@cleocode/cleo 2026.5.79 → 2026.5.81

package/dist/cli/index.js

@@ -12312,6 +12312,92 @@ var init_registry = __esm({
       // 4-verb pipeline registered below: `release.plan`, `release.open`,
       // `release.reconcile`, plus `cleo verify <task> --gate X --evidence …`
       // for per-task gate verification (R-422 / ADR-051).
+      // release mutate: plan (T9525 / SPEC-T9345 §4.2 — Phase 1 plan verb)
+      {
+        gateway: "mutate",
+        domain: "release",
+        operation: "plan",
+        description: "release.plan (mutate) \u2014 build canonical Release Plan envelope, write .cleo/release/<version>.plan.json, INSERT/UPDATE releases row status=planned (T9525 / SPEC-T9345 \xA74.2).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version", "epicId"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Candidate version (e.g. v2026.5.80)"
+          },
+          {
+            name: "epicId",
+            type: "string",
+            required: true,
+            description: "Epic task ID whose children scope the release (R-303)"
+          },
+          {
+            name: "scheme",
+            type: "string",
+            required: false,
+            description: "Versioning scheme: calver | semver | calver-suffix"
+          },
+          {
+            name: "channel",
+            type: "string",
+            required: false,
+            description: "Release channel: latest | beta | alpha | rc"
+          },
+          {
+            name: "hotfix",
+            type: "boolean",
+            required: false,
+            description: "Mark plan as release_kind=hotfix"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Compute the plan without writing file or DB row"
+          }
+        ]
+      },
+      // release mutate: open (T9530 / SPEC-T9345 §4.3 — Phase 3 open verb)
+      {
+        gateway: "mutate",
+        domain: "release",
+        operation: "open",
+        description: "release.open (mutate) \u2014 dispatch release-prepare.yml via gh workflow run, UPDATE releases.status to pr-opened (T9530 / SPEC-T9345 \xA74.3).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["version"],
+        params: [
+          {
+            name: "version",
+            type: "string",
+            required: true,
+            description: "Release version whose plan file lives at .cleo/release/<version>.plan.json"
+          },
+          {
+            name: "workflow",
+            type: "string",
+            required: false,
+            description: "Workflow file name (default: release-prepare.yml)"
+          },
+          {
+            name: "watch",
+            type: "boolean",
+            required: false,
+            description: "Poll gh run watch until terminal state"
+          },
+          {
+            name: "commitPlan",
+            type: "boolean",
+            required: false,
+            description: "Commit plan file before dispatching"
+          }
+        ]
+      },
       // release mutate: reconcile (T9526 / SPEC-T9345 §4.4 — v2 reconcile verb)
       {
         gateway: "mutate",
@@ -12699,6 +12785,75 @@ var init_registry = __esm({
             description: "Include the freshly rendered YAML in the response (for diff display)"
           }
         ]
+      },
+      // ---------------------------------------------------------------------------
+      // Worktree domain — `cleo worktree list/prune/force-unlock` (T9546/T9547)
+      // ---------------------------------------------------------------------------
+      {
+        gateway: "query",
+        domain: "worktree",
+        operation: "list",
+        description: "worktree.list (query) \u2014 enumerate git worktrees with 5 status categories (active|stale|merged|orphan|locked). Reads tasks.db for owning-task status. 60s git timeout (T9546).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "statusFilter",
+            type: "string",
+            required: false,
+            description: "Filter to one or more status categories (comma-separated)"
+          },
+          {
+            name: "staleDays",
+            type: "number",
+            required: false,
+            description: "Days of inactivity before flagging stale (default 7)"
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "worktree",
+        operation: "prune",
+        description: "worktree.prune (mutate) \u2014 remove orphaned worktrees with per-orphan confirmation. Audit-logs to .cleo/audit/worktree-lifecycle.jsonl (T9547).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "paths",
+            type: "array",
+            required: false,
+            description: "Pre-confirmed paths to remove"
+          },
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Enumerate orphans without acting"
+          }
+        ]
+      },
+      {
+        gateway: "mutate",
+        domain: "worktree",
+        operation: "forceUnlock",
+        description: "worktree.forceUnlock (mutate) \u2014 remove .git/index.lock and run git worktree unlock for a task. Warns on uncommitted changes (T9547).",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ["taskId"],
+        params: [
+          {
+            name: "taskId",
+            type: "string",
+            required: true,
+            description: "Task ID whose worktree (branch task/T<id>) to unlock"
+          }
+        ]
       }
     ];
     counts = getCounts();
@@ -25507,16 +25662,16 @@ async function orchestrateRejectOp(params) {
 async function orchestrateClassify(request, context, projectRoot) {
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync18, readdirSync: readdirSync4, existsSync: existsSync16 } = await import("node:fs");
-    const { join: join28 } = await import("node:path");
+    const { readFileSync: readFileSync18, readdirSync: readdirSync4, existsSync: existsSync17 } = await import("node:fs");
+    const { join: join29 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync16(workflowsDir)) {
+    if (existsSync17(workflowsDir)) {
       const files = readdirSync4(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync18(join28(workflowsDir, file), "utf-8");
+          const src = readFileSync18(join29(workflowsDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -25531,12 +25686,12 @@ async function orchestrateClassify(request, context, projectRoot) {
         }
       }
     }
-    const localCantDir = join28(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
-    if (existsSync16(localCantDir)) {
+    const localCantDir = join29(projectRoot, CLEO_DIR_NAME, WORKFLOWS_SUBDIR);
+    if (existsSync17(localCantDir)) {
       const files = readdirSync4(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
-          const src = readFileSync18(join28(localCantDir, file), "utf-8");
+          const src = readFileSync18(join29(localCantDir, file), "utf-8");
           const teamMatch = /^team\s+(\S+):/m.exec(src);
           if (!teamMatch) continue;
           const teamName = teamMatch[1];
@@ -32238,7 +32393,7 @@ import {
   detectStaleAgents,
   getHealthReport,
   STALE_THRESHOLD_MS
-} from "@cleocode/core/internal";
+} from "@cleocode/core/agents";
 function inferTierFromRole(role) {
   if (role === "orchestrator") return "high";
   return "mid";
@@ -32621,7 +32776,8 @@ var init_agent = __esm({
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const agentId = args.id;
@@ -32640,12 +32796,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync16, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join28 } = await import("node:path");
-          const cantDir = join28(CLEO_DIR_NAME, AGENTS_SUBDIR);
-          const cantPath = join28(cantDir, `${agentId}.cant`);
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join29 } = await import("node:path");
+          const cantDir = join29(CLEO_DIR_NAME, AGENTS_SUBDIR);
+          const cantPath = join29(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync16(cantPath)) {
+          if (!existsSync17(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -32705,7 +32861,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync16(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync17(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -32738,7 +32894,8 @@ agent ${agentId}:
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -32822,10 +32979,11 @@ agent ${agentId}:
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync16, readFileSync: readFileSync18 } = await import("node:fs");
-          const { join: join28 } = await import("node:path");
+          const { existsSync: existsSync17, readFileSync: readFileSync18 } = await import("node:fs");
+          const { join: join29 } = await import("node:path");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -32845,8 +33003,8 @@ agent ${agentId}:
           }
           let profile = null;
           let cantValidation = null;
-          const cantPath = args.cant ?? join28(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync16(cantPath)) {
+          const cantPath = args.cant ?? join29(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          if (existsSync17(cantPath)) {
             profile = readFileSync18(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -32943,7 +33101,8 @@ agent ${agentId}:
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -32999,7 +33158,8 @@ agent ${agentId}:
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           if (args.agentId) {
@@ -33074,7 +33234,8 @@ agent ${agentId}:
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3, createConduit } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const active = await registry.getActive();
@@ -33130,7 +33291,8 @@ Assigned task ${args.taskId}. Run: cleo show ${args.taskId} && cleo start ${args
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3, createConduit } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const active = await registry.getActive();
@@ -33195,7 +33357,8 @@ You are idle. Check your queue: cleo current || cleo next. Report status immedia
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const role = args.role;
@@ -33259,7 +33422,8 @@ You are idle. Check your queue: cleo current || cleo next. Report status immedia
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3, createConduit } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const active = await registry.getActive();
@@ -33302,7 +33466,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run() {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const agents = await registry.list({ active: true });
@@ -33368,10 +33533,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync16 } = await import("node:fs");
-          const { join: join28 } = await import("node:path");
+          const { existsSync: existsSync17 } = await import("node:fs");
+          const { join: join29 } = await import("node:path");
           const { execFile: execFile2 } = await import("node:child_process");
           const { promisify: promisify2 } = await import("node:util");
           const execFileAsync = promisify2(execFile2);
@@ -33391,8 +33557,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
-          const cantPath = join28(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync16(cantPath);
+          const cantPath = join29(CLEO_DIR_NAME, AGENTS_SUBDIR, `${args.agentId}.cant`);
+          const hasProfile = existsSync17(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -33528,7 +33694,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { listAgentsForProject, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { listAgentsForProject } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const includeGlobal = args.global === true;
           const includeDisabled = args["include-disabled"] === true;
@@ -33579,7 +33746,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { lookupAgent, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { lookupAgent } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const includeGlobal = args.global === true;
           const agent = lookupAgent(process.cwd(), args.agentId, { includeGlobal });
@@ -33645,7 +33813,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, attachAgentToProject, lookupAgent, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, attachAgentToProject, lookupAgent } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const projectRoot = process.cwd();
           const _registry = new AgentRegistryAccessor(projectRoot);
@@ -33700,7 +33869,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const projectRoot = process.cwd();
           const _registry = new AgentRegistryAccessor(projectRoot);
@@ -33756,7 +33926,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, detachAgentFromProject, getProjectAgentRef } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const projectRoot = process.cwd();
           if (!args.global) {
@@ -33837,7 +34008,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const result = await registry.rotateKey(args.agentId);
@@ -33875,7 +34047,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const credential = await registry.get(args.agentId);
@@ -33948,7 +34121,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           const { createRuntime } = await import("@cleocode/runtime");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
@@ -34031,7 +34205,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, createConduit, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const agentId = args.agent;
@@ -34082,7 +34257,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { AgentRegistryAccessor, createConduit, getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { AgentRegistryAccessor, createConduit } = await import("@cleocode/core/agents");
+          const { getDb: getDb3 } = await import("@cleocode/core/internal");
           await getDb3();
           const registry = new AgentRegistryAccessor(process.cwd());
           const agentId = args.agent;
@@ -34240,11 +34416,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync16, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
-          const { join: join28, basename, resolve: resolve8, extname } = await import("node:path");
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, statSync, readdirSync: readdirSync4, copyFileSync } = await import("node:fs");
+          const { join: join29, basename, resolve: resolve8, extname } = await import("node:path");
           const { tmpdir: tmpdir2 } = await import("node:os");
           const resolvedPath = resolve8(args.path);
-          if (!existsSync16(resolvedPath)) {
+          if (!existsSync17(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -34265,7 +34441,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             cantPath = resolvedPath;
           } else if (stat2.isFile() && ext === ".cantz") {
             const { execFileSync: execFileSync5 } = await import("node:child_process");
-            tempDir = join28(tmpdir2(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join29(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync7(tempDir, { recursive: true });
             try {
               execFileSync5("unzip", ["-o", "-q", resolvedPath, "-d", tempDir], {
@@ -34287,7 +34463,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const topLevel = readdirSync4(tempDir).filter(
-              (entry) => statSync(join28(tempDir, entry)).isDirectory()
+              (entry) => statSync(join29(tempDir, entry)).isDirectory()
             );
             if (topLevel.length !== 1) {
               cliOutput(
@@ -34304,8 +34480,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               return;
             }
             const agentName = topLevel[0];
-            const personaPath = join28(tempDir, agentName, "persona.cant");
-            if (!existsSync16(personaPath)) {
+            const personaPath = join29(tempDir, agentName, "persona.cant");
+            if (!existsSync17(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -34319,12 +34495,12 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            cantPath = join28(tempDir, `${agentName}.cant`);
+            cantPath = join29(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else if (stat2.isDirectory()) {
             const agentName = basename(resolvedPath);
-            const personaPath = join28(resolvedPath, "persona.cant");
-            if (!existsSync16(personaPath)) {
+            const personaPath = join29(resolvedPath, "persona.cant");
+            if (!existsSync17(personaPath)) {
               cliOutput(
                 {
                   success: false,
@@ -34338,9 +34514,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               process.exitCode = 6;
               return;
             }
-            tempDir = join28(tmpdir2(), `cleo-agent-install-${Date.now()}`);
+            tempDir = join29(tmpdir2(), `cleo-agent-install-${Date.now()}`);
             mkdirSync7(tempDir, { recursive: true });
-            cantPath = join28(tempDir, `${agentName}.cant`);
+            cantPath = join29(tempDir, `${agentName}.cant`);
             copyFileSync(personaPath, cantPath);
           } else {
             cliOutput(
@@ -34356,7 +34532,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 6;
             return;
           }
-          const { installAgentFromCant: installAgentFromCant2, attachAgentToProject } = await import("@cleocode/core/internal");
+          const { installAgentFromCant: installAgentFromCant2, attachAgentToProject } = await import("@cleocode/core/agents");
           const { openCleoDb: openCleoDb2 } = await import("@cleocode/core/store/open-cleo-db");
           const { db: _sdDb } = await openCleoDb2("signaldock");
           const db = _sdDb;
@@ -34459,11 +34635,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync16, statSync } = await import("node:fs");
+          const { existsSync: existsSync17, statSync } = await import("node:fs");
           const { resolve: resolve8, basename, dirname: dirname11 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
           const resolvedDir = resolve8(args.dir);
-          if (!existsSync16(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+          if (!existsSync17(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -34477,9 +34653,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             process.exitCode = 4;
             return;
           }
-          const { join: join28 } = await import("node:path");
-          const personaPath = join28(resolvedDir, "persona.cant");
-          if (!existsSync16(personaPath)) {
+          const { join: join29 } = await import("node:path");
+          const personaPath = join29(resolvedDir, "persona.cant");
+          if (!existsSync17(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -34526,7 +34702,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
               if (entry.isFile()) {
                 fileCount++;
               } else if (entry.isDirectory()) {
-                countFiles(join28(dirPath, entry.name));
+                countFiles(join29(dirPath, entry.name));
               }
             }
           };
@@ -34595,9 +34771,9 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync16, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
-          const { join: join28 } = await import("node:path");
-          const { homedir: homedir9 } = await import("node:os");
+          const { existsSync: existsSync17, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { join: join29 } = await import("node:path");
+          const { homedir: homedir10 } = await import("node:os");
           const name = args.name;
           const role = args.role;
           const tier = args.tier ?? inferTierFromRole(role);
@@ -34655,14 +34831,14 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           let targetRoot;
           if (isGlobal) {
-            const home = homedir9();
-            const xdgData = process.env["XDG_DATA_HOME"] ?? join28(home, ".local", "share");
-            targetRoot = join28(xdgData, "cleo", "cant", "agents");
+            const home = homedir10();
+            const xdgData = process.env["XDG_DATA_HOME"] ?? join29(home, ".local", "share");
+            targetRoot = join29(xdgData, "cleo", "cant", "agents");
           } else {
-            targetRoot = join28(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
+            targetRoot = join29(process.cwd(), CLEO_DIR_NAME, CANT_AGENTS_SUBDIR);
           }
-          const agentDir = join28(targetRoot, name);
-          if (existsSync16(agentDir)) {
+          const agentDir = join29(targetRoot, name);
+          if (existsSync17(agentDir)) {
             cliOutput(
               {
                 success: false,
@@ -34686,29 +34862,29 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
             domain,
             parent
           });
-          writeFileSync7(join28(agentDir, "persona.cant"), personaContent, "utf-8");
+          writeFileSync7(join29(agentDir, "persona.cant"), personaContent, "utf-8");
           const manifest = generateManifest({ name, role, tier, domain });
           writeFileSync7(
-            join28(agentDir, "manifest.json"),
+            join29(agentDir, "manifest.json"),
             `${JSON.stringify(manifest, null, 2)}
 `,
             "utf-8"
           );
           const createdFiles = [
-            join28(agentDir, "persona.cant"),
-            join28(agentDir, "manifest.json")
+            join29(agentDir, "persona.cant"),
+            join29(agentDir, "manifest.json")
           ];
           if (team) {
             const teamConfigContent = generateTeamConfig(name, role, team);
-            writeFileSync7(join28(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
-            createdFiles.push(join28(agentDir, "team-config.cant"));
+            writeFileSync7(join29(agentDir, "team-config.cant"), teamConfigContent, "utf-8");
+            createdFiles.push(join29(agentDir, "team-config.cant"));
           }
           if (seedBrain) {
-            const expertiseDir = join28(agentDir, "expertise");
+            const expertiseDir = join29(agentDir, "expertise");
             mkdirSync7(expertiseDir, { recursive: true });
             const seedContent = generateMentalModelSeed(name, role, domain);
-            writeFileSync7(join28(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
-            createdFiles.push(join28(expertiseDir, "mental-model-seed.md"));
+            writeFileSync7(join29(expertiseDir, "mental-model-seed.md"), seedContent, "utf-8");
+            createdFiles.push(join29(expertiseDir, "mental-model-seed.md"));
             try {
               const { execFile: execFile2 } = await import("node:child_process");
               const { promisify: promisify2 } = await import("node:util");
@@ -34729,7 +34905,8 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           let registered = false;
           try {
-            const { AgentRegistryAccessor, getDb: getDb3 } = await import("@cleocode/core/internal");
+            const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
+            const { getDb: getDb3 } = await import("@cleocode/core/internal");
             await getDb3();
             const registry = new AgentRegistryAccessor(process.cwd());
             const existing = await registry.get(name);
@@ -34806,17 +34983,17 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync16, readFileSync: readFileSync18, mkdirSync: mkdirSync7 } = await import("node:fs");
-          const { resolve: resolve8, join: join28 } = await import("node:path");
+          const { existsSync: existsSync17, readFileSync: readFileSync18, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { resolve: resolve8, join: join29 } = await import("node:path");
           const specPath = resolve8(args.spec);
-          if (!existsSync16(specPath)) {
+          if (!existsSync17(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
           }
           const specContent = readFileSync18(specPath, "utf-8");
           const projectRoot = process.cwd();
-          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join28(projectRoot, ".cleo", "cant", "agents");
+          const outputDir = args["output-dir"] ? resolve8(args["output-dir"]) : join29(projectRoot, ".cleo", "cant", "agents");
           mkdirSync7(outputDir, { recursive: true });
           if (args["dry-run"]) {
             cliOutput(
@@ -34875,7 +35052,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/internal");
+          const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/agents");
           const { openCleoDb: openCleoDb2 } = await import("@cleocode/core/store/open-cleo-db");
           const { db: _sdDb2 } = await openCleoDb2("signaldock");
           const db = _sdDb2;
@@ -34941,7 +35118,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/internal");
+          const { buildDoctorReport, reconcileDoctor } = await import("@cleocode/core/agents");
           const { openCleoDb: openCleoDb2 } = await import("@cleocode/core/store/open-cleo-db");
           const { db: _sdDb3 } = await openCleoDb2("signaldock");
           const db = _sdDb3;
@@ -35286,7 +35463,140 @@ var init_audit2 = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/auth/consent.ts
+var authConsentCommand;
+var init_consent = __esm({
+  "packages/cleo/src/cli/commands/auth/consent.ts"() {
+    "use strict";
+    init_dist();
+    init_renderers();
+    authConsentCommand = defineCommand({
+      meta: {
+        name: "consent",
+        description: "Manage consent gates for external credential sources (e.g. Claude Code OAuth). Use --enable-claude-code / --disable-claude-code to toggle, --status to inspect."
+      },
+      args: {
+        "enable-claude-code": {
+          type: "boolean",
+          description: "Grant consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=true in the global config and removes any suppression entry."
+        },
+        "disable-claude-code": {
+          type: "boolean",
+          description: "Revoke consent for the claude-code seeder: sets auth.claudeCodeConsentGiven=false, adds a suppression entry, and purges all source:claude-code entries from the pool."
+        },
+        status: {
+          type: "boolean",
+          description: "Print the current state of all consent gates."
+        },
+        json: {
+          type: "boolean",
+          description: "Output as JSON envelope"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const enableClaudeCode = a["enable-claude-code"] === true;
+        const disableClaudeCode = a["disable-claude-code"] === true;
+        const showStatus = a["status"] === true;
+        if (!enableClaudeCode && !disableClaudeCode && !showStatus) {
+          cliError("Specify one of --enable-claude-code, --disable-claude-code, or --status.", 6, {
+            name: "E_INVALID_INPUT",
+            fix: "Run `cleo auth consent --status` to see current consent state."
+          });
+          process.exit(6);
+        }
+        if (enableClaudeCode && disableClaudeCode) {
+          cliError("--enable-claude-code and --disable-claude-code are mutually exclusive.", 6, {
+            name: "E_INVALID_INPUT"
+          });
+          process.exit(6);
+        }
+        const configMod = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/config.js"
+        );
+        const getConfigValue = configMod.getConfigValue;
+        const setConfigValue = configMod.setConfigValue;
+        const { addSuppression, removeSuppression, isSuppressed } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credential-removal.js"
+        );
+        const CONSENT_KEY = "auth.claudeCodeConsentGiven";
+        const SOURCE_ID = "claude-code";
+        const PROVIDER = "anthropic";
+        if (showStatus) {
+          const resolved = await getConfigValue(CONSENT_KEY);
+          const consentEnabled = resolved.value === true;
+          const suppressed = isSuppressed(PROVIDER, SOURCE_ID);
+          const result2 = {
+            gates: [
+              {
+                gate: "claudeCode",
+                configKey: CONSENT_KEY,
+                enabled: consentEnabled,
+                suppressed
+              }
+            ]
+          };
+          cliOutput(result2, {
+            command: "auth-consent-status",
+            operation: "auth.consent.status"
+          });
+          return;
+        }
+        if (enableClaudeCode) {
+          await setConfigValue(CONSENT_KEY, true, void 0, { global: true });
+          const suppressionChanged2 = removeSuppression(PROVIDER, SOURCE_ID);
+          const result2 = {
+            action: "enabled",
+            gate: "claudeCode",
+            configKey: CONSENT_KEY,
+            value: true,
+            suppressionChanged: suppressionChanged2,
+            purgedCount: 0
+          };
+          cliOutput(result2, {
+            command: "auth-consent-enable",
+            operation: "auth.consent.enable"
+          });
+          return;
+        }
+        await setConfigValue(CONSENT_KEY, false, void 0, { global: true });
+        const wasAlreadySuppressed = isSuppressed(PROVIDER, SOURCE_ID);
+        addSuppression(PROVIDER, SOURCE_ID);
+        const suppressionChanged = !wasAlreadySuppressed;
+        const { listCredentials, removeCredential } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/llm/credentials-store.js"
+        );
+        const allEntries = await listCredentials();
+        const claudeCodeEntries = allEntries.filter((c) => c.source === SOURCE_ID);
+        let purgedCount = 0;
+        for (const entry of claudeCodeEntries) {
+          const removed = await removeCredential(entry.provider, entry.label);
+          if (removed) purgedCount++;
+        }
+        const result = {
+          action: "disabled",
+          gate: "claudeCode",
+          configKey: CONSENT_KEY,
+          value: false,
+          suppressionChanged,
+          purgedCount
+        };
+        cliOutput(result, {
+          command: "auth-consent-disable",
+          operation: "auth.consent.disable"
+        });
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/auth/list.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join7 } from "node:path";
 function formatExpiry(expiresAt) {
   if (expiresAt == null) return "never";
   const remaining = expiresAt - Date.now();
@@ -35328,7 +35638,26 @@ var init_list = __esm({
         );
         const pool = getCredentialPool();
         await pool.seed();
-        const stored = await pool.list();
+        const allStored = await pool.list();
+        const ghCliEntries = allStored.filter((c) => c.source === "gh-cli");
+        if (ghCliEntries.length > 0) {
+          const { removeCredential } = await import(
+            /* webpackIgnore: true */
+            "@cleocode/core/llm/credentials-store.js"
+          );
+          const { addSuppression } = await import(
+            /* webpackIgnore: true */
+            "@cleocode/core/llm/credential-removal.js"
+          );
+          for (const entry of ghCliEntries) {
+            await removeCredential(
+              entry.provider,
+              entry.label
+            );
+          }
+          addSuppression("openai", "gh-cli");
+        }
+        const stored = allStored.filter((c) => c.source !== "gh-cli");
         const entries = stored.filter((c) => providerFilter ? c.provider === providerFilter : true).map((c) => ({
           provider: c.provider,
           label: c.label,
@@ -35344,8 +35673,10 @@ var init_list = __esm({
           const p = a2.provider.localeCompare(b.provider);
           return p !== 0 ? p : a2.label.localeCompare(b.label);
         });
+        const claudeCredsPath = join7(homedir2(), ".claude", ".credentials.json");
+        const hint = existsSync6(claudeCredsPath) && entries.every((e) => e.source !== "claude-code") ? "Hint: Claude Code OAuth detected at ~/.claude/.credentials.json but consent is off. Run `cleo auth consent --enable-claude-code` to seed it into the pool." : null;
         cliOutput(
-          { entries },
+          { entries, ...hint !== null ? { hint } : {} },
           {
             command: "auth-list",
             operation: "auth.list"
@@ -35357,8 +35688,8 @@ var init_list = __esm({
 });
 
 // packages/cleo/src/cli/commands/auth/migrate-project-secrets.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join8 } from "node:path";
 import { createInterface } from "node:readline";
 function resolveProjectRootArg(arg) {
   if (typeof arg === "string" && arg.length > 0) return arg;
@@ -35366,7 +35697,7 @@ function resolveProjectRootArg(arg) {
 }
 function projectConfigPath(projectRoot) {
   const cleoDir = process.env["CLEO_DIR"] ?? ".cleo";
-  return join7(projectRoot, cleoDir, "config.json");
+  return join8(projectRoot, cleoDir, "config.json");
 }
 function extractApiKeyEntries(config) {
   if (!config || typeof config !== "object") return [];
@@ -35424,7 +35755,7 @@ async function promptYesNo(question) {
 }
 async function runMigrateProjectSecrets(opts) {
   const configPath = projectConfigPath(opts.projectRoot);
-  if (!existsSync6(configPath)) {
+  if (!existsSync7(configPath)) {
     return {
       configPath,
       backupPath: null,
@@ -35685,6 +36016,7 @@ var init_remove = __esm({
 var init_auth = __esm({
   "packages/cleo/src/cli/commands/auth/index.ts"() {
     "use strict";
+    init_consent();
     init_list();
     init_migrate_project_secrets();
     init_remove();
@@ -35708,6 +36040,7 @@ var init_auth2 = __esm({
         description: "Unified credential view across all seeded sources (cleo llm list is the LLM-scoped sister command)."
       },
       subCommands: {
+        consent: authConsentCommand,
         list: authListCommand,
         remove: authRemoveCommand,
         "migrate-project-secrets": authMigrateProjectSecretsCommand
@@ -36277,7 +36610,8 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const scope = args.scope;
-        const { packBundle, getProjectRoot: getProjectRoot38 } = await import("@cleocode/core/internal");
+        const { packBundle } = await import("@cleocode/core/store/backup-pack.js");
+        const { getProjectRoot: getProjectRoot38 } = await import("@cleocode/core");
         const includesProject = scope === "project" || scope === "all";
         const projectRoot = includesProject ? getProjectRoot38() : void 0;
         let passphrase;
@@ -36355,10 +36689,14 @@ var init_backup = __esm({
       },
       async run({ args }) {
         const bundlePath = args.bundle;
-        const core2 = await import("@cleocode/core/internal");
-        const projectRoot = core2.getProjectRoot();
+        const { getProjectRoot: getProjectRoot38, getCleoHome: getCleoHome3, getCleoVersion } = await import("@cleocode/core");
+        const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
+        const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
+        const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
+        const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
+        const projectRoot = getProjectRoot38();
         if (args.force !== true) {
-          const existing = checkForExistingData(projectRoot, core2.getCleoHome());
+          const existing = checkForExistingData(projectRoot, getCleoHome3());
           if (existing.length > 0) {
             process.stderr.write(
               JSON.stringify({
@@ -36392,9 +36730,9 @@ var init_backup = __esm({
         }
         let result;
         try {
-          result = await core2.unpackBundle({ bundlePath, passphrase });
+          result = await unpackBundle({ bundlePath, passphrase });
         } catch (err) {
-          if (err instanceof core2.BundleError) {
+          if (err instanceof BundleError) {
             process.stderr.write(
               JSON.stringify({
                 success: false,
@@ -36414,7 +36752,7 @@ var init_backup = __esm({
           for (const dbEntry of manifest.databases) {
             const src = path2.join(stagingDir, dbEntry.filename);
             if (!fs2.existsSync(src)) continue;
-            const dst = resolveDbTarget(projectRoot, dbEntry.name, core2.getCleoHome());
+            const dst = resolveDbTarget(projectRoot, dbEntry.name, getCleoHome3());
             fs2.mkdirSync(path2.dirname(dst), { recursive: true });
             const tmpDst = `${dst}.import-tmp-${Date.now()}`;
             fs2.copyFileSync(src, tmpDst);
@@ -36436,13 +36774,13 @@ var init_backup = __esm({
             const basename = path2.basename(jsonEntry.filename);
             let localGenerated;
             if (basename === CONFIG_JSON) {
-              localGenerated = core2.regenerateConfigJson(projectRoot).content;
+              localGenerated = regenerateConfigJson(projectRoot).content;
             } else if (basename === PROJECT_INFO_JSON) {
-              localGenerated = core2.regenerateProjectInfoJson(projectRoot).content;
+              localGenerated = regenerateProjectInfoJson(projectRoot).content;
             } else {
-              localGenerated = core2.regenerateProjectContextJson(projectRoot).content;
+              localGenerated = regenerateProjectContextJson(projectRoot).content;
             }
-            const report = core2.regenerateAndCompare({
+            const report = regenerateAndCompare({
               filename: basename,
               imported,
               localGenerated
@@ -36452,12 +36790,12 @@ var init_backup = __esm({
             fs2.mkdirSync(path2.dirname(targetPath), { recursive: true });
             fs2.writeFileSync(targetPath, JSON.stringify(report.applied, null, 2), "utf-8");
           }
-          const cleoVersion = core2.getCleoVersion();
-          const conflictMd = core2.buildConflictReport({
+          const cleoVersion = getCleoVersion();
+          const conflictMd = buildConflictReport({
             reports: jsonReports,
             bundlePath,
             sourceMachineFingerprint: manifest.backup.machineFingerprint,
-            targetMachineFingerprint: sha256OfMachineKey(core2.getCleoHome()),
+            targetMachineFingerprint: sha256OfMachineKey(getCleoHome3()),
             cleoVersion,
             schemaWarnings: warnings.map((w) => ({
               db: w.db,
@@ -36466,7 +36804,7 @@ var init_backup = __esm({
               severity: w.severity
             }))
           });
-          core2.writeConflictReport(projectRoot, conflictMd);
+          writeConflictReport(projectRoot, conflictMd);
           const importedDir = path2.join(projectRoot, CLEO_DIR_NAME, RESTORE_IMPORTED_SUBDIR);
           fs2.mkdirSync(importedDir, { recursive: true });
           for (const jsonEntry of manifest.json) {
@@ -36508,7 +36846,7 @@ var init_backup = __esm({
           );
           process.exitCode = 79;
         } finally {
-          core2.cleanupStaging(stagingDir);
+          cleanupStaging(stagingDir);
         }
       }
     });
@@ -36574,16 +36912,16 @@ var brain_exports = {};
 __export(brain_exports, {
   brainCommand: () => brainCommand
 });
+import { getProjectRoot as getProjectRoot24 } from "@cleocode/core";
 import {
   backfillBrainGraph,
   exportBrainAsGexf,
   exportBrainAsJson,
   getMemoryQualityReport,
   getPlasticityStats,
-  getProjectRoot as getProjectRoot24,
   purgeBrainNoise,
   runBrainMaintenance
-} from "@cleocode/core/internal";
+} from "@cleocode/core/memory";
 var maintenanceCommand, backfillBrainCommand, purgeCommand, plasticityStatsCommand, plasticityCommand, qualityCommand, exportCommand2, brainCommand;
 var init_brain2 = __esm({
   "packages/cleo/src/cli/commands/brain.ts"() {
@@ -36956,12 +37294,12 @@ var briefing_exports = {};
 __export(briefing_exports, {
   briefingCommand: () => briefingCommand
 });
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join9 } from "node:path";
 function resolveInjectionTemplatePath() {
-  const xdgConfig = process.env["XDG_CONFIG_HOME"] ?? join8(homedir2(), ".cleo");
-  return join8(xdgConfig, "templates", "CLEO-INJECTION.md");
+  const xdgConfig = process.env["XDG_CONFIG_HOME"] ?? join9(homedir3(), ".cleo");
+  return join9(xdgConfig, "templates", "CLEO-INJECTION.md");
 }
 function extractSection(content, sectionName) {
   const openTag = `<!-- CLEO-INJECTION:section=${sectionName} -->`;
@@ -36988,7 +37326,7 @@ function renderForAdapter(sectionName, content, format) {
 }
 async function runBriefingInject(sectionName, formatStr) {
   const templatePath = resolveInjectionTemplatePath();
-  if (!existsSync7(templatePath)) {
+  if (!existsSync8(templatePath)) {
     process.stderr.write(`[briefing inject] CLEO-INJECTION.md not found at ${templatePath}
 `);
     process.exitCode = 1;
@@ -37136,8 +37474,8 @@ var caamp_exports = {};
 __export(caamp_exports, {
   caampCommand: () => caampCommand
 });
-import { homedir as homedir3 } from "node:os";
-import { join as join9 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join10 } from "node:path";
 var dedupeCommand, caampCommand;
 var init_caamp = __esm({
   "packages/cleo/src/cli/commands/caamp.ts"() {
@@ -37172,20 +37510,20 @@ var init_caamp = __esm({
         if (args.file) {
           filePaths = [args.file];
         } else {
-          const home = homedir3();
+          const home = homedir4();
           filePaths = [
-            join9(home, ".agents", "AGENTS.md"),
+            join10(home, ".agents", "AGENTS.md"),
             // project-level AGENTS.md in cwd
-            join9(process.cwd(), "AGENTS.md")
+            join10(process.cwd(), "AGENTS.md")
           ];
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync16 } = await import("node:fs");
+          const { existsSync: existsSync17 } = await import("node:fs");
           const { readFile: readFile6 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync16(filePath)) {
+            if (!existsSync17(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -37283,13 +37621,13 @@ var cant_exports = {};
 __export(cant_exports, {
   cantCommand: () => cantCommand
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, isAbsolute, join as join10, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, isAbsolute, join as join11, resolve as resolve4 } from "node:path";
 function resolveFilePath(file) {
   return isAbsolute(file) ? file : resolve4(process.cwd(), file);
 }
 function ensureExists(filePath, operation) {
-  if (existsSync8(filePath)) return true;
+  if (existsSync9(filePath)) return true;
   cliError(`File not found: ${filePath}`, "E_FILE_READ");
   process.exitCode = 3;
   if (process.env["CLEO_DEBUG"]) humanWarn(`(operation: ${operation})`);
@@ -37449,7 +37787,7 @@ var init_cant = __esm({
             const projectRoot = process.cwd();
             let written = 0;
             for (const outputFile of result.outputFiles) {
-              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join10(projectRoot, outputFile.path);
+              const outputPath = isAbsolute(outputFile.path) ? outputFile.path : join11(projectRoot, outputFile.path);
               mkdirSync2(dirname5(outputPath), { recursive: true });
               writeFileSync3(outputPath, outputFile.content, "utf-8");
               written++;
@@ -38207,9 +38545,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartOutline } = await import("@cleocode/core/internal");
-            const { join: join28 } = await import("node:path");
+            const { join: join29 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join28(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join29(root, args.file);
             const result = smartOutline(absPath, root);
             if (result.errors.length > 0 && result.symbols.length === 0) {
               cliError(result.errors.join(", "), 1, { name: "E_OUTLINE_FAILED" });
@@ -38300,9 +38638,9 @@ var init_code = __esm({
           async run({ args }) {
             await requireTreeSitter();
             const { smartUnfold } = await import("@cleocode/core/internal");
-            const { join: join28 } = await import("node:path");
+            const { join: join29 } = await import("node:path");
             const root = process.cwd();
-            const absPath = args.file.startsWith("/") ? args.file : join28(root, args.file);
+            const absPath = args.file.startsWith("/") ? args.file : join29(root, args.file);
             const result = smartUnfold(absPath, args.symbol, root);
             if (!result.found) {
               const errs = result.errors.length > 0 ? `: ${result.errors.join(", ")}` : "";
@@ -39444,9 +39782,9 @@ var daemon_exports = {};
 __export(daemon_exports, {
   daemonCommand: () => daemonCommand
 });
-import { existsSync as existsSync9 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { getGCDaemonStatus, spawnGCDaemon, stopGCDaemon } from "@cleocode/core/gc/daemon.js";
 import {
@@ -39511,9 +39849,9 @@ async function showDaemonStatus(cleoDir, projectRoot) {
 }
 function resolveDaemonInstallerScript() {
   const filePath = fileURLToPath4(import.meta.url);
-  const candidate1 = join11(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
-  if (existsSync9(candidate1)) return candidate1;
-  const candidate2 = join11(
+  const candidate1 = join12(filePath, "..", "..", "..", "scripts", "install-daemon-service.mjs");
+  if (existsSync10(candidate1)) return candidate1;
+  const candidate2 = join12(
     filePath,
     "..",
     "..",
@@ -39548,7 +39886,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join12(homedir5(), ".cleo");
         const foreground = args.foreground ?? false;
         if (foreground) {
           const projectRoot = process.cwd();
@@ -39585,13 +39923,13 @@ var init_daemon = __esm({
             {
               pid,
               cleoDir,
-              logs: join11(cleoDir, "logs", "gc.log"),
+              logs: join12(cleoDir, "logs", "gc.log"),
               message: `GC daemon started (PID ${pid})`
             },
             {
               command: "daemon",
               operation: "daemon.start",
-              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join11(cleoDir, "logs", "gc.log")}`
+              message: `GC daemon started (PID ${pid}) \u2014 Logs: ${join12(cleoDir, "logs", "gc.log")}`
             }
           );
         } catch (err) {
@@ -39621,7 +39959,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join12(homedir5(), ".cleo");
         try {
           const stopResult = await stopGCDaemon(cleoDir);
           cliOutput(stopResult, {
@@ -39659,7 +39997,7 @@ var init_daemon = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join12(homedir5(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -39757,7 +40095,7 @@ var init_daemon = __esm({
       },
       async run({ args, cmd, rawArgs }) {
         if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
-        const cleoDir = args["cleo-dir"] ?? join11(homedir4(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join12(homedir5(), ".cleo");
         await showDaemonStatus(cleoDir, process.cwd());
       }
     });
@@ -40220,12 +40558,12 @@ var detect_drift_exports = {};
 __export(detect_drift_exports, {
   detectDriftCommand: () => detectDriftCommand
 });
-import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync11 } from "node:fs";
-import { dirname as dirname6, join as join12 } from "node:path";
+import { existsSync as existsSync11, readdirSync, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname6, join as join13 } from "node:path";
 function findProjectRoot() {
   let currentDir = process.cwd();
   while (currentDir !== "/") {
-    if (existsSync10(join12(currentDir, "package.json"))) {
+    if (existsSync11(join13(currentDir, "package.json"))) {
       return currentDir;
     }
     const parent = dirname6(currentDir);
@@ -40249,8 +40587,8 @@ var init_detect_drift = __esm({
       },
       async run() {
         const projectRoot = findProjectRoot();
-        const isCleoRepo = existsSync10(join12(projectRoot, "packages", "cleo", "src"));
-        const cleoSrcRoot = isCleoRepo ? join12(projectRoot, "packages", "cleo", "src") : join12(projectRoot, "src");
+        const isCleoRepo = existsSync11(join13(projectRoot, "packages", "cleo", "src"));
+        const cleoSrcRoot = isCleoRepo ? join13(projectRoot, "packages", "cleo", "src") : join13(projectRoot, "src");
         const safeRead = (filePath) => {
           try {
             return readFileSync11(filePath, "utf-8");
@@ -40264,8 +40602,8 @@ var init_detect_drift = __esm({
             checks: [],
             recommendations: []
           };
-          const injPath = join12(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (existsSync10(injPath)) {
+          const injPath = join13(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (existsSync11(injPath)) {
             const content = safeRead(injPath);
             userResult.checks.push({
               name: "Agent injection",
@@ -40316,10 +40654,10 @@ var init_detect_drift = __esm({
           }
         };
         try {
-          const specPath = join12(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
-          const registryPath = join12(cleoSrcRoot, "dispatch", "registry.ts");
-          const dispatchDomainsDir = join12(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync10(specPath)) {
+          const specPath = join13(projectRoot, "docs", "specs", "CLEO-OPERATION-CONSTITUTION.md");
+          const registryPath = join13(cleoSrcRoot, "dispatch", "registry.ts");
+          const dispatchDomainsDir = join13(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync11(specPath)) {
             addCheck("Gateway-to-spec sync", "fail", "CLEO-OPERATION-CONSTITUTION.md missing", [
               {
                 severity: "error",
@@ -40329,7 +40667,7 @@ var init_detect_drift = __esm({
                 recommendation: "Create docs/specs/CLEO-OPERATION-CONSTITUTION.md with canonical operation definitions"
               }
             ]);
-          } else if (!existsSync10(registryPath) || !existsSync10(dispatchDomainsDir)) {
+          } else if (!existsSync11(registryPath) || !existsSync11(dispatchDomainsDir)) {
             addCheck("Gateway-to-spec sync", "fail", "Dispatch registry or domains missing", [
               {
                 severity: "error",
@@ -40387,9 +40725,9 @@ var init_detect_drift = __esm({
           ]);
         }
         try {
-          const cliDir = join12(cleoSrcRoot, "cli", "commands");
-          const coreDir = isCleoRepo ? join12(projectRoot, "packages", "core", "src") : join12(projectRoot, "src", "core");
-          if (!existsSync10(cliDir)) {
+          const cliDir = join13(cleoSrcRoot, "cli", "commands");
+          const coreDir = isCleoRepo ? join13(projectRoot, "packages", "core", "src") : join13(projectRoot, "src", "core");
+          if (!existsSync11(cliDir)) {
             addCheck("CLI-to-core sync", "fail", "CLI commands directory missing", [
               {
                 severity: "error",
@@ -40398,7 +40736,7 @@ var init_detect_drift = __esm({
                 recommendation: "Verify TypeScript source structure is intact"
               }
             ]);
-          } else if (!existsSync10(coreDir)) {
+          } else if (!existsSync11(coreDir)) {
             addCheck("CLI-to-core sync", "fail", "Core directory missing", [
               {
                 severity: "error",
@@ -40415,8 +40753,8 @@ var init_detect_drift = __esm({
           addCheck("CLI-to-core sync", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const domainsDir = join12(cleoSrcRoot, "dispatch", "domains");
-          if (!existsSync10(domainsDir)) {
+          const domainsDir = join13(cleoSrcRoot, "dispatch", "domains");
+          if (!existsSync11(domainsDir)) {
             addCheck("Domain handler coverage", "fail", "Dispatch domains directory missing", [
               {
                 severity: "error",
@@ -40433,8 +40771,8 @@ var init_detect_drift = __esm({
           addCheck("Domain handler coverage", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const matrixPath = join12(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
-          if (!existsSync10(matrixPath)) {
+          const matrixPath = join13(cleoSrcRoot, "dispatch", "lib", "capability-matrix.ts");
+          if (!existsSync11(matrixPath)) {
             addCheck("Capability matrix", "fail", "Capability matrix missing", [
               {
                 severity: "error",
@@ -40450,8 +40788,8 @@ var init_detect_drift = __esm({
           addCheck("Capability matrix", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const schemaPath = join12(projectRoot, "src", "store", "schema.ts");
-          if (!existsSync10(schemaPath)) {
+          const schemaPath = join13(projectRoot, "src", "store", "schema.ts");
+          if (!existsSync11(schemaPath)) {
             addCheck("Schema validation", "fail", "Schema definition missing", [
               {
                 severity: "error",
@@ -40485,10 +40823,10 @@ var init_detect_drift = __esm({
           addCheck("Schema validation", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const visionPath = join12(projectRoot, "docs", "concepts", "CLEO-VISION.md");
-          const specPath = join12(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
+          const visionPath = join13(projectRoot, "docs", "concepts", "CLEO-VISION.md");
+          const specPath = join13(projectRoot, "docs", "specs", "CLEO-PORTABLE-PROJECT-BRAIN-SPEC.md");
           const issues = [];
-          if (!existsSync10(visionPath)) {
+          if (!existsSync11(visionPath)) {
             issues.push({
               severity: "error",
               category: "vision",
@@ -40497,7 +40835,7 @@ var init_detect_drift = __esm({
               recommendation: "Create docs/concepts/CLEO-VISION.md with project vision"
             });
           }
-          if (!existsSync10(specPath)) {
+          if (!existsSync11(specPath)) {
             issues.push({
               severity: "error",
               category: "spec",
@@ -40541,8 +40879,8 @@ var init_detect_drift = __esm({
           addCheck("Canonical identity", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const injectionPath = join12(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
-          if (!existsSync10(injectionPath)) {
+          const injectionPath = join13(projectRoot, CLEO_DIR_NAME, TEMPLATES_SUBDIR, CLEO_INJECTION_MD);
+          if (!existsSync11(injectionPath)) {
             addCheck("Agent injection", "fail", "Agent injection template missing", [
               {
                 severity: "error",
@@ -40571,8 +40909,8 @@ var init_detect_drift = __esm({
           addCheck("Agent injection", "fail", `Error: ${getErrorMessage(e)}`);
         }
         try {
-          const exitCodesPath = join12(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
-          if (!existsSync10(exitCodesPath)) {
+          const exitCodesPath = join13(cleoSrcRoot, "dispatch", "lib", "exit-codes.ts");
+          if (!existsSync11(exitCodesPath)) {
             addCheck("Exit codes", "fail", "Exit codes definition missing", [
               {
                 severity: "error",
@@ -40746,7 +41084,7 @@ __export(docs_exports, {
   docsCommand: () => docsCommand
 });
 import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute2, join as join13, resolve as resolve5 } from "node:path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join14, resolve as resolve5 } from "node:path";
 import {
   buildDocsGraph,
   CleoError as CleoError3,
@@ -40762,7 +41100,7 @@ import {
   searchDocs as searchDocs2
 } from "@cleocode/core/internal";
 async function getScriptNames(projectRoot) {
-  const scriptsDir = join13(projectRoot, "scripts");
+  const scriptsDir = join14(projectRoot, "scripts");
   try {
     const files = await readdir(scriptsDir);
     return files.filter((f) => f.endsWith(".sh")).map((f) => f.replace(".sh", "")).sort();
@@ -40771,7 +41109,7 @@ async function getScriptNames(projectRoot) {
   }
 }
 async function getIndexedCommands(projectRoot) {
-  const indexPath = join13(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
+  const indexPath = join14(projectRoot, "docs", "commands", "COMMANDS-INDEX.json");
   const index = await readJson(indexPath);
   if (!index) return [];
   return index.commands.map((c) => c.name).sort();
@@ -40804,7 +41142,7 @@ async function runGapCheck(_projectRoot, filterId) {
     const reviewFiles = files.filter((f) => f.endsWith(".md"));
     for (const file of reviewFiles) {
       if (filterId && !file.includes(filterId)) continue;
-      const filePath = join13(reviewDir, file);
+      const filePath = join14(reviewDir, file);
       const content = await readFile2(filePath, "utf-8");
       const taskMatch = file.match(/^(T\d+)/);
       const taskId = taskMatch ? taskMatch[1] : "UNKNOWN";
@@ -41770,8 +42108,8 @@ __export(migrate_agents_v2_exports, {
   walkAgentsDir: () => walkAgentsDir
 });
 import { createHash as createHash2 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "node:fs";
-import { join as join14 } from "node:path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 import { getProjectRoot as getProjectRoot26, installAgentFromCant } from "@cleocode/core/internal";
 import { openCleoDb } from "@cleocode/core/store/open-cleo-db";
 function sha256Hex(bytes) {
@@ -41791,15 +42129,15 @@ function extractAgentName(source) {
   return headerMatch[1] ?? null;
 }
 function appendAuditLog(projectRoot, entry) {
-  const auditPath = join14(projectRoot, AUDIT_LOG_RELATIVE);
-  const auditDir = join14(auditPath, "..");
-  if (!existsSync11(auditDir)) {
+  const auditPath = join15(projectRoot, AUDIT_LOG_RELATIVE);
+  const auditDir = join15(auditPath, "..");
+  if (!existsSync12(auditDir)) {
     mkdirSync3(auditDir, { recursive: true });
   }
   appendFileSync2(auditPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
-  if (!existsSync11(scanDir)) return;
+  if (!existsSync12(scanDir)) return;
   let files;
   try {
     files = readdirSync2(scanDir).filter((f) => f.endsWith(".cant"));
@@ -41810,7 +42148,7 @@ function walkAgentsDir(db, scanDir, projectRoot, summary, verbose) {
     return;
   }
   for (const filename of files) {
-    const cantPath = join14(scanDir, filename);
+    const cantPath = join15(scanDir, filename);
     const relPath = cantPath.replace(`${projectRoot}/`, "");
     let sourceBytes;
     let sourceText;
@@ -41907,9 +42245,9 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   const { db: _sdDb } = await openCleoDb("signaldock");
   const db = _sdDb;
   try {
-    const canonicalDir = join14(projectRoot, ".cleo", "cant", "agents");
+    const canonicalDir = join15(projectRoot, ".cleo", "cant", "agents");
     walkAgentsDir(db, canonicalDir, projectRoot, summary, verbose);
-    const legacyDir = join14(projectRoot, ".cleo", "agents");
+    const legacyDir = join15(projectRoot, ".cleo", "agents");
     walkAgentsDir(db, legacyDir, projectRoot, summary, verbose);
   } finally {
     db.close();
@@ -41917,8 +42255,8 @@ async function runMigrateAgentsV2(projectRoot, verbose = true) {
   return summary;
 }
 function readMigrationConflicts(projectRoot) {
-  const auditPath = join14(projectRoot, AUDIT_LOG_RELATIVE);
-  if (!existsSync11(auditPath)) return [];
+  const auditPath = join15(projectRoot, AUDIT_LOG_RELATIVE);
+  if (!existsSync12(auditPath)) return [];
   let raw;
   try {
     raw = readFileSync12(auditPath, "utf8");
@@ -42002,10 +42340,14 @@ __export(doctor_exports, {
   doctorCommand: () => doctorCommand2
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join15 } from "node:path";
-import { getProjectRoot as getProjectRoot27, quarantineRogueCleoDir, scanRogueCleoDirs } from "@cleocode/core/internal";
+import { join as join16 } from "node:path";
+import { getProjectRoot as getProjectRoot27 } from "@cleocode/core";
+import {
+  quarantineRogueCleoDir,
+  scanRogueCleoDirs
+} from "@cleocode/core/system/rogue-cleo-detector.js";
 async function scanTestFixturesInProd(projectRoot) {
-  const { getDb: getDb3, getNativeDb } = await import("@cleocode/core/internal");
+  const { getDb: getDb3, getNativeDb } = await import("@cleocode/core/store/sqlite.js");
   await getDb3(projectRoot);
   const nativeDb = getNativeDb();
   if (!nativeDb) return [];
@@ -42037,8 +42379,8 @@ async function scanTestFixturesInProd(projectRoot) {
 }
 async function quarantineTestFixtures(projectRoot, matches) {
   if (matches.length === 0) return 0;
-  const cleoDir = join15(projectRoot, ".cleo");
-  const quarantineDir = join15(
+  const cleoDir = join16(projectRoot, ".cleo");
+  const quarantineDir = join16(
     cleoDir,
     "quarantine",
     `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
@@ -42046,10 +42388,10 @@ async function quarantineTestFixtures(projectRoot, matches) {
   mkdirSync4(quarantineDir, { recursive: true });
   const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
   writeFileSync4(
-    join15(quarantineDir, "manifest.jsonl"),
+    join16(quarantineDir, "manifest.jsonl"),
     manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
   );
-  const { getNativeDb } = await import("@cleocode/core/internal");
+  const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
   const nativeDb = getNativeDb();
   if (nativeDb) {
     for (const m of matches) {
@@ -42224,7 +42566,7 @@ var init_doctor = __esm({
         progress.start();
         try {
           if (args.brain) {
-            const { computeBrainHealthDashboard } = await import("@cleocode/core/internal");
+            const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
             const projectRoot = getProjectRoot27();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
@@ -42382,8 +42724,8 @@ var init_doctor = __esm({
             }
           } else if (args["scan-stray-nexus-dbs"]) {
             progress.step(0, "Scanning for stray nexus.db files");
-            const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/internal");
-            const { getCleoHome: getCleoHome3 } = await import("@cleocode/core/internal");
+            const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
+            const { getCleoHome: getCleoHome3 } = await import("@cleocode/core");
             const cleoHome = getCleoHome3();
             const projectRoot = getProjectRoot27();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
@@ -42408,7 +42750,7 @@ var init_doctor = __esm({
             cliOutput(report, { command: "doctor", operation: "doctor.scan-stray-nexus-dbs" });
           } else if (args["audit-worktrees"]) {
             progress.step(0, "Auditing orphaned agent worktrees");
-            const { auditOrphanWorktrees } = await import("@cleocode/core/internal");
+            const { auditOrphanWorktrees } = await import("@cleocode/core/gc/index.js");
             const checkResult = auditOrphanWorktrees();
             progress.complete(`Worktree audit complete \u2014 ${checkResult.status}`);
             cliOutput(checkResult, { command: "doctor", operation: "doctor.audit-worktrees" });
@@ -42417,7 +42759,7 @@ var init_doctor = __esm({
             }
           } else if (args["audit-temp"]) {
             progress.step(0, "Auditing orphaned CLEO temp directories");
-            const { auditOrphanTempDirs } = await import("@cleocode/core/internal");
+            const { auditOrphanTempDirs } = await import("@cleocode/core/gc/index.js");
             const checkResult = await auditOrphanTempDirs();
             progress.complete(`Temp audit complete \u2014 ${checkResult.status}`);
             cliOutput(checkResult, { command: "doctor", operation: "doctor.audit-temp" });
@@ -42499,7 +42841,7 @@ __export(event_exports, {
   orchestratorCommand: () => orchestratorCommand
 });
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { cwd as processCwd } from "node:process";
 import { appendEvent } from "@cleocode/core/events/event-bus.js";
 function resolveProjectRoot3(arg) {
@@ -42622,7 +42964,7 @@ var init_event = __esm({
         const agentIdFilter = args.agent;
         const showAll = args.all === true;
         const lines = parseInt(args.lines ?? "20", 10);
-        const eventsDir = join16(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join17(projectRoot, ".cleo", "agent-events");
         try {
           let files = [];
           try {
@@ -42660,7 +43002,7 @@ var init_event = __esm({
           for (const file of filesToTail) {
             const agentId = file.replace(".jsonl", "");
             const { readFileSync: readFileSync18 } = await import("node:fs");
-            const content = readFileSync18(join16(eventsDir, file), "utf-8");
+            const content = readFileSync18(join17(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -42730,7 +43072,7 @@ var init_event = __esm({
         const epicFilter = args.epic;
         const follow = args.follow === true;
         const lines = parseInt(args.lines ?? "50", 10);
-        const eventsDir = join16(projectRoot, ".cleo", "agent-events");
+        const eventsDir = join17(projectRoot, ".cleo", "agent-events");
         let files = [];
         try {
           const entries = await readdir2(eventsDir);
@@ -42756,7 +43098,7 @@ var init_event = __esm({
           const agentId = file.replace(".jsonl", "");
           try {
             const { readFileSync: readFileSync18 } = await import("node:fs");
-            const content = readFileSync18(join16(eventsDir, file), "utf-8");
+            const content = readFileSync18(join17(eventsDir, file), "utf-8");
             const eventLines = content.trim().split("\n").filter(Boolean);
             const tail = eventLines.slice(-lines);
             if (jsonMode) {
@@ -43130,8 +43472,8 @@ var gc_exports = {};
 __export(gc_exports, {
   gcCommand: () => gcCommand
 });
-import { homedir as homedir5, tmpdir } from "node:os";
-import { join as join17 } from "node:path";
+import { homedir as homedir6, tmpdir } from "node:os";
+import { join as join18 } from "node:path";
 import { pruneOrphanTempDirs, pruneOrphanWorktrees } from "@cleocode/core/gc/cleanup.js";
 import { runGC } from "@cleocode/core/gc/runner.js";
 import { readGCState } from "@cleocode/core/gc/state.js";
@@ -43170,7 +43512,7 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join17(homedir5(), ".cleo");
+        const cleoDir = args["cleo-dir"] ?? join18(homedir6(), ".cleo");
         const dryRun = args["dry-run"];
         try {
           const gcResult = await runGC({ cleoDir, dryRun });
@@ -43212,8 +43554,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const cleoDir = args["cleo-dir"] ?? join17(homedir5(), ".cleo");
-        const statePath = join17(cleoDir, "gc-state.json");
+        const cleoDir = args["cleo-dir"] ?? join18(homedir6(), ".cleo");
+        const statePath = join18(cleoDir, "gc-state.json");
         try {
           const state = await readGCState(statePath);
           const diskStr = state.lastDiskUsedPct !== null ? `${state.lastDiskUsedPct.toFixed(1)}%` : "unknown";
@@ -43266,8 +43608,8 @@ var init_gc = __esm({
         }
       },
       async run({ args }) {
-        const xdgData = process.env["XDG_DATA_HOME"] ?? join17(homedir5(), ".local", "share");
-        const worktreesRoot = args["worktrees-root"] ?? join17(xdgData, "cleo", "worktrees");
+        const xdgData = process.env["XDG_DATA_HOME"] ?? join18(homedir6(), ".local", "share");
+        const worktreesRoot = args["worktrees-root"] ?? join18(xdgData, "cleo", "worktrees");
         const projectHash = args["project-hash"];
         const dryRun = args["dry-run"];
         const preserveRaw = args["preserve-tasks"];
@@ -43377,8 +43719,8 @@ __export(generate_changelog_exports, {
   generateChangelogCommand: () => generateChangelogCommand
 });
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname8, join as join18 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname8, join as join19 } from "node:path";
 import { CleoError as CleoError4, formatError as formatError6, getConfigPath, getProjectRoot as getProjectRoot28 } from "@cleocode/core";
 function getChangelogSource(cwd) {
   const configPath = getConfigPath(cwd);
@@ -43543,8 +43885,8 @@ var init_generate_changelog = __esm({
           const targetPlatform = args.platform;
           const dryRun = args["dry-run"] === true;
           const sourceFile = getChangelogSource();
-          const sourcePath = join18(getProjectRoot28(), sourceFile);
-          if (!existsSync12(sourcePath)) {
+          const sourcePath = join19(getProjectRoot28(), sourceFile);
+          if (!existsSync13(sourcePath)) {
             throw new CleoError4(4 /* NOT_FOUND */, `Changelog source not found: ${sourcePath}`);
           }
           const sourceContent = readFileSync13(sourcePath, "utf-8");
@@ -43556,7 +43898,7 @@ var init_generate_changelog = __esm({
             const outputPath = platformConfig?.path ?? getDefaultOutputPath(targetPlatform);
             const content = generateForPlatform(targetPlatform, sourceContent, repoSlug, limit);
             if (!dryRun) {
-              const fullPath = join18(getProjectRoot28(), outputPath);
+              const fullPath = join19(getProjectRoot28(), outputPath);
               mkdirSync5(dirname8(fullPath), { recursive: true });
               writeFileSync5(fullPath, content, "utf-8");
             }
@@ -43577,7 +43919,7 @@ var init_generate_changelog = __esm({
                 limit
               );
               if (!dryRun) {
-                const fullPath = join18(getProjectRoot28(), platformConfig.path);
+                const fullPath = join19(getProjectRoot28(), platformConfig.path);
                 mkdirSync5(dirname8(fullPath), { recursive: true });
                 writeFileSync5(fullPath, content, "utf-8");
               }
@@ -44717,8 +45059,8 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
-import { dirname as dirname9, join as join19, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
+import { dirname as dirname9, join as join20, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import {
   CleoError as CleoError5,
@@ -44729,11 +45071,11 @@ import {
 function getGitignoreTemplate() {
   try {
     const thisFile = fileURLToPath5(import.meta.url);
-    const packageRoot = join19(thisFile, "..", "..", "..", "..");
-    const localTemplatePath = join19(packageRoot, "templates", "cleo-gitignore");
-    const monorepoTemplatePath = join19(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync13(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync13(templatePath)) {
+    const packageRoot = join20(thisFile, "..", "..", "..", "..");
+    const localTemplatePath = join20(packageRoot, "templates", "cleo-gitignore");
+    const monorepoTemplatePath = join20(packageRoot, "..", "..", "templates", "cleo-gitignore");
+    const templatePath = existsSync14(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync14(templatePath)) {
       return readFileSync14(templatePath, "utf-8");
     }
   } catch {
@@ -44743,7 +45085,7 @@ function getGitignoreTemplate() {
 function getWorkflowTemplatesDir() {
   const thisFile = fileURLToPath5(import.meta.url);
   const packageRoot = resolve6(dirname9(thisFile), "..", "..", "..", "..");
-  return join19(packageRoot, "templates", "workflows");
+  return join20(packageRoot, "templates", "workflows");
 }
 var initCommand2;
 var init_init = __esm({
@@ -47235,17 +47577,19 @@ __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join21 } from "node:path";
+import { getProjectRoot as getProjectRoot30 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
-  getBrainNativeDb as getBrainNativeDb3,
   getDreamStatus,
-  getProjectRoot as getProjectRoot30,
+  getTierStats,
   runConsolidation,
+  scanDuplicateEntries,
+  setEntryTier,
   triggerManualDream
-} from "@cleocode/core/internal";
+} from "@cleocode/core/memory";
 function parseMemoryFileFrontmatter(raw) {
   const lines = raw.split("\n");
   if (!lines[0]?.trim().startsWith("---")) {
@@ -47278,7 +47622,7 @@ ${body}`).digest("hex").slice(0, 16);
 }
 function loadImportHashes(stateFile) {
   try {
-    if (!existsSync14(stateFile)) return /* @__PURE__ */ new Set();
+    if (!existsSync15(stateFile)) return /* @__PURE__ */ new Set();
     const raw = readFileSync15(stateFile, "utf-8");
     const parsed = JSON.parse(raw);
     return new Set(parsed.hashes);
@@ -47288,7 +47632,7 @@ function loadImportHashes(stateFile) {
 }
 function saveImportHashes(stateFile, hashes) {
   const dir = stateFile.slice(0, stateFile.lastIndexOf("/"));
-  if (!existsSync14(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync15(dir)) mkdirSync6(dir, { recursive: true });
   writeFileSync6(stateFile, JSON.stringify({ hashes: [...hashes] }, null, 2), "utf-8");
 }
 function makeMemorySubcommand(opts) {
@@ -48266,7 +48610,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const root = getProjectRoot30();
         try {
-          const { runObserver, runReflector } = await import("@cleocode/core/internal");
+          const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
             thresholdOverride: 1
           });
@@ -48306,65 +48650,13 @@ var init_memory3 = __esm({
       async run({ args }) {
         const root = getProjectRoot30();
         try {
-          const { getBrainDb: getBrainDbInner, getBrainNativeDb: getBrainNativeDbInner } = await import("@cleocode/core/internal");
-          await getBrainDbInner(root);
-          const nativeDb = getBrainNativeDbInner();
-          if (!nativeDb) {
-            cliError("brain.db is unavailable", "E_INTERNAL", { name: "E_INTERNAL" });
-            process.exit(1);
-            return;
-          }
-          const tables = [
-            { name: "brain_observations", hashCol: "content_hash", labelCol: "title" },
-            { name: "brain_decisions", hashCol: "content_hash", labelCol: "decision" },
-            { name: "brain_patterns", hashCol: "content_hash", labelCol: "pattern" },
-            { name: "brain_learnings", hashCol: "content_hash", labelCol: "insight" }
-          ];
-          const groups = [];
-          for (const t of tables) {
-            let dupRows;
-            try {
-              dupRows = nativeDb.prepare(
-                `SELECT ${t.hashCol} AS hash, COUNT(*) AS cnt
-               FROM ${t.name}
-               WHERE ${t.hashCol} IS NOT NULL
-                 AND invalid_at IS NULL
-               GROUP BY ${t.hashCol}
-               HAVING cnt > 1
-               ORDER BY cnt DESC
-               LIMIT 20`
-              ).all();
-            } catch {
-              dupRows = [];
-            }
-            for (const row of dupRows) {
-              let sampleRows;
-              try {
-                sampleRows = nativeDb.prepare(
-                  `SELECT id, COALESCE(${t.labelCol}, id) AS label
-                 FROM ${t.name}
-                 WHERE ${t.hashCol} = ?
-                   AND invalid_at IS NULL
-                 LIMIT 3`
-                ).all(row.hash);
-              } catch {
-                sampleRows = [];
-              }
-              groups.push({
-                table: t.name,
-                hash: row.hash,
-                count: row.cnt,
-                samples: sampleRows.map((r) => `${r.id}: ${String(r.label).slice(0, 80)}`)
-              });
-            }
-          }
-          const totalDups = groups.reduce((sum, g) => sum + (g.count - 1), 0);
+          await getBrainDb2(root);
+          const { totalDuplicateRows, groups } = await scanDuplicateEntries();
           if (args.apply) {
-            const { runConsolidation: runConsolidationInner } = await import("@cleocode/core/internal");
-            const result = await runConsolidationInner(root);
+            const result = await runConsolidation(root);
             cliOutput(
               {
-                totalDuplicateRows: totalDups,
+                totalDuplicateRows,
                 groups,
                 applied: true,
                 consolidation: { deduplicated: result.deduplicated }
@@ -48373,7 +48665,7 @@ var init_memory3 = __esm({
             );
           } else {
             cliOutput(
-              { totalDuplicateRows: totalDups, groups, applied: false },
+              { totalDuplicateRows, groups, applied: false },
               { command: "memory-dedup-scan", operation: "memory.dedup-scan" }
             );
           }
@@ -48400,16 +48692,16 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const sourceDir = args.from ?? join20(homedir6(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
+        const sourceDir = args.from ?? join21(homedir7(), ".claude", "projects", "-mnt-projects-cleocode", "memory");
         const isDryRun = !!args["dry-run"];
         const projectRoot = getProjectRoot30();
-        const stateFile = join20(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
-        if (!existsSync14(sourceDir)) {
+        const stateFile = join21(projectRoot, CLEO_DIR_NAME, MIGRATE_MEMORY_HASHES_JSON);
+        if (!existsSync15(sourceDir)) {
           cliError(`Source directory not found: ${sourceDir}`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
           process.exit(1);
           return;
         }
-        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join20(sourceDir, f));
+        const files = readdirSync3(sourceDir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").map((f) => join21(sourceDir, f));
         const importedHashes = isDryRun ? /* @__PURE__ */ new Set() : loadImportHashes(stateFile);
         const stats = { total: files.length, imported: 0, skipped: 0, errors: 0 };
         const importedEntries = [];
@@ -48618,68 +48910,12 @@ var init_memory3 = __esm({
         const root = getProjectRoot30();
         try {
           await getBrainDb2(root);
-          const nativeDb = getBrainNativeDb3();
-          if (!nativeDb) {
-            cliError("brain.db not available", "E_INTERNAL", { name: "E_INTERNAL" });
-            process.exit(1);
-            return;
-          }
-          const tables = ["brain_observations", "brain_learnings", "brain_patterns", "brain_decisions"];
+          const result = await getTierStats(root);
           const distribution = {};
-          for (const tbl of tables) {
-            try {
-              const rows = nativeDb.prepare(
-                `SELECT COALESCE(memory_tier, 'short') as tier, COUNT(*) as cnt
-               FROM ${tbl}
-               WHERE invalid_at IS NULL
-               GROUP BY memory_tier`
-              ).all();
-              distribution[tbl] = { short: 0, medium: 0, long: 0 };
-              for (const r of rows) {
-                distribution[tbl][r.tier] = r.cnt;
-              }
-            } catch {
-              distribution[tbl] = { short: 0, medium: 0, long: 0 };
-            }
-          }
-          const age7dMs = 7 * 24 * 60 * 60 * 1e3;
-          const now = Date.now();
-          const countdown = [];
-          for (const tbl of tables) {
-            const dateCol = tbl === "brain_patterns" ? "extracted_at" : "created_at";
-            try {
-              const rawRows = nativeDb.prepare(
-                `SELECT id, ${dateCol} as created_at, citation_count, verified, quality_score
-               FROM ${tbl}
-               WHERE memory_tier = 'medium'
-                 AND invalid_at IS NULL
-                 AND (citation_count >= 5 OR verified = 1)
-               ORDER BY ${dateCol} ASC
-               LIMIT 20`
-              ).all();
-              const rows = rawRows.map((raw) => {
-                const r = raw;
-                return {
-                  id: String(r["id"] ?? ""),
-                  tbl,
-                  created_at: String(r["created_at"] ?? ""),
-                  citation_count: Number(r["citation_count"] ?? 0),
-                  verified: Number(r["verified"] ?? 0),
-                  quality_score: r["quality_score"] == null ? null : Number(r["quality_score"])
-                };
-              });
-              for (const r of rows) {
-                const entryMs = new Date(r.created_at.replace(" ", "T")).getTime();
-                const promotionMs = entryMs + age7dMs;
-                const daysUntil = Math.max(0, (promotionMs - now) / (24 * 60 * 60 * 1e3));
-                const track = r.citation_count >= 5 ? `citation (${r.citation_count})` : "verified";
-                countdown.push({ id: r.id, table: tbl, daysUntil, track });
-              }
-            } catch {
-            }
+          for (const t of result.tables) {
+            distribution[t.table] = { short: t.short, medium: t.medium, long: t.long };
           }
-          countdown.sort((a, b) => a.daysUntil - b.daysUntil);
-          const top10 = countdown.slice(0, 10);
+          const top10 = result.upcomingLongPromotions.slice(0, 10);
           cliOutput(
             { distribution, upcomingLongPromotions: top10 },
             { command: "memory-tier-stats", operation: "memory.tier.stats" }
@@ -48729,64 +48965,26 @@ var init_memory3 = __esm({
         }
         try {
           await getBrainDb2(root);
-          const nativeDb = getBrainNativeDb3();
-          if (!nativeDb) {
-            cliError("brain.db not available", "E_INTERNAL", { name: "E_INTERNAL" });
-            process.exit(1);
-            return;
-          }
-          const tables = ["brain_observations", "brain_learnings", "brain_patterns", "brain_decisions"];
-          const now = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-          let found = false;
-          let fromTier = "";
-          let foundTable = "";
-          for (const tbl of tables) {
-            try {
-              const row = nativeDb.prepare(
-                `SELECT id, memory_tier FROM ${tbl} WHERE id = ? AND invalid_at IS NULL LIMIT 1`
-              ).get(args.id);
-              if (row) {
-                found = true;
-                fromTier = row.memory_tier ?? "short";
-                foundTable = tbl;
-                if (fromTier === targetTier) {
-                  cliError(`Entry ${args.id} is already at tier '${targetTier}'`, "E_VALIDATION", {
-                    name: "E_VALIDATION"
-                  });
-                  process.exit(1);
-                }
-                const tierOrder = { short: 0, medium: 1, long: 2 };
-                const fromOrd = tierOrder[fromTier] ?? 0;
-                const toOrd = tierOrder[targetTier] ?? 0;
-                if (toOrd <= fromOrd) {
-                  cliError(
-                    `Cannot promote: '${targetTier}' is not higher than current tier '${fromTier}'. Use 'demote' to lower tiers.`,
-                    "E_VALIDATION",
-                    { name: "E_VALIDATION" }
-                  );
-                  process.exit(1);
-                }
-                nativeDb.prepare(`UPDATE ${tbl} SET memory_tier = ?, updated_at = ? WHERE id = ?`).run(targetTier, now, args.id);
-                break;
-              }
-            } catch {
-            }
-          }
-          if (!found) {
-            cliError(
-              `Entry '${args.id}' not found in any brain table (or is invalidated)`,
-              "E_NOT_FOUND",
-              { name: "E_NOT_FOUND" }
-            );
-            process.exit(1);
-          }
+          const result = await setEntryTier(args.id, targetTier, "promote");
           cliOutput(
-            { id: args.id, table: foundTable, fromTier, toTier: targetTier, reason, promotedAt: now },
+            {
+              id: result.id,
+              table: result.table,
+              fromTier: result.fromTier,
+              toTier: result.toTier,
+              reason,
+              promotedAt: result.updatedAt
+            },
             { command: "memory-tier-promote", operation: "memory.tier.promote" }
           );
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          cliError(`Tier promote failed: ${message}`, "E_INTERNAL", { name: "E_INTERNAL" });
+          const isValidation = message.includes("already at tier") || message.includes("Cannot promote") || message.includes("not found");
+          if (isValidation) {
+            cliError(message, "E_VALIDATION", { name: "E_VALIDATION" });
+          } else {
+            cliError(`Tier promote failed: ${message}`, "E_INTERNAL", { name: "E_INTERNAL" });
+          }
           process.exit(1);
         }
       }
@@ -48833,72 +49031,26 @@ var init_memory3 = __esm({
         }
         try {
           await getBrainDb2(root);
-          const nativeDb = getBrainNativeDb3();
-          if (!nativeDb) {
-            cliError("brain.db not available", "E_INTERNAL", { name: "E_INTERNAL" });
-            process.exit(1);
-            return;
-          }
-          const tables = ["brain_observations", "brain_learnings", "brain_patterns", "brain_decisions"];
-          const now = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-          let found = false;
-          let fromTier = "";
-          let foundTable = "";
-          for (const tbl of tables) {
-            try {
-              const row = nativeDb.prepare(
-                `SELECT id, memory_tier FROM ${tbl} WHERE id = ? AND invalid_at IS NULL LIMIT 1`
-              ).get(args.id);
-              if (row) {
-                found = true;
-                fromTier = row.memory_tier ?? "short";
-                foundTable = tbl;
-                if (fromTier === "long" && !args.force) {
-                  cliError(
-                    `Entry ${args.id} is in long tier. Long-tier entries are permanent. Use --force to override.`,
-                    "E_VALIDATION",
-                    { name: "E_VALIDATION" }
-                  );
-                  process.exit(1);
-                }
-                if (fromTier === targetTier) {
-                  cliError(`Entry ${args.id} is already at tier '${targetTier}'`, "E_VALIDATION", {
-                    name: "E_VALIDATION"
-                  });
-                  process.exit(1);
-                }
-                const tierOrder = { short: 0, medium: 1, long: 2 };
-                const fromOrd = tierOrder[fromTier] ?? 0;
-                const toOrd = tierOrder[targetTier] ?? 0;
-                if (toOrd >= fromOrd) {
-                  cliError(
-                    `Cannot demote: '${targetTier}' is not lower than current tier '${fromTier}'. Use 'promote' to raise tiers.`,
-                    "E_VALIDATION",
-                    { name: "E_VALIDATION" }
-                  );
-                  process.exit(1);
-                }
-                nativeDb.prepare(`UPDATE ${tbl} SET memory_tier = ?, updated_at = ? WHERE id = ?`).run(targetTier, now, args.id);
-                break;
-              }
-            } catch {
-            }
-          }
-          if (!found) {
-            cliError(
-              `Entry '${args.id}' not found in any brain table (or is invalidated)`,
-              "E_NOT_FOUND",
-              { name: "E_NOT_FOUND" }
-            );
-            process.exit(1);
-          }
+          const result = await setEntryTier(args.id, targetTier, "demote", { force: !!args.force });
           cliOutput(
-            { id: args.id, table: foundTable, fromTier, toTier: targetTier, reason, demotedAt: now },
+            {
+              id: result.id,
+              table: result.table,
+              fromTier: result.fromTier,
+              toTier: result.toTier,
+              reason,
+              demotedAt: result.updatedAt
+            },
             { command: "memory-tier-demote", operation: "memory.tier.demote" }
           );
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          cliError(`Tier demote failed: ${message}`, "E_INTERNAL", { name: "E_INTERNAL" });
+          const isValidation = message.includes("already at tier") || message.includes("Cannot demote") || message.includes("not found") || message.includes("long tier") || message.includes("Long-tier");
+          if (isValidation) {
+            cliError(message, "E_VALIDATION", { name: "E_VALIDATION" });
+          } else {
+            cliError(`Tier demote failed: ${message}`, "E_INTERNAL", { name: "E_INTERNAL" });
+          }
           process.exit(1);
         }
       }
@@ -49546,13 +49698,13 @@ __export(nexus_exports, {
   nexusCommand: () => nexusCommand
 });
 import { appendFile, mkdir as mkdir2 } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import path4 from "node:path";
 import { generateGexf, getSymbolImpact } from "@cleocode/core/nexus";
 async function appendDeprecationTelemetry(op, replacement) {
   try {
     const dateStr = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const dir = path4.join(homedir7(), ".local", "state", "cleo", "nexus-deprecation");
+    const dir = path4.join(homedir8(), ".local", "state", "cleo", "nexus-deprecation");
     await mkdir2(dir, { recursive: true });
     const record = JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), op, replacement }) + "\n";
     await appendFile(path4.join(dir, `${dateStr}.jsonl`), record, "utf8");
@@ -49806,9 +49958,9 @@ var init_nexus4 = __esm({
       args: {},
       async run() {
         try {
-          const { homedir: homedir9 } = await import("node:os");
+          const { homedir: homedir10 } = await import("node:os");
           const { installNexusAugmentHook } = await import("@cleocode/core/internal");
-          const homeDir = homedir9();
+          const homeDir = homedir10();
           installNexusAugmentHook(homeDir);
           cliOutput({ homeDir }, { command: "nexus-setup", operation: "nexus.setup" });
         } catch (err) {
@@ -53781,7 +53933,7 @@ var init_provenance2 = __esm({
         await dispatchFromCli(
           "mutate",
           "provenance",
-          "provenance.backfill",
+          "backfill",
           {
             since: args.since,
             forceOverwrite: args["force-overwrite"] === true,
@@ -53821,7 +53973,7 @@ var init_provenance2 = __esm({
         await dispatchFromCli(
           "query",
           "provenance",
-          "provenance.verify",
+          "verify",
           {
             ...version ? { version } : {},
             all,
@@ -54458,7 +54610,7 @@ var init_release3 = __esm({
         await dispatchFromCli(
           "mutate",
           "release",
-          "release.plan",
+          "plan",
           {
             version: args.version,
             epicId: args.epic,
@@ -54472,7 +54624,7 @@ var init_release3 = __esm({
         await dispatchFromCli(
           "mutate",
           "release",
-          "release.open",
+          "open",
           {
             version: args.version
           },
@@ -54680,7 +54832,7 @@ var init_release3 = __esm({
         await dispatchFromCli(
           "mutate",
           "release",
-          "release.plan",
+          "plan",
           {
             version: args.version,
             epicId: args.epic,
@@ -54721,7 +54873,7 @@ var init_release3 = __esm({
         await dispatchFromCli(
           "mutate",
           "release",
-          "release.open",
+          "open",
           {
             version: args.version,
             workflow: args.workflow,
@@ -55620,8 +55772,7 @@ __export(restore_exports, {
 });
 import fs3 from "node:fs";
 import path5 from "node:path";
-import { CleoError as CleoError8, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
-import { getProjectRoot as getProjectRoot33 } from "@cleocode/core/internal";
+import { CleoError as CleoError8, getProjectRoot as getProjectRoot33, getTaskAccessor as getTaskAccessor3 } from "@cleocode/core";
 function parseMarkdownValue(raw) {
   const trimmed = raw.trim();
   if (trimmed === "_(not present)_" || trimmed === "") return void 0;
@@ -56107,7 +56258,7 @@ __export(revert_exports, {
   revertCommand: () => revertCommand
 });
 import { readFile as readFile3 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 import { cwd as processCwd2 } from "node:process";
 import { E_RECEIPT_NOT_FOUND } from "@cleocode/core/sentient/chain-walker.js";
 import { SENTIENT_STATE_FILE } from "@cleocode/core/sentient/daemon.js";
@@ -56160,7 +56311,7 @@ async function loadOwnerAttestation(attestationFilePath) {
   return obj;
 }
 async function loadOwnerPubkeys(projectRoot) {
-  const path6 = join21(projectRoot, OWNER_PUBKEYS_FILE);
+  const path6 = join22(projectRoot, OWNER_PUBKEYS_FILE);
   try {
     const raw = await readFile3(path6, "utf-8");
     const parsed = JSON.parse(raw);
@@ -56244,7 +56395,7 @@ var init_revert = __esm({
         if (attestation && allowedPubkeys.size > 0 && !allowedPubkeys.has(attestation.ownerPubkey)) {
           emitFailure2(
             E_OWNER_ATTESTATION_REQUIRED,
-            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join21(projectRoot, OWNER_PUBKEYS_FILE)}`,
+            `Attestation pubkey "${attestation.ownerPubkey}" is not in the owner allowlist at ${join22(projectRoot, OWNER_PUBKEYS_FILE)}`,
             jsonMode
           );
         }
@@ -56297,7 +56448,7 @@ ${lines}`
             identity,
             includeHuman
           });
-          const statePath = join21(projectRoot, SENTIENT_STATE_FILE);
+          const statePath = join22(projectRoot, SENTIENT_STATE_FILE);
           const state = await readSentientState(statePath);
           emitSuccess(
             {
@@ -56679,7 +56830,7 @@ __export(self_update_exports, {
 });
 import { execFile } from "node:child_process";
 import { readFile as readFile4 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 import * as readline2 from "node:readline";
 import { promisify } from "node:util";
 import {
@@ -56694,7 +56845,7 @@ import {
 async function getCurrentVersion() {
   const cleoHome = getCleoHome();
   try {
-    const content = await readFile4(join22(cleoHome, "VERSION"), "utf-8");
+    const content = await readFile4(join23(cleoHome, "VERSION"), "utf-8");
     return (content.split("\n")[0] ?? "unknown").trim();
   } catch {
     return "unknown";
@@ -56748,7 +56899,7 @@ async function writeRuntimeVersionMetadata(mode, source, version) {
   ];
   await import("node:fs/promises").then(
     ({ writeFile: writeFile3, mkdir: mkdir4 }) => mkdir4(cleoHome, { recursive: true }).then(
-      () => writeFile3(join22(cleoHome, "VERSION"), `${lines.join("\n")}
+      () => writeFile3(join23(cleoHome, "VERSION"), `${lines.join("\n")}
 `, "utf-8")
     )
   );
@@ -57159,7 +57310,7 @@ var sentient_exports = {};
 __export(sentient_exports, {
   sentientCommand: () => sentientCommand
 });
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 import { cwd as processCwd3 } from "node:process";
 import {
   getSentientDaemonStatus as getSentientDaemonStatus2,
@@ -57228,7 +57379,7 @@ var init_sentient3 = __esm({
             return;
           }
           if (dryRun) {
-            const statePath2 = join23(projectRoot, SENTIENT_STATE_FILE2);
+            const statePath2 = join24(projectRoot, SENTIENT_STATE_FILE2);
             const outcome = await safeRunTick({ projectRoot, statePath: statePath2, dryRun: true });
             emitSuccess2(
               { dryRun: true, outcome },
@@ -57344,7 +57495,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const dryRun = args["dry-run"] === true;
         try {
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunTick({ projectRoot, statePath, dryRun });
           emitSuccess2(
             { outcome, dryRun },
@@ -57396,7 +57547,7 @@ Logs:  ${logPath}`
         const jsonMode = args.json === true;
         const id = args.id;
         try {
-          const { getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { getDb: getDb3 } = await import("@cleocode/core/store/sqlite.js");
           const { tasks } = await import("@cleocode/core/store/tasks-schema");
           const { and, eq: eq2, like } = await import("drizzle-orm");
           const db = await getDb3(projectRoot);
@@ -57413,7 +57564,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "pending", updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -57448,7 +57599,7 @@ Logs:  ${logPath}`
         const id = args.id;
         const reason = args.reason ?? "rejected by owner";
         try {
-          const { getDb: getDb3 } = await import("@cleocode/core/internal");
+          const { getDb: getDb3 } = await import("@cleocode/core/store/sqlite.js");
           const { tasks } = await import("@cleocode/core/store/tasks-schema");
           const { and, eq: eq2, like } = await import("drizzle-orm");
           const db = await getDb3(projectRoot);
@@ -57465,7 +57616,7 @@ Logs:  ${logPath}`
             return;
           }
           await db.update(tasks).set({ status: "cancelled", cancellationReason: reason, cancelledAt: now, updatedAt: now }).where(eq2(tasks.id, id)).run();
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           await patchSentientState(statePath, {
             tier2Stats: {
@@ -57510,7 +57661,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const outcome = await safeRunProposeTick({ projectRoot, statePath });
           emitSuccess2(
             { outcome },
@@ -57530,7 +57681,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: true });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals enabled");
         } catch (err) {
@@ -57549,7 +57700,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const updated = await patchSentientState(statePath, { tier2Enabled: false });
           emitSuccess2({ tier2Enabled: updated.tier2Enabled }, jsonMode, "Tier-2 proposals disabled");
         } catch (err) {
@@ -57580,7 +57731,7 @@ Logs:  ${logPath}`
         const projectRoot = resolveProjectRoot6(args.project);
         const jsonMode = args.json === true;
         try {
-          const statePath = join23(projectRoot, SENTIENT_STATE_FILE2);
+          const statePath = join24(projectRoot, SENTIENT_STATE_FILE2);
           const state = await readSentientState2(statePath);
           emitSuccess2(
             {
@@ -58541,12 +58692,48 @@ var init_session4 = __esm({
 // packages/cleo/src/cli/lib/readline-wizard-io.ts
 import { stdin as input, stdout as output } from "node:process";
 import * as readline3 from "node:readline/promises";
-var ReadlineWizardIO;
+import { WizardFatalError, WizardInterruptError } from "@cleocode/core/setup";
+function stripBracketedPaste(raw) {
+  return raw.replace(/\x1b\[200~/g, "").replace(/\x1b\[201~/g, "").trim();
+}
+var SETUP_STDIN_CLOSED_CODE, StdinClosedError, ReadlineWizardIO;
 var init_readline_wizard_io = __esm({
   "packages/cleo/src/cli/lib/readline-wizard-io.ts"() {
     "use strict";
+    SETUP_STDIN_CLOSED_CODE = "E_SETUP_STDIN_CLOSED";
+    StdinClosedError = class _StdinClosedError extends WizardFatalError {
+      codeName = SETUP_STDIN_CLOSED_CODE;
+      constructor() {
+        super("stdin closed before section completed");
+        this.name = "StdinClosedError";
+      }
+      /**
+       * Type-guard so callers can identify this error without `instanceof`.
+       *
+       * @param err - Value caught from a `catch` block.
+       */
+      static is(err) {
+        return err instanceof _StdinClosedError;
+      }
+    };
     ReadlineWizardIO = class {
+      /**
+       * Underlying readline interface.
+       *
+       * Exposed as `protected` (not `private`) so tests can emit `'SIGINT'` on it
+       * to simulate Ctrl-C without requiring a real TTY. Production code MUST NOT
+       * access this field directly.
+       *
+       * @internal
+       */
       rl;
+      /** AbortController aborted when stdin closes — surfaced as {@link StdinClosedError}. */
+      eofController;
+      /**
+       * Whether a SIGINT was received. Set before throwing so `rethrowEof` does
+       * not mistakenly wrap the AbortError as a `StdinClosedError`.
+       */
+      sigintReceived = false;
       /**
        * Construct a readline interface bound to the supplied streams.
        *
@@ -58554,10 +58741,23 @@ var init_readline_wizard_io = __esm({
        * production use; tests inject in-memory streams.
        *
        * @param inStream - Input stream; defaults to `process.stdin`.
-       * @param outStream - Output stream; defaults to `process.stdout`.
+       * @param outStream - Output stream passed to readline for terminal-echo
+       *   purposes only; informational output goes to stderr.
        */
       constructor(inStream = input, outStream = output) {
+        this.eofController = new AbortController();
         this.rl = readline3.createInterface({ input: inStream, output: outStream });
+        this.rl.on("close", () => {
+          if (!this.eofController.signal.aborted) {
+            this.eofController.abort(new StdinClosedError());
+          }
+        });
+        this.rl.on("SIGINT", () => {
+          this.sigintReceived = true;
+          if (!this.eofController.signal.aborted) {
+            this.eofController.abort(new WizardInterruptError("interrupted by user"));
+          }
+        });
       }
       /**
        * Release the underlying readline interface.
@@ -58568,13 +58768,45 @@ var init_readline_wizard_io = __esm({
       close() {
         this.rl.close();
       }
+      /**
+       * Wrap an AbortError thrown by `rl.question()` into the appropriate
+       * typed error.
+       *
+       * - SIGINT received → throw {@link WizardInterruptError}
+       * - Stdin EOF → throw {@link StdinClosedError}
+       * - Any other error → re-throw as-is.
+       *
+       * @internal
+       */
+      rethrowEof(err) {
+        if (err instanceof Error && (err.name === "AbortError" || err.name === "AbortSignal") && this.eofController.signal.aborted) {
+          if (this.sigintReceived) {
+            throw new WizardInterruptError("interrupted by user");
+          }
+          throw new StdinClosedError();
+        }
+        throw err;
+      }
       async prompt(question) {
-        const answer = await this.rl.question(`${question} `);
-        return answer.trim();
+        try {
+          const raw = await this.rl.question(`${question} `, {
+            signal: this.eofController.signal
+          });
+          return stripBracketedPaste(raw);
+        } catch (err) {
+          this.rethrowEof(err);
+        }
       }
       async confirm(question, defaultValue) {
         const hint = defaultValue === void 0 ? "[y/n]" : defaultValue ? "[Y/n]" : "[y/N]";
-        const raw = (await this.rl.question(`${question} ${hint} `)).trim().toLowerCase();
+        let raw;
+        try {
+          raw = stripBracketedPaste(
+            await this.rl.question(`${question} ${hint} `, { signal: this.eofController.signal })
+          ).toLowerCase();
+        } catch (err) {
+          this.rethrowEof(err);
+        }
         if (raw === "") {
           if (defaultValue === void 0) {
             return this.confirm(question, defaultValue);
@@ -58589,35 +58821,47 @@ var init_readline_wizard_io = __esm({
         if (options.length === 0) {
           throw new Error(`ReadlineWizardIO.select: option list is empty for '${question}'`);
         }
-        process.stdout.write(`${question}
+        process.stderr.write(`${question}
 `);
         options.forEach((opt, idx) => {
-          process.stdout.write(`  ${idx + 1}) ${opt}
+          process.stderr.write(`  ${idx + 1}) ${opt}
 `);
         });
         const MAX_RETRIES = 10;
         for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-          const raw = (await this.rl.question(`Choose [1-${options.length}]: `)).trim();
+          let raw;
+          try {
+            raw = stripBracketedPaste(
+              await this.rl.question(`Choose [1-${options.length}]: `, {
+                signal: this.eofController.signal
+              })
+            );
+          } catch (err) {
+            this.rethrowEof(err);
+          }
           if (/^\d+$/.test(raw)) {
             const idx = Number.parseInt(raw, 10) - 1;
             if (idx >= 0 && idx < options.length) return options[idx];
           }
           if (options.includes(raw)) return raw;
-          process.stdout.write(`Invalid choice '${raw}'. Try again.
+          process.stderr.write(`Invalid choice '${raw}'. Try again.
 `);
         }
         throw new Error(
           `ReadlineWizardIO.select: gave up after ${MAX_RETRIES} invalid responses for '${question}'`
         );
       }
+      /** Informational message — goes to stderr, never stdout. */
       info(message) {
-        process.stdout.write(`${message}
+        process.stderr.write(`${message}
 `);
       }
+      /** Non-fatal warning — goes to stderr. */
       warn(message) {
         process.stderr.write(`${message}
 `);
       }
+      /** Error message — goes to stderr. */
       error(message) {
         process.stderr.write(`${message}
 `);
@@ -58633,12 +58877,138 @@ __export(setup_exports, {
   runSetup: () => runSetup,
   setupCommand: () => setupCommand2
 });
-import { createDefaultWizardRunner } from "@cleocode/core/setup";
+import { createDefaultWizardRunner, WizardInterruptError as WizardInterruptError2 } from "@cleocode/core/setup";
+function mergeConfigJson(parsed, out) {
+  out.configJson = parsed;
+  for (const [sectionId, sectionOpts] of Object.entries(parsed)) {
+    if (!WIZARD_SECTION_IDS.has(sectionId)) continue;
+    if (typeof sectionOpts !== "object" || sectionOpts === null) continue;
+    if ("provider" in sectionOpts && out.provider === void 0) {
+      if (typeof sectionOpts["provider"] === "string" && sectionOpts["provider"] !== "") {
+        out.provider = sectionOpts["provider"];
+      }
+    }
+    if ("apiKey" in sectionOpts && out.apiKey === void 0) {
+      if (typeof sectionOpts["apiKey"] === "string" && sectionOpts["apiKey"] !== "") {
+        out.apiKey = sectionOpts["apiKey"];
+      }
+    }
+    if ("label" in sectionOpts && out.label === void 0) {
+      if (typeof sectionOpts["label"] === "string" && sectionOpts["label"] !== "") {
+        out.label = sectionOpts["label"];
+      }
+    }
+    if ("agentName" in sectionOpts && out.agentName === void 0) {
+      if (typeof sectionOpts["agentName"] === "string" && sectionOpts["agentName"] !== "") {
+        out.agentName = sectionOpts["agentName"];
+      }
+    }
+    if ("soulMdContent" in sectionOpts && out.soulMdContent === void 0) {
+      if (typeof sectionOpts["soulMdContent"] === "string" && sectionOpts["soulMdContent"] !== "") {
+        out.soulMdContent = sectionOpts["soulMdContent"];
+      }
+    }
+    if ("strictness" in sectionOpts && out.strictness === void 0) {
+      const s = sectionOpts["strictness"];
+      if (s === "strict" || s === "standard" || s === "minimal") {
+        out.strictness = s;
+      }
+    }
+    if ("harness" in sectionOpts && out.harness === void 0) {
+      const h = sectionOpts["harness"];
+      if (h === "pi" || h === "claude-code") {
+        out.harness = h;
+      }
+    }
+    if ("brainBridgeMode" in sectionOpts && out.brainBridgeMode === void 0) {
+      const b = sectionOpts["brainBridgeMode"];
+      if (b === "digest" || b === "file" || b === "disabled") {
+        out.brainBridgeMode = b;
+      }
+    }
+    if ("sentientEnabled" in sectionOpts && out.sentientEnabled === void 0) {
+      if (typeof sectionOpts["sentientEnabled"] === "boolean") {
+        out.sentientEnabled = sectionOpts["sentientEnabled"];
+      }
+    }
+    if ("tier2Enabled" in sectionOpts && out.tier2Enabled === void 0) {
+      if (typeof sectionOpts["tier2Enabled"] === "boolean") {
+        out.tier2Enabled = sectionOpts["tier2Enabled"];
+      }
+    }
+    if ("signaldockAutoConnect" in sectionOpts && out.signaldockAutoConnect === void 0) {
+      if (typeof sectionOpts["signaldockAutoConnect"] === "boolean") {
+        out.signaldockAutoConnect = sectionOpts["signaldockAutoConnect"];
+      }
+    }
+    if ("brainRetentionDays" in sectionOpts && out.brainRetentionDays === void 0) {
+      const v = sectionOpts["brainRetentionDays"];
+      if (typeof v === "number" && Number.isInteger(v) && v >= 0) {
+        out.brainRetentionDays = v;
+      }
+    }
+    if ("brainEmbeddingEnabled" in sectionOpts && out.brainEmbeddingEnabled === void 0) {
+      if (typeof sectionOpts["brainEmbeddingEnabled"] === "boolean") {
+        out.brainEmbeddingEnabled = sectionOpts["brainEmbeddingEnabled"];
+      }
+    }
+    if ("signaldockEnabled" in sectionOpts && out.signaldockEnabled === void 0) {
+      if (typeof sectionOpts["signaldockEnabled"] === "boolean") {
+        out.signaldockEnabled = sectionOpts["signaldockEnabled"];
+      }
+    }
+    if ("signaldockEndpoint" in sectionOpts && out.signaldockEndpoint === void 0) {
+      if (typeof sectionOpts["signaldockEndpoint"] === "string" && sectionOpts["signaldockEndpoint"] !== "") {
+        out.signaldockEndpoint = sectionOpts["signaldockEndpoint"];
+      }
+    }
+    if ("studioEnabled" in sectionOpts && out.studioEnabled === void 0) {
+      if (typeof sectionOpts["studioEnabled"] === "boolean") {
+        out.studioEnabled = sectionOpts["studioEnabled"];
+      }
+    }
+    if ("conduitPath" in sectionOpts && out.conduitPath === void 0) {
+      if (typeof sectionOpts["conduitPath"] === "string" && sectionOpts["conduitPath"] !== "") {
+        out.conduitPath = sectionOpts["conduitPath"];
+      }
+    }
+    if ("poolSeedingConsent" in sectionOpts && out.poolSeedingConsent === void 0) {
+      if (typeof sectionOpts["poolSeedingConsent"] === "boolean") {
+        out.poolSeedingConsent = sectionOpts["poolSeedingConsent"];
+      }
+    }
+    if ("acEnforcementMode" in sectionOpts && out.acEnforcementMode === void 0) {
+      const m = sectionOpts["acEnforcementMode"];
+      if (m === "block" || m === "warn" || m === "off") {
+        out.acEnforcementMode = m;
+      }
+    }
+    if ("sessionAutoStart" in sectionOpts && out.sessionAutoStart === void 0) {
+      if (typeof sectionOpts["sessionAutoStart"] === "boolean") {
+        out.sessionAutoStart = sectionOpts["sessionAutoStart"];
+      }
+    }
+  }
+}
 function buildWizardOptions(args) {
   const out = {};
+  const configJsonRaw = args["config-json"] ?? args["configJson"];
+  if (typeof configJsonRaw === "string" && configJsonRaw !== "") {
+    let parsed;
+    try {
+      parsed = JSON.parse(configJsonRaw);
+    } catch {
+    }
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      mergeConfigJson(parsed, out);
+    }
+  }
   if (args["non-interactive"] === true || args["nonInteractive"] === true) {
     out.nonInteractive = true;
   }
+  if (args["reset"] === true) {
+    out.reset = true;
+  }
   if (typeof args["provider"] === "string" && args["provider"] !== "") {
     out.provider = args["provider"];
   }
@@ -58664,12 +59034,65 @@ function buildWizardOptions(args) {
   if (typeof args["project-root"] === "string" && args["project-root"] !== "") {
     out.projectRoot = args["project-root"];
   }
+  if (typeof args["harness"] === "string" && args["harness"] !== "") {
+    const h = args["harness"];
+    if (h === "pi" || h === "claude-code") {
+      out.harness = h;
+    }
+  }
+  if (typeof args["brain-bridge-mode"] === "string" && args["brain-bridge-mode"] !== "") {
+    const b = args["brain-bridge-mode"];
+    if (b === "digest" || b === "file" || b === "disabled") {
+      out.brainBridgeMode = b;
+    }
+  } else if (typeof args["brainBridgeMode"] === "string" && args["brainBridgeMode"] !== "") {
+    const b = args["brainBridgeMode"];
+    if (b === "digest" || b === "file" || b === "disabled") {
+      out.brainBridgeMode = b;
+    }
+  }
+  if (typeof args["retention-days"] === "string" && args["retention-days"] !== "") {
+    const days = Number.parseInt(args["retention-days"], 10);
+    if (!Number.isNaN(days) && days >= 0) {
+      out.brainRetentionDays = days;
+    }
+  } else if (typeof args["retentionDays"] === "number") {
+    const days = args["retentionDays"];
+    if (Number.isInteger(days) && days >= 0) {
+      out.brainRetentionDays = days;
+    }
+  }
+  if (typeof args["sentient"] === "string" && args["sentient"] !== "") {
+    const s = args["sentient"];
+    if (s === "on") out.sentientEnabled = true;
+    else if (s === "off") out.sentientEnabled = false;
+  }
+  if (typeof args["tier2"] === "string" && args["tier2"] !== "") {
+    const t = args["tier2"];
+    if (t === "on") out.tier2Enabled = true;
+    else if (t === "off") out.tier2Enabled = false;
+  }
+  if (args["signaldock-enabled"] === true) {
+    out.signaldockEnabled = true;
+  } else if (args["signaldock-enabled"] === false) {
+    out.signaldockEnabled = false;
+  }
+  if (typeof args["signaldock-endpoint"] === "string" && args["signaldock-endpoint"] !== "") {
+    out.signaldockEndpoint = args["signaldock-endpoint"];
+  }
+  if (args["studio-enabled"] === true) {
+    out.studioEnabled = true;
+  } else if (args["studio-enabled"] === false) {
+    out.studioEnabled = false;
+  }
   return out;
 }
 function wrapSingleSection(name, result) {
   return {
     sectionsRun: [name],
-    summary: [`${name}: ${result.summary}`]
+    summary: [`${name}: ${result.summary}`],
+    // Single-section runs never trigger the full first-run completion flow.
+    firstRunComplete: false
   };
 }
 function isOk(result) {
@@ -58696,30 +59119,40 @@ async function runSetup(args, io) {
     ok: isOk(runResult)
   };
 }
-var setupCommand2;
+var WIZARD_SECTION_IDS, setupCommand2;
 var init_setup = __esm({
   "packages/cleo/src/cli/commands/setup.ts"() {
     "use strict";
     init_dist();
     init_readline_wizard_io();
     init_renderers();
+    WIZARD_SECTION_IDS = /* @__PURE__ */ new Set([
+      "llm",
+      "identity",
+      "harness",
+      "sentient",
+      "project-conventions",
+      "brain",
+      "integrations",
+      "verification"
+    ]);
     setupCommand2 = defineCommand({
       meta: {
         name: "setup",
-        description: "Interactive setup wizard \u2014 runs all sections (llm, identity, sentient, project-conventions) in canonical order. Use --section <name> for a single section or --non-interactive with --provider/--api-key to configure LLM without prompts."
+        description: "Interactive setup wizard \u2014 runs all 8 sections in canonical order (identity \u2192 llm \u2192 sentient \u2192 harness \u2192 brain \u2192 project-conventions \u2192 integrations \u2192 verification). Use --section <name> for a single section, --non-interactive with section-specific flags to configure without prompts, --config-json for fully scripted setup, or --reset to reconfigure already-set sections."
       },
       args: {
         section: {
           type: "string",
-          description: "Run only one named section. Valid: llm | identity | sentient | project-conventions"
+          description: "Run only one named section. Valid: identity | llm | sentient | harness | brain | project-conventions | integrations | verification"
         },
         "non-interactive": {
           type: "boolean",
-          description: "Skip prompts. Sections that need extra data short-circuit silently. Pair with --provider and --api-key to configure LLM."
+          description: "Skip prompts. Requires section-specific flags (e.g. --provider/--api-key for llm, --harness for harness, --brain-bridge-mode for brain, --sentient/--tier2 for sentient, --signaldock-enabled/--signaldock-endpoint/--studio-enabled for integrations). Missing required flags emit E_SETUP_MISSING_FLAG."
         },
         provider: {
           type: "string",
-          description: "LLM provider id when --non-interactive (anthropic, openai, gemini, openrouter, \u2026)."
+          description: "LLM provider id when --non-interactive (anthropic, openai, gemini, openrouter, moonshot, deepseek, xai, groq, ollama)."
         },
         "api-key": {
           type: "string",
@@ -58740,6 +59173,46 @@ var init_setup = __esm({
         "project-root": {
           type: "string",
           description: "Override project root path (defaults to process.cwd())."
+        },
+        harness: {
+          type: "string",
+          description: "Active harness for the harness section when --non-interactive: 'pi' | 'claude-code'."
+        },
+        "brain-bridge-mode": {
+          type: "string",
+          description: "BRAIN memory bridge mode for the brain section when --non-interactive: 'digest' | 'file' | 'disabled'."
+        },
+        sentient: {
+          type: "string",
+          description: "Enable or disable the sentient daemon for the sentient section when --non-interactive: 'on' | 'off'."
+        },
+        tier2: {
+          type: "string",
+          description: "Enable or disable Tier-2 proposals for the sentient section when --non-interactive: 'on' | 'off'."
+        },
+        "config-json": {
+          type: "string",
+          description: `JSON bag of per-section options. Keys are section IDs ('identity', 'llm', 'brain', 'sentient', 'harness', 'project-conventions', 'integrations', 'verification'), values are WizardOptions sub-objects. Example: '{"identity":{"agentName":"Atlas"},"llm":{"provider":"anthropic","apiKey":"sk-ant-..."}}'. Explicit CLI flags take precedence over configJson values.`
+        },
+        reset: {
+          type: "boolean",
+          description: "Clear the 'already configured' sentinel before running \u2014 forces all sections to re-run even if they report isConfigured()=true. Does NOT clear the credential pool; use 'cleo llm remove' for that."
+        },
+        "retention-days": {
+          type: "string",
+          description: "BRAIN retention days for the brain section when --non-interactive (0 = retain forever, default 0). Must be a non-negative integer."
+        },
+        "signaldock-enabled": {
+          type: "boolean",
+          description: "Enable (true) or disable (false) the SignalDock transport. Used by the integrations section."
+        },
+        "signaldock-endpoint": {
+          type: "string",
+          description: "SignalDock endpoint URL for the integrations section (e.g. http://localhost:4000). Must be a valid HTTP(S) URL."
+        },
+        "studio-enabled": {
+          type: "boolean",
+          description: "Enable (true) or disable (false) the Studio web UI. Used by the integrations section."
         }
       },
       async run({ args }) {
@@ -58747,6 +59220,24 @@ var init_setup = __esm({
         let result;
         try {
           result = await runSetup(args, io);
+        } catch (err) {
+          io.close();
+          if (err instanceof WizardInterruptError2 || err?.isWizardInterruptError) {
+            process.stderr.write("Setup interrupted. Run 'cleo setup' to continue.\n");
+            process.exit(130);
+          }
+          if (err instanceof WizardInterruptError2) {
+            process.stderr.write("Setup interrupted. Run 'cleo setup' to continue.\n");
+            process.exit(130);
+          }
+          if (StdinClosedError.is(err)) {
+            cliError(err.message, 1, {
+              name: err.codeName,
+              fix: "Run cleo setup interactively (with a TTY) or use --non-interactive flags."
+            });
+            process.exit(1);
+          }
+          throw err;
         } finally {
           io.close();
         }
@@ -60402,8 +60893,8 @@ var transcript_exports = {};
 __export(transcript_exports, {
   transcriptCommand: () => transcriptCommand
 });
-import { homedir as homedir8 } from "node:os";
-import { join as join24 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join25 } from "node:path";
 import { getProjectRoot as getProjectRoot36 } from "@cleocode/core";
 import {
   parseDurationMs,
@@ -60457,7 +60948,7 @@ var init_transcript = __esm({
           }
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join24(homedir8(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join25(homedir9(), ".claude", "projects");
         try {
           const result = await scanTranscripts(projectsDir);
           cliOutput(
@@ -60763,7 +61254,7 @@ var init_transcript = __esm({
           process.exit(2);
           return;
         }
-        const projectsDir = args["projects-dir"] ?? join24(homedir8(), ".claude", "projects");
+        const projectsDir = args["projects-dir"] ?? join25(homedir9(), ".claude", "projects");
         try {
           const pruneResult = await pruneTranscripts({
             olderThanMs,
@@ -61428,15 +61919,15 @@ __export(web_exports, {
 });
 import { execFileSync as execFileSync4, spawn as spawn2 } from "node:child_process";
 import { mkdir as mkdir3, open, readFile as readFile5, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { CleoError as CleoError12, formatError as formatError9, getCleoHome as getCleoHome2 } from "@cleocode/core";
 function getWebPaths() {
   const cleoHome = getCleoHome2();
   return {
-    pidFile: join25(cleoHome, "web-server.pid"),
-    configFile: join25(cleoHome, "web-server.json"),
-    logDir: join25(cleoHome, "logs"),
-    logFile: join25(cleoHome, "logs", "web-server.log")
+    pidFile: join26(cleoHome, "web-server.pid"),
+    configFile: join26(cleoHome, "web-server.json"),
+    logDir: join26(cleoHome, "logs"),
+    logFile: join26(cleoHome, "logs", "web-server.log")
   };
 }
 function isProcessRunning(pid) {
@@ -61475,7 +61966,7 @@ async function startWebServer(port, host) {
     throw new CleoError12(1 /* GENERAL_ERROR */, `Server already running (PID: ${status.pid})`);
   }
   const projectRoot = process.env["CLEO_ROOT"] ?? process.cwd();
-  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join25(projectRoot, "packages", "studio", "build");
+  const studioDir = process.env["CLEO_STUDIO_DIR"] ?? join26(projectRoot, "packages", "studio", "build");
   await mkdir3(logDir, { recursive: true });
   await writeFile2(
     configFile,
@@ -61485,7 +61976,7 @@ async function startWebServer(port, host) {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     })
   );
-  const webIndexPath = join25(studioDir, "index.js");
+  const webIndexPath = join26(studioDir, "index.js");
   try {
     await stat(webIndexPath);
   } catch {
@@ -61986,7 +62477,7 @@ init_dist();
 init_field_context();
 init_format_context();
 import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname10, join as join27 } from "node:path";
+import { dirname as dirname10, join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // packages/cleo/src/cli/generated/command-manifest.ts
@@ -62564,7 +63055,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "releaseCommand",
     name: "release",
-    description: "Release lifecycle management",
+    description: "Release lifecycle management \u2014 4-verb pipeline: plan \u2192 open \u2192 reconcile / rollback. ",
     load: async () => (await Promise.resolve().then(() => (init_release3(), release_exports))).releaseCommand
   },
   {
@@ -62780,7 +63271,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "worktreeCommand",
     name: "worktree",
-    description: "Inspect CLEO-managed git worktrees attached to this project. ",
+    description: "Inspect and manage CLEO-attached git worktrees. ",
     load: async () => (await Promise.resolve().then(() => (init_worktree3(), worktree_exports))).worktreeCommand
   }
 ];
@@ -63087,14 +63578,14 @@ function didYouMean(input2, candidates, maxDistance = 2) {
 }
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync16 } from "node:fs";
+import { join as join27 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
-  const configPath = join26(getCleoPlatformPaths().config, "config.json");
-  if (existsSync15(configPath)) return false;
+  const configPath = join27(getCleoPlatformPaths().config, "config.json");
+  if (existsSync16(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();
@@ -63182,7 +63673,7 @@ Or via NodeSource: https://github.com/nodesource/distributions
   }
 }
 function getPackageVersion() {
-  const pkgPath = join27(dirname10(fileURLToPath6(import.meta.url)), "../../package.json");
+  const pkgPath = join28(dirname10(fileURLToPath6(import.meta.url)), "../../package.json");
   const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
   return pkg.version;
 }