@cleocode/cleo 2026.5.65 → 2026.5.67

package/dist/cli/index.js

@@ -24279,8 +24279,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot34();
+    const { getProjectRoot: getProjectRoot35 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot35();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -24324,8 +24324,8 @@ async function acquireDb() {
 async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
-  const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot34();
+  const { getProjectRoot: getProjectRoot35 } = await import("@cleocode/core/internal");
+  const projectRoot = getProjectRoot35();
   return {
     async dispatch(input) {
       try {
@@ -24515,8 +24515,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot34();
+              const { getProjectRoot: getProjectRoot35 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot35();
             } catch {
               projectRoot = void 0;
             }
@@ -24580,14 +24580,14 @@ var init_playbook2 = __esm({
         const dispatcher = await buildDefaultDispatcher();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot35 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot34()
+            projectRoot: getProjectRoot35()
           };
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
             opts.approvalSecret = __playbookRuntimeOverrides.approvalSecret;
@@ -29496,11 +29496,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot34) {
+function createSanitizer(getProjectRoot35) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot34 ? getProjectRoot34() : void 0;
+        const root = getProjectRoot35 ? getProjectRoot35() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -34722,9 +34722,9 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const scope = args.scope;
-        const { packBundle, getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
+        const { packBundle, getProjectRoot: getProjectRoot35 } = await import("@cleocode/core/internal");
         const includesProject = scope === "project" || scope === "all";
-        const projectRoot = includesProject ? getProjectRoot34() : void 0;
+        const projectRoot = includesProject ? getProjectRoot35() : void 0;
         let passphrase;
         if (args.encrypt === true) {
           passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
@@ -44054,11 +44054,262 @@ var init_list = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/llm-cost.ts
+var llm_cost_exports = {};
+__export(llm_cost_exports, {
+  costCommand: () => costCommand
+});
+import { getProjectRoot as getProjectRoot26 } from "@cleocode/core/internal";
+import { computeCost } from "@cleocode/core/llm/usage-pricing";
+function resolveSessionId(raw) {
+  if (raw === "current") {
+    const envId = process.env["CLEO_SESSION_ID"];
+    if (envId) return envId;
+    return "current";
+  }
+  return raw;
+}
+async function loadSessionCostBreakdown(projectRoot, sessionId) {
+  const { listTokenUsage: listTokenUsage2 } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/internal"
+  );
+  const result = await listTokenUsage2(projectRoot, {
+    sessionId,
+    limit: 1e3
+    // Practical upper bound for a single session.
+  });
+  const entries = result.records.map(
+    (row) => {
+      const usage = {
+        inputTokens: row.inputTokens,
+        outputTokens: row.outputTokens
+      };
+      const model = row.model ?? "unknown";
+      return {
+        id: row.id,
+        provider: row.provider,
+        model: row.model,
+        usage,
+        costUsd: computeCost(usage, model),
+        createdAt: row.createdAt
+      };
+    }
+  );
+  entries.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  return entries;
+}
+var costCommand;
+var init_llm_cost = __esm({
+  "packages/cleo/src/cli/commands/llm-cost.ts"() {
+    "use strict";
+    init_dist();
+    init_renderers();
+    costCommand = defineCommand({
+      meta: {
+        name: "cost",
+        description: 'Compute cumulative USD cost for an LLM session from recorded token_usage entries. Use "current" to resolve the active session from CLEO_SESSION_ID. Returns totalUsd=0 when no usage records exist yet (ADR-072 Wave 4b pending).'
+      },
+      args: {
+        sessionId: {
+          type: "positional",
+          description: 'Session id to query, or "current" for the active session',
+          required: true
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const rawSessionId = String(a["sessionId"] ?? "");
+        if (!rawSessionId) {
+          cliError("session-id is required", 6, {
+            name: "E_VALIDATION",
+            fix: 'Provide a session id or "current": cleo llm cost <session-id>'
+          });
+          process.exit(6);
+        }
+        const sessionId = resolveSessionId(rawSessionId);
+        const projectRoot = getProjectRoot26(process.cwd());
+        let breakdown;
+        try {
+          breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(`Failed to query token_usage: ${message}`, 1, {
+            name: "E_QUERY_FAILED",
+            fix: "Ensure tasks.db is initialized: cleo session start"
+          });
+          process.exit(1);
+        }
+        const totalUsd = breakdown.reduce((sum, entry) => sum + entry.costUsd, 0);
+        const result = {
+          sessionId,
+          totalUsd,
+          recordCount: breakdown.length,
+          breakdown
+        };
+        if (breakdown.length === 0) {
+          result.note = "No token_usage records found for this session. Live usage wiring is pending ADR-072 Wave 4b (LlmExecutor done event). Records will appear automatically once that wave ships.";
+        }
+        cliOutput(result, {
+          command: "llm-cost",
+          operation: "llm.cost"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/llm-login.ts
+import { addCredential } from "@cleocode/core/llm/credentials-store.js";
+import {
+  DeviceCodeAuthError,
+  DeviceCodeTimeoutError,
+  getAnthropicDeviceCodeConfig,
+  pollForToken,
+  startDeviceCodeFlow
+} from "@cleocode/core/llm/oauth/device-code.js";
+async function runLlmLogin(provider, opts) {
+  const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+  if (provider !== "anthropic") {
+    return {
+      success: false,
+      error: {
+        code: "E_NOT_IMPLEMENTED",
+        codeName: "E_NOT_IMPLEMENTED",
+        message: `OAuth device-code login for '${provider}' is not yet wired. 'anthropic' is the only supported provider in the current MVP. To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+      },
+      meta
+    };
+  }
+  const cfg = getAnthropicDeviceCodeConfig();
+  let startResp;
+  try {
+    startResp = await startDeviceCodeFlow(cfg);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_DEVICE_CODE_START_FAILED",
+        codeName: "E_DEVICE_CODE_START_FAILED",
+        message: `Failed to initiate device-code OAuth flow: ${msg}`
+      },
+      meta
+    };
+  }
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Visit:      ${startResp.verificationUriComplete ?? startResp.verificationUri}
+`
+  );
+  process.stderr.write(`  Enter code: ${startResp.userCode}
+`);
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Waiting for authorization (up to ${Math.round(startResp.expiresIn / 60)} min)...
+`
+  );
+  let tokenResp;
+  try {
+    tokenResp = await pollForToken(cfg, startResp, {
+      onPending: (elapsed) => {
+        process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
+      }
+    });
+  } catch (err) {
+    process.stderr.write("\n");
+    if (err instanceof DeviceCodeTimeoutError) {
+      return {
+        success: false,
+        error: {
+          code: "E_DEVICE_CODE_TIMEOUT",
+          codeName: "E_DEVICE_CODE_TIMEOUT",
+          message: err.message
+        },
+        meta
+      };
+    }
+    if (err instanceof DeviceCodeAuthError) {
+      return {
+        success: false,
+        error: {
+          code: "E_DEVICE_CODE_AUTH_FAILED",
+          codeName: "E_DEVICE_CODE_AUTH_FAILED",
+          message: err.message
+        },
+        meta
+      };
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_DEVICE_CODE_POLL_FAILED",
+        codeName: "E_DEVICE_CODE_POLL_FAILED",
+        message: `Polling for device code token failed: ${msg}`
+      },
+      meta
+    };
+  }
+  process.stderr.write("\r  Authorization approved.              \n\n");
+  const label = opts.label ?? "oauth-login";
+  const expiresAt = typeof tokenResp.expiresIn === "number" ? Date.now() + tokenResp.expiresIn * 1e3 : void 0;
+  try {
+    await addCredential({
+      provider: "anthropic",
+      label,
+      authType: "oauth",
+      accessToken: tokenResp.accessToken,
+      refreshToken: tokenResp.refreshToken,
+      expiresAt,
+      priority: 10,
+      source: "oauth-device-code",
+      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_CREDENTIAL_STORE_FAILED",
+        codeName: "E_CREDENTIAL_STORE_FAILED",
+        message: `Failed to store credential in pool: ${msg}`
+      },
+      meta
+    };
+  }
+  return {
+    success: true,
+    data: {
+      provider: "anthropic",
+      label,
+      expiresIn: tokenResp.expiresIn
+    },
+    meta
+  };
+}
+var init_llm_login = __esm({
+  "packages/cleo/src/cli/commands/llm-login.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cleo/src/cli/commands/llm.ts
 var llm_exports = {};
 __export(llm_exports, {
   llmCommand: () => llmCommand
 });
+async function getListProviders() {
+  const { listProviders } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/provider-registry"
+  );
+  return listProviders;
+}
 async function readApiKeyFromStdin() {
   if (process.stdin.isTTY) return "";
   process.stdin.setEncoding("utf-8");
@@ -44085,12 +44336,15 @@ function makeLlmSubcommand(opts) {
     }
   });
 }
-var API_KEY_FLAG_DEPRECATION, addCommand5, listCommand10, removeCommand3, useCommand, profileCommand, testCommand, whoamiCommand, llmCommand;
+var API_KEY_FLAG_DEPRECATION, addCommand5, listCommand10, removeCommand3, useCommand, profileCommand, testCommand, whoamiCommand, listProvidersCommand, loginCommand, llmCommand;
 var init_llm3 = __esm({
   "packages/cleo/src/cli/commands/llm.ts"() {
     "use strict";
     init_dist();
     init_cli();
+    init_renderers();
+    init_llm_cost();
+    init_llm_login();
     API_KEY_FLAG_DEPRECATION = "[warning] --api-key exposes the secret to 'ps' listings and shell history. Prefer --api-key-stdin or --api-key-env=NAME for production use.";
     addCommand5 = defineCommand({
       meta: {
@@ -44331,6 +44585,76 @@ var init_llm3 = __esm({
         ...args["role"] !== void 0 && args["role"] !== "" ? { role: args["role"] } : {}
       })
     });
+    listProvidersCommand = defineCommand({
+      meta: {
+        name: "list-providers",
+        description: "List all registered LLM provider profiles (builtins + user plugins from $CLEO_HOME/plugins/model-providers/)."
+      },
+      args: {
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run() {
+        const listProviders = await getListProviders();
+        const profiles = await listProviders();
+        const providers = profiles.map((p) => ({
+          name: p.name,
+          displayName: p.displayName,
+          authTypes: p.authTypes,
+          defaultModel: p.defaultModel,
+          baseUrl: p.baseUrl
+        }));
+        cliOutput(
+          { providers },
+          {
+            command: "llm-list-providers",
+            operation: "llm.listProviders"
+          }
+        );
+      }
+    });
+    loginCommand = defineCommand({
+      meta: {
+        name: "login",
+        description: "Authenticate with a provider via OAuth device-code flow. Supported providers: anthropic (MVP). Prints the verification URL and user code, then polls until the user approves."
+      },
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider to authenticate with (e.g. anthropic)",
+          required: true
+        },
+        label: {
+          type: "string",
+          description: "Human-readable label for the stored credential (default: 'oauth-login'). Must be unique within the provider. Use distinct labels when storing multiple OAuth sessions."
+        },
+        json: {
+          type: "boolean",
+          description: "Output result as JSON"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const provider = String(a["provider"] ?? "");
+        const label = typeof a["label"] === "string" && a["label"] ? a["label"] : void 0;
+        const jsonOutput = a["json"] === true;
+        const result = await runLlmLogin(provider, { label });
+        if (jsonOutput) {
+          process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        } else if (result.success && result.data) {
+          process.stdout.write(
+            `Logged in to ${result.data.provider} as '${result.data.label}'` + (result.data.expiresIn != null ? ` (expires in ${Math.round(result.data.expiresIn / 60)} min)` : "") + "\n"
+          );
+        } else if (result.error) {
+          process.stderr.write(`[error] ${result.error.message}
+`);
+          process.exit(1);
+        }
+      }
+    });
     llmCommand = defineCommand({
       meta: {
         name: "llm",
@@ -44338,12 +44662,15 @@ var init_llm3 = __esm({
       },
       subCommands: {
         add: addCommand5,
+        cost: costCommand,
         list: listCommand10,
+        login: loginCommand,
         remove: removeCommand3,
         use: useCommand,
         profile: profileCommand,
         test: testCommand,
-        whoami: whoamiCommand
+        whoami: whoamiCommand,
+        "list-providers": listProvidersCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
@@ -44786,7 +45113,7 @@ import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
   getDreamStatus,
-  getProjectRoot as getProjectRoot26,
+  getProjectRoot as getProjectRoot27,
   runConsolidation,
   triggerManualDream
 } from "@cleocode/core/internal";
@@ -45747,7 +46074,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -45771,7 +46098,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -45808,7 +46135,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/internal");
           const observerResult = await runObserver(root, args.session, {
@@ -45848,7 +46175,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         try {
           const { getBrainDb: getBrainDbInner, getBrainNativeDb: getBrainNativeDbInner } = await import("@cleocode/core/internal");
           await getBrainDbInner(root);
@@ -45946,7 +46273,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from ?? join19(homedir6(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot26();
+        const projectRoot = getProjectRoot27();
         const stateFile = join19(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
         if (!existsSync14(sourceDir)) {
           cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -46159,7 +46486,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         try {
           await getBrainDb2(root);
           const nativeDb = getBrainNativeDb3();
@@ -46258,7 +46585,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -46362,7 +46689,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot26();
+        const root = getProjectRoot27();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -46876,7 +47203,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot27, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot28, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -46939,7 +47266,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot27();
+        const root = getProjectRoot28();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -46988,7 +47315,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot27();
+        const projectRoot = getProjectRoot28();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -47933,7 +48260,7 @@ var init_nexus4 = __esm({
         const repoPath = args.path ? path4.resolve(args.path) : process.cwd();
         humanInfo(`[nexus] Analyzing: ${repoPath}${isIncremental ? " (incremental)" : ""}`);
         try {
-          const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot34 }, { eq: eq2 }] = await Promise.all([
+          const [{ getNexusDb, nexusSchema }, { runPipeline }, { getProjectRoot: getProjectRoot35 }, { eq: eq2 }] = await Promise.all([
             import("@cleocode/core/store/nexus-sqlite"),
             import("@cleocode/nexus/pipeline"),
             import("@cleocode/core/internal"),
@@ -48013,7 +48340,7 @@ var init_nexus4 = __esm({
               extensions: { duration_ms: durationMs }
             }
           );
-          void getProjectRoot34;
+          void getProjectRoot35;
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           cliError(
@@ -51615,7 +51942,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot28 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot29 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -51628,7 +51955,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot28();
+        const projectDir = getProjectRoot29();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -52938,7 +53265,7 @@ __export(restore_exports, {
 import fs3 from "node:fs";
 import path5 from "node:path";
 import { CleoError as CleoError8, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
-import { getProjectRoot as getProjectRoot29 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot30 } from "@cleocode/core/internal";
 function parseMarkdownValue(raw) {
   const trimmed = raw.trim();
   if (trimmed === "_(not present)_" || trimmed === "") return void 0;
@@ -53058,7 +53385,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot29();
+        const projectRoot = getProjectRoot30();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -55033,7 +55360,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot30 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot31 } from "@cleocode/core/internal";
 var showCommand12, checkCommand6, repairCommand, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -55069,7 +55396,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot30();
+        const projectRoot = getProjectRoot31();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -55512,8 +55839,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot34 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot34();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot35 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot35();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -57021,7 +57348,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync15 } from "node:fs";
-import { getProjectRoot as getProjectRoot31, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot32, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -57185,7 +57512,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot31(), input) : await measureTokenExchange(input);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot32(), input) : await measureTokenExchange(input);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -57221,7 +57548,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir8 } from "node:os";
 import { join as join23 } from "node:path";
-import { getProjectRoot as getProjectRoot32 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot33 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -57251,7 +57578,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot32();
+            const projectRoot = getProjectRoot33();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -57348,7 +57675,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot32();
+        const projectRoot = getProjectRoot33();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -57460,7 +57787,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot32();
+        const projectRoot = getProjectRoot33();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -58062,7 +58389,7 @@ import { resolve as resolve6 } from "node:path";
 import {
   backfillAllPendingVerifiers,
   backfillVerifier,
-  getProjectRoot as getProjectRoot33,
+  getProjectRoot as getProjectRoot34,
   resolveVerifierScript as resolveVerifierScript2,
   runVerifier
 } from "@cleocode/core";
@@ -58159,7 +58486,7 @@ var init_verify = __esm({
         }
       },
       async run({ args, cmd }) {
-        const projectRoot = getProjectRoot33();
+        const projectRoot = getProjectRoot34();
         const force = !!args.force;
         if (args["all-pending"]) {
           await runBackfillAll(projectRoot, force);
@@ -58229,7 +58556,7 @@ var init_verify = __esm({
           const taskIdArg = remainingArgs.find((a) => !a.startsWith("-"));
           const allPending = remainingArgs.includes("--all-pending");
           const force = remainingArgs.includes("--force");
-          const projectRoot = getProjectRoot33();
+          const projectRoot = getProjectRoot34();
           if (allPending) {
             await runBackfillAll(projectRoot, force);
           } else if (taskIdArg) {
@@ -59064,6 +59391,12 @@ var COMMAND_MANIFEST = [
     description: "List tasks with optional filters",
     load: async () => (await Promise.resolve().then(() => (init_list(), list_exports))).listCommand
   },
+  {
+    exportName: "costCommand",
+    name: "cost",
+    description: "Compute cumulative USD cost for an LLM session from recorded token_usage entries. ",
+    load: async () => (await Promise.resolve().then(() => (init_llm_cost(), llm_cost_exports))).costCommand
+  },
   {
     exportName: "llmCommand",
     name: "llm",
@@ -59837,7 +60170,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger17,
-    getProjectRoot: getProjectRoot34,
+    getProjectRoot: getProjectRoot35,
     isCleanupMarkerSet,
     migrateSignaldockToConduit,
     needsSignaldockToConduitMigration,
@@ -59846,7 +60179,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot34();
+    projectRootForCleanup = getProjectRoot35();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -59866,7 +60199,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot34();
+      const _projectRootForMigration = getProjectRoot35();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {