@cleocode/cleo 2026.5.77 → 2026.5.78

package/dist/cli/index.js

@@ -103,8 +103,8 @@ function formatLineColumns(lines, linePrefix = "") {
   for (const line of lines) for (const [i, element] of line.entries()) maxLength[i] = Math.max(maxLength[i] || 0, element.length);
   return lines.map((l) => l.map((c, i) => linePrefix + c[i === 0 ? "padStart" : "padEnd"](maxLength[i])).join("  ")).join("\n");
 }
-function resolveValue(input) {
-  return typeof input === "function" ? input() : input;
+function resolveValue(input2) {
+  return typeof input2 === "function" ? input2() : input2;
 }
 function parseRawArgs(args = [], opts = {}) {
   const booleans = new Set(opts.boolean || []);
@@ -403,12 +403,12 @@ function getFieldContext() {
   return currentContext;
 }
 function resolveFieldContext(opts) {
-  const input = {
+  const input2 = {
     fieldFlag: typeof opts["field"] === "string" ? opts["field"] : void 0,
     fieldsFlag: typeof opts["fields"] === "string" ? opts["fields"] : void 0,
     mviFlag: typeof opts["mvi"] === "string" ? opts["mvi"] : void 0
   };
-  return resolveFieldExtraction(input);
+  return resolveFieldExtraction(input2);
 }
 var currentContext;
 var init_field_context = __esm({
@@ -429,6 +429,9 @@ function setFormatContext(resolution) {
 function getFormatContext() {
   return currentResolution;
 }
+function isJsonFormat() {
+  return currentResolution.format === "json";
+}
 var currentResolution;
 var init_format_context = __esm({
   "packages/cleo/src/cli/format-context.ts"() {
@@ -442,11 +445,11 @@ var init_format_context = __esm({
 });
 
 // packages/animations/src/animate-context.ts
-function createAnimateContext(input) {
-  const format = input.flagResolution.format;
-  const quiet = input.flagResolution.quiet;
-  const isTTY = input.isTTY ?? Boolean(process.stdout.isTTY);
-  const noColor3 = input.noColor ?? process.env.NO_COLOR != null;
+function createAnimateContext(input2) {
+  const format = input2.flagResolution.format;
+  const quiet = input2.flagResolution.quiet;
+  const isTTY = input2.isTTY ?? Boolean(process.stdout.isTTY);
+  const noColor3 = input2.noColor ?? process.env.NO_COLOR != null;
   const inputs = { format, quiet, isTTY, noColor: noColor3 };
   if (format !== "human") {
     return { enabled: false, reason: "format-json", inputs };
@@ -2896,10 +2899,10 @@ var init_colors = __esm({
 });
 
 // packages/cleo/src/cli/renderers/format-helpers.ts
-function pagerFooter(input) {
-  const { shown, page } = input;
-  const total = page?.total ?? input.total ?? shown;
-  const filtered = input.filtered;
+function pagerFooter(input2) {
+  const { shown, page } = input2;
+  const total = page?.total ?? input2.total ?? shown;
+  const filtered = input2.filtered;
   const hasMore = page?.hasMore === true || shown < total;
   const filterActive = typeof filtered === "number" && filtered !== total;
   if (!hasMore && !filterActive) return "";
@@ -20296,10 +20299,10 @@ function rowToApproval(row) {
   if (reason !== void 0) approval.reason = reason;
   return approval;
 }
-function createApprovalGate(db, input) {
-  const token = generateResumeToken(input.runId, input.nodeId, input.bindings, input.secret);
+function createApprovalGate(db, input2) {
+  const token = generateResumeToken(input2.runId, input2.nodeId, input2.bindings, input2.secret);
   const approvalId = randomUUID3();
-  const autoPassed = input.autoPassed ?? false;
+  const autoPassed = input2.autoPassed ?? false;
   const status = autoPassed ? "approved" : "pending";
   const stmt = db.prepare(`
     INSERT INTO playbook_approvals
@@ -20308,13 +20311,13 @@ function createApprovalGate(db, input) {
   `);
   stmt.run(
     approvalId,
-    input.runId,
-    input.nodeId,
+    input2.runId,
+    input2.nodeId,
     token,
     status,
     autoPassed ? 1 : 0,
-    input.approver ?? null,
-    input.reason ?? null
+    input2.approver ?? null,
+    input2.reason ?? null
   );
   const row = db.prepare("SELECT * FROM playbook_approvals WHERE approval_id = ?").get(approvalId);
   if (row === void 0) {
@@ -20803,14 +20806,14 @@ function resolveYamlBinary(data) {
   return bitlen % 8 === 0;
 }
 function constructYamlBinary(data) {
-  var idx, tailbits, input = data.replace(/[\r\n=]/g, ""), max = input.length, map2 = BASE64_MAP, bits = 0, result = [];
+  var idx, tailbits, input2 = data.replace(/[\r\n=]/g, ""), max = input2.length, map2 = BASE64_MAP, bits = 0, result = [];
   for (idx = 0; idx < max; idx++) {
     if (idx % 4 === 0 && idx) {
       result.push(bits >> 16 & 255);
       result.push(bits >> 8 & 255);
       result.push(bits & 255);
     }
-    bits = bits << 6 | map2.indexOf(input.charAt(idx));
+    bits = bits << 6 | map2.indexOf(input2.charAt(idx));
   }
   tailbits = max % 4 * 6;
   if (tailbits === 0) {
@@ -20985,8 +20988,8 @@ function setProperty(object, key, value) {
     object[key] = value;
   }
 }
-function State$1(input, options) {
-  this.input = input;
+function State$1(input2, options) {
+  this.input = input2;
   this.filename = options["filename"] || null;
   this.schema = options["schema"] || _default;
   this.onWarning = options["onWarning"] || null;
@@ -20995,7 +20998,7 @@ function State$1(input, options) {
   this.listener = options["listener"] || null;
   this.implicitTypes = this.schema.compiledImplicit;
   this.typeMap = this.schema.compiledTypeMap;
-  this.length = input.length;
+  this.length = input2.length;
   this.position = 0;
   this.line = 0;
   this.lineStart = 0;
@@ -21951,19 +21954,19 @@ function readDocument(state) {
     return;
   }
 }
-function loadDocuments(input, options) {
-  input = String(input);
+function loadDocuments(input2, options) {
+  input2 = String(input2);
   options = options || {};
-  if (input.length !== 0) {
-    if (input.charCodeAt(input.length - 1) !== 10 && input.charCodeAt(input.length - 1) !== 13) {
-      input += "\n";
+  if (input2.length !== 0) {
+    if (input2.charCodeAt(input2.length - 1) !== 10 && input2.charCodeAt(input2.length - 1) !== 13) {
+      input2 += "\n";
     }
-    if (input.charCodeAt(0) === 65279) {
-      input = input.slice(1);
+    if (input2.charCodeAt(0) === 65279) {
+      input2 = input2.slice(1);
     }
   }
-  var state = new State$1(input, options);
-  var nullpos = input.indexOf("\0");
+  var state = new State$1(input2, options);
+  var nullpos = input2.indexOf("\0");
   if (nullpos !== -1) {
     state.position = nullpos;
     throwError(state, "null byte is not allowed in input");
@@ -21978,12 +21981,12 @@ function loadDocuments(input, options) {
   }
   return state.documents;
 }
-function loadAll$1(input, iterator, options) {
+function loadAll$1(input2, iterator, options) {
   if (iterator !== null && typeof iterator === "object" && typeof options === "undefined") {
     options = iterator;
     iterator = null;
   }
-  var documents = loadDocuments(input, options);
+  var documents = loadDocuments(input2, options);
   if (typeof iterator !== "function") {
     return documents;
   }
@@ -21991,8 +21994,8 @@ function loadAll$1(input, iterator, options) {
     iterator(documents[index]);
   }
 }
-function load$1(input, options) {
-  var documents = loadDocuments(input, options);
+function load$1(input2, options) {
+  var documents = loadDocuments(input2, options);
   if (documents.length === 0) {
     return void 0;
   } else if (documents.length === 1) {
@@ -22538,11 +22541,11 @@ function inspectNode(object, objects, duplicatesIndexes) {
     }
   }
 }
-function dump$1(input, options) {
+function dump$1(input2, options) {
   options = options || {};
   var state = new State(options);
-  if (!state.noRefs) getDuplicateReferences(input, state);
-  var value = input;
+  if (!state.noRefs) getDuplicateReferences(input2, state);
+  var value = input2;
   if (state.replacer) {
     value = state.replacer.call({ "": value }, "", value);
   }
@@ -23298,11 +23301,11 @@ function parseInputs(raw) {
       required = r.required;
     }
     const description = typeof r.description === "string" ? r.description : void 0;
-    const input = { name: r.name };
-    if (required !== void 0) input.required = required;
-    if (Object.hasOwn(r, "default")) input.default = r.default;
-    if (description !== void 0) input.description = description;
-    return input;
+    const input2 = { name: r.name };
+    if (required !== void 0) input2.required = required;
+    if (Object.hasOwn(r, "default")) input2.default = r.default;
+    if (description !== void 0) input2.description = description;
+    return input2;
   });
 }
 function parseErrorHandlers(raw) {
@@ -23705,9 +23708,9 @@ function rowToPlaybookApproval(row) {
     autoPassed: row.auto_passed === 1
   };
 }
-function createPlaybookRun(db, input) {
+function createPlaybookRun(db, input2) {
   const runId = randomUUID4();
-  const bindingsJson = JSON.stringify(input.initialBindings ?? {});
+  const bindingsJson = JSON.stringify(input2.initialBindings ?? {});
   const insert = db.prepare(
     `INSERT INTO playbook_runs (
        run_id, playbook_name, playbook_hash, bindings, status,
@@ -23716,11 +23719,11 @@ function createPlaybookRun(db, input) {
   );
   insert.run(
     runId,
-    input.playbookName,
-    input.playbookHash,
+    input2.playbookName,
+    input2.playbookHash,
     bindingsJson,
-    input.epicId ?? null,
-    input.sessionId ?? null
+    input2.epicId ?? null,
+    input2.sessionId ?? null
   );
   const row = db.prepare("SELECT * FROM playbook_runs WHERE run_id = ?").get(runId);
   if (!row) {
@@ -23823,14 +23826,14 @@ function deletePlaybookRun(db, runId) {
   const result = db.prepare("DELETE FROM playbook_runs WHERE run_id = ?").run(runId);
   return Number(result.changes) > 0;
 }
-function createPlaybookApproval(db, input) {
+function createPlaybookApproval(db, input2) {
   const approvalId = randomUUID4();
-  const autoPassed = input.autoPassed ? 1 : 0;
+  const autoPassed = input2.autoPassed ? 1 : 0;
   db.prepare(
     `INSERT INTO playbook_approvals (
        approval_id, run_id, node_id, token, status, auto_passed
      ) VALUES (?, ?, ?, ?, 'pending', ?)`
-  ).run(approvalId, input.runId, input.nodeId, input.token, autoPassed);
+  ).run(approvalId, input2.runId, input2.nodeId, input2.token, autoPassed);
   const row = db.prepare("SELECT * FROM playbook_approvals WHERE approval_id = ?").get(approvalId);
   if (!row) {
     throw new Error(`playbook state: failed to read back approval ${approvalId} after insert`);
@@ -24007,7 +24010,7 @@ async function executeAgenticNode(node, runId, context, iteration, dispatcher) {
 async function executeDeterministicNode(node, runId, context, iteration, dispatcher, runner) {
   try {
     if (runner !== void 0) {
-      const input = {
+      const input2 = {
         runId,
         nodeId: node.id,
         command: node.command,
@@ -24015,10 +24018,10 @@ async function executeDeterministicNode(node, runId, context, iteration, dispatc
         context: { ...context },
         iteration
       };
-      if (node.cwd !== void 0) input.cwd = node.cwd;
-      if (node.env !== void 0) input.env = node.env;
-      if (node.timeout_ms !== void 0) input.timeout_ms = node.timeout_ms;
-      const result2 = await runner.run(input);
+      if (node.cwd !== void 0) input2.cwd = node.cwd;
+      if (node.env !== void 0) input2.env = node.env;
+      if (node.timeout_ms !== void 0) input2.timeout_ms = node.timeout_ms;
+      const result2 = await runner.run(input2);
       if (result2.status === "success") {
         return { kind: "success", output: result2.output };
       }
@@ -24639,10 +24642,10 @@ async function buildDefaultDispatcher() {
   const { getProjectRoot: getProjectRoot34 } = await import("@cleocode/core/internal");
   const projectRoot = getProjectRoot34();
   return {
-    async dispatch(input) {
+    async dispatch(input2) {
       try {
         const result = await orchestrateSpawnExecute2(
-          input.taskId,
+          input2.taskId,
           /* adapterId */
           void 0,
           /* protocolType */
@@ -24655,9 +24658,9 @@ async function buildDefaultDispatcher() {
           return {
             status: "success",
             output: {
-              [`${input.nodeId}_spawn`]: true,
-              nodeId: input.nodeId,
-              agentId: input.agentId,
+              [`${input2.nodeId}_spawn`]: true,
+              nodeId: input2.nodeId,
+              agentId: input2.agentId,
               dispatchData: result.data ?? null
             }
           };
@@ -24665,7 +24668,7 @@ async function buildDefaultDispatcher() {
         return {
           status: "failure",
           output: {},
-          error: result.error?.message ?? `spawn failed for ${input.agentId}`
+          error: result.error?.message ?? `spawn failed for ${input2.agentId}`
         };
       } catch (err) {
         return {
@@ -25261,16 +25264,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync17, readdirSync: readdirSync4, existsSync: existsSync14 } = await import("node:fs");
-    const { join: join26 } = await import("node:path");
+    const { readFileSync: readFileSync18, readdirSync: readdirSync4, existsSync: existsSync16 } = await import("node:fs");
+    const { join: join28 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync14(workflowsDir)) {
+    if (existsSync16(workflowsDir)) {
       const files = readdirSync4(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync17(join26(workflowsDir, file), "utf-8");
+          const src = readFileSync18(join28(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -25285,12 +25288,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join26(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync14(localCantDir)) {
+    const localCantDir = join28(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync16(localCantDir)) {
       const files = readdirSync4(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync17(join26(localCantDir, file), "utf-8");
+          const src = readFileSync18(join28(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -30672,7 +30675,7 @@ var init_add_batch = __esm({
             });
           }
         }
-        const output = {
+        const output2 = {
           total: tasks.length,
           created: tasks.length - failed,
           failed,
@@ -30680,14 +30683,14 @@ var init_add_batch = __esm({
           results
         };
         if (failed > 0) {
-          cliOutput(output, {
+          cliOutput(output2, {
             command: "add-batch",
             message: `${failed} of ${tasks.length} tasks failed`,
             operation: "tasks.add-batch"
           });
           process.exit(1);
         } else {
-          cliOutput(output, {
+          cliOutput(output2, {
             command: "add-batch",
             operation: "tasks.add-batch"
           });
@@ -31964,12 +31967,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync14, mkdirSync: mkdirSync7, writeFileSync: writeFileSync6 } = await import("node:fs");
-          const { join: join26 } = await import("node:path");
-          const cantDir = join26(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join26(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync16, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join28 } = await import("node:path");
+          const cantDir = join28(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join28(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync14(cantPath)) {
+          if (!existsSync16(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -32020,7 +32023,7 @@ agent ${agentId}:
   enforcement:
     1: TODO \u2014 what does this agent push back on?
 `;
-            writeFileSync6(cantPath, cantContent, "utf-8");
+            writeFileSync7(cantPath, cantContent, "utf-8");
             cantScaffolded = true;
           }
           cliOutput(
@@ -32029,7 +32032,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync14(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync16(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -32148,8 +32151,8 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync14, readFileSync: readFileSync17 } = await import("node:fs");
-          const { join: join26 } = await import("node:path");
+          const { existsSync: existsSync16, readFileSync: readFileSync18 } = await import("node:fs");
+          const { join: join28 } = await import("node:path");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -32169,9 +32172,9 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join26(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync14(cantPath)) {
-            profile = readFileSync17(cantPath, "utf-8");
+          const cantPath = args.cant ?? join28(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync16(cantPath)) {
+            profile = readFileSync18(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
@@ -32694,8 +32697,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync14 } = await import("node:fs");
-          const { join: join26 } = await import("node:path");
+          const { existsSync: existsSync16 } = await import("node:fs");
+          const { join: join28 } = await import("node:path");
           const { execFile: execFile2 } = await import("node:child_process");
           const { promisify: promisify2 } = await import("node:util");
           const execFileAsync = promisify2(execFile2);
@@ -32715,8 +32718,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join26(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync14(cantPath);
+          const cantPath = join28(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync16(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -33564,11 +33567,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync14, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
-          const { join: join26, basename, resolve: resolve5, extname } = await import("node:path");
+          const { existsSync: existsSync16, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
+          const { join: join28, basename, resolve: resolve5, extname } = await import("node:path");
           const { tmpdir: tmpdir2 } = await import("node:os");
           const resolvedPath = resolve5(args.path);
-          if (!existsSync14(resolvedPath)) {
+          if (!existsSync16(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -33589,7 +33592,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             cantPath = resolvedPath;
           } else if (stat2.isFile() && ext === ".cantz") {
             const { execFileSync: execFileSync5 } = await import("node:child_process");
-            tempDir = join26(tmpdir2(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join28(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync7(tempDir, { recursive: true });
             try {
               execFileSync5("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
@@ -33611,7 +33614,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const topLevel = readdirSync4(tempDir).filter(
-              (entry) => statSync(join26(tempDir, entry)).isDirectory()
+              (entry) => statSync(join28(tempDir, entry)).isDirectory()
             );
             if (topLevel.length !== 1) {
               cliOutput(
@@ -33628,8 +33631,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const agentName = topLevel[0];
-            const personaPath = join26(tempDir, agentName, "persona.cant");
-            if (!existsSync14(personaPath)) {
+            const personaPath = join28(tempDir, agentName, "persona.cant");
+            if (!existsSync16(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -33643,12 +33646,12 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            cantPath = join26(tempDir, `${agentName}.cant`);
+            cantPath = join28(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else if (stat2.isDirectory()) {
             const agentName = basename(resolvedPath);
-            const personaPath = join26(resolvedPath, "persona.cant");
-            if (!existsSync14(personaPath)) {
+            const personaPath = join28(resolvedPath, "persona.cant");
+            if (!existsSync16(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -33662,9 +33665,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            tempDir = join26(tmpdir2(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join28(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync7(tempDir, { recursive: true });
-            cantPath = join26(tempDir, `${agentName}.cant`);
+            cantPath = join28(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else {
             cliOutput(
@@ -33783,11 +33786,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, statSync } = await import("node:fs");
+          const { existsSync: existsSync16, statSync } = await import("node:fs");
           const { resolve: resolve5, basename, dirname: dirname9 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
           const resolvedDir = resolve5(args.dir);
-          if (!existsSync14(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          if (!existsSync16(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -33801,9 +33804,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join26 } = await import("node:path");
-          const personaPath = join26(resolvedDir, "persona.cant");
-          if (!existsSync14(personaPath)) {
+          const { join: join28 } = await import("node:path");
+          const personaPath = join28(resolvedDir, "persona.cant");
+          if (!existsSync16(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -33850,7 +33853,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join26(dirPath, entry.name));
+                countFiles(join28(dirPath, entry.name));
               }
             }
           };
@@ -33919,8 +33922,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, mkdirSync: mkdirSync7, writeFileSync: writeFileSync6 } = await import("node:fs");
-          const { join: join26 } = await import("node:path");
+          const { existsSync: existsSync16, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join28 } = await import("node:path");
           const { homedir: homedir9 } = await import("node:os");
           const name = args.name;
           const role = args.role;
@@ -33980,13 +33983,13 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           let targetRoot;
           if (isGlobal) {
             const home = homedir9();
-            const xdgData = process.env["XDG_DATA_HOME"] ?? join26(home, ".local", "share");
-            targetRoot = join26(xdgData, "cleo", "cant", "agents");
+            const xdgData = process.env["XDG_DATA_HOME"] ?? join28(home, ".local", "share");
+            targetRoot = join28(xdgData, "cleo", "cant", "agents");
           } else {
-            targetRoot = join26(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
+            targetRoot = join28(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
           }
-          const agentDir = join26(targetRoot, name);
-          if (existsSync14(agentDir)) {
+          const agentDir = join28(targetRoot, name);
+          if (existsSync16(agentDir)) {
             cliOutput(
               {
                 success: false,
@@ -34010,29 +34013,29 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             domain,
             parent
           });
-          writeFileSync6(join26(agentDir, "persona.cant"), personaContent, "utf-8");
+          writeFileSync7(join28(agentDir, "persona.cant"), personaContent, "utf-8");
           const manifest = generateManifest({ name, role, tier, domain });
-          writeFileSync6(
-            join26(agentDir, "manifest.json"),
+          writeFileSync7(
+            join28(agentDir, "manifest.json"),
             `${JSON.stringify(manifest, null, 2)}
 `,
             "utf-8"
           );
           const createdFiles = [
-            join26(agentDir, "persona.cant"),
-            join26(agentDir, "manifest.json")
+            join28(agentDir, "persona.cant"),
+            join28(agentDir, "manifest.json")
           ];
           if (team) {
             const teamConfigContent = generateTeamConfig(name, role, team);
-            writeFileSync6(join26(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
-            createdFiles.push(join26(agentDir, "team-config.cant"));
+            writeFileSync7(join28(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
+            createdFiles.push(join28(agentDir, "team-config.cant"));
           }
           if (seedBrain) {
-            const expertiseDir = join26(agentDir, "expertise");
+            const expertiseDir = join28(agentDir, "expertise");
             mkdirSync7(expertiseDir, { recursive: true });
             const seedContent = generateMentalModelSeed(name, role, domain);
-            writeFileSync6(join26(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
-            createdFiles.push(join26(expertiseDir, "mental-model-seed.md"));
+            writeFileSync7(join28(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
+            createdFiles.push(join28(expertiseDir, "mental-model-seed.md"));
             try {
               const { execFile: execFile2 } = await import("node:child_process");
               const { promisify: promisify2 } = await import("node:util");
@@ -34130,17 +34133,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync14, readFileSync: readFileSync17, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve5, join: join26 } = await import("node:path");
+          const { existsSync: existsSync16, readFileSync: readFileSync18, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve5, join: join28 } = await import("node:path");
           const specPath = resolve5(args.spec);
-          if (!existsSync14(specPath)) {
+          if (!existsSync16(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
-          const specContent = readFileSync17(specPath, "utf-8");
+          const specContent = readFileSync18(specPath, "utf-8");
           const projectRoot = process.cwd();
-          const outputDir = args["output-dir"] ? resolve5(args["output-dir"]) : join26(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve5(args["output-dir"]) : join28(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -34610,6 +34613,441 @@ var init_audit2 = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/auth/list.ts
+function formatExpiry(expiresAt) {
+  if (expiresAt == null) return "never";
+  const remaining = expiresAt - Date.now();
+  if (remaining <= 0) return "expired";
+  const minutes = Math.floor(remaining / 6e4);
+  if (minutes <= 90) return `expires in ${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours <= 36) return `expires in ${hours}h`;
+  const days = Math.floor(hours / 24);
+  return `expires in ${days}d`;
+}
+var authListCommand;
+var init_list = __esm({
+  "packages/cleo/src/cli/commands/auth/list.ts"() {
+    "use strict";
+    init_dist();
+    init_renderers();
+    authListCommand = defineCommand({
+      meta: {
+        name: "list",
+        description: "List ALL pool entries from ALL sources (env, claude-code, cleo-pkce, codex-cli, gemini-cli, gh-cli, manual). Tokens are never surfaced \u2014 use `cleo llm list` for the LLM-scoped view that mirrors the manual store only."
+      },
+      args: {
+        provider: {
+          type: "string",
+          description: "Filter to a single provider id (e.g. anthropic)"
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON envelope"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const providerFilter = typeof a["provider"] === "string" && a["provider"] !== "" ? a["provider"] : null;
+        const { getCredentialPool } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credential-pool.js"
+        );
+        const pool = getCredentialPool();
+        await pool.seed();
+        const stored = await pool.list();
+        const entries = stored.filter((c) => providerFilter ? c.provider === providerFilter : true).map((c) => ({
+          provider: c.provider,
+          label: c.label,
+          source: c.source ?? "manual",
+          authType: c.authType,
+          expiryStatus: formatExpiry(c.expiresAt),
+          // `current` is "is this entry not in active cooldown AND not disabled"
+          // — i.e. could it be served right now. A richer notion of "default
+          // credential per provider" would require resolver introspection,
+          // which lands in a follow-up task.
+          current: !c.disabled && (c.lastErrorResetAt == null || c.lastErrorResetAt <= Date.now())
+        })).sort((a2, b) => {
+          const p = a2.provider.localeCompare(b.provider);
+          return p !== 0 ? p : a2.label.localeCompare(b.label);
+        });
+        cliOutput(
+          { entries },
+          {
+            command: "auth-list",
+            operation: "auth.list"
+          }
+        );
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { createInterface } from "node:readline";
+function resolveProjectRootArg(arg) {
+  if (typeof arg === "string" && arg.length > 0) return arg;
+  return process.cwd();
+}
+function projectConfigPath(projectRoot) {
+  const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
+  return join7(projectRoot, cleoDir, "config.json");
+}
+function extractApiKeyEntries(config) {
+  if (!config || typeof config !== "object") return [];
+  const llm = config["llm"];
+  if (!llm || typeof llm !== "object") return [];
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return [];
+  const out = [];
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") continue;
+    const apiKey = raw["apiKey"];
+    if (typeof apiKey === "string" && apiKey.trim().length > 0) {
+      out.push({ provider, apiKey: apiKey.trim() });
+    }
+  }
+  return out;
+}
+function stripApiKeysFromConfig(config) {
+  const clone = structuredClone(config);
+  const llm = clone["llm"];
+  if (!llm || typeof llm !== "object") return clone;
+  const providers = llm["providers"];
+  if (!providers || typeof providers !== "object") return clone;
+  const cleanedProviders = {};
+  for (const [provider, raw] of Object.entries(providers)) {
+    if (!raw || typeof raw !== "object") {
+      cleanedProviders[provider] = raw;
+      continue;
+    }
+    const entry = { ...raw };
+    delete entry["apiKey"];
+    if (Object.keys(entry).length > 0) {
+      cleanedProviders[provider] = entry;
+    }
+  }
+  llm["providers"] = cleanedProviders;
+  return clone;
+}
+function detectAuthType(provider, token) {
+  if (provider !== "anthropic") return "api_key";
+  if (token.startsWith("sk-ant-oat-") || token.startsWith("sk-ant-ort-")) return "oauth";
+  return "api_key";
+}
+async function promptYesNo(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((resolve5) => {
+      rl.question(question, (a) => resolve5(a));
+    });
+    const clean = answer.trim().toLowerCase();
+    return clean === "y" || clean === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runMigrateProjectSecrets(opts) {
+  const configPath = projectConfigPath(opts.projectRoot);
+  if (!existsSync6(configPath)) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  const raw = readFileSync7(configPath, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${configPath}: ${err instanceof Error ? err.message : String(err)}. Fix the JSON syntax error before running migrate-project-secrets.`
+    );
+  }
+  const entries = extractApiKeyEntries(parsed);
+  if (entries.length === 0) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: [],
+      cancelled: false,
+      dryRun: opts.dryRun
+    };
+  }
+  if (!opts.yes) {
+    process.stderr.write(
+      `Found ${entries.length} project-config secret(s) to migrate:
+` + entries.map((e) => `  - ${e.provider}
+`).join("") + `
+This will:
+  1. Back up ${configPath} -> ${configPath}.pre-migration-bak
+  2. Move each apiKey into the unified credential pool with label 'migrated-from-project-config'
+  3. Remove the apiKey fields from the project config
+
+`
+    );
+    const confirmed = await promptYesNo("Proceed? [y/N] ");
+    if (!confirmed) {
+      return {
+        configPath,
+        backupPath: null,
+        migrated: [],
+        cancelled: true,
+        dryRun: opts.dryRun
+      };
+    }
+  }
+  if (opts.dryRun) {
+    return {
+      configPath,
+      backupPath: null,
+      migrated: entries.map((e) => ({
+        provider: e.provider,
+        label: "migrated-from-project-config",
+        moved: false
+      })),
+      cancelled: false,
+      dryRun: true
+    };
+  }
+  const backupPath = `${configPath}.pre-migration-bak`;
+  writeFileSync2(backupPath, raw, { mode: 384 });
+  const { addCredential: addCredential2 } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/credentials-store.js"
+  );
+  const migrated = [];
+  for (const { provider, apiKey } of entries) {
+    await addCredential2({
+      provider,
+      label: "migrated-from-project-config",
+      authType: detectAuthType(provider, apiKey),
+      accessToken: apiKey,
+      source: "manual"
+    });
+    migrated.push({ provider, label: "migrated-from-project-config", moved: true });
+  }
+  const stripped = stripApiKeysFromConfig(parsed);
+  writeFileSync2(configPath, `${JSON.stringify(stripped, null, 2)}
+`, "utf-8");
+  return {
+    configPath,
+    backupPath,
+    migrated,
+    cancelled: false,
+    dryRun: false
+  };
+}
+var authMigrateProjectSecretsCommand;
+var init_migrate_project_secrets = __esm({
+  "packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts"() {
+    "use strict";
+    init_dist();
+    init_renderers();
+    authMigrateProjectSecretsCommand = defineCommand({
+      meta: {
+        name: "migrate-project-secrets",
+        description: "Move every llm.providers.*.apiKey out of .cleo/config.json (project-scoped, often committed to git) and into the unified credential pool. Atomic: backs up the original config to .cleo/config.json.pre-migration-bak first."
+      },
+      args: {
+        "project-root": {
+          type: "string",
+          description: "Override the project root (default: cwd)"
+        },
+        yes: {
+          type: "boolean",
+          description: "Skip the interactive confirmation prompt",
+          default: false
+        },
+        "dry-run": {
+          type: "boolean",
+          description: "Show what would be migrated without writing anything",
+          default: false
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON envelope"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const projectRoot = resolveProjectRootArg(a["project-root"]);
+        const yes = Boolean(a["yes"]);
+        const dryRun = Boolean(a["dry-run"]);
+        let result;
+        try {
+          result = await runMigrateProjectSecrets({ projectRoot, yes, dryRun });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          cliError(message, 6, { name: "E_VALIDATION" });
+          process.exit(6);
+        }
+        cliOutput(result, {
+          command: "auth-migrate-project-secrets",
+          operation: "auth.migrate-project-secrets"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/remove.ts
+var authRemoveCommand;
+var init_remove = __esm({
+  "packages/cleo/src/cli/commands/auth/remove.ts"() {
+    "use strict";
+    init_dist();
+    init_renderers();
+    authRemoveCommand = defineCommand({
+      meta: {
+        name: "remove",
+        description: "Remove a credential by (provider, label) and suppress its source from future re-seeding. Dispatches to the per-source RemovalStep so claude-code (et al.) entries are handled correctly without deleting external files."
+      },
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider id (e.g. anthropic, openai, gemini)",
+          required: true
+        },
+        label: {
+          type: "positional",
+          description: "Label of the credential to remove (unique within provider)",
+          required: true
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON envelope"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const provider = String(a["provider"] ?? "");
+        const label = String(a["label"] ?? "");
+        if (!provider) {
+          cliError("provider is required", 6, { name: "E_INVALID_INPUT" });
+          process.exit(6);
+        }
+        if (!label) {
+          cliError("label is required", 6, { name: "E_INVALID_INPUT" });
+          process.exit(6);
+        }
+        const { getCredentialPool } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credential-pool.js"
+        );
+        const { REMOVAL_REGISTRY, addSuppression } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credential-removal.js"
+        );
+        const { removeCredential } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credentials-store.js"
+        );
+        const pool = getCredentialPool();
+        const entries = await pool.list();
+        const entry = entries.find((c) => c.provider === provider && c.label === label);
+        if (!entry) {
+          cliError(`No credential found for provider='${provider}' label='${label}'`, 4, {
+            name: "E_NOT_FOUND",
+            fix: `Run 'cleo auth list' to see active credentials.`
+          });
+          process.exit(4);
+        }
+        const sourceId = entry.source ?? "manual";
+        const step = REMOVAL_REGISTRY.find(sourceId);
+        if (!step) {
+          cliError(
+            `No RemovalStep registered for source='${sourceId}' \u2014 cannot safely remove '${provider}/${label}'.`,
+            2,
+            {
+              name: "E_REMOVAL_NOT_REGISTERED",
+              fix: `Open an issue: a credential was seeded from an unknown source.`
+            }
+          );
+          process.exit(2);
+        }
+        const stepResult = await step.remove({ provider, label });
+        for (const path6 of stepResult.cleaned) {
+          process.stderr.write(`cleaned: ${path6}
+`);
+        }
+        for (const hint of stepResult.hints) {
+          process.stderr.write(`hint: ${hint}
+`);
+        }
+        let suppressed = false;
+        if (stepResult.suppress) {
+          addSuppression(provider, sourceId);
+          suppressed = true;
+        }
+        const removed = await removeCredential(
+          entry.provider,
+          // ModelTransport
+          label
+        );
+        const result = {
+          provider,
+          label,
+          source: sourceId,
+          removed,
+          cleaned: stepResult.cleaned,
+          hints: stepResult.hints,
+          suppressed
+        };
+        cliOutput(result, {
+          command: "auth-remove",
+          operation: "auth.remove"
+        });
+      }
+    });
+  }
+});
+
+// packages/cleo/src/cli/commands/auth/index.ts
+var init_auth = __esm({
+  "packages/cleo/src/cli/commands/auth/index.ts"() {
+    "use strict";
+    init_list();
+    init_migrate_project_secrets();
+    init_remove();
+  }
+});
+
+// packages/cleo/src/cli/commands/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  authCommand: () => authCommand
+});
+var authCommand;
+var init_auth2 = __esm({
+  "packages/cleo/src/cli/commands/auth.ts"() {
+    "use strict";
+    init_dist();
+    init_auth();
+    authCommand = defineCommand({
+      meta: {
+        name: "auth",
+        description: "Unified credential view across all seeded sources (cleo llm list is the LLM-scoped sister command)."
+      },
+      subCommands: {
+        list: authListCommand,
+        remove: authRemoveCommand,
+        "migrate-project-secrets": authMigrateProjectSecretsCommand
+      },
+      async run({ cmd, rawArgs }) {
+        const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+        if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+        await showUsage(cmd);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/backfill.ts
 var backfill_exports = {};
 __export(backfill_exports, {
@@ -34713,7 +35151,7 @@ var init_backfill = __esm({
         }
         try {
           const result = await backfillTasks(root, { dryRun, rollback, taskIds });
-          const output = {
+          const output2 = {
             dryRun,
             rollback,
             tasksScanned: result.tasksScanned,
@@ -34721,12 +35159,12 @@ var init_backfill = __esm({
             changes: result.changes
           };
           if (!rollback) {
-            output["acAdded"] = result.acAdded;
-            output["verificationAdded"] = result.verificationAdded;
+            output2["acAdded"] = result.acAdded;
+            output2["verificationAdded"] = result.verificationAdded;
           }
           const messagePrefix = dryRun ? "[dry run] " : rollback ? "[rollback] " : "";
           const messageSuffix = result.changes.length === 0 ? "Nothing to do \u2014 all tasks already have AC and verification metadata." : `Scanned ${result.tasksScanned}, changed ${result.tasksChanged} task(s).`;
-          cliOutput(output, {
+          cliOutput(output2, {
             command: "backfill",
             operation: "admin.backfill",
             message: `${messagePrefix}${messageSuffix}`
@@ -35845,12 +36283,12 @@ var briefing_exports = {};
 __export(briefing_exports, {
   briefingCommand: () => briefingCommand
 });
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function resolveInjectionTemplatePath() {
-  const xdgConfig = process.env["XDG_CONFIG_HOME"] ?? join7(homedir2(), ".cleo");
-  return join7(xdgConfig, "templates", "CLEO-INJECTION.md");
+  const xdgConfig = process.env["XDG_CONFIG_HOME"] ?? join8(homedir2(), ".cleo");
+  return join8(xdgConfig, "templates", "CLEO-INJECTION.md");
 }
 function extractSection(content, sectionName) {
   const openTag = `<!-- CLEO-INJECTION:section=${sectionName} -->`;
@@ -35877,13 +36315,13 @@ function renderForAdapter(sectionName, content, format) {
 }
 async function runBriefingInject(sectionName, formatStr) {
   const templatePath = resolveInjectionTemplatePath();
-  if (!existsSync6(templatePath)) {
+  if (!existsSync7(templatePath)) {
     process.stderr.write(`[briefing inject] CLEO-INJECTION.md not found at ${templatePath}
 `);
     process.exitCode = 1;
     return;
   }
-  const content = readFileSync7(templatePath, "utf-8");
+  const content = readFileSync8(templatePath, "utf-8");
   const section = extractSection(content, sectionName);
   if (section === null) {
     const available = INJECTION_SECTION_NAMES.join(", ");
@@ -35895,7 +36333,7 @@ Available sections: ${available}
     process.exitCode = 1;
     return;
   }
-  let output = section;
+  let output2 = section;
   if (formatStr.startsWith("adapter:")) {
     const adapterName = formatStr.slice("adapter:".length);
     if (!ADAPTER_FORMATS.includes(adapterName)) {
@@ -35906,9 +36344,9 @@ Available sections: ${available}
       process.exitCode = 1;
       return;
     }
-    output = renderForAdapter(sectionName, section, adapterName);
+    output2 = renderForAdapter(sectionName, section, adapterName);
   }
-  process.stdout.write(output + "\n");
+  process.stdout.write(output2 + "\n");
 }
 var INJECTION_SECTION_NAMES, ADAPTER_FORMATS, briefingCommand;
 var init_briefing = __esm({
@@ -36026,7 +36464,7 @@ __export(caamp_exports, {
   caampCommand: () => caampCommand
 });
 import { homedir as homedir3 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 var dedupeCommand, caampCommand;
 var init_caamp = __esm({
   "packages/cleo/src/cli/commands/caamp.ts"() {
@@ -36063,18 +36501,18 @@ var init_caamp = __esm({
         } else {
           const home = homedir3();
           filePaths = [
-            join8(home, ".agents", "AGENTS.md"),
+            join9(home, ".agents", "AGENTS.md"),
             // project-level AGENTS.md in cwd
-            join8(process.cwd(), "AGENTS.md")
+            join9(process.cwd(), "AGENTS.md")
           ];
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync14 } = await import("node:fs");
+          const { existsSync: existsSync16 } = await import("node:fs");
           const { readFile: readFile6 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync14(filePath)) {
+            if (!existsSync16(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -36172,13 +36610,13 @@ var cant_exports = {};
 __export(cant_exports, {
   cantCommand: () => cantCommand
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, isAbsolute, join as join9, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, isAbsolute, join as join10, resolve as resolve3 } from "node:path";
 function resolveFilePath(file) {
   return isAbsolute(file) ? file : resolve3(process.cwd(), file);
 }
 function ensureExists(filePath, operation) {
-  if (existsSync7(filePath)) return true;
+  if (existsSync8(filePath)) return true;
   cliError(`File not found: ${filePath}`, "E_FILE_READ");
   process.exitCode = 3;
   if (process.env["CLEO_DEBUG"]) humanWarn(`(operation: ${operation})`);
@@ -36328,7 +36766,7 @@ var init_cant = __esm({
         if (!ensureExists(filePath, "cant.migrate")) return;
         try {
           const mod = await loadMigrateEngine();
-          const content = readFileSync8(filePath, "utf-8");
+          const content = readFileSync9(filePath, "utf-8");
           const result = mod.migrateMarkdown(content, filePath, {
             write: isWrite,
             verbose: isVerbose,
@@ -36338,9 +36776,9 @@ var init_cant = __esm({
             const projectRoot = process.cwd();
             let written = 0;
             for (const outputFile of result.outputFiles) {
-              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join9(projectRoot, outputFile.path);
+              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join10(projectRoot, outputFile.path);
               mkdirSync2(dirname4(outputPath), { recursive: true });
-              writeFileSync2(outputPath, outputFile.content, "utf-8");
+              writeFileSync3(outputPath, outputFile.content, "utf-8");
               written++;
             }
             cliOutput(
@@ -36394,7 +36832,7 @@ var chain_exports = {};
 __export(chain_exports, {
   chainCommand: () => chainCommand
 });
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 var showCommand3, listCommand5, addCommand3, instantiateCommand, advanceCommand, chainCommand;
 var init_chain = __esm({
   "packages/cleo/src/cli/commands/chain.ts"() {
@@ -36436,7 +36874,7 @@ var init_chain = __esm({
         }
       },
       async run({ args }) {
-        const chainJson = JSON.parse(readFileSync9(args.file, "utf-8"));
+        const chainJson = JSON.parse(readFileSync10(args.file, "utf-8"));
         await dispatchFromCli(
           "mutate",
           "pipeline",
@@ -36621,10 +37059,10 @@ var init_check2 = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync17 } = await import("node:fs");
+        const { readFileSync: readFileSync18 } = await import("node:fs");
         let chain;
         try {
-          chain = JSON.parse(readFileSync17(args.file, "utf8"));
+          chain = JSON.parse(readFileSync18(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse chain file: ${message}`, 2, {
@@ -37096,9 +37534,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join26 } = await import("node:path");
+            const { join: join28 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join26(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join28(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -37189,9 +37627,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join26 } = await import("node:path");
+            const { join: join28 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join26(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join28(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -37270,16 +37708,16 @@ var init_complete = __esm({
         }
         const data = response.data;
         const task = data?.task ?? data;
-        const output = { task };
+        const output2 = { task };
         const autoCompleted = data?.autoCompleted;
         if (Array.isArray(autoCompleted) && autoCompleted.length > 0) {
-          output["autoCompleted"] = autoCompleted;
+          output2["autoCompleted"] = autoCompleted;
         }
         const unblockedTasks = data?.unblockedTasks;
         if (Array.isArray(unblockedTasks) && unblockedTasks.length > 0) {
-          output["unblockedTasks"] = unblockedTasks;
+          output2["unblockedTasks"] = unblockedTasks;
         }
-        cliOutput(output, { command: "complete", operation: "tasks.complete" });
+        cliOutput(output2, { command: "complete", operation: "tasks.complete" });
       }
     });
   }
@@ -38333,9 +38771,9 @@ var daemon_exports = {};
 __export(daemon_exports, {
   daemonCommand: () => daemonCommand
 });
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
 import {
@@ -38400,9 +38838,9 @@ async function showDaemonStatus(cleoDir, projectRoot) {
 }
 function resolveDaemonInstallerScript() {
   const filePath = fileURLToPath3(import.meta.url);
-  const candidate1 = join10(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
-  if (existsSync8(candidate1)) return candidate1;
-  const candidate2 = join10(
+  const candidate1 = join11(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
+  if (existsSync9(candidate1)) return candidate1;
+  const candidate2 = join11(
     filePath,
     "..",
     "..",
@@ -38437,7 +38875,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
         const foreground = args.foreground ?? false;
         if (foreground) {
           const projectRoot = process.cwd();
@@ -38474,13 +38912,13 @@ var init_daemon = __esm({
             {
               pid,
               cleoDir,
-              logs: join10(cleoDir, "logs", "gc.log"),
+              logs: join11(cleoDir, "logs", "gc.log"),
               message: `GC daemon started (PID ${pid})`
             },
             {
               command: "daemon",
               operation: "daemon.start",
-              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join10(cleoDir, "logs", "gc.log")}`
+              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join11(cleoDir, "logs", "gc.log")}`
             }
           );
         } catch (err) {
@@ -38510,7 +38948,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
         try {
           const stopResult = await stopGCDaemon(cleoDir);
           cliOutput(stopResult, {
@@ -38548,7 +38986,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join10(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -38646,7 +39084,7 @@ var init_daemon = __esm({
       },
       async run({ args, cmd, rawArgs }) {
         if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
-        const cleoDir = args["cleo-dir"] ?? join10(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -38843,12 +39281,12 @@ var init_delete = __esm({
           handleRawError(response, { command: "delete", operation: "tasks.delete" });
         }
         const data = response.data;
-        const output = { deletedTask: data?.deletedTask };
+        const output2 = { deletedTask: data?.deletedTask };
         const cascadeDeleted = data?.cascadeDeleted;
         if (Array.isArray(cascadeDeleted) && cascadeDeleted.length > 0) {
-          output["cascadeDeleted"] = cascadeDeleted;
+          output2["cascadeDeleted"] = cascadeDeleted;
         }
-        cliOutput(output, { command: "delete", operation: "tasks.delete" });
+        cliOutput(output2, { command: "delete", operation: "tasks.delete" });
       }
     });
   }
@@ -39109,12 +39547,12 @@ var detect_drift_exports = {};
 __export(detect_drift_exports, {
   detectDriftCommand: () => detectDriftCommand
 });
-import { existsSync as existsSync9, readdirSync, readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname5, join as join12 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
-    if (existsSync9(join11(currentDir, "package.json"))) {
+    if (existsSync10(join12(currentDir, "package.json"))) {
       return currentDir;
     }
     const parent = dirname5(currentDir);
@@ -39138,11 +39576,11 @@ var init_detect_drift = __esm({
       },
       async run() {
         const projectRoot = findProjectRoot();
-        const isCleoRepo = existsSync9(join11(projectRoot, "packages", "cleo", "src"));
-        const cleoSrcRoot = isCleoRepo ? join11(projectRoot, "packages", "cleo", "src") : join11(projectRoot, "src");
+        const isCleoRepo = existsSync10(join12(projectRoot, "packages", "cleo", "src"));
+        const cleoSrcRoot = isCleoRepo ? join12(projectRoot, "packages", "cleo", "src") : join12(projectRoot, "src");
         const safeRead = (filePath) => {
           try {
-            return readFileSync10(filePath, "utf-8");
+            return readFileSync11(filePath, "utf-8");
           } catch {
             return "";
           }
@@ -39153,8 +39591,8 @@ var init_detect_drift = __esm({
             checks: [],
             recommendations: []
           };
-          const injPath = join11(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (existsSync9(injPath)) {
+          const injPath = join12(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (existsSync10(injPath)) {
             const content = safeRead(injPath);
             userResult.checks.push({
               name: "Agent injection",
@@ -39205,10 +39643,10 @@ var init_detect_drift = __esm({
           }
         };
         try {
-          const specPath = join11(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
-          const registryPath = join11(cleoSrcRoot, "dispatch", "registry.ts");
-          const dispatchDomainsDir = join11(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync9(specPath)) {
+          const specPath = join12(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
+          const registryPath = join12(cleoSrcRoot, "dispatch", "registry.ts");
+          const dispatchDomainsDir = join12(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync10(specPath)) {
             addCheck("Gateway-to-spec sync", "fail", "CLEO-OPERATION-CONSTITUTION.md missing", [
               {
                 severity: "error",
@@ -39218,7 +39656,7 @@ var init_detect_drift = __esm({
                 recommendation: "Create docs/specs/CLEO-OPERATION-CONSTITUTION.md with canonical operation definitions"
               }
             ]);
-          } else if (!existsSync9(registryPath) || !existsSync9(dispatchDomainsDir)) {
+          } else if (!existsSync10(registryPath) || !existsSync10(dispatchDomainsDir)) {
             addCheck("Gateway-to-spec sync", "fail", "Dispatch registry or domains missing", [
               {
                 severity: "error",
@@ -39276,9 +39714,9 @@ var init_detect_drift = __esm({
           ]);
         }
         try {
-          const cliDir = join11(cleoSrcRoot, "cli", "commands");
-          const coreDir = isCleoRepo ? join11(projectRoot, "packages", "core", "src") : join11(projectRoot, "src", "core");
-          if (!existsSync9(cliDir)) {
+          const cliDir = join12(cleoSrcRoot, "cli", "commands");
+          const coreDir = isCleoRepo ? join12(projectRoot, "packages", "core", "src") : join12(projectRoot, "src", "core");
+          if (!existsSync10(cliDir)) {
             addCheck("CLI-to-core sync", "fail", "CLI commands directory missing", [
               {
                 severity: "error",
@@ -39287,7 +39725,7 @@ var init_detect_drift = __esm({
                 recommendation: "Verify TypeScript source structure is intact"
               }
             ]);
-          } else if (!existsSync9(coreDir)) {
+          } else if (!existsSync10(coreDir)) {
             addCheck("CLI-to-core sync", "fail", "Core directory missing", [
               {
                 severity: "error",
@@ -39304,8 +39742,8 @@ var init_detect_drift = __esm({
           addCheck("CLI-to-core sync", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const domainsDir = join11(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync9(domainsDir)) {
+          const domainsDir = join12(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync10(domainsDir)) {
             addCheck("Domain handler coverage", "fail", "Dispatch domains directory missing", [
               {
                 severity: "error",
@@ -39322,8 +39760,8 @@ var init_detect_drift = __esm({
           addCheck("Domain handler coverage", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const matrixPath = join11(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
-          if (!existsSync9(matrixPath)) {
+          const matrixPath = join12(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
+          if (!existsSync10(matrixPath)) {
             addCheck("Capability matrix", "fail", "Capability matrix missing", [
               {
                 severity: "error",
@@ -39339,8 +39777,8 @@ var init_detect_drift = __esm({
           addCheck("Capability matrix", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const schemaPath = join11(projectRoot, "src", "store", "schema.ts");
-          if (!existsSync9(schemaPath)) {
+          const schemaPath = join12(projectRoot, "src", "store", "schema.ts");
+          if (!existsSync10(schemaPath)) {
             addCheck("Schema validation", "fail", "Schema definition missing", [
               {
                 severity: "error",
@@ -39374,10 +39812,10 @@ var init_detect_drift = __esm({
           addCheck("Schema validation", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const visionPath = join11(projectRoot, "docs", "concepts", "CLEO-VISION.md");
-          const specPath = join11(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
+          const visionPath = join12(projectRoot, "docs", "concepts", "CLEO-VISION.md");
+          const specPath = join12(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
           const issues = [];
-          if (!existsSync9(visionPath)) {
+          if (!existsSync10(visionPath)) {
             issues.push({
               severity: "error",
               category: "vision",
@@ -39386,7 +39824,7 @@ var init_detect_drift = __esm({
               recommendation: "Create docs/concepts/CLEO-VISION.md with project vision"
             });
           }
-          if (!existsSync9(specPath)) {
+          if (!existsSync10(specPath)) {
             issues.push({
               severity: "error",
               category: "spec",
@@ -39430,8 +39868,8 @@ var init_detect_drift = __esm({
           addCheck("Canonical identity", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const injectionPath = join11(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (!existsSync9(injectionPath)) {
+          const injectionPath = join12(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (!existsSync10(injectionPath)) {
             addCheck("Agent injection", "fail", "Agent injection template missing", [
               {
                 severity: "error",
@@ -39460,8 +39898,8 @@ var init_detect_drift = __esm({
           addCheck("Agent injection", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const exitCodesPath = join11(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
-          if (!existsSync9(exitCodesPath)) {
+          const exitCodesPath = join12(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
+          if (!existsSync10(exitCodesPath)) {
             addCheck("Exit codes", "fail", "Exit codes definition missing", [
               {
                 severity: "error",
@@ -39635,7 +40073,7 @@ __export(docs_exports, {
   docsCommand: () => docsCommand
 });
 import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join12, resolve as resolve4 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, resolve as resolve4 } from "node:path";
 import {
   buildDocsGraph,
   CleoError as CleoError3,
@@ -39651,7 +40089,7 @@ import {
   searchDocs as searchDocs2
 } from "@cleocode/core/internal";
 async function getScriptNames(projectRoot) {
-  const scriptsDir = join12(projectRoot, "scripts");
+  const scriptsDir = join13(projectRoot, "scripts");
   try {
     const files = await readdir(scriptsDir);
     return files.filter((f) => f.endsWith(".sh")).map((f) => f.replace(".sh", "")).sort();
@@ -39660,7 +40098,7 @@ async function getScriptNames(projectRoot) {
   }
 }
 async function getIndexedCommands(projectRoot) {
-  const indexPath = join12(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
+  const indexPath = join13(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
   const index = await readJson(indexPath);
   if (!index) return [];
   return index.commands.map((c) => c.name).sort();
@@ -39693,7 +40131,7 @@ async function runGapCheck(_projectRoot, filterId) {
     const reviewFiles = files.filter((f) => f.endsWith(".md"));
     for (const file of reviewFiles) {
       if (filterId && !file.includes(filterId)) continue;
-      const filePath = join12(reviewDir, file);
+      const filePath = join13(reviewDir, file);
       const content = await readFile2(filePath, "utf-8");
       const taskMatch = file.match(/^(T\d+)/);
       const taskId = taskMatch ? taskMatch[1] : "UNKNOWN";
@@ -40107,7 +40545,7 @@ var init_docs3 = __esm({
         const fmt = args.format ?? "mermaid";
         try {
           const result = await buildDocsGraph({ ownerId: String(args.for), projectRoot });
-          let output;
+          let output2;
           if (fmt === "dot") {
             const dotLines = ["digraph docs {"];
             for (const node of result.nodes) {
@@ -40117,9 +40555,9 @@ var init_docs3 = __esm({
               dotLines.push(`  "${edge.source}" -> "${edge.target}" [label="${edge.relation}"];`);
             }
             dotLines.push("}");
-            output = dotLines.join("\n");
+            output2 = dotLines.join("\n");
           } else if (fmt === "json") {
-            output = JSON.stringify(result, null, 2);
+            output2 = JSON.stringify(result, null, 2);
           } else {
             const lines = ["graph LR"];
             for (const edge of result.edges) {
@@ -40130,16 +40568,16 @@ var init_docs3 = __esm({
                 lines.push(`  ${node.id}["${node.label}"]`);
               }
             }
-            output = lines.join("\n");
+            output2 = lines.join("\n");
           }
           if (typeof args.out === "string" && args.out.length > 0) {
             const outPath = isAbsolute2(args.out) ? args.out : resolve4(projectRoot, args.out);
             await mkdir(dirname6(outPath), { recursive: true });
-            await writeFile(outPath, output, "utf8");
+            await writeFile(outPath, output2, "utf8");
             humanInfo(`Wrote graph to ${outPath}`);
           }
           cliOutput(
-            { format: fmt, nodeCount: result.nodes.length, edgeCount: result.edges.length, output },
+            { format: fmt, nodeCount: result.nodes.length, edgeCount: result.edges.length, output: output2 },
             { command: "docs graph", operation: "docs.graph" }
           );
         } catch (err) {
@@ -40659,8 +41097,8 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync11 } from "node:fs";
-import { join as join13 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "node:fs";
+import { join as join14 } from "node:path";
 import { getProjectRoot as getProjectRoot23, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
@@ -40680,15 +41118,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join13(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join13(auditPath, "..");
-  if (!existsSync10(auditDir)) {
+  const auditPath = join14(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join14(auditPath, "..");
+  if (!existsSync11(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync10(scanDir)) return;
+  if (!existsSync11(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -40699,12 +41137,12 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join13(scanDir, filename);
+    const cantPath = join14(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
     try {
-      sourceBytes = readFileSync11(cantPath);
+      sourceBytes = readFileSync12(cantPath);
       sourceText = sourceBytes.toString("utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -40796,9 +41234,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const { db: _sdDb } = await openCleoDb("signaldock");
   const db = _sdDb;
   try {
-    const canonicalDir = join13(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join14(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join13(projectRoot, ".cleo", "agents");
+    const legacyDir = join14(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -40806,11 +41244,11 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join13(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync10(auditPath)) return [];
+  const auditPath = join14(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync11(auditPath)) return [];
   let raw;
   try {
-    raw = readFileSync11(auditPath, "utf8");
+    raw = readFileSync12(auditPath, "utf8");
   } catch {
     return [];
   }
@@ -40890,8 +41328,8 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join14 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join15 } from "node:path";
 import { getProjectRoot as getProjectRoot24, quarantineRogueCleoDir, scanRogueCleoDirs } from "@cleocode/core/internal";
 async function scanTestFixturesInProd(projectRoot) {
   const { getDb: getDb3, getNativeDb } = await import("@cleocode/core/internal");
@@ -40926,16 +41364,16 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join14(projectRoot, ".cleo");
-  const quarantineDir = join14(
+  const cleoDir = join15(projectRoot, ".cleo");
+  const quarantineDir = join15(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
   );
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
-  writeFileSync3(
-    join14(quarantineDir, "manifest.jsonl"),
+  writeFileSync4(
+    join15(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
   const { getNativeDb } = await import("@cleocode/core/internal");
@@ -41388,7 +41826,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot3(arg) {
@@ -41511,7 +41949,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join15(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join16(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -41548,8 +41986,8 @@ var init_event = __esm({
           }
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
-            const { readFileSync: readFileSync17 } = await import("node:fs");
-            const content = readFileSync17(join15(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync18 } = await import("node:fs");
+            const content = readFileSync18(join16(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -41619,7 +42057,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join15(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join16(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -41644,8 +42082,8 @@ var init_event = __esm({
         const printAgentLog = async (file) => {
           const agentId = file.replace(".jsonl", "");
           try {
-            const { readFileSync: readFileSync17 } = await import("node:fs");
-            const content = readFileSync17(join15(eventsDir, file), "utf-8");
+            const { readFileSync: readFileSync18 } = await import("node:fs");
+            const content = readFileSync18(join16(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -42020,7 +42458,7 @@ __export(gc_exports, {
   gcCommand: () => gcCommand
 });
 import { homedir as homedir5, tmpdir } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -42059,7 +42497,7 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join16(homedir5(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join17(homedir5(), ".cleo");
         const dryRun = args["dry-run"];
         try {
           const gcResult = await runGC({ cleoDir, dryRun });
@@ -42101,8 +42539,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join16(homedir5(), ".cleo");
-        const statePath = join16(cleoDir, "gc-state.json");
+        const cleoDir = args["cleo-dir"] ?? join17(homedir5(), ".cleo");
+        const statePath = join17(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -42155,8 +42593,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join16(homedir5(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join16(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join17(homedir5(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join17(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -42266,13 +42704,13 @@ __export(generate_changelog_exports, {
   generateChangelogCommand: () => generateChangelogCommand
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, join as join17 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname7, join as join18 } from "node:path";
 import { CleoError as CleoError4, formatError as formatError6, getConfigPath, getProjectRoot as getProjectRoot25 } from "@cleocode/core";
 function getChangelogSource(cwd) {
   const configPath = getConfigPath(cwd);
   try {
-    const config = JSON.parse(readFileSync12(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync13(configPath, "utf-8"));
     return config?.release?.changelog?.source ?? "CHANGELOG.md";
   } catch {
     return "CHANGELOG.md";
@@ -42281,7 +42719,7 @@ function getChangelogSource(cwd) {
 function getEnabledPlatforms(cwd) {
   const configPath = getConfigPath(cwd);
   try {
-    const config = JSON.parse(readFileSync12(configPath, "utf-8"));
+    const config = JSON.parse(readFileSync13(configPath, "utf-8"));
     const outputs = config?.release?.changelog?.outputs ?? [];
     return outputs.filter((o) => o.enabled);
   } catch {
@@ -42432,11 +42870,11 @@ var init_generate_changelog = __esm({
           const targetPlatform = args.platform;
           const dryRun = args["dry-run"] === true;
           const sourceFile = getChangelogSource();
-          const sourcePath = join17(getProjectRoot25(), sourceFile);
-          if (!existsSync11(sourcePath)) {
+          const sourcePath = join18(getProjectRoot25(), sourceFile);
+          if (!existsSync12(sourcePath)) {
             throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
           }
-          const sourceContent = readFileSync12(sourcePath, "utf-8");
+          const sourceContent = readFileSync13(sourcePath, "utf-8");
           const repoSlug = getGitHubRepoSlug();
           const results = [];
           if (targetPlatform) {
@@ -42445,9 +42883,9 @@ var init_generate_changelog = __esm({
             const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
             const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
             if (!dryRun) {
-              const fullPath = join17(getProjectRoot25(), outputPath);
+              const fullPath = join18(getProjectRoot25(), outputPath);
               mkdirSync5(dirname7(fullPath), { recursive: true });
-              writeFileSync4(fullPath, content, "utf-8");
+              writeFileSync5(fullPath, content, "utf-8");
             }
             results.push({ platform: targetPlatform, path: outputPath, written: !dryRun });
           } else {
@@ -42466,9 +42904,9 @@ var init_generate_changelog = __esm({
                 limit
               );
               if (!dryRun) {
-                const fullPath = join17(getProjectRoot25(), platformConfig.path);
+                const fullPath = join18(getProjectRoot25(), platformConfig.path);
                 mkdirSync5(dirname7(fullPath), { recursive: true });
-                writeFileSync4(fullPath, content, "utf-8");
+                writeFileSync5(fullPath, content, "utf-8");
               }
               results.push({
                 platform: platformConfig.platform,
@@ -43605,19 +44043,19 @@ __export(init_exports, {
   getGitignoreTemplate: () => getGitignoreTemplate,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync12, readFileSync as readFileSync13 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { CleoError as CleoError5, formatError as formatError7, initProject as initProject2 } from "@cleocode/core";
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath4(import.meta.url);
-    const packageRoot = join18(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join18(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join18(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync12(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync12(templatePath)) {
-      return readFileSync13(templatePath, "utf-8");
+    const packageRoot = join19(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join19(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join19(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync13(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync13(templatePath)) {
+      return readFileSync14(templatePath, "utf-8");
     }
   } catch {
   }
@@ -44446,7 +44884,7 @@ __export(list_exports, {
 });
 import { createPage as createPage2 } from "@cleocode/core";
 var listArgs, listCommand9;
-var init_list = __esm({
+var init_list2 = __esm({
   "packages/cleo/src/cli/commands/list.ts"() {
     "use strict";
     init_src2();
@@ -46080,9 +46518,9 @@ __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import {
   getBrainDb as getBrainDb2,
   getBrainNativeDb as getBrainNativeDb3,
@@ -46123,8 +46561,8 @@ ${body}`).digest("hex").slice(0, 16);
 }
 function loadImportHashes(stateFile) {
   try {
-    if (!existsSync13(stateFile)) return /* @__PURE__ */ new Set();
-    const raw = readFileSync14(stateFile, "utf-8");
+    if (!existsSync14(stateFile)) return /* @__PURE__ */ new Set();
+    const raw = readFileSync15(stateFile, "utf-8");
     const parsed = JSON.parse(raw);
     return new Set(parsed.hashes);
   } catch {
@@ -46133,8 +46571,8 @@ function loadImportHashes(stateFile) {
 }
 function saveImportHashes(stateFile, hashes) {
   const dir = stateFile.slice(0, stateFile.lastIndexOf("/"));
-  if (!existsSync13(dir)) mkdirSync6(dir, { recursive: true });
-  writeFileSync5(stateFile, JSON.stringify({ hashes: [...hashes] }, null, 2), "utf-8");
+  if (!existsSync14(dir)) mkdirSync6(dir, { recursive: true });
+  writeFileSync6(stateFile, JSON.stringify({ hashes: [...hashes] }, null, 2), "utf-8");
 }
 function makeMemorySubcommand(opts) {
   const mergedArgs = {
@@ -47245,16 +47683,16 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const sourceDir = args.from ?? join19(homedir6(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
+        const sourceDir = args.from ?? join20(homedir6(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
         const isDryRun = !!args["dry-run"];
         const projectRoot = getProjectRoot27();
-        const stateFile = join19(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
-        if (!existsSync13(sourceDir)) {
+        const stateFile = join20(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
+        if (!existsSync14(sourceDir)) {
           cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
           process.exit(1);
           return;
         }
-        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join19(sourceDir, f));
+        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join20(sourceDir, f));
         const importedHashes = isDryRun ? /* @__PURE__ */ new Set() : loadImportHashes(stateFile);
         const stats = { total: files.length, imported: 0, skipped: 0, errors: 0 };
         const importedEntries = [];
@@ -47263,7 +47701,7 @@ var init_memory3 = __esm({
         for (const filePath of files) {
           const fileName = filePath.split("/").pop() ?? filePath;
           try {
-            const raw = readFileSync14(filePath, "utf-8");
+            const raw = readFileSync15(filePath, "utf-8");
             if (!raw.trim()) {
               stats.skipped++;
               skippedEntries.push({ file: fileName, reason: "empty file" });
@@ -49649,8 +50087,8 @@ var init_nexus4 = __esm({
             return;
           }
           if (!skipPrompt) {
-            const { createInterface: createInterface2 } = await import("node:readline");
-            const rl = createInterface2({ input: process.stdin, output: process.stdout });
+            const { createInterface: createInterface4 } = await import("node:readline");
+            const rl = createInterface4({ input: process.stdin, output: process.stdout });
             const confirmed = await new Promise((resolve5) => {
               rl.question(
                 `
@@ -49813,9 +50251,9 @@ var init_nexus4 = __esm({
           }
           const nodes = projectFilter ? allNodes.filter((n) => n["projectId"] === projectFilter) : allNodes;
           const relations = projectFilter ? allRelations.filter((r) => r["projectId"] === projectFilter) : allRelations;
-          let output = "";
+          let output2 = "";
           if (format === "json") {
-            output = JSON.stringify(
+            output2 = JSON.stringify(
               {
                 nodes: nodes.map((n) => ({
                   id: n["id"],
@@ -49842,7 +50280,7 @@ var init_nexus4 = __esm({
               2
             );
           } else if (format === "gexf") {
-            output = generateGexf(nodes, relations);
+            output2 = generateGexf(nodes, relations);
           } else {
             cliError(
               `Unknown format '${format}'. Supported: gexf, json`,
@@ -49854,8 +50292,8 @@ var init_nexus4 = __esm({
             return;
           }
           if (outputFile) {
-            const { writeFileSync: writeFileSync6 } = await import("node:fs");
-            writeFileSync6(outputFile, output, "utf-8");
+            const { writeFileSync: writeFileSync7 } = await import("node:fs");
+            writeFileSync7(outputFile, output2, "utf-8");
             const durationMs = Date.now() - startTime;
             cliOutput(
               { outputFile, nodeCount: nodes.length, edgeCount: relations.length },
@@ -49867,8 +50305,8 @@ var init_nexus4 = __esm({
             );
             humanInfo(`[nexus] Export completed in ${durationMs}ms`);
           } else {
-            process.stdout.write(output);
-            if (!output.endsWith("\n")) process.stdout.write("\n");
+            process.stdout.write(output2);
+            if (!output2.endsWith("\n")) process.stdout.write("\n");
           }
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
@@ -54771,7 +55209,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -54824,7 +55262,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join20(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join21(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile3(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -54908,7 +55346,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join20(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join21(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -54961,7 +55399,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join20(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join21(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -55343,7 +55781,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -55358,7 +55796,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome();
   try {
-    const content = await readFile4(join21(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile4(join22(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -55412,7 +55850,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile3, mkdir: mkdir4 }) => mkdir4(cleoHome, { recursive: true }).then(
-      () => writeFile3(join21(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile3(join22(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -55823,7 +56261,7 @@ var sentient_exports = {};
 __export(sentient_exports, {
   sentientCommand: () => sentientCommand
 });
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 import { cwd as processCwd3 } from "node:process";
 import {
   getSentientDaemonStatus as getSentientDaemonStatus2,
@@ -55892,7 +56330,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join22(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join23(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -56008,7 +56446,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -56077,7 +56515,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -56129,7 +56567,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -56174,7 +56612,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -56194,7 +56632,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -56213,7 +56651,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -56244,7 +56682,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join22(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -56609,9 +57047,9 @@ async function promptOwnerAuthPassword(sessionName) {
     );
     return null;
   }
-  const { createInterface: createInterface2 } = await import("node:readline");
+  const { createInterface: createInterface4 } = await import("node:readline");
   const { deriveOwnerAuthToken } = await import("@cleocode/core/internal");
-  const rl = createInterface2({
+  const rl = createInterface4({
     input: process.stdin,
     output: process.stderr,
     terminal: true
@@ -57202,6 +57640,231 @@ var init_session4 = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/readline-wizard-io.ts
+import { stdin as input, stdout as output } from "node:process";
+import * as readline3 from "node:readline/promises";
+var ReadlineWizardIO;
+var init_readline_wizard_io = __esm({
+  "packages/cleo/src/cli/lib/readline-wizard-io.ts"() {
+    "use strict";
+    ReadlineWizardIO = class {
+      rl;
+      /**
+       * Construct a readline interface bound to the supplied streams.
+       *
+       * The defaults (`process.stdin` / `process.stdout`) are correct for
+       * production use; tests inject in-memory streams.
+       *
+       * @param inStream - Input stream; defaults to `process.stdin`.
+       * @param outStream - Output stream; defaults to `process.stdout`.
+       */
+      constructor(inStream = input, outStream = output) {
+        this.rl = readline3.createInterface({ input: inStream, output: outStream });
+      }
+      /**
+       * Release the underlying readline interface.
+       *
+       * Safe to call multiple times — `readline.Interface.close()` is
+       * idempotent.
+       */
+      close() {
+        this.rl.close();
+      }
+      async prompt(question) {
+        const answer = await this.rl.question(`${question} `);
+        return answer.trim();
+      }
+      async confirm(question, defaultValue) {
+        const hint = defaultValue === void 0 ? "[y/n]" : defaultValue ? "[Y/n]" : "[y/N]";
+        const raw = (await this.rl.question(`${question} ${hint} `)).trim().toLowerCase();
+        if (raw === "") {
+          if (defaultValue === void 0) {
+            return this.confirm(question, defaultValue);
+          }
+          return defaultValue;
+        }
+        if (raw === "y" || raw === "yes") return true;
+        if (raw === "n" || raw === "no") return false;
+        return this.confirm(question, defaultValue);
+      }
+      async select(question, options) {
+        if (options.length === 0) {
+          throw new Error(`ReadlineWizardIO.select: option list is empty for '${question}'`);
+        }
+        process.stdout.write(`${question}
+`);
+        options.forEach((opt, idx) => {
+          process.stdout.write(`  ${idx + 1}) ${opt}
+`);
+        });
+        const MAX_RETRIES = 10;
+        for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+          const raw = (await this.rl.question(`Choose [1-${options.length}]: `)).trim();
+          if (/^\d+$/.test(raw)) {
+            const idx = Number.parseInt(raw, 10) - 1;
+            if (idx >= 0 && idx < options.length) return options[idx];
+          }
+          if (options.includes(raw)) return raw;
+          process.stdout.write(`Invalid choice '${raw}'. Try again.
+`);
+        }
+        throw new Error(
+          `ReadlineWizardIO.select: gave up after ${MAX_RETRIES} invalid responses for '${question}'`
+        );
+      }
+      info(message) {
+        process.stdout.write(`${message}
+`);
+      }
+      warn(message) {
+        process.stderr.write(`${message}
+`);
+      }
+      error(message) {
+        process.stderr.write(`${message}
+`);
+      }
+    };
+  }
+});
+
+// packages/cleo/src/cli/commands/setup.ts
+var setup_exports = {};
+__export(setup_exports, {
+  buildWizardOptions: () => buildWizardOptions,
+  runSetup: () => runSetup,
+  setupCommand: () => setupCommand2
+});
+import { createDefaultWizardRunner } from "@cleocode/core/setup";
+function buildWizardOptions(args) {
+  const out = {};
+  if (args["non-interactive"] === true || args["nonInteractive"] === true) {
+    out.nonInteractive = true;
+  }
+  if (typeof args["provider"] === "string" && args["provider"] !== "") {
+    out.provider = args["provider"];
+  }
+  if (typeof args["api-key"] === "string" && args["api-key"] !== "") {
+    out.apiKey = args["api-key"];
+  } else if (typeof args["apiKey"] === "string" && args["apiKey"] !== "") {
+    out.apiKey = args["apiKey"];
+  }
+  if (typeof args["label"] === "string" && args["label"] !== "") {
+    out.label = args["label"];
+  }
+  if (typeof args["agent-name"] === "string" && args["agent-name"] !== "") {
+    out.agentName = args["agent-name"];
+  } else if (typeof args["agentName"] === "string" && args["agentName"] !== "") {
+    out.agentName = args["agentName"];
+  }
+  if (typeof args["strictness"] === "string" && args["strictness"] !== "") {
+    const s = args["strictness"];
+    if (s === "strict" || s === "standard" || s === "minimal") {
+      out.strictness = s;
+    }
+  }
+  if (typeof args["project-root"] === "string" && args["project-root"] !== "") {
+    out.projectRoot = args["project-root"];
+  }
+  return out;
+}
+function wrapSingleSection(name, result) {
+  return {
+    sectionsRun: [name],
+    summary: [`${name}: ${result.summary}`]
+  };
+}
+function isOk(result) {
+  return !result.summary.some((line) => /:\s*failed:/i.test(line));
+}
+async function runSetup(args, io) {
+  const options = buildWizardOptions(args);
+  const runner = createDefaultWizardRunner();
+  const sectionArg = typeof args["section"] === "string" ? args["section"] : null;
+  let runResult;
+  if (sectionArg) {
+    const known = runner.list().map((r) => r.section);
+    if (!known.includes(sectionArg)) {
+      throw new Error(`cleo setup: unknown section '${sectionArg}'. Known: ${known.join(", ")}`);
+    }
+    const single = await runner.runSection(sectionArg, io, options);
+    runResult = wrapSingleSection(sectionArg, single);
+  } else {
+    runResult = await runner.run(io, options);
+  }
+  return {
+    sectionsRun: runResult.sectionsRun,
+    summary: runResult.summary,
+    ok: isOk(runResult)
+  };
+}
+var setupCommand2;
+var init_setup = __esm({
+  "packages/cleo/src/cli/commands/setup.ts"() {
+    "use strict";
+    init_dist();
+    init_readline_wizard_io();
+    init_renderers();
+    setupCommand2 = defineCommand({
+      meta: {
+        name: "setup",
+        description: "Interactive setup wizard \u2014 runs all sections (llm, identity, sentient, project-conventions) in canonical order. Use --section <name> for a single section or --non-interactive with --provider/--api-key to configure LLM without prompts."
+      },
+      args: {
+        section: {
+          type: "string",
+          description: "Run only one named section. Valid: llm | identity | sentient | project-conventions"
+        },
+        "non-interactive": {
+          type: "boolean",
+          description: "Skip prompts. Sections that need extra data short-circuit silently. Pair with --provider and --api-key to configure LLM."
+        },
+        provider: {
+          type: "string",
+          description: "LLM provider id when --non-interactive (anthropic, openai, gemini, openrouter, \u2026)."
+        },
+        "api-key": {
+          type: "string",
+          description: "API key used when --non-interactive --provider is set."
+        },
+        label: {
+          type: "string",
+          description: "Optional credential label override (defaults to 'cli-input')."
+        },
+        "agent-name": {
+          type: "string",
+          description: "Override agent display name for the identity section."
+        },
+        strictness: {
+          type: "string",
+          description: "Project-conventions strictness preset: 'strict' | 'standard' | 'minimal'."
+        },
+        "project-root": {
+          type: "string",
+          description: "Override project root path (defaults to process.cwd())."
+        }
+      },
+      async run({ args }) {
+        const io = new ReadlineWizardIO();
+        let result;
+        try {
+          result = await runSetup(args, io);
+        } finally {
+          io.close();
+        }
+        cliOutput(result, {
+          command: "setup",
+          operation: "setup.run",
+          message: result.ok ? `Setup completed (${result.sectionsRun.length} section(s)).` : `Setup finished with errors (${result.sectionsRun.length} section(s)).`
+        });
+        if (!result.ok) {
+          process.exit(1);
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/show.ts
 var show_exports = {};
 __export(show_exports, {
@@ -57802,6 +58465,134 @@ var init_stats = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/status.ts
+var status_exports = {};
+__export(status_exports, {
+  statusCommand: () => statusCommand13
+});
+import { getCleoStatus } from "@cleocode/core/status";
+function formatEpoch(epoch) {
+  if (epoch == null) return "";
+  const d = new Date(epoch);
+  if (Number.isNaN(d.getTime())) return "";
+  return d.toISOString().replace("T", " ").slice(0, 19) + "Z";
+}
+function renderCredentialLine(c) {
+  const badges = [];
+  if (c.lastStatus === "invalid") badges.push(`${RED}${BOLD}[INVALID]${NC}`);
+  if (c.isExpired === true) badges.push(`${YELLOW}${BOLD}[EXPIRED]${NC}`);
+  const label = c.label ?? "(no label)";
+  const head = `${BOLD}${c.provider}${NC} ${DIM}${label}${NC}`;
+  const meta = [];
+  meta.push(`source=${c.source}`);
+  if (c.authType !== void 0) meta.push(`authType=${c.authType}`);
+  if (c.lastStatus !== void 0) meta.push(`lastStatus=${c.lastStatus}`);
+  if (c.expiresAt != null) meta.push(`expiresAt=${formatEpoch(c.expiresAt)}`);
+  const metaLine = `${DIM}${meta.join(" \xB7 ")}${NC}`;
+  const badgeStr = badges.length > 0 ? ` ${badges.join(" ")}` : "";
+  return `    ${head}${badgeStr}
+      ${metaLine}`;
+}
+function renderStatusHuman(status) {
+  const lines = [];
+  if (status.config.hasSecretsInProjectConfig) {
+    lines.push(`${RED}${BOLD}WARNING: Secrets detected in project config${NC}`);
+    for (const w of status.config.secretsWarnings) {
+      lines.push(`  ${RED}${w}${NC}`);
+    }
+    lines.push("");
+  }
+  lines.push(`${BOLD}Identity${NC}`);
+  lines.push(`  ${DIM}agentId:${NC}      ${status.identity.agentId ?? "(none)"}`);
+  lines.push(`  ${DIM}identityFile:${NC} ${status.identity.identityFile ?? "(none)"}`);
+  const loggedInBadge = status.identity.loggedIn ? `${GREEN}yes${NC}` : `${YELLOW}no \u2014 run \`cleo setup\`${NC}`;
+  lines.push(`  ${DIM}loggedIn:${NC}     ${loggedInBadge}`);
+  lines.push("");
+  lines.push(`${BOLD}Credentials${NC} ${DIM}(${status.credentials.length} entries)${NC}`);
+  if (status.credentials.length === 0) {
+    lines.push(`  ${DIM}(no credentials \u2014 run \`cleo auth list\` after \`cleo setup\`)${NC}`);
+  } else {
+    for (const c of status.credentials) {
+      lines.push(renderCredentialLine(c));
+    }
+  }
+  lines.push("");
+  lines.push(`${BOLD}Config${NC}`);
+  lines.push(`  ${DIM}globalConfigPath:${NC}  ${status.config.globalConfigPath}`);
+  lines.push(`  ${DIM}projectConfigPath:${NC} ${status.config.projectConfigPath ?? "(none)"}`);
+  lines.push(`  ${DIM}activeConfigPath:${NC}  ${status.config.activeConfigPath}`);
+  lines.push("");
+  lines.push(`${BOLD}Session${NC}`);
+  const sessionState = status.session.active ? `${GREEN}active${NC}` : `${DIM}inactive${NC}`;
+  lines.push(`  ${DIM}state:${NC}       ${sessionState}`);
+  lines.push(`  ${DIM}sessionId:${NC}   ${status.session.sessionId ?? "(none)"}`);
+  lines.push(`  ${DIM}focusedTask:${NC} ${status.session.focusedTask ?? "(none)"}`);
+  lines.push("");
+  lines.push(`${BOLD}Harness${NC}`);
+  lines.push(`  ${DIM}active:${NC}  ${CYAN}${status.harness.active}${NC}`);
+  lines.push(
+    `  ${DIM}healthy:${NC} ${status.harness.healthy ? `${GREEN}yes${NC}` : `${RED}no${NC}`}`
+  );
+  if (status.harness.issues.length > 0) {
+    for (const issue of status.harness.issues) {
+      lines.push(`    ${YELLOW}- ${issue}${NC}`);
+    }
+  }
+  lines.push("");
+  lines.push(`${BOLD}Daemon${NC}`);
+  const daemonState = status.daemon.running ? `${GREEN}running${NC}` : `${DIM}stopped${NC}`;
+  lines.push(`  ${DIM}state:${NC}            ${daemonState}`);
+  lines.push(`  ${DIM}pid:${NC}              ${status.daemon.pid ?? "(none)"}`);
+  lines.push(
+    `  ${DIM}lastTickAt:${NC}       ${status.daemon.lastTickAt != null ? formatEpoch(status.daemon.lastTickAt) : "(never)"}`
+  );
+  const killSwitchBadge = status.daemon.killSwitchActive ? `${RED}${BOLD}ACTIVE${NC}` : `${DIM}inactive${NC}`;
+  lines.push(`  ${DIM}killSwitchActive:${NC} ${killSwitchBadge}`);
+  return lines.join("\n");
+}
+function computeExitCode(status) {
+  const hasInvalid = status.credentials.some((c) => c.lastStatus === "invalid");
+  return hasInvalid ? 1 : 0;
+}
+var statusCommand13;
+var init_status = __esm({
+  "packages/cleo/src/cli/commands/status.ts"() {
+    "use strict";
+    init_dist();
+    init_format_context();
+    init_colors();
+    init_renderers();
+    statusCommand13 = defineCommand({
+      meta: {
+        name: "status",
+        description: "Unified config + credential + session + harness + daemon snapshot. Use --json for the full LAFS envelope (CleoStatus interface). Exits non-zero when any credential is in invalid state."
+      },
+      args: {
+        json: {
+          type: "boolean",
+          description: "Output as JSON envelope (CleoStatus interface)"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const forceJson = a["json"] === true;
+        const status = await getCleoStatus();
+        if (forceJson || isJsonFormat()) {
+          cliOutput(status, {
+            command: "status",
+            operation: "status.show"
+          });
+        } else {
+          process.stdout.write(`${renderStatusHuman(status)}
+`);
+        }
+        const exitCode = computeExitCode(status);
+        if (exitCode !== 0) process.exit(exitCode);
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/sticky.ts
 var sticky_exports = {};
 __export(sticky_exports, {
@@ -58229,10 +59020,10 @@ var init_sync = __esm({
         }
       },
       async run({ args }) {
-        const { readFileSync: readFileSync17 } = await import("node:fs");
+        const { readFileSync: readFileSync18 } = await import("node:fs");
         let externalTasks;
         try {
-          externalTasks = JSON.parse(readFileSync17(args.file, "utf8"));
+          externalTasks = JSON.parse(readFileSync18(args.file, "utf8"));
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           cliError(`Failed to read or parse external tasks file: ${message}`, 2, {
@@ -58388,7 +59179,7 @@ var testing_exports = {};
 __export(testing_exports, {
   testingCommand: () => testingCommand
 });
-var validateCommand9, checkCommand7, statusCommand13, coverageCommand, runCommand4, testingCommand;
+var validateCommand9, checkCommand7, statusCommand14, coverageCommand, runCommand4, testingCommand;
 var init_testing = __esm({
   "packages/cleo/src/cli/commands/testing.ts"() {
     "use strict";
@@ -58449,7 +59240,7 @@ var init_testing = __esm({
         );
       }
     });
-    statusCommand13 = defineCommand({
+    statusCommand14 = defineCommand({
       meta: { name: "status", description: "Show test suite status" },
       async run() {
         await dispatchFromCli(
@@ -58496,7 +59287,7 @@ var init_testing = __esm({
       subCommands: {
         validate: validateCommand9,
         check: checkCommand7,
-        status: statusCommand13,
+        status: statusCommand14,
         coverage: coverageCommand,
         run: runCommand4
       },
@@ -58514,12 +59305,12 @@ var token_exports = {};
 __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 import { getProjectRoot as getProjectRoot32, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
-  if (file) return readFileSync15(file, "utf-8");
+  if (file) return readFileSync16(file, "utf-8");
   return text;
 }
 var filterArgs, summaryCommand3, listCommand24, showCommand16, deleteCommand3, clearCommand2, estimateCommand, tokenCommand;
@@ -58669,7 +59460,7 @@ var init_token = __esm({
       async run({ args }) {
         const requestPayload = readPayload(args, "request-text", "request-file");
         const responsePayload = readPayload(args, "response-text", "response-file");
-        const input = {
+        const input2 = {
           requestPayload,
           responsePayload,
           provider: args.provider,
@@ -58679,7 +59470,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot32(), input) : await measureTokenExchange(input);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot32(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -58714,7 +59505,7 @@ __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
 import { homedir as homedir8 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { getProjectRoot as getProjectRoot33 } from "@cleocode/core";
 import {
   parseDurationMs,
@@ -58768,7 +59559,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join23(homedir8(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join24(homedir8(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -59074,7 +59865,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join23(homedir8(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join24(homedir8(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -59666,15 +60457,15 @@ __export(web_exports, {
 });
 import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
 import { mkdir as mkdir3, open, readFile as readFile5, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError9, getCleoHome as getCleoHome2 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome2();
   return {
-    pidFile: join24(cleoHome, "web-server.pid"),
-    configFile: join24(cleoHome, "web-server.json"),
-    logDir: join24(cleoHome, "logs"),
-    logFile: join24(cleoHome, "logs", "web-server.log")
+    pidFile: join25(cleoHome, "web-server.pid"),
+    configFile: join25(cleoHome, "web-server.json"),
+    logDir: join25(cleoHome, "logs"),
+    logFile: join25(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -59713,7 +60504,7 @@ async function startWebServer(port, host) {
     throw new CleoError12(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join24(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join25(projectRoot, "packages", "studio", "build");
   await mkdir3(logDir, { recursive: true });
   await writeFile2(
     configFile,
@@ -59723,7 +60514,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join24(studioDir, "index.js");
+  const webIndexPath = join25(studioDir, "index.js");
   try {
     await stat(webIndexPath);
   } catch {
@@ -59792,7 +60583,7 @@ Logs: ${logFile}`
     { command: "web", message: `CLEO Web UI running on port ${port}` }
   );
 }
-var DEFAULT_PORT, DEFAULT_HOST, startCommand10, stopCommand5, restartCommand, statusCommand14, openCommand, webCommand;
+var DEFAULT_PORT, DEFAULT_HOST, startCommand10, stopCommand5, restartCommand, statusCommand15, openCommand, webCommand;
 var init_web = __esm({
   "packages/cleo/src/cli/commands/web.ts"() {
     "use strict";
@@ -59924,7 +60715,7 @@ var init_web = __esm({
         }
       }
     });
-    statusCommand14 = defineCommand({
+    statusCommand15 = defineCommand({
       meta: { name: "status", description: "Check server status" },
       async run() {
         try {
@@ -59978,7 +60769,7 @@ var init_web = __esm({
         start: startCommand10,
         stop: stopCommand5,
         restart: restartCommand,
-        status: statusCommand14,
+        status: statusCommand15,
         open: openCommand
       },
       async run({ cmd, rawArgs }) {
@@ -59994,8 +60785,8 @@ var init_web = __esm({
 init_dist();
 init_field_context();
 init_format_context();
-import { readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname8, join as join25 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { dirname as dirname8, join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -60066,6 +60857,12 @@ var COMMAND_MANIFEST = [
     description: "Git-backed audit tooling (lineage reconstruction, integrity checks). ",
     load: async () => (await Promise.resolve().then(() => (init_audit2(), audit_exports))).auditCommand
   },
+  {
+    exportName: "authCommand",
+    name: "auth",
+    description: "Unified credential view across all seeded sources (cleo llm list is the LLM-scoped sister command).",
+    load: async () => (await Promise.resolve().then(() => (init_auth2(), auth_exports))).authCommand
+  },
   {
     exportName: "backfillCommand",
     name: "backfill",
@@ -60412,7 +61209,7 @@ var COMMAND_MANIFEST = [
     exportName: "listCommand",
     name: "list",
     description: "List tasks with optional filters",
-    load: async () => (await Promise.resolve().then(() => (init_list(), list_exports))).listCommand
+    load: async () => (await Promise.resolve().then(() => (init_list2(), list_exports))).listCommand
   },
   {
     exportName: "costCommand",
@@ -60666,6 +61463,12 @@ var COMMAND_MANIFEST = [
     description: "Manage work sessions",
     load: async () => (await Promise.resolve().then(() => (init_session4(), session_exports))).sessionCommand
   },
+  {
+    exportName: "setupCommand",
+    name: "setup",
+    description: "Interactive setup wizard \u2014 runs all sections (llm, identity, sentient, project-conventions) in canonical order. Use --section <name> for a single section or --non-interactive with --provider/--api-key to configure LLM without prompts.",
+    load: async () => (await Promise.resolve().then(() => (init_setup(), setup_exports))).setupCommand
+  },
   {
     exportName: "showCommand",
     name: "show",
@@ -60696,6 +61499,12 @@ var COMMAND_MANIFEST = [
     description: "Project statistics (counts, completion rates, velocity)",
     load: async () => (await Promise.resolve().then(() => (init_stats(), stats_exports))).statsCommand
   },
+  {
+    exportName: "statusCommand",
+    name: "status",
+    description: "Unified config + credential + session + harness + daemon snapshot. ",
+    load: async () => (await Promise.resolve().then(() => (init_status(), status_exports))).statusCommand
+  },
   {
     exportName: "stickyCommand",
     name: "sticky",
@@ -61030,8 +61839,8 @@ function lazyCommand(meta, loader2) {
 }
 
 // packages/cleo/src/cli/lib/did-you-mean.ts
-function levenshteinDistance(input, candidate) {
-  const inputLen = input.length;
+function levenshteinDistance(input2, candidate) {
+  const inputLen = input2.length;
   const candidateLen = candidate.length;
   const matrix = Array.from({ length: inputLen + 1 }, (_, i) => [i]);
   for (let j = 1; j <= candidateLen; j++) {
@@ -61039,7 +61848,7 @@ function levenshteinDistance(input, candidate) {
   }
   for (let i = 1; i <= inputLen; i++) {
     for (let j = 1; j <= candidateLen; j++) {
-      const cost = input[i - 1] === candidate[j - 1] ? 0 : 1;
+      const cost = input2[i - 1] === candidate[j - 1] ? 0 : 1;
       matrix[i][j] = Math.min(
         matrix[i - 1][j] + 1,
         // deletion
@@ -61052,10 +61861,10 @@ function levenshteinDistance(input, candidate) {
   }
   return matrix[inputLen][candidateLen];
 }
-function didYouMean(input, candidates, maxDistance = 2) {
+function didYouMean(input2, candidates, maxDistance = 2) {
   const suggestions = candidates.map((candidate) => ({
     command: candidate,
-    distance: levenshteinDistance(input, candidate)
+    distance: levenshteinDistance(input2, candidate)
   })).filter((item) => item.distance <= maxDistance).sort((a, b) => {
     if (a.distance !== b.distance) {
       return a.distance - b.distance;
@@ -61065,17 +61874,77 @@ function didYouMean(input, candidates, maxDistance = 2) {
   return suggestions;
 }
 
+// packages/cleo/src/cli/lib/first-run-detection.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join26 } from "node:path";
+async function detectFirstRun() {
+  const envKey = process.env["ANTHROPIC_API_KEY"];
+  if (typeof envKey === "string" && envKey.length > 0) return false;
+  const { getCleoPlatformPaths } = await import("@cleocode/paths");
+  const configPath = join26(getCleoPlatformPaths().config, "config.json");
+  if (existsSync15(configPath)) return false;
+  try {
+    const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
+    const pool = getCredentialPool();
+    const entries = await pool.list();
+    if (entries.length > 0) return false;
+  } catch {
+  }
+  return true;
+}
+function waitForEnterOrTimeout(timeoutMs) {
+  return new Promise((resolve5) => {
+    let resolved = false;
+    const finish = () => {
+      if (resolved) return;
+      resolved = true;
+      clearTimeout(timer);
+      process.stdin.removeListener("data", onData);
+      process.stdin.removeListener("end", onEnd);
+      try {
+        process.stdin.pause();
+      } catch {
+      }
+      resolve5();
+    };
+    const onData = (chunk) => {
+      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      if (s.includes("\n") || s.includes("\r")) finish();
+    };
+    const onEnd = () => finish();
+    const timer = setTimeout(finish, timeoutMs);
+    process.stdin.on("data", onData);
+    process.stdin.on("end", onEnd);
+    try {
+      process.stdin.resume();
+    } catch {
+    }
+  });
+}
+async function maybePromptFirstRun() {
+  try {
+    const isFirstRun = await detectFirstRun();
+    if (!isFirstRun) return;
+    if (process.stdin.isTTY !== true) return;
+    process.stderr.write(
+      "CLEO is not configured. Run 'cleo setup' to get started. (Press Enter to skip, or wait 10s)\n"
+    );
+    await waitForEnterOrTimeout(1e4);
+  } catch {
+  }
+}
+
 // packages/cleo/src/cli/middleware/output-format.ts
 import { resolveOutputFormat } from "@cleocode/lafs";
 function resolveFormat(opts, defaults) {
-  const input = {
+  const input2 = {
     jsonFlag: opts["json"] === true,
     humanFlag: opts["human"] === true,
     quiet: opts["quiet"] === true,
     projectDefault: defaults?.projectDefault,
     userDefault: defaults?.userDefault
   };
-  return resolveOutputFormat(input);
+  return resolveOutputFormat(input2);
 }
 
 // packages/cleo/src/cli/index.ts
@@ -61101,8 +61970,8 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join25(dirname8(fileURLToPath5(import.meta.url)), "../../package.json");
-  const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
+  const pkgPath = join27(dirname8(fileURLToPath5(import.meta.url)), "../../package.json");
+  const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
   return pkg.version;
 }
 var CLI_VERSION = getPackageVersion();
@@ -61162,6 +62031,12 @@ async function startCli() {
   if (!isHelpOrVersion) {
     await runStartupMaintenance();
   }
+  if (!isHelpOrVersion) {
+    try {
+      await maybePromptFirstRun();
+    } catch {
+    }
+  }
   const main = defineCommand({
     meta: {
       name: "cleo",