir);
     if (result.written) {
@@ -47438,7 +47644,7 @@ init_src();
 import fs3 from "node:fs";
 import path4 from "node:path";
 import { CleoError as CleoError8, formatError as formatError10, getAccessor as getAccessor3 } from "@cleocode/core";
-import { getProjectRoot as getProjectRoot27 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot28 } from "@cleocode/core/internal";
 init_cli();
 init_paths();
 init_renderers();
@@ -47552,7 +47758,7 @@ var finalizeCommand = defineCommand({
     description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
   },
   async run() {
-    const projectRoot = getProjectRoot27();
+    const projectRoot = getProjectRoot28();
     const reportPath = path4.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
     if (!fs3.existsSync(reportPath)) {
       console.log("No pending restore conflicts. Nothing to finalize.");
@@ -49182,7 +49388,7 @@ var sentientCommand = defineCommand({
 });
 
 // packages/cleo/src/cli/commands/sequence.ts
-import { getProjectRoot as getProjectRoot28 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot29 } from "@cleocode/core/internal";
 init_cli();
 init_renderers();
 var showCommand12 = defineCommand({
@@ -49213,7 +49419,7 @@ var repairCommand = defineCommand({
   meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
   async run() {
     const { repairSequence } = await import("@cleocode/core/internal");
-    const projectRoot = getProjectRoot28();
+    const projectRoot = getProjectRoot29();
     const repair = await repairSequence(projectRoot);
     const result = {
       repaired: repair.repaired,
@@ -49640,8 +49846,8 @@ var driftCommand = defineCommand({
     "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
   },
   async run({ args }) {
-    const { detectSessionDrift, getProjectRoot: getProjectRoot32 } = await import("@cleocode/core");
-    const projectRoot = await getProjectRoot32();
+    const { detectSessionDrift, getProjectRoot: getProjectRoot33 } = await import("@cleocode/core");
+    const projectRoot = await getProjectRoot33();
     const scope = args["audit-scope"] === "local" ? "local" : "global";
     const report = await detectSessionDrift({ projectRoot, auditScope: scope });
     cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -50913,7 +51119,7 @@ var testingCommand = defineCommand({
 
 // packages/cleo/src/cli/commands/token.ts
 import { readFileSync as readFileSync12 } from "node:fs";
-import { getProjectRoot as getProjectRoot29, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot30, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 init_cli();
 init_renderers();
 function readPayload(args, textKey, fileKey) {
@@ -51072,7 +51278,7 @@ var estimateCommand = defineCommand({
       domain: args.domain,
       operation: args.operation
     };
-    const result = args.record ? await recordTokenExchange2(getProjectRoot29(), input) : await measureTokenExchange(input);
+    const result = args.record ? await recordTokenExchange2(getProjectRoot30(), input) : await measureTokenExchange(input);
     cliOutput(result, {
       command: "token",
       operation: args.record ? "admin.token.record" : "token.estimate"
@@ -51102,7 +51308,7 @@ var tokenCommand = defineCommand({
 // packages/cleo/src/cli/commands/transcript.ts
 import { homedir as homedir5 } from "node:os";
 import { join as join17 } from "node:path";
-import { getProjectRoot as getProjectRoot30 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot31 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -51127,7 +51333,7 @@ var scanCommand = defineCommand({
   async run({ args }) {
     if (args.pending) {
       try {
-        const projectRoot = getProjectRoot30();
+        const projectRoot = getProjectRoot31();
         const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
         const pending = await scanPendingTranscripts(projectRoot);
         cliOutput(
@@ -51224,7 +51430,7 @@ var extractCommand = defineCommand({
   async run({ args }) {
     const tier = args.tier ?? "warm";
     const dryRun = args["dry-run"] ?? false;
-    const projectRoot = getProjectRoot30();
+    const projectRoot = getProjectRoot31();
     try {
       const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
       const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -51333,7 +51539,7 @@ var migrateCommand2 = defineCommand({
     const dryRun = args["dry-run"] ?? false;
     const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
     const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-    const projectRoot = getProjectRoot30();
+    const projectRoot = getProjectRoot31();
     try {
       const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
       const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -51507,6 +51713,7 @@ var transcriptCommand = defineCommand({
 
 // packages/cleo/src/cli/commands/update.ts
 init_cli();
+init_renderers();
 var updateCommand2 = defineCommand({
   meta: { name: "update", description: "Update a task" },
   args: {
@@ -51647,6 +51854,21 @@ var updateCommand2 = defineCommand({
     reason: {
       type: "string",
       description: "Operator override reason for AC-immutability guard (required to mutate --acceptance once stage >= implementation; T1590)"
+    },
+    /**
+     * Waiver for the critical-priority dependency declaration requirement.
+     *
+     * Critical-priority tasks without declared dependencies silently break
+     * wave-order spawning when downstream work assumes they are load-bearing.
+     * Provide a justification string to waive the `--depends` requirement.
+     * The waiver is stored in task metadata for auditability.
+     *
+     * @task T1856
+     * @epic T1855
+     */
+    "depends-waiver": {
+      type: "string",
+      description: "Justification for promoting a task to critical priority without --depends (T1856). Records waiver in task metadata."
     }
   },
   async run({ args, cmd }) {
@@ -51686,6 +51908,28 @@ var updateCommand2 = defineCommand({
     if (args.kind !== void 0) params["role"] = params["role"] ?? args.kind;
     if (args.scope !== void 0) params["scope"] = args.scope;
     if (args.reason !== void 0) params["reason"] = args.reason;
+    if (args.priority === "critical" && !args.depends && !args["add-depends"] && args["depends-waiver"] === void 0) {
+      const showResponse = await dispatchRaw("query", "tasks", "show", {
+        taskId: args.taskId
+      });
+      const existingTask = showResponse.success ? showResponse.data : void 0;
+      const existingDepends = existingTask?.["depends"];
+      const hasDependencies = Array.isArray(existingDepends) && existingDepends.length > 0;
+      if (!hasDependencies) {
+        cliError(
+          'Critical-priority tasks must declare at least one dependency (--depends) or provide a waiver (--depends-waiver "<reason>").',
+          "E_VALIDATION",
+          {
+            name: "E_VALIDATION",
+            fix: 'Add --depends <taskId> to declare a dependency, or use --depends-waiver "<reason>" to waive the requirement. Use `cleo find "<topic>"` to discover candidate dependencies.'
+          },
+          { operation: "tasks.update" }
+        );
+        process.exit(6);
+        return;
+      }
+    }
+    if (args["depends-waiver"] !== void 0) params["dependsWaiver"] = args["depends-waiver"];
     await dispatchFromCli("mutate", "tasks", "update", params, { command: "update" });
   }
 });
@@ -52363,7 +52607,7 @@ subCommands["rm"] = deleteCommand;
 subCommands["ls"] = listCommand9;
 subCommands["tags"] = labelsCommand;
 subCommands["pipeline"] = phaseCommand;
-{
+async function startCli() {
   const argv = process.argv.slice(2);
   const rawOpts = {};
   for (let i = 0; i < argv.length; i++) {
@@ -52387,12 +52631,12 @@ subCommands["pipeline"] = phaseCommand;
   } catch {
   }
   try {
-    detectAndRemoveStrayProjectNexus(getProjectRoot31());
+    detectAndRemoveStrayProjectNexus(getProjectRoot32());
   } catch {
   }
   const _startupLog = getLogger17("cli-startup");
   try {
-    const _projectRootForMigration = getProjectRoot31();
+    const _projectRootForMigration = getProjectRoot32();
     if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
       const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
       if (migrationResult.status === "failed") {
@@ -52412,7 +52656,7 @@ subCommands["pipeline"] = phaseCommand;
     }
   }
   try {
-    ensureConduitDb(getProjectRoot31());
+    ensureConduitDb(getProjectRoot32());
   } catch {
   }
   try {
@@ -52439,38 +52683,41 @@ subCommands["pipeline"] = phaseCommand;
     cliOutput2({ version: CLI_VERSION }, { command: "version" });
     process.exit(0);
   }
-}
-var main = defineCommand({
-  meta: {
-    name: "cleo",
-    version: CLI_VERSION,
-    description: "CLEO V2 - Task management for AI coding agents"
-  },
-  subCommands
-});
-var aliasMap = buildAliasMap(subCommands);
-var customShowUsage = createCustomShowUsage(CLI_VERSION, subCommands, aliasMap);
-{
-  const rawArgs = process.argv.slice(2);
-  const firstArg = rawArgs[0];
-  if (firstArg && !firstArg.startsWith("-") && firstArg !== "--help" && firstArg !== "-h" && firstArg !== "--version" && firstArg !== "-V") {
-    const availableCommands = Object.keys(subCommands);
-    if (!availableCommands.includes(firstArg)) {
-      const suggestions = didYouMean(firstArg, availableCommands, 3);
-      process.stderr.write(`Unknown command ${firstArg}
+  const main = defineCommand({
+    meta: {
+      name: "cleo",
+      version: CLI_VERSION,
+      description: "CLEO V2 - Task management for AI coding agents"
+    },
+    subCommands
+  });
+  const aliasMap = buildAliasMap(subCommands);
+  const customShowUsage = createCustomShowUsage(CLI_VERSION, subCommands, aliasMap);
+  {
+    const rawArgs = process.argv.slice(2);
+    const firstArg = rawArgs[0];
+    if (firstArg && !firstArg.startsWith("-") && firstArg !== "--help" && firstArg !== "-h" && firstArg !== "--version" && firstArg !== "-V") {
+      const availableCommands = Object.keys(subCommands);
+      if (!availableCommands.includes(firstArg)) {
+        const suggestions = didYouMean(firstArg, availableCommands, 3);
+        process.stderr.write(`Unknown command ${firstArg}
 `);
-      if (suggestions.length > 0) {
-        process.stderr.write("\nDid you mean one of:\n");
-        for (const suggestion of suggestions) {
-          process.stderr.write(`  cleo ${suggestion}
+        if (suggestions.length > 0) {
+          process.stderr.write("\nDid you mean one of:\n");
+          for (const suggestion of suggestions) {
+            process.stderr.write(`  cleo ${suggestion}
 `);
+          }
         }
+        process.exit(127);
       }
-      process.exit(127);
     }
   }
+  runMain(main, { showUsage: customShowUsage });
 }
-runMain(main, { showUsage: customShowUsage });
+runWithWorktreeScopeFromEnv(() => {
+  void startCli();
+});
 /*! Bundled license information:
 
 js-yaml/dist/js-yaml.mjs: