@cleocode/cleo 2026.5.62 → 2026.5.63

package/dist/cli/index.js

@@ -11964,6 +11964,220 @@ var init_registry = __esm({
             description: "Preview without mutations"
           }
         ]
+      },
+      // ---------------------------------------------------------------------------
+      // LLM domain — `cleo llm` CLI surface (T9258 · T-LLM-CRED Phase 2)
+      // ---------------------------------------------------------------------------
+      // llm query: list — redacted credential pool view
+      {
+        gateway: "query",
+        domain: "llm",
+        operation: "list",
+        description: "llm.list (query) \u2014 list redacted credentials from the multi-credential pool, optionally filtered by provider",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: false,
+            description: "Filter to a single provider transport"
+          }
+        ]
+      },
+      // llm query: test — round-trip provider ping
+      {
+        gateway: "query",
+        domain: "llm",
+        operation: "test",
+        description: "llm.test (query) \u2014 round-trip ping against the resolved provider; returns latency + response id (tokens never surfaced)",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["provider"],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider transport to probe",
+            cli: { positional: true }
+          },
+          {
+            name: "label",
+            type: "string",
+            required: false,
+            description: "Credential label to pin the test to a specific store entry"
+          },
+          {
+            name: "model",
+            type: "string",
+            required: false,
+            description: "Model override (defaults to the provider's implicit fallback)"
+          }
+        ]
+      },
+      // llm query: whoami — role-by-role resolver dump
+      {
+        gateway: "query",
+        domain: "llm",
+        operation: "whoami",
+        description: "llm.whoami (query) \u2014 resolve every role and report which provider / model / credential would be picked",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "role",
+            type: "string",
+            required: false,
+            description: "Optional role filter (extraction | consolidation | derivation | hygiene | judgement)"
+          }
+        ]
+      },
+      // llm mutate: add — upsert credential into the pool
+      {
+        gateway: "mutate",
+        domain: "llm",
+        operation: "add",
+        description: "llm.add (mutate) \u2014 upsert a credential into the multi-credential pool; auto-detects authType from token prefix",
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ["provider", "apiKey"],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider transport",
+            cli: { positional: true }
+          },
+          {
+            name: "apiKey",
+            type: "string",
+            required: true,
+            description: "API key or OAuth bearer token to persist"
+          },
+          {
+            name: "label",
+            type: "string",
+            required: false,
+            description: "Human-readable label, unique within provider (default: 'default')"
+          },
+          {
+            name: "baseUrl",
+            type: "string",
+            required: false,
+            description: "Optional override for the provider base URL"
+          },
+          {
+            name: "authType",
+            type: "string",
+            required: false,
+            description: "Explicit auth type override ('api_key' | 'oauth' | 'aws_sdk')"
+          },
+          {
+            name: "priority",
+            type: "number",
+            required: false,
+            description: "Optional priority override (lower wins)"
+          }
+        ]
+      },
+      // llm mutate: remove — delete (provider, label) pair
+      {
+        gateway: "mutate",
+        domain: "llm",
+        operation: "remove",
+        description: "llm.remove (mutate) \u2014 delete a (provider, label) credential pair from the pool",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["provider", "label"],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider transport",
+            cli: { positional: true }
+          },
+          {
+            name: "label",
+            type: "string",
+            required: true,
+            description: "Label of the credential to remove"
+          }
+        ]
+      },
+      // llm mutate: use — set llm.default.{provider,model}
+      {
+        gateway: "mutate",
+        domain: "llm",
+        operation: "use",
+        description: "llm.use (mutate) \u2014 set llm.default.{provider,model} in the global config",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["provider"],
+        params: [
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider transport to mark as default",
+            cli: { positional: true }
+          },
+          {
+            name: "model",
+            type: "string",
+            required: false,
+            description: "Optional default model identifier"
+          }
+        ]
+      },
+      // llm mutate: profile — set llm.roles[role]
+      {
+        gateway: "mutate",
+        domain: "llm",
+        operation: "profile",
+        description: "llm.profile (mutate) \u2014 pin a role to a specific provider / model / credential label",
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["role", "provider"],
+        params: [
+          {
+            name: "role",
+            type: "string",
+            required: true,
+            description: "Role name (extraction | consolidation | derivation | hygiene | judgement)",
+            cli: { positional: true }
+          },
+          {
+            name: "provider",
+            type: "string",
+            required: true,
+            description: "Provider transport for this role",
+            cli: { positional: true }
+          },
+          {
+            name: "model",
+            type: "string",
+            required: false,
+            description: "Optional model identifier for this role"
+          },
+          {
+            name: "credentialLabel",
+            type: "string",
+            required: false,
+            description: "Optional credential label to pin this role to a specific store entry"
+          }
+        ]
       }
     ];
     counts = getCounts();
@@ -16458,6 +16672,107 @@ var init_intelligence2 = __esm({
   }
 });
 
+// packages/cleo/src/dispatch/domains/llm/index.ts
+import {
+  llmAdd,
+  llmList,
+  llmProfile,
+  llmRemove,
+  llmTest,
+  llmUse,
+  llmWhoami
+} from "@cleocode/core/internal";
+async function wrap(op, params, label) {
+  try {
+    const result = await op(params);
+    if (result.success) return lafsSuccess(result.data, label);
+    return lafsError(String(result.error.code), result.error.message, label);
+  } catch (err) {
+    return lafsError("E_INTERNAL", err instanceof Error ? err.message : String(err), label);
+  }
+}
+var coreOps, _llmTypedHandler, QUERY_OPS4, MUTATE_OPS4, LlmHandler;
+var init_llm2 = __esm({
+  "packages/cleo/src/dispatch/domains/llm/index.ts"() {
+    "use strict";
+    init_typed();
+    init_base();
+    coreOps = {
+      list: llmList,
+      test: llmTest,
+      whoami: llmWhoami,
+      add: llmAdd,
+      remove: llmRemove,
+      use: llmUse,
+      profile: llmProfile
+    };
+    _llmTypedHandler = defineTypedHandler("llm", {
+      // -------------------------------------------------------------------------
+      // Query ops
+      // -------------------------------------------------------------------------
+      list: async (params) => wrap(coreOps["list"], params, "list"),
+      test: async (params) => wrap(coreOps["test"], params, "test"),
+      whoami: async (params) => wrap(coreOps["whoami"], params, "whoami"),
+      // -------------------------------------------------------------------------
+      // Mutate ops
+      // -------------------------------------------------------------------------
+      add: async (params) => wrap(coreOps["add"], params, "add"),
+      remove: async (params) => wrap(coreOps["remove"], params, "remove"),
+      use: async (params) => wrap(coreOps["use"], params, "use"),
+      profile: async (params) => wrap(coreOps["profile"], params, "profile")
+    });
+    QUERY_OPS4 = /* @__PURE__ */ new Set(["list", "test", "whoami"]);
+    MUTATE_OPS4 = /* @__PURE__ */ new Set(["add", "remove", "use", "profile"]);
+    LlmHandler = class {
+      /** Declared operations for introspection and validation. */
+      getSupportedOperations() {
+        return {
+          query: ["list", "test", "whoami"],
+          mutate: ["add", "remove", "use", "profile"]
+        };
+      }
+      /**
+       * Execute a read-only llm query operation.
+       */
+      async query(operation, params) {
+        const startTime = Date.now();
+        if (!QUERY_OPS4.has(operation)) {
+          return unsupportedOp("query", "llm", operation, startTime);
+        }
+        try {
+          const envelope = await typedDispatch(
+            _llmTypedHandler,
+            operation,
+            params ?? {}
+          );
+          return wrapResult(envelopeToEngineResult(envelope), "query", "llm", operation, startTime);
+        } catch (error) {
+          return handleErrorResult("query", "llm", operation, error, startTime);
+        }
+      }
+      /**
+       * Execute a state-modifying llm mutate operation.
+       */
+      async mutate(operation, params) {
+        const startTime = Date.now();
+        if (!MUTATE_OPS4.has(operation)) {
+          return unsupportedOp("mutate", "llm", operation, startTime);
+        }
+        try {
+          const envelope = await typedDispatch(
+            _llmTypedHandler,
+            operation,
+            params ?? {}
+          );
+          return wrapResult(envelopeToEngineResult(envelope), "mutate", "llm", operation, startTime);
+        } catch (error) {
+          return handleErrorResult("mutate", "llm", operation, error, startTime);
+        }
+      }
+    };
+  }
+});
+
 // packages/cleo/src/dispatch/domains/memory.ts
 import { getLogger as getLogger6, getProjectRoot as getProjectRoot6 } from "@cleocode/core";
 import {
@@ -18652,7 +18967,7 @@ async function handleImpact(operation, params, startTime) {
     return handleErrorResult("query", "nexus", operation, dbErr, startTime);
   }
 }
-var _nexusTypedHandler, QUERY_OPS4, MUTATE_OPS4, NexusHandler, IMPACT_REVERSE_TYPES;
+var _nexusTypedHandler, QUERY_OPS5, MUTATE_OPS5, NexusHandler, IMPACT_REVERSE_TYPES;
 var init_nexus3 = __esm({
   "packages/cleo/src/dispatch/domains/nexus.ts"() {
     "use strict";
@@ -19072,7 +19387,7 @@ var init_nexus3 = __esm({
       },
       "sigil.sync": async (_params) => wrapCoreResult(await nexusSigilSync(), "sigil.sync")
     });
-    QUERY_OPS4 = /* @__PURE__ */ new Set([
+    QUERY_OPS5 = /* @__PURE__ */ new Set([
       "share.status",
       "status",
       "list",
@@ -19114,7 +19429,7 @@ var init_nexus3 = __esm({
       "hot-nodes",
       "cold-symbols"
     ]);
-    MUTATE_OPS4 = /* @__PURE__ */ new Set([
+    MUTATE_OPS5 = /* @__PURE__ */ new Set([
       "share.snapshot.export",
       "share.snapshot.import",
       "init",
@@ -19149,7 +19464,7 @@ var init_nexus3 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS4.has(operation)) {
+        if (!QUERY_OPS5.has(operation)) {
           return unsupportedOp("query", "nexus", operation, startTime);
         }
         if (operation === "top-entries") {
@@ -19184,7 +19499,7 @@ var init_nexus3 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS4.has(operation)) {
+        if (!MUTATE_OPS5.has(operation)) {
           return unsupportedOp("mutate", "nexus", operation, startTime);
         }
         try {
@@ -19206,8 +19521,8 @@ var init_nexus3 = __esm({
       /** Declared operations for introspection and validation. */
       getSupportedOperations() {
         return {
-          query: Array.from(QUERY_OPS4),
-          mutate: Array.from(MUTATE_OPS4)
+          query: Array.from(QUERY_OPS5),
+          mutate: Array.from(MUTATE_OPS5)
         };
       }
     };
@@ -24076,7 +24391,7 @@ async function lookupApprovalByTokenForDispatch(token) {
   const db = await acquireDb();
   return getPlaybookApprovalByToken(db, token);
 }
-var __playbookRuntimeOverrides, _playbookTypedHandler, QUERY_OPS5, MUTATE_OPS5, PlaybookHandler;
+var __playbookRuntimeOverrides, _playbookTypedHandler, QUERY_OPS6, MUTATE_OPS6, PlaybookHandler;
 var init_playbook2 = __esm({
   "packages/cleo/src/dispatch/domains/playbook.ts"() {
     "use strict";
@@ -24379,15 +24694,15 @@ var init_playbook2 = __esm({
         }
       }
     });
-    QUERY_OPS5 = /* @__PURE__ */ new Set(["status", "list", "validate", "catalog"]);
-    MUTATE_OPS5 = /* @__PURE__ */ new Set(["run", "resume"]);
+    QUERY_OPS6 = /* @__PURE__ */ new Set(["status", "list", "validate", "catalog"]);
+    MUTATE_OPS6 = /* @__PURE__ */ new Set(["run", "resume"]);
     PlaybookHandler = class {
       /**
        * Query gateway — `status`, `list`, and `validate`.
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS5.has(operation)) {
+        if (!QUERY_OPS6.has(operation)) {
           return unsupportedOp("query", "playbook", operation, startTime);
         }
         try {
@@ -24415,7 +24730,7 @@ var init_playbook2 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS5.has(operation)) {
+        if (!MUTATE_OPS6.has(operation)) {
           return unsupportedOp("mutate", "playbook", operation, startTime);
         }
         try {
@@ -25095,7 +25410,7 @@ async function handleRejectGate(params, startTime) {
     return handleErrorResult("mutate", "orchestrate", "reject", error, startTime);
   }
 }
-var ivtrHandler, FANOUT_MANIFEST_MAX_SIZE, fanoutManifestStore, coreOps, OrchestrateHandler;
+var ivtrHandler, FANOUT_MANIFEST_MAX_SIZE, fanoutManifestStore, coreOps2, OrchestrateHandler;
 var init_orchestrate2 = __esm({
   "packages/cleo/src/dispatch/domains/orchestrate.ts"() {
     "use strict";
@@ -25109,7 +25424,7 @@ var init_orchestrate2 = __esm({
     ivtrHandler = new IvtrHandler();
     FANOUT_MANIFEST_MAX_SIZE = 64;
     fanoutManifestStore = /* @__PURE__ */ new Map();
-    coreOps = {
+    coreOps2 = {
       status: orchestrateStatusOp,
       next: orchestrateNextOp,
       ready: orchestrateReadyOp,
@@ -25149,7 +25464,7 @@ var init_orchestrate2 = __esm({
           switch (operation) {
             case "status": {
               const p = { epicId: params?.epicId };
-              return wrapResult(await coreOps.status(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.status(p), "query", "orchestrate", operation, startTime);
             }
             case "next": {
               if (!params?.epicId)
@@ -25162,7 +25477,7 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const p = { epicId: params.epicId };
-              return wrapResult(await coreOps.next(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.next(p), "query", "orchestrate", operation, startTime);
             }
             case "ready": {
               if (!params?.epicId)
@@ -25178,7 +25493,7 @@ var init_orchestrate2 = __esm({
                 epicId: params.epicId,
                 ignoreDepsValidate: params.ignoreDepsValidate
               };
-              return wrapResult(await coreOps.ready(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.ready(p), "query", "orchestrate", operation, startTime);
             }
             case "analyze": {
               const p = {
@@ -25187,7 +25502,7 @@ var init_orchestrate2 = __esm({
                 taskIds: params?.taskIds
               };
               return wrapResult(
-                await coreOps.analyze(p),
+                await coreOps2.analyze(p),
                 "query",
                 "orchestrate",
                 "analyze",
@@ -25209,7 +25524,7 @@ var init_orchestrate2 = __esm({
                 context: params.context
               };
               return wrapResult(
-                await coreOps.classify(p),
+                await coreOps2.classify(p),
                 "query",
                 "orchestrate",
                 operation,
@@ -25229,7 +25544,7 @@ var init_orchestrate2 = __esm({
               const p = {
                 manifestEntryId: params.manifestEntryId
               };
-              const result = await coreOps["fanout.status"](p);
+              const result = await coreOps2["fanout.status"](p);
               return {
                 meta: dispatchMeta("query", "orchestrate", operation, startTime),
                 success: true,
@@ -25238,7 +25553,7 @@ var init_orchestrate2 = __esm({
             }
             case "context": {
               const p = { epicId: params?.epicId };
-              return wrapResult(await coreOps.context(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.context(p), "query", "orchestrate", operation, startTime);
             }
             case "waves": {
               if (!params?.epicId)
@@ -25251,7 +25566,7 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const p = { epicId: params.epicId };
-              return wrapResult(await coreOps.waves(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.waves(p), "query", "orchestrate", operation, startTime);
             }
             case "plan": {
               if (!params?.epicId)
@@ -25269,14 +25584,14 @@ var init_orchestrate2 = __esm({
                 preferTier = preferTierRaw;
               }
               const p = { epicId: params.epicId, preferTier };
-              return wrapResult(await coreOps.plan(p), "query", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.plan(p), "query", "orchestrate", operation, startTime);
             }
             case "bootstrap": {
               const p = {
                 speed: params?.speed
               };
               return wrapResult(
-                await coreOps.bootstrap(p),
+                await coreOps2.bootstrap(p),
                 "query",
                 "orchestrate",
                 operation,
@@ -25285,7 +25600,7 @@ var init_orchestrate2 = __esm({
             }
             case "unblock.opportunities":
               return wrapResult(
-                await coreOps["unblock.opportunities"]({}),
+                await coreOps2["unblock.opportunities"]({}),
                 "query",
                 "orchestrate",
                 operation,
@@ -25362,7 +25677,7 @@ var init_orchestrate2 = __esm({
                   startTime
                 );
               const p = { epicId: params.epicId };
-              return wrapResult(await coreOps.start(p), "mutate", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.start(p), "mutate", "orchestrate", operation, startTime);
             }
             case "spawn": {
               if (!params?.taskId)
@@ -25382,7 +25697,7 @@ var init_orchestrate2 = __esm({
                 tier,
                 noWorktree: params.noWorktree
               };
-              return wrapResult(await coreOps.spawn(p), "mutate", "orchestrate", operation, startTime);
+              return wrapResult(await coreOps2.spawn(p), "mutate", "orchestrate", operation, startTime);
             }
             case "handoff": {
               if (!params?.taskId)
@@ -25415,7 +25730,7 @@ var init_orchestrate2 = __esm({
                 idempotencyKey: params.idempotencyKey
               };
               return wrapResult(
-                await coreOps.handoff(p),
+                await coreOps2.handoff(p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25441,7 +25756,7 @@ var init_orchestrate2 = __esm({
                 tier
               };
               return wrapResult(
-                await coreOps["spawn.execute"](p),
+                await coreOps2["spawn.execute"](p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25460,7 +25775,7 @@ var init_orchestrate2 = __esm({
                 );
               const p = { taskId: params.taskId };
               return wrapResult(
-                await coreOps.validate(p),
+                await coreOps2.validate(p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25502,7 +25817,7 @@ var init_orchestrate2 = __esm({
                 blocksFrom: params.blocksFrom
               };
               return wrapResult(
-                await coreOps.pivot(p),
+                await coreOps2.pivot(p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25521,7 +25836,7 @@ var init_orchestrate2 = __esm({
                 );
               const p = { taskId: params.taskId };
               return wrapResult(
-                await coreOps["worktree.complete"](p),
+                await coreOps2["worktree.complete"](p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25533,7 +25848,7 @@ var init_orchestrate2 = __esm({
                 taskIds: params?.taskIds
               };
               return wrapResult(
-                await coreOps["worktree.cleanup"](p),
+                await coreOps2["worktree.cleanup"](p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25545,7 +25860,7 @@ var init_orchestrate2 = __esm({
                 taskId: params?.taskId
               };
               return wrapResult(
-                await coreOps["worktree.prune"](p),
+                await coreOps2["worktree.prune"](p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -25627,7 +25942,7 @@ var init_orchestrate2 = __esm({
                 );
               const p = { items };
               return wrapResult(
-                await coreOps.fanout(p),
+                await coreOps2.fanout(p),
                 "mutate",
                 "orchestrate",
                 operation,
@@ -26003,7 +26318,7 @@ function pipelineEnvelopeResponse(envelope, operation, startTime) {
     ...enginePage ? { page: enginePage } : {}
   };
 }
-var coreOps2, _pipelineTypedHandler, PipelineHandler;
+var coreOps3, _pipelineTypedHandler, PipelineHandler;
 var init_pipeline3 = __esm({
   "packages/cleo/src/dispatch/domains/pipeline.ts"() {
     "use strict";
@@ -26011,7 +26326,7 @@ var init_pipeline3 = __esm({
     init_engine();
     init_base();
     init_meta2();
-    coreOps2 = {
+    coreOps3 = {
       "stage.validate": stageValidateOp,
       "stage.status": stageStatusOp,
       "stage.history": stageHistoryOp,
@@ -26056,19 +26371,19 @@ var init_pipeline3 = __esm({
         if (!params.epicId || !params.targetStage) {
           return lafsError("E_INVALID_INPUT", "epicId and targetStage are required", "stage.validate");
         }
-        return wrapCoreResult(await coreOps2["stage.validate"](params), "stage.validate");
+        return wrapCoreResult(await coreOps3["stage.validate"](params), "stage.validate");
       },
       "stage.status": async (params) => {
         if (!params.epicId) {
           return lafsError("E_INVALID_INPUT", "epicId is required", "stage.status");
         }
-        return wrapCoreResult(await coreOps2["stage.status"](params), "stage.status");
+        return wrapCoreResult(await coreOps3["stage.status"](params), "stage.status");
       },
       "stage.history": async (params) => {
         if (!params.taskId) {
           return lafsError("E_INVALID_INPUT", "taskId is required", "stage.history");
         }
-        return wrapCoreResult(await coreOps2["stage.history"](params), "stage.history");
+        return wrapCoreResult(await coreOps3["stage.history"](params), "stage.history");
       },
       // SSoT-EXEMPT: sentinel-unwrap from stageGuidanceOp + isValidStage + buildStageGuidance
       // + formatStageGuidance — Core fn returns an intermediate sentinel shape; dispatch
@@ -26078,7 +26393,7 @@ var init_pipeline3 = __esm({
           _stage: stage,
           _format: format,
           _projectRoot: projectRoot
-        } = await coreOps2["stage.guidance"](params);
+        } = await coreOps3["stage.guidance"](params);
         if (!stage) {
           return lafsError(
             "E_INVALID_INPUT",
@@ -26110,37 +26425,37 @@ var init_pipeline3 = __esm({
         if (!params.taskId || !params.stage || !params.status) {
           return lafsError("E_INVALID_INPUT", "taskId, stage, and status are required", "stage.record");
         }
-        return wrapCoreResult(await coreOps2["stage.record"](params), "stage.record");
+        return wrapCoreResult(await coreOps3["stage.record"](params), "stage.record");
       },
       "stage.skip": async (params) => {
         if (!params.taskId || !params.stage || !params.reason) {
           return lafsError("E_INVALID_INPUT", "taskId, stage, and reason are required", "stage.skip");
         }
-        return wrapCoreResult(await coreOps2["stage.skip"](params), "stage.skip");
+        return wrapCoreResult(await coreOps3["stage.skip"](params), "stage.skip");
       },
       "stage.reset": async (params) => {
         if (!params.taskId || !params.stage || !params.reason) {
           return lafsError("E_INVALID_INPUT", "taskId, stage, and reason are required", "stage.reset");
         }
-        return wrapCoreResult(await coreOps2["stage.reset"](params), "stage.reset");
+        return wrapCoreResult(await coreOps3["stage.reset"](params), "stage.reset");
       },
       "stage.gate.pass": async (params) => {
         if (!params.taskId || !params.gateName) {
           return lafsError("E_INVALID_INPUT", "taskId and gateName are required", "stage.gate.pass");
         }
-        return wrapCoreResult(await coreOps2["stage.gate.pass"](params), "stage.gate.pass");
+        return wrapCoreResult(await coreOps3["stage.gate.pass"](params), "stage.gate.pass");
       },
       "stage.gate.fail": async (params) => {
         if (!params.taskId || !params.gateName) {
           return lafsError("E_INVALID_INPUT", "taskId and gateName are required", "stage.gate.fail");
         }
-        return wrapCoreResult(await coreOps2["stage.gate.fail"](params), "stage.gate.fail");
+        return wrapCoreResult(await coreOps3["stage.gate.fail"](params), "stage.gate.fail");
       },
       // -------------------------------------------------------------------------
       // Release queries
       // -------------------------------------------------------------------------
       "release.list": async (params) => {
-        const result = await coreOps2["release.list"](params);
+        const result = await coreOps3["release.list"](params);
         if (!result.success) {
           return lafsError(
             String(result.error?.code ?? "E_INTERNAL"),
@@ -26157,16 +26472,16 @@ var init_pipeline3 = __esm({
         if (!params.version) {
           return lafsError("E_INVALID_INPUT", "version is required", "release.show");
         }
-        return wrapCoreResult(await coreOps2["release.show"](params), "release.show");
+        return wrapCoreResult(await coreOps3["release.show"](params), "release.show");
       },
       // Always succeeds (git branch detection falls back to 'unknown') — no error path.
-      "release.channel.show": async (_params) => lafsSuccess((await coreOps2["release.channel.show"](_params)).data, "release.channel.show"),
+      "release.channel.show": async (_params) => lafsSuccess((await coreOps3["release.channel.show"](_params)).data, "release.channel.show"),
       "release.changelog.since": async (params) => {
         if (!params.sinceTag) {
           return lafsError("E_INVALID_INPUT", "sinceTag is required", "release.changelog.since");
         }
         return wrapCoreResult(
-          await coreOps2["release.changelog.since"](params),
+          await coreOps3["release.changelog.since"](params),
           "release.changelog.since"
         );
       },
@@ -26177,32 +26492,32 @@ var init_pipeline3 = __esm({
         if (!params.version || !params.epicId) {
           return lafsError("E_INVALID_INPUT", "version and epicId are required", "release.ship");
         }
-        return wrapCoreResult(await coreOps2["release.ship"](params), "release.ship");
+        return wrapCoreResult(await coreOps3["release.ship"](params), "release.ship");
       },
       // release.pr-status — T9095 query: poll CI checks for an in-progress release PR
       "release.pr-status": async (params) => {
         if (!params.version) {
           return lafsError("E_INVALID_INPUT", "version is required", "release.pr-status");
         }
-        return wrapCoreResult(await coreOps2["release.pr-status"](params), "release.pr-status");
+        return wrapCoreResult(await coreOps3["release.pr-status"](params), "release.pr-status");
       },
       "release.cancel": async (params) => {
         if (!params.version) {
           return lafsError("E_INVALID_INPUT", "version is required", "release.cancel");
         }
-        return wrapCoreResult(await coreOps2["release.cancel"](params), "release.cancel");
+        return wrapCoreResult(await coreOps3["release.cancel"](params), "release.cancel");
       },
       "release.rollback": async (params) => {
         if (!params.version) {
           return lafsError("E_INVALID_INPUT", "version is required", "release.rollback");
         }
-        return wrapCoreResult(await coreOps2["release.rollback"](params), "release.rollback");
+        return wrapCoreResult(await coreOps3["release.rollback"](params), "release.rollback");
       },
       "release.rollback.full": async (params) => {
         if (!params.version) {
           return lafsError("E_INVALID_INPUT", "version is required", "release.rollback.full");
         }
-        return wrapCoreResult(await coreOps2["release.rollback.full"](params), "release.rollback.full");
+        return wrapCoreResult(await coreOps3["release.rollback.full"](params), "release.rollback.full");
       },
       // -------------------------------------------------------------------------
       // Manifest queries
@@ -26211,10 +26526,10 @@ var init_pipeline3 = __esm({
         if (!params.entryId) {
           return lafsError("E_INVALID_INPUT", "entryId is required", "manifest.show");
         }
-        return wrapCoreResult(await coreOps2["manifest.show"](params), "manifest.show");
+        return wrapCoreResult(await coreOps3["manifest.show"](params), "manifest.show");
       },
       "manifest.list": async (params) => {
-        const result = await coreOps2["manifest.list"](params);
+        const result = await coreOps3["manifest.list"](params);
         if (!result.success) {
           return lafsError(
             String(result.error?.code ?? "E_INTERNAL"),
@@ -26231,9 +26546,9 @@ var init_pipeline3 = __esm({
         if (!params.query) {
           return lafsError("E_INVALID_INPUT", "query is required", "manifest.find");
         }
-        return wrapCoreResult(await coreOps2["manifest.find"](params), "manifest.find");
+        return wrapCoreResult(await coreOps3["manifest.find"](params), "manifest.find");
       },
-      "manifest.stats": async (params) => wrapCoreResult(await coreOps2["manifest.stats"](params), "manifest.stats"),
+      "manifest.stats": async (params) => wrapCoreResult(await coreOps3["manifest.stats"](params), "manifest.stats"),
       // -------------------------------------------------------------------------
       // Manifest mutations
       // -------------------------------------------------------------------------
@@ -26241,7 +26556,7 @@ var init_pipeline3 = __esm({
         if (!params.entry) {
           return lafsError("E_INVALID_INPUT", "entry is required", "manifest.append");
         }
-        return wrapCoreResult(await coreOps2["manifest.append"](params), "manifest.append");
+        return wrapCoreResult(await coreOps3["manifest.append"](params), "manifest.append");
       },
       "manifest.archive": async (params) => {
         if (!params.beforeDate) {
@@ -26251,14 +26566,14 @@ var init_pipeline3 = __esm({
             "manifest.archive"
           );
         }
-        return wrapCoreResult(await coreOps2["manifest.archive"](params), "manifest.archive");
+        return wrapCoreResult(await coreOps3["manifest.archive"](params), "manifest.archive");
       },
       // -------------------------------------------------------------------------
       // Phase queries
       // -------------------------------------------------------------------------
-      "phase.show": async (params) => wrapCoreResult(await coreOps2["phase.show"](params), "phase.show"),
+      "phase.show": async (params) => wrapCoreResult(await coreOps3["phase.show"](params), "phase.show"),
       // Pagination is applied in PipelineHandler.query() for phase.list.
-      "phase.list": async (_params) => wrapCoreResult(await coreOps2["phase.list"](_params), "phase.list"),
+      "phase.list": async (_params) => wrapCoreResult(await coreOps3["phase.list"](_params), "phase.list"),
       // -------------------------------------------------------------------------
       // Phase mutations
       // -------------------------------------------------------------------------
@@ -26266,20 +26581,20 @@ var init_pipeline3 = __esm({
         if (!params.phaseId) {
           return lafsError("E_INVALID_INPUT", "phaseId is required", "phase.set");
         }
-        return wrapCoreResult(await coreOps2["phase.set"](params), "phase.set");
+        return wrapCoreResult(await coreOps3["phase.set"](params), "phase.set");
       },
-      "phase.advance": async (params) => wrapCoreResult(await coreOps2["phase.advance"](params), "phase.advance"),
+      "phase.advance": async (params) => wrapCoreResult(await coreOps3["phase.advance"](params), "phase.advance"),
       "phase.rename": async (params) => {
         if (!params.oldName || !params.newName) {
           return lafsError("E_INVALID_INPUT", "oldName and newName are required", "phase.rename");
         }
-        return wrapCoreResult(await coreOps2["phase.rename"](params), "phase.rename");
+        return wrapCoreResult(await coreOps3["phase.rename"](params), "phase.rename");
       },
       "phase.delete": async (params) => {
         if (!params.phaseId) {
           return lafsError("E_INVALID_INPUT", "phaseId is required", "phase.delete");
         }
-        return wrapCoreResult(await coreOps2["phase.delete"](params), "phase.delete");
+        return wrapCoreResult(await coreOps3["phase.delete"](params), "phase.delete");
       },
       // -------------------------------------------------------------------------
       // Chain queries
@@ -26288,14 +26603,14 @@ var init_pipeline3 = __esm({
         if (!params.chainId) {
           return lafsError("E_INVALID_INPUT", "chainId is required", "chain.show");
         }
-        const { _chain, _chainId } = await coreOps2["chain.show"](params);
+        const { _chain, _chainId } = await coreOps3["chain.show"](params);
         if (!_chain) {
           return lafsError("E_NOT_FOUND", `Chain "${_chainId}" not found`, "chain.show");
         }
         return lafsSuccess(_chain, "chain.show");
       },
       "chain.list": async (params) => {
-        return lafsSuccess(await coreOps2["chain.list"](params), "chain.list");
+        return lafsSuccess(await coreOps3["chain.list"](params), "chain.list");
       },
       // -------------------------------------------------------------------------
       // Chain mutations
@@ -26304,14 +26619,14 @@ var init_pipeline3 = __esm({
         if (!params.chain) {
           return lafsError("E_INVALID_INPUT", "chain is required", "chain.add");
         }
-        return lafsSuccess(await coreOps2["chain.add"](params), "chain.add");
+        return lafsSuccess(await coreOps3["chain.add"](params), "chain.add");
       },
       "chain.instantiate": async (params) => {
         if (!params.chainId || !params.epicId) {
           return lafsError("E_INVALID_INPUT", "chainId and epicId are required", "chain.instantiate");
         }
         try {
-          return lafsSuccess(await coreOps2["chain.instantiate"](params), "chain.instantiate");
+          return lafsSuccess(await coreOps3["chain.instantiate"](params), "chain.instantiate");
         } catch (error) {
           const message = error instanceof Error ? error.message : String(error);
           if (message.includes(`Chain "${params.chainId}" not found`) || message.includes("FOREIGN KEY constraint failed") || message.includes("SQLITE_CONSTRAINT_FOREIGNKEY")) {
@@ -26324,7 +26639,7 @@ var init_pipeline3 = __esm({
         if (!params.instanceId || !params.nextStage) {
           return lafsError("E_INVALID_INPUT", "instanceId and nextStage are required", "chain.advance");
         }
-        return lafsSuccess(await coreOps2["chain.advance"](params), "chain.advance");
+        return lafsSuccess(await coreOps3["chain.advance"](params), "chain.advance");
       }
     });
     PipelineHandler = class {
@@ -26500,7 +26815,7 @@ async function releaseGateOp(params) {
 async function releaseIvtrSuggestOp(params) {
   return releaseIvtrAutoSuggest(params.taskId, getProjectRoot11());
 }
-var log2, coreOps3, ReleaseHandler;
+var log2, coreOps4, ReleaseHandler;
 var init_release2 = __esm({
   "packages/cleo/src/dispatch/domains/release.ts"() {
     "use strict";
@@ -26508,7 +26823,7 @@ var init_release2 = __esm({
     init_base();
     init_meta2();
     log2 = getLogger11("domain:release");
-    coreOps3 = {
+    coreOps4 = {
       gate: releaseGateOp,
       "ivtr-suggest": releaseIvtrSuggestOp
     };
@@ -26542,7 +26857,7 @@ var init_release2 = __esm({
                 );
               const force = typeof params?.force === "boolean" ? params.force : false;
               const typed = { epicId, force };
-              return wrapResult(await coreOps3.gate(typed), "query", "release", operation, startTime);
+              return wrapResult(await coreOps4.gate(typed), "query", "release", operation, startTime);
             }
             // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07)
             case "ivtr-suggest": {
@@ -26558,7 +26873,7 @@ var init_release2 = __esm({
                 );
               const typed = { taskId };
               return wrapResult(
-                await coreOps3["ivtr-suggest"](typed),
+                await coreOps4["ivtr-suggest"](typed),
                 "query",
                 "release",
                 operation,
@@ -26618,7 +26933,7 @@ var init_release2 = __esm({
                 );
               const force = typeof params?.force === "boolean" ? params.force : false;
               const typed = { epicId, force };
-              return wrapResult(await coreOps3.gate(typed), "mutate", "release", operation, startTime);
+              return wrapResult(await coreOps4.gate(typed), "mutate", "release", operation, startTime);
             }
             // release.ivtr-suggest — IVTR auto-suggest (RELEASE-07, no DB writes)
             case "ivtr-suggest": {
@@ -26634,7 +26949,7 @@ var init_release2 = __esm({
                 );
               const typed = { taskId };
               return wrapResult(
-                await coreOps3["ivtr-suggest"](typed),
+                await coreOps4["ivtr-suggest"](typed),
                 "mutate",
                 "release",
                 operation,
@@ -26723,13 +27038,13 @@ import {
   sentientProposeReject,
   sentientProposeRun
 } from "@cleocode/core/sentient";
-var coreOps4, _sentientTypedHandler, QUERY_OPS6, MUTATE_OPS6, SentientHandler;
+var coreOps5, _sentientTypedHandler, QUERY_OPS7, MUTATE_OPS7, SentientHandler;
 var init_sentient2 = __esm({
   "packages/cleo/src/dispatch/domains/sentient.ts"() {
     "use strict";
     init_typed();
     init_base();
-    coreOps4 = {
+    coreOps5 = {
       "propose.list": (params) => sentientProposeList(getProjectRoot12(), params),
       "propose.diff": (params) => sentientProposeDiff(getProjectRoot12(), params),
       "allowlist.list": (params) => sentientAllowlistList(getProjectRoot12(), params),
@@ -26747,7 +27062,7 @@ var init_sentient2 = __esm({
       // -------------------------------------------------------------------------
       "propose.list": async (params) => {
         try {
-          const data = await coreOps4["propose.list"](params);
+          const data = await coreOps5["propose.list"](params);
           return lafsSuccess(data, "propose.list");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26756,7 +27071,7 @@ var init_sentient2 = __esm({
       },
       "propose.diff": async (params) => {
         try {
-          const data = await coreOps4["propose.diff"](params);
+          const data = await coreOps5["propose.diff"](params);
           return lafsSuccess(data, "propose.diff");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26765,7 +27080,7 @@ var init_sentient2 = __esm({
       },
       "allowlist.list": async (_params) => {
         try {
-          const data = await coreOps4["allowlist.list"](_params);
+          const data = await coreOps5["allowlist.list"](_params);
           return lafsSuccess(data, "allowlist.list");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26777,7 +27092,7 @@ var init_sentient2 = __esm({
       // -------------------------------------------------------------------------
       "propose.accept": async (params) => {
         try {
-          const data = await coreOps4["propose.accept"](params);
+          const data = await coreOps5["propose.accept"](params);
           return lafsSuccess(data, "propose.accept");
         } catch (err) {
           const code = err.code ?? "E_INTERNAL";
@@ -26787,7 +27102,7 @@ var init_sentient2 = __esm({
       },
       "propose.reject": async (params) => {
         try {
-          const data = await coreOps4["propose.reject"](params);
+          const data = await coreOps5["propose.reject"](params);
           return lafsSuccess(data, "propose.reject");
         } catch (err) {
           const code = err.code ?? "E_INTERNAL";
@@ -26797,7 +27112,7 @@ var init_sentient2 = __esm({
       },
       "propose.run": async (_params) => {
         try {
-          const data = await coreOps4["propose.run"](_params);
+          const data = await coreOps5["propose.run"](_params);
           return lafsSuccess(data, "propose.run");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26806,7 +27121,7 @@ var init_sentient2 = __esm({
       },
       "propose.enable": async (_params) => {
         try {
-          const data = await coreOps4["propose.enable"](_params);
+          const data = await coreOps5["propose.enable"](_params);
           return lafsSuccess(data, "propose.enable");
         } catch (err) {
           const code = err.code ?? "E_INTERNAL";
@@ -26816,7 +27131,7 @@ var init_sentient2 = __esm({
       },
       "propose.disable": async (_params) => {
         try {
-          const data = await coreOps4["propose.disable"](_params);
+          const data = await coreOps5["propose.disable"](_params);
           return lafsSuccess(data, "propose.disable");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26825,7 +27140,7 @@ var init_sentient2 = __esm({
       },
       "allowlist.add": async (params) => {
         try {
-          const data = await coreOps4["allowlist.add"](params);
+          const data = await coreOps5["allowlist.add"](params);
           return lafsSuccess(data, "allowlist.add");
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
@@ -26834,7 +27149,7 @@ var init_sentient2 = __esm({
       },
       "allowlist.remove": async (params) => {
         try {
-          const data = await coreOps4["allowlist.remove"](params);
+          const data = await coreOps5["allowlist.remove"](params);
           return lafsSuccess(data, "allowlist.remove");
         } catch (err) {
           const code = err.code === "E_ALLOWLIST_KEY_NOT_FOUND" ? "E_ALLOWLIST_KEY_NOT_FOUND" : "E_ALLOWLIST_REMOVE";
@@ -26843,8 +27158,8 @@ var init_sentient2 = __esm({
         }
       }
     });
-    QUERY_OPS6 = /* @__PURE__ */ new Set(["propose.list", "propose.diff", "allowlist.list"]);
-    MUTATE_OPS6 = /* @__PURE__ */ new Set([
+    QUERY_OPS7 = /* @__PURE__ */ new Set(["propose.list", "propose.diff", "allowlist.list"]);
+    MUTATE_OPS7 = /* @__PURE__ */ new Set([
       "propose.accept",
       "propose.reject",
       "propose.run",
@@ -26877,7 +27192,7 @@ var init_sentient2 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS6.has(operation)) {
+        if (!QUERY_OPS7.has(operation)) {
           return unsupportedOp("query", "sentient", operation, startTime);
         }
         try {
@@ -26905,7 +27220,7 @@ var init_sentient2 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS6.has(operation)) {
+        if (!MUTATE_OPS7.has(operation)) {
           return unsupportedOp("mutate", "sentient", operation, startTime);
         }
         try {
@@ -27033,7 +27348,7 @@ async function storeSessionOwnerAuthToken(projectRoot, sessionId, token) {
   const db = await getDb(projectRoot);
   db.update(sessions).set({ ownerAuthToken: token }).where(eq(sessions.id, sessionId)).run();
 }
-var coreOps5, _sessionTypedHandler, QUERY_OPS7, MUTATE_OPS7, SessionHandler;
+var coreOps6, _sessionTypedHandler, QUERY_OPS8, MUTATE_OPS8, SessionHandler;
 var init_session3 = __esm({
   "packages/cleo/src/dispatch/domains/session.ts"() {
     "use strict";
@@ -27041,7 +27356,7 @@ var init_session3 = __esm({
     init_session_context();
     init_engine();
     init_base();
-    coreOps5 = {
+    coreOps6 = {
       status: sessionStatusOp,
       list: sessionListOp,
       show: sessionShowOp,
@@ -27064,19 +27379,19 @@ var init_session3 = __esm({
       // -------------------------------------------------------------------------
       // Engine guarantees data on success; fallback mirrors empty-state shape.
       // overrideCount included per T1501 / P0-5.
-      status: async (_params) => wrapCoreResult(await coreOps5.status(), "status", {
+      status: async (_params) => wrapCoreResult(await coreOps6.status(), "status", {
         hasActiveSession: false,
         session: null,
         taskWork: null,
         overrideCount: 0
       }),
-      list: async (params) => wrapCoreResult(await coreOps5.list(params), "list"),
+      list: async (params) => wrapCoreResult(await coreOps6.list(params), "list"),
       // session.show absorbs debrief.show via include param (T5615)
       show: async (params) => {
         if (!params.sessionId) {
           return lafsError("E_INVALID_INPUT", "sessionId is required", "show");
         }
-        const result = await coreOps5.show(params);
+        const result = await coreOps6.show(params);
         if (!result.success) {
           return lafsError(
             String(result.error?.code ?? "E_INTERNAL"),
@@ -27090,7 +27405,7 @@ var init_session3 = __esm({
         return lafsSuccess(result.data, "show");
       },
       find: async (params) => {
-        const result = await coreOps5.find(params);
+        const result = await coreOps6.find(params);
         if (!result.success) {
           return lafsError(
             String(result.error?.code ?? "E_INTERNAL"),
@@ -27100,16 +27415,16 @@ var init_session3 = __esm({
         }
         return lafsSuccess({ sessions: result.data ?? [] }, "find");
       },
-      "decision.log": async (params) => wrapCoreResult(await coreOps5["decision.log"](params), "decision.log", []),
+      "decision.log": async (params) => wrapCoreResult(await coreOps6["decision.log"](params), "decision.log", []),
       "context.drift": async (params) => {
-        const result = await coreOps5["context.drift"](params);
+        const result = await coreOps6["context.drift"](params);
         if (result.success && !result.data) {
           return lafsError("E_INTERNAL", "context.drift returned no data", "context.drift");
         }
         return wrapCoreResult(result, "context.drift");
       },
-      "handoff.show": async (params) => wrapCoreResult(await coreOps5["handoff.show"](params), "handoff.show", null),
-      "briefing.show": async (params) => wrapCoreResult(await coreOps5["briefing.show"](params), "briefing.show"),
+      "handoff.show": async (params) => wrapCoreResult(await coreOps6["handoff.show"](params), "handoff.show", null),
+      "briefing.show": async (params) => wrapCoreResult(await coreOps6["briefing.show"](params), "briefing.show"),
       // -------------------------------------------------------------------------
       // Mutate ops
       // -------------------------------------------------------------------------
@@ -27120,7 +27435,7 @@ var init_session3 = __esm({
         if (!params.scope) {
           return lafsError("E_INVALID_INPUT", "scope is required", "start");
         }
-        const result = await coreOps5.start(params);
+        const result = await coreOps6.start(params);
         if (!result.success) {
           return lafsError(
             String(result.error?.code ?? "E_INTERNAL"),
@@ -27166,7 +27481,7 @@ var init_session3 = __esm({
       // unbindSession (process-context teardown), refreshMemoryBridge — ADR-058
       end: async (params) => {
         const projectRoot = getProjectRoot13();
-        const endResult = await coreOps5.end(params);
+        const endResult = await coreOps6.end(params);
         if (!endResult.success) {
           return lafsError(
             String(endResult.error?.code ?? "E_INTERNAL"),
@@ -27216,7 +27531,7 @@ var init_session3 = __esm({
         if (!params.sessionId) {
           return lafsError("E_INVALID_INPUT", "sessionId is required", "resume");
         }
-        const result = await coreOps5.resume(params);
+        const result = await coreOps6.resume(params);
         if (result.success && !result.data) {
           return lafsError("E_NOT_FOUND", `Session ${params.sessionId} not found`, "resume");
         }
@@ -27226,30 +27541,30 @@ var init_session3 = __esm({
         if (!params.sessionId) {
           return lafsError("E_INVALID_INPUT", "sessionId is required", "suspend");
         }
-        const result = await coreOps5.suspend(params);
+        const result = await coreOps6.suspend(params);
         if (result.success && !result.data) {
           return lafsError("E_NOT_FOUND", `Session ${params.sessionId} not found`, "suspend");
         }
         return wrapCoreResult(result, "suspend");
       },
       // Engine guarantees data on success; fallback for safety.
-      gc: async (params) => wrapCoreResult(await coreOps5.gc(params), "gc", { orphaned: [], removed: [] }),
+      gc: async (params) => wrapCoreResult(await coreOps6.gc(params), "gc", { orphaned: [], removed: [] }),
       "record.decision": async (params) => {
-        const result = await coreOps5["record.decision"](params);
+        const result = await coreOps6["record.decision"](params);
         if (result.success && !result.data) {
           return lafsError("E_INTERNAL", "record.decision returned no data", "record.decision");
         }
         return wrapCoreResult(result, "record.decision");
       },
       "record.assumption": async (params) => {
-        const result = await coreOps5["record.assumption"](params);
+        const result = await coreOps6["record.assumption"](params);
         if (result.success && !result.data) {
           return lafsError("E_INTERNAL", "record.assumption returned no data", "record.assumption");
         }
         return wrapCoreResult(result, "record.assumption");
       }
     });
-    QUERY_OPS7 = /* @__PURE__ */ new Set([
+    QUERY_OPS8 = /* @__PURE__ */ new Set([
       "status",
       "list",
       "show",
@@ -27259,7 +27574,7 @@ var init_session3 = __esm({
       "handoff.show",
       "briefing.show"
     ]);
-    MUTATE_OPS7 = /* @__PURE__ */ new Set([
+    MUTATE_OPS8 = /* @__PURE__ */ new Set([
       "start",
       "end",
       "resume",
@@ -27280,7 +27595,7 @@ var init_session3 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS7.has(operation)) {
+        if (!QUERY_OPS8.has(operation)) {
           return unsupportedOp("query", "session", operation, startTime);
         }
         try {
@@ -27309,7 +27624,7 @@ var init_session3 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS7.has(operation)) {
+        if (!MUTATE_OPS8.has(operation)) {
           return unsupportedOp("mutate", "session", operation, startTime);
         }
         try {
@@ -27442,7 +27757,7 @@ function envelopeToDispatch(envelope, gateway, operation, startTime) {
     }
   };
 }
-var log3, stickyCoreOps, _stickyTypedHandler, QUERY_OPS8, MUTATE_OPS8, CONVERT_TARGET_TO_KEY, StickyHandler;
+var log3, stickyCoreOps, _stickyTypedHandler, QUERY_OPS9, MUTATE_OPS9, CONVERT_TARGET_TO_KEY, StickyHandler;
 var init_sticky2 = __esm({
   "packages/cleo/src/dispatch/domains/sticky.ts"() {
     "use strict";
@@ -27520,8 +27835,8 @@ var init_sticky2 = __esm({
         return data.taskId ? lafsSuccess(data, "convert.task_note") : lafsError("E_CONVERT_FAILED", "convert to task note failed", "convert.task_note");
       }
     });
-    QUERY_OPS8 = /* @__PURE__ */ new Set(["list", "show"]);
-    MUTATE_OPS8 = /* @__PURE__ */ new Set(["add", "convert", "archive", "purge"]);
+    QUERY_OPS9 = /* @__PURE__ */ new Set(["list", "show"]);
+    MUTATE_OPS9 = /* @__PURE__ */ new Set(["add", "convert", "archive", "purge"]);
     CONVERT_TARGET_TO_KEY = {
       task: "convert.task",
       memory: "convert.memory",
@@ -27531,7 +27846,7 @@ var init_sticky2 = __esm({
     StickyHandler = class {
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS8.has(operation)) {
+        if (!QUERY_OPS9.has(operation)) {
           return unsupportedOp("query", "sticky", operation, startTime);
         }
         try {
@@ -27548,7 +27863,7 @@ var init_sticky2 = __esm({
       }
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS8.has(operation)) {
+        if (!MUTATE_OPS9.has(operation)) {
           return unsupportedOp("mutate", "sticky", operation, startTime);
         }
         try {
@@ -27591,7 +27906,7 @@ var init_sticky2 = __esm({
 
 // packages/cleo/src/dispatch/domains/tasks.ts
 import { getLogger as getLogger14, getProjectRoot as getProjectRoot15 } from "@cleocode/core";
-var _tasksTypedHandler, QUERY_OPS9, MUTATE_OPS9, TasksHandler;
+var _tasksTypedHandler, QUERY_OPS10, MUTATE_OPS10, TasksHandler;
 var init_tasks3 = __esm({
   "packages/cleo/src/dispatch/domains/tasks.ts"() {
     "use strict";
@@ -27976,7 +28291,7 @@ var init_tasks3 = __esm({
         return wrapCoreResult(await taskUnclaim(projectRoot, params.taskId), "unclaim");
       }
     });
-    QUERY_OPS9 = /* @__PURE__ */ new Set([
+    QUERY_OPS10 = /* @__PURE__ */ new Set([
       "show",
       "list",
       "find",
@@ -27996,7 +28311,7 @@ var init_tasks3 = __esm({
       "label.list",
       "sync.links"
     ]);
-    MUTATE_OPS9 = /* @__PURE__ */ new Set([
+    MUTATE_OPS10 = /* @__PURE__ */ new Set([
       "add",
       "update",
       "complete",
@@ -28027,7 +28342,7 @@ var init_tasks3 = __esm({
        */
       async query(operation, params) {
         const startTime = Date.now();
-        if (!QUERY_OPS9.has(operation)) {
+        if (!QUERY_OPS10.has(operation)) {
           return unsupportedOp("query", "tasks", operation, startTime);
         }
         if (operation === "impact" && !params?.change) {
@@ -28066,7 +28381,7 @@ var init_tasks3 = __esm({
        */
       async mutate(operation, params) {
         const startTime = Date.now();
-        if (!MUTATE_OPS9.has(operation)) {
+        if (!MUTATE_OPS10.has(operation)) {
           return unsupportedOp("mutate", "tasks", operation, startTime);
         }
         try {
@@ -28721,6 +29036,7 @@ function createDomainHandlers() {
   handlers.set("conduit", new ConduitHandler());
   handlers.set("sentient", new SentientHandler());
   handlers.set("release", new ReleaseHandler());
+  handlers.set("llm", new LlmHandler());
   return handlers;
 }
 var init_domains = __esm({
@@ -28732,6 +29048,7 @@ var init_domains = __esm({
     init_diagnostics();
     init_docs2();
     init_intelligence2();
+    init_llm2();
     init_memory2();
     init_nexus3();
     init_orchestrate2();
@@ -43737,6 +44054,306 @@ var init_list = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/llm.ts
+var llm_exports = {};
+__export(llm_exports, {
+  llmCommand: () => llmCommand
+});
+async function readApiKeyFromStdin() {
+  if (process.stdin.isTTY) return "";
+  process.stdin.setEncoding("utf-8");
+  let buf = "";
+  for await (const chunk of process.stdin) {
+    buf += chunk;
+  }
+  return buf.replace(/\r?\n$/, "").trim();
+}
+function makeLlmSubcommand(opts) {
+  const mergedArgs = {
+    ...opts.args,
+    json: {
+      type: "boolean",
+      description: "Output as JSON"
+    }
+  };
+  return defineCommand({
+    meta: { name: opts.name, description: opts.description },
+    args: mergedArgs,
+    async run({ args }) {
+      const params = opts.paramBuilder(args);
+      await dispatchFromCli(opts.gateway, "llm", opts.operation, params, opts.output);
+    }
+  });
+}
+var API_KEY_FLAG_DEPRECATION, addCommand5, listCommand10, removeCommand3, useCommand, profileCommand, testCommand, whoamiCommand, llmCommand;
+var init_llm3 = __esm({
+  "packages/cleo/src/cli/commands/llm.ts"() {
+    "use strict";
+    init_dist();
+    init_cli();
+    API_KEY_FLAG_DEPRECATION = "[warning] --api-key exposes the secret to 'ps' listings and shell history. Prefer --api-key-stdin or --api-key-env=NAME for production use.";
+    addCommand5 = defineCommand({
+      meta: {
+        name: "add",
+        // Help text lists --api-key-stdin first (recommended path) and
+        // --api-key last (deprecated). See S-11 in T9258 for the rationale.
+        description: "Upsert a credential into the multi-credential pool. Reads the secret from stdin (--api-key-stdin, recommended), from an env var (--api-key-env=NAME), or as a literal flag value (--api-key, DEPRECATED \u2014 visible to ps + shell history). Auto-detects authType from token prefix (sk-ant-oat-* \u2192 oauth)."
+      },
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider transport (anthropic | openai | gemini | moonshot)",
+          required: true
+        },
+        // Recommended path — listed first to surface it in --help output.
+        "api-key-stdin": {
+          type: "boolean",
+          description: '(recommended) Read the API key from stdin. Example: `echo "$KEY" | cleo llm add anthropic --api-key-stdin`. Not visible to `ps` listings or shell history.'
+        },
+        // Named-env mode — second-priority. Lets users put the key in a
+        // .envrc / secret manager and reference it by name.
+        "api-key-env": {
+          type: "string",
+          description: "Read the API key from the env var named here. Example: `cleo llm add anthropic --api-key-env=ANTHROPIC_API_KEY`."
+        },
+        // Deprecated literal-value mode — last in the help order. Backward
+        // compat for CI scripts; emits a stderr warning when used.
+        "api-key": {
+          type: "string",
+          description: "(DEPRECATED) API key or OAuth bearer token as a literal flag value. Exposes the secret to `ps` and shell history. Prefer --api-key-stdin or --api-key-env=NAME."
+        },
+        label: {
+          type: "string",
+          description: "Human-readable label, unique within provider (default: 'default')"
+        },
+        "base-url": {
+          type: "string",
+          description: "Optional override for the provider base URL"
+        },
+        "auth-type": {
+          type: "string",
+          description: "Explicit auth type override ('api_key' | 'oauth' | 'aws_sdk')"
+        },
+        priority: {
+          type: "string",
+          description: "Optional priority override (lower wins)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        let apiKey = "";
+        let source = "none";
+        if (a["api-key-stdin"] === true) {
+          apiKey = await readApiKeyFromStdin();
+          source = "stdin";
+          if (!apiKey) {
+            process.stderr.write(
+              '[error] --api-key-stdin set but stdin is empty or a TTY. Pipe the secret in, e.g. `echo "$KEY" | cleo llm add ...`.\n'
+            );
+            process.exit(2);
+          }
+        } else if (typeof a["api-key-env"] === "string" && a["api-key-env"]) {
+          const envName = a["api-key-env"];
+          const envValue = process.env[envName];
+          if (!envValue) {
+            process.stderr.write(`[error] --api-key-env=${envName} is not set in the environment.
+`);
+            process.exit(2);
+          }
+          apiKey = envValue;
+          source = "env";
+        } else if (typeof a["api-key"] === "string" && a["api-key"]) {
+          process.stderr.write(`${API_KEY_FLAG_DEPRECATION}
+`);
+          apiKey = a["api-key"];
+          source = "flag";
+        } else {
+          process.stderr.write(
+            "[error] cleo llm add requires one of --api-key-stdin (recommended), --api-key-env=NAME, or --api-key=<value> (deprecated).\n"
+          );
+          process.exit(2);
+        }
+        const params = {
+          provider: a["provider"],
+          apiKey,
+          _source: source
+          // surfaces in audit logs for incident response
+        };
+        if (a["label"] !== void 0) params["label"] = a["label"];
+        if (a["base-url"] !== void 0) params["baseUrl"] = a["base-url"];
+        if (a["auth-type"] !== void 0) params["authType"] = a["auth-type"];
+        if (a["priority"] !== void 0) params["priority"] = Number(a["priority"]);
+        await dispatchFromCli("mutate", "llm", "add", params, {
+          command: "llm-add",
+          operation: "llm.add"
+        });
+      }
+    });
+    listCommand10 = makeLlmSubcommand({
+      name: "list",
+      description: "List redacted credentials from the multi-credential pool (tokens shown as last 4 chars only).",
+      args: {
+        provider: {
+          type: "positional",
+          description: "Optional provider filter",
+          required: false
+        }
+      },
+      gateway: "query",
+      operation: "list",
+      output: { command: "llm-list", operation: "llm.list" },
+      paramBuilder: (args) => ({
+        ...args["provider"] !== void 0 && args["provider"] !== "" ? { provider: args["provider"] } : {}
+      })
+    });
+    removeCommand3 = makeLlmSubcommand({
+      name: "remove",
+      description: "Delete a (provider, label) credential pair from the pool.",
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider transport",
+          required: true
+        },
+        label: {
+          type: "string",
+          description: "Label of the credential to remove",
+          required: true
+        }
+      },
+      gateway: "mutate",
+      operation: "remove",
+      output: { command: "llm-remove", operation: "llm.remove" },
+      paramBuilder: (args) => ({
+        provider: args["provider"],
+        label: args["label"]
+      })
+    });
+    useCommand = makeLlmSubcommand({
+      name: "use",
+      description: "Set llm.default.{provider,model} in the global config.",
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider transport to mark as default",
+          required: true
+        },
+        model: {
+          type: "string",
+          description: "Optional default model identifier"
+        }
+      },
+      gateway: "mutate",
+      operation: "use",
+      output: { command: "llm-use", operation: "llm.use" },
+      paramBuilder: (args) => ({
+        provider: args["provider"],
+        ...args["model"] !== void 0 && { model: args["model"] }
+      })
+    });
+    profileCommand = makeLlmSubcommand({
+      name: "profile",
+      description: "Pin a logical role (extraction | consolidation | derivation | hygiene | judgement) to a specific provider / model / credential label.",
+      args: {
+        role: {
+          type: "positional",
+          description: "Role name",
+          required: true
+        },
+        provider: {
+          type: "positional",
+          description: "Provider transport for this role",
+          required: true
+        },
+        model: {
+          type: "string",
+          description: "Optional model identifier for this role"
+        },
+        "credential-label": {
+          type: "string",
+          description: "Optional credential label to pin this role to a specific store entry"
+        }
+      },
+      gateway: "mutate",
+      operation: "profile",
+      output: { command: "llm-profile", operation: "llm.profile" },
+      paramBuilder: (args) => ({
+        role: args["role"],
+        provider: args["provider"],
+        ...args["model"] !== void 0 && { model: args["model"] },
+        ...args["credential-label"] !== void 0 && { credentialLabel: args["credential-label"] }
+      })
+    });
+    testCommand = makeLlmSubcommand({
+      name: "test",
+      description: "Round-trip ping against the resolved provider (1-token prompt). Returns latency + response id; tokens never surfaced.",
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider transport to probe",
+          required: true
+        },
+        label: {
+          type: "string",
+          description: "Credential label to pin the test to a specific store entry"
+        },
+        model: {
+          type: "string",
+          description: "Model override (defaults to the provider's implicit fallback)"
+        }
+      },
+      gateway: "query",
+      operation: "test",
+      output: { command: "llm-test", operation: "llm.test" },
+      paramBuilder: (args) => ({
+        provider: args["provider"],
+        ...args["label"] !== void 0 && { label: args["label"] },
+        ...args["model"] !== void 0 && { model: args["model"] }
+      })
+    });
+    whoamiCommand = makeLlmSubcommand({
+      name: "whoami",
+      description: "For each role, resolve and report which provider / model / credential would be picked today.",
+      args: {
+        role: {
+          type: "string",
+          description: "Optional role filter"
+        }
+      },
+      gateway: "query",
+      operation: "whoami",
+      output: { command: "llm-whoami", operation: "llm.whoami" },
+      paramBuilder: (args) => ({
+        ...args["role"] !== void 0 && args["role"] !== "" ? { role: args["role"] } : {}
+      })
+    });
+    llmCommand = defineCommand({
+      meta: {
+        name: "llm",
+        description: "Manage LLM credentials, role profiles, and resolver diagnostics"
+      },
+      subCommands: {
+        add: addCommand5,
+        list: listCommand10,
+        remove: removeCommand3,
+        use: useCommand,
+        profile: profileCommand,
+        test: testCommand,
+        whoami: whoamiCommand
+      },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/log.ts
 var log_exports = {};
 __export(log_exports, {
@@ -43815,7 +44432,7 @@ async function readStdin() {
     process.stdin.on("error", reject);
   });
 }
-var showCommand7, listCommand10, findCommand4, statsCommand3, appendCommand, archiveCommand2, manifestCommand;
+var showCommand7, listCommand11, findCommand4, statsCommand3, appendCommand, archiveCommand2, manifestCommand;
 var init_manifest = __esm({
   "packages/cleo/src/cli/commands/manifest.ts"() {
     "use strict";
@@ -43845,7 +44462,7 @@ var init_manifest = __esm({
         );
       }
     });
-    listCommand10 = defineCommand({
+    listCommand11 = defineCommand({
       meta: {
         name: "list",
         description: "List manifest entries with optional filters"
@@ -44109,7 +44726,7 @@ var init_manifest = __esm({
       },
       subCommands: {
         show: showCommand7,
-        list: listCommand10,
+        list: listCommand11,
         find: findCommand4,
         stats: statsCommand3,
         append: appendCommand,
@@ -46491,7 +47108,7 @@ function applyJsonFlag2(jsonFlag) {
     setFormatContext({ format: "json", source: "flag", quiet: false });
   }
 }
-var initCommand3, registerCommand2, unregisterCommand, listCommand11, statusCommand8, showCommand8, resolveCommand2, discoverCommand2, augmentCommand2, setupCommand, searchCommand3, depsCommand3, criticalPathCommand2, blockingCommand, orphansCommand2, syncCommand5, reconcileCommand2, graphCommand3, shareStatusCommand, transferPreviewCommand, transferCommand, permissionSetCommand, permissionCommand, shareExportCommand, shareImportCommand, shareCommand, clustersCommand2, flowsCommand2, contextCommand4, impactCommand3, analyzeCommand3, projectsListCommand, projectsRegisterCommand, projectsRemoveCommand, projectsScanCommand, projectsCleanCommand, projectsCommand, refreshBridgeCommand, exportCommand6, diffCommand2, queryCommand2, routeMapCommand2, shapeCheckCommand2, fullContextCommand, taskFootprintCommand, brainAnchorsCommand, whyCommand, impactFullCommand2, conduitScanCommand, taskSymbolsCommand, searchCodeCommand2, contractsSyncCommand, contractsShowCommand, contractsLinkTasksCommand, contractsCommand, groupCommand, wikiCommand2, hotPathsCommand2, hotNodesCommand2, coldSymbolsCommand2, sigilSyncCommand, sigilListCommand, sigilCommand, topEntriesCommand, nexusCommand;
+var initCommand3, registerCommand2, unregisterCommand, listCommand12, statusCommand8, showCommand8, resolveCommand2, discoverCommand2, augmentCommand2, setupCommand, searchCommand3, depsCommand3, criticalPathCommand2, blockingCommand, orphansCommand2, syncCommand5, reconcileCommand2, graphCommand3, shareStatusCommand, transferPreviewCommand, transferCommand, permissionSetCommand, permissionCommand, shareExportCommand, shareImportCommand, shareCommand, clustersCommand2, flowsCommand2, contextCommand4, impactCommand3, analyzeCommand3, projectsListCommand, projectsRegisterCommand, projectsRemoveCommand, projectsScanCommand, projectsCleanCommand, projectsCommand, refreshBridgeCommand, exportCommand6, diffCommand2, queryCommand2, routeMapCommand2, shapeCheckCommand2, fullContextCommand, taskFootprintCommand, brainAnchorsCommand, whyCommand, impactFullCommand2, conduitScanCommand, taskSymbolsCommand, searchCodeCommand2, contractsSyncCommand, contractsShowCommand, contractsLinkTasksCommand, contractsCommand, groupCommand, wikiCommand2, hotPathsCommand2, hotNodesCommand2, coldSymbolsCommand2, sigilSyncCommand, sigilListCommand, sigilCommand, topEntriesCommand, nexusCommand;
 var init_nexus4 = __esm({
   "packages/cleo/src/cli/commands/nexus.ts"() {
     "use strict";
@@ -46556,7 +47173,7 @@ var init_nexus4 = __esm({
         );
       }
     });
-    listCommand11 = defineCommand({
+    listCommand12 = defineCommand({
       meta: { name: "list", description: "List all registered projects" },
       async run() {
         await dispatchFromCli("query", "nexus", "list", {}, { command: "nexus" });
@@ -48951,7 +49568,7 @@ var init_nexus4 = __esm({
         init: initCommand3,
         register: registerCommand2,
         unregister: unregisterCommand,
-        list: listCommand11,
+        list: listCommand12,
         status: statusCommand8,
         show: showCommand8,
         resolve: resolveCommand2,
@@ -50099,7 +50716,7 @@ var phase_exports = {};
 __export(phase_exports, {
   phaseCommand: () => phaseCommand
 });
-var showCommand9, listCommand12, setCommand2, startCommand6, completeCommand3, advanceCommand2, renameCommand, deleteCommand2, phaseCommand;
+var showCommand9, listCommand13, setCommand2, startCommand6, completeCommand3, advanceCommand2, renameCommand, deleteCommand2, phaseCommand;
 var init_phase = __esm({
   "packages/cleo/src/cli/commands/phase.ts"() {
     "use strict";
@@ -50119,7 +50736,7 @@ var init_phase = __esm({
         await dispatchFromCli("query", "pipeline", "phase.show", params, { command: "phase" });
       }
     });
-    listCommand12 = defineCommand({
+    listCommand13 = defineCommand({
       meta: { name: "list", description: "List all phases with status" },
       async run() {
         await dispatchFromCli("query", "pipeline", "phase.list", {}, { command: "phase" });
@@ -50277,7 +50894,7 @@ var init_phase = __esm({
       meta: { name: "phase", description: "Project-level phase lifecycle management" },
       subCommands: {
         show: showCommand9,
-        list: listCommand12,
+        list: listCommand13,
         set: setCommand2,
         start: startCommand6,
         complete: completeCommand3,
@@ -50383,7 +51000,7 @@ var playbook_exports = {};
 __export(playbook_exports, {
   playbookCommand: () => playbookCommand
 });
-var runCommand3, statusCommand11, resumeCommand, createCommand2, listCommand13, validateCommand7, playbookCommand;
+var runCommand3, statusCommand11, resumeCommand, createCommand2, listCommand14, validateCommand7, playbookCommand;
 var init_playbook3 = __esm({
   "packages/cleo/src/cli/commands/playbook.ts"() {
     "use strict";
@@ -50504,7 +51121,7 @@ var init_playbook3 = __esm({
         );
       }
     });
-    listCommand13 = defineCommand({
+    listCommand14 = defineCommand({
       meta: {
         name: "list",
         description: "List playbook runs (optionally filter by status: active|completed|pending|failed|cancelled)"
@@ -50574,7 +51191,7 @@ var init_playbook3 = __esm({
         run: runCommand3,
         status: statusCommand11,
         resume: resumeCommand,
-        list: listCommand13,
+        list: listCommand14,
         create: createCommand2,
         validate: validateCommand7
       },
@@ -50625,14 +51242,14 @@ var provider_exports = {};
 __export(provider_exports, {
   providerCommand: () => providerCommand
 });
-var listCommand14, detectCommand3, injectStatusCommand, supportsCommand, hooksCommand, injectCommand2, providerCommand;
+var listCommand15, detectCommand3, injectStatusCommand, supportsCommand, hooksCommand, injectCommand2, providerCommand;
 var init_provider = __esm({
   "packages/cleo/src/cli/commands/provider.ts"() {
     "use strict";
     init_dist();
     init_cli();
     init_subcommand_guard();
-    listCommand14 = defineCommand({
+    listCommand15 = defineCommand({
       meta: { name: "list", description: "List all registered CAAMP providers" },
       args: {
         limit: {
@@ -50790,7 +51407,7 @@ var init_provider = __esm({
         description: "CAAMP provider registry: list, detect, supports, hooks, inject"
       },
       subCommands: {
-        list: listCommand14,
+        list: listCommand15,
         detect: detectCommand3,
         "inject-status": injectStatusCommand,
         supports: supportsCommand,
@@ -51029,7 +51646,7 @@ var relates_exports = {};
 __export(relates_exports, {
   relatesCommand: () => relatesCommand
 });
-var suggestCommand2, addCommand5, discoverCommand3, removeCommand3, listCommand15, relatesCommand;
+var suggestCommand2, addCommand6, discoverCommand3, removeCommand4, listCommand16, relatesCommand;
 var init_relates = __esm({
   "packages/cleo/src/cli/commands/relates.ts"() {
     "use strict";
@@ -51060,7 +51677,7 @@ var init_relates = __esm({
         cliOutput(response.data ?? {}, { command: "relates" });
       }
     });
-    addCommand5 = defineCommand({
+    addCommand6 = defineCommand({
       meta: {
         name: "add",
         description: "Add a relates entry to a task. Valid types: blocks|related|duplicates|absorbs|fixes|extends|supersedes"
@@ -51115,7 +51732,7 @@ var init_relates = __esm({
         cliOutput(response.data ?? {}, { command: "relates" });
       }
     });
-    removeCommand3 = defineCommand({
+    removeCommand4 = defineCommand({
       meta: {
         name: "remove",
         description: "Remove a relates entry between two tasks"
@@ -51147,7 +51764,7 @@ var init_relates = __esm({
         );
       }
     });
-    listCommand15 = defineCommand({
+    listCommand16 = defineCommand({
       meta: { name: "list", description: "Show existing relates entries for a task" },
       args: {
         taskId: {
@@ -51173,10 +51790,10 @@ var init_relates = __esm({
       },
       subCommands: {
         suggest: suggestCommand2,
-        add: addCommand5,
-        remove: removeCommand3,
+        add: addCommand6,
+        remove: removeCommand4,
         discover: discoverCommand3,
-        list: listCommand15
+        list: listCommand16
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -51193,7 +51810,7 @@ __export(release_exports, {
   releaseCommand: () => releaseCommand
 });
 import { release as release2 } from "@cleocode/core";
-var shipCommand, listCommand16, showCommand10, cancelCommand2, changelogCommand, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, startCommand7, verifyCommand2, publishCommand3, reconcileCommand4, releaseCommand;
+var shipCommand, listCommand17, showCommand10, cancelCommand2, changelogCommand, rollbackCommand, rollbackFullCommand, prStatusCommand, channelCommand, startCommand7, verifyCommand2, publishCommand3, reconcileCommand4, releaseCommand;
 var init_release3 = __esm({
   "packages/cleo/src/cli/commands/release.ts"() {
     "use strict";
@@ -51257,7 +51874,7 @@ var init_release3 = __esm({
         );
       }
     });
-    listCommand16 = defineCommand({
+    listCommand17 = defineCommand({
       meta: { name: "list", description: "List all releases" },
       async run() {
         await dispatchFromCli("query", "pipeline", "release.list", {}, { command: "release" });
@@ -51472,7 +52089,7 @@ var init_release3 = __esm({
       meta: { name: "release", description: "Release lifecycle management" },
       subCommands: {
         ship: shipCommand,
-        list: listCommand16,
+        list: listCommand17,
         show: showCommand10,
         cancel: cancelCommand2,
         changelog: changelogCommand,
@@ -51868,14 +52485,14 @@ var req_exports = {};
 __export(req_exports, {
   reqCommand: () => reqCommand
 });
-var addCommand6, listCommand17, migrateCommand, reqCommand;
+var addCommand7, listCommand18, migrateCommand, reqCommand;
 var init_req = __esm({
   "packages/cleo/src/cli/commands/req.ts"() {
     "use strict";
     init_dist();
     init_cli();
     init_renderers();
-    addCommand6 = defineCommand({
+    addCommand7 = defineCommand({
       meta: {
         name: "add",
         description: "Add a typed AcceptanceGate (with REQ-ID) to a task's acceptance array"
@@ -51910,7 +52527,7 @@ var init_req = __esm({
         await dispatchFromCli("mutate", "tasks", "req.add", { taskId, gate }, { command: "req add" });
       }
     });
-    listCommand17 = defineCommand({
+    listCommand18 = defineCommand({
       meta: { name: "list", description: "List all REQ-ID-addressed acceptance gates on a task" },
       args: {
         "task-id": {
@@ -51955,8 +52572,8 @@ var init_req = __esm({
     reqCommand = defineCommand({
       meta: { name: "req", description: "Manage REQ-ID-addressable acceptance gates on tasks" },
       subCommands: {
-        add: addCommand6,
-        list: listCommand17,
+        add: addCommand7,
+        list: listCommand18,
         migrate: migrateCommand
       },
       async run({ cmd, rawArgs }) {
@@ -51976,14 +52593,14 @@ __export(research_exports, {
 function generateResearchId() {
   return `res_${Date.now()}`;
 }
-var addCommand7, showCommand11, listCommand18, pendingCommand2, linkCommand2, updateCommand, statsCommand5, linksCommand, archiveCommand3, manifestCommand2, researchCommand;
+var addCommand8, showCommand11, listCommand19, pendingCommand2, linkCommand2, updateCommand, statsCommand5, linksCommand, archiveCommand3, manifestCommand2, researchCommand;
 var init_research2 = __esm({
   "packages/cleo/src/cli/commands/research.ts"() {
     "use strict";
     init_dist();
     init_cli();
     init_renderers();
-    addCommand7 = defineCommand({
+    addCommand8 = defineCommand({
       meta: { name: "add", description: "Add a research entry" },
       args: {
         task: {
@@ -52058,7 +52675,7 @@ var init_research2 = __esm({
         );
       }
     });
-    listCommand18 = defineCommand({
+    listCommand19 = defineCommand({
       meta: { name: "list", description: "List research entries" },
       args: {
         task: {
@@ -52292,9 +52909,9 @@ var init_research2 = __esm({
     researchCommand = defineCommand({
       meta: { name: "research", description: "Research commands and manifest operations" },
       subCommands: {
-        add: addCommand7,
+        add: addCommand8,
         show: showCommand11,
-        list: listCommand18,
+        list: listCommand19,
         pending: pendingCommand2,
         link: linkCommand2,
         update: updateCommand,
@@ -54541,7 +55158,7 @@ async function promptOwnerAuthPassword(sessionName) {
   const token = deriveOwnerAuthToken(sessionName, password);
   return token;
 }
-var startCommand8, endCommand, handoffCommand2, statusCommand12, resumeCommand2, findCommand6, listCommand19, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, sessionCommand;
+var startCommand8, endCommand, handoffCommand2, statusCommand12, resumeCommand2, findCommand6, listCommand20, gcCommand2, showCommand13, driftCommand, contextDriftCommand, suspendCommand, recordAssumptionCommand, recordDecisionCommand, decisionLogCommand, sessionCommand;
 var init_session4 = __esm({
   "packages/cleo/src/cli/commands/session.ts"() {
     "use strict";
@@ -54807,7 +55424,7 @@ var init_session4 = __esm({
         );
       }
     });
-    listCommand19 = defineCommand({
+    listCommand20 = defineCommand({
       meta: { name: "list", description: "List sessions" },
       args: {
         status: {
@@ -55072,7 +55689,7 @@ var init_session4 = __esm({
         status: statusCommand12,
         resume: resumeCommand2,
         find: findCommand6,
-        list: listCommand19,
+        list: listCommand20,
         gc: gcCommand2,
         show: showCommand13,
         "context-drift": contextDriftCommand,
@@ -55131,14 +55748,14 @@ var skills_exports = {};
 __export(skills_exports, {
   skillsCommand: () => skillsCommand2
 });
-var listCommand20, searchCommand4, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, spawnProvidersCommand, skillsCommand2;
+var listCommand21, searchCommand4, validateCommand8, infoCommand, installCommand3, uninstallCommand2, enableCommand2, disableCommand2, refreshCommand, dispatchCommand, catalogCommand, precedenceCommand, depsCommand4, spawnProvidersCommand, skillsCommand2;
 var init_skills2 = __esm({
   "packages/cleo/src/cli/commands/skills.ts"() {
     "use strict";
     init_dist();
     init_cli();
     init_subcommand_guard();
-    listCommand20 = defineCommand({
+    listCommand21 = defineCommand({
       meta: { name: "list", description: "List installed skills" },
       args: {
         global: {
@@ -55453,7 +56070,7 @@ var init_skills2 = __esm({
     skillsCommand2 = defineCommand({
       meta: { name: "skills", description: "Skill management: list, search, validate, info, install" },
       subCommands: {
-        list: listCommand20,
+        list: listCommand21,
         search: searchCommand4,
         validate: validateCommand8,
         info: infoCommand,
@@ -55697,7 +56314,7 @@ __export(sticky_exports, {
   stickyCommand: () => stickyCommand
 });
 import { CleoError as CleoError10 } from "@cleocode/core";
-var addCommand8, listCommand21, showCommand15, convertCommand, archiveCommand4, purgeCommand2, stickyCommand;
+var addCommand9, listCommand22, showCommand15, convertCommand, archiveCommand4, purgeCommand2, stickyCommand;
 var init_sticky3 = __esm({
   "packages/cleo/src/cli/commands/sticky.ts"() {
     "use strict";
@@ -55705,7 +56322,7 @@ var init_sticky3 = __esm({
     init_dist();
     init_cli();
     init_renderers();
-    addCommand8 = defineCommand({
+    addCommand9 = defineCommand({
       meta: { name: "add", description: "Create a new sticky note" },
       args: {
         content: {
@@ -55753,7 +56370,7 @@ var init_sticky3 = __esm({
         }
       }
     });
-    listCommand21 = defineCommand({
+    listCommand22 = defineCommand({
       meta: { name: "list", description: "List active sticky notes" },
       args: {
         tag: {
@@ -55987,10 +56604,10 @@ var init_sticky3 = __esm({
         description: "Manage sticky notes - quick project-wide ephemeral captures"
       },
       subCommands: {
-        add: addCommand8,
-        jot: addCommand8,
-        list: listCommand21,
-        ls: listCommand21,
+        add: addCommand9,
+        jot: addCommand9,
+        list: listCommand22,
+        ls: listCommand22,
         show: showCommand15,
         convert: convertCommand,
         archive: archiveCommand4,
@@ -56411,7 +57028,7 @@ function readPayload(args, textKey, fileKey) {
   if (file) return readFileSync15(file, "utf-8");
   return text;
 }
-var filterArgs, summaryCommand3, listCommand22, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
+var filterArgs, summaryCommand3, listCommand23, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
 var init_token = __esm({
   "packages/cleo/src/cli/commands/token.ts"() {
     "use strict";
@@ -56447,7 +57064,7 @@ var init_token = __esm({
         );
       }
     });
-    listCommand22 = defineCommand({
+    listCommand23 = defineCommand({
       meta: { name: "list", description: "List recorded token telemetry" },
       args: {
         ...filterArgs,
@@ -56582,7 +57199,7 @@ var init_token = __esm({
       },
       subCommands: {
         summary: summaryCommand3,
-        list: listCommand22,
+        list: listCommand23,
         show: showCommand16,
         delete: deleteCommand3,
         clear: clearCommand2,
@@ -58447,6 +59064,12 @@ var COMMAND_MANIFEST = [
     description: "List tasks with optional filters",
     load: async () => (await Promise.resolve().then(() => (init_list(), list_exports))).listCommand
   },
+  {
+    exportName: "llmCommand",
+    name: "llm",
+    description: "Manage LLM credentials, role profiles, and resolver diagnostics",
+    load: async () => (await Promise.resolve().then(() => (init_llm3(), llm_exports))).llmCommand
+  },
   {
     exportName: "logCommand",
     name: "log",