@cleocode/cleo 2026.6.2 → 2026.6.4

package/dist/cli/index.js

@@ -12302,6 +12302,13 @@ var init_plugin_llm = __esm({
   }
 });
 
+// packages/contracts/src/llm/system-resolver.ts
+var init_system_resolver = __esm({
+  "packages/contracts/src/llm/system-resolver.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/memory/observe.ts
 var init_observe = __esm({
   "packages/contracts/src/memory/observe.ts"() {
@@ -14224,6 +14231,7 @@ var init_src2 = __esm({
     init_invariants();
     init_lafs();
     init_plugin_llm();
+    init_system_resolver();
     init_observe();
     init_migration_parity();
     init_mvi();
@@ -28898,12 +28906,12 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
   }
   try {
     const { getCleoCantWorkflowsDir } = await import("@cleocode/core/internal");
-    const { readFileSync: readFileSync22, readdirSync: readdirSync3, existsSync: existsSync21 } = await import("node:fs");
+    const { readFileSync: readFileSync22, readdirSync: readdirSync3, existsSync: existsSync22 } = await import("node:fs");
     const { join: join38 } = await import("node:path");
     const workflowsDir = getCleoCantWorkflowsDir();
     const combined = `${request} ${context ?? ""}`.toLowerCase();
     const matches = [];
-    if (existsSync21(workflowsDir)) {
+    if (existsSync22(workflowsDir)) {
       const files = readdirSync3(workflowsDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
@@ -28923,7 +28931,7 @@ async function orchestrateClassify(request, context, projectRoot, taskId) {
       }
     }
     const localCantDir = join38(projectRoot, CLEO_DIR_NAME2, WORKFLOWS_SUBDIR);
-    if (existsSync21(localCantDir)) {
+    if (existsSync22(localCantDir)) {
       const files = readdirSync3(localCantDir).filter((f) => f.endsWith(".cant"));
       for (const file of files) {
         try {
@@ -36988,12 +36996,12 @@ var init_agent = __esm({
             transportConfig: {},
             isActive: true
           });
-          const { existsSync: existsSync21, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
+          const { existsSync: existsSync22, mkdirSync: mkdirSync7, writeFileSync: writeFileSync7 } = await import("node:fs");
           const { join: join38 } = await import("node:path");
           const cantDir = join38(CLEO_DIR_NAME3, AGENTS_SUBDIR);
           const cantPath = join38(cantDir, `${agentId}.cant`);
           let cantScaffolded = false;
-          if (!existsSync21(cantPath)) {
+          if (!existsSync22(cantPath)) {
             mkdirSync7(cantDir, { recursive: true });
             const role = classification ?? "specialist";
             const cantContent = `---
@@ -37053,7 +37061,7 @@ agent ${agentId}:
               data: {
                 agentId: credential.agentId,
                 displayName: credential.displayName,
-                cantFile: cantScaffolded ? cantPath : existsSync21(cantPath) ? cantPath : null,
+                cantFile: cantScaffolded ? cantPath : existsSync22(cantPath) ? cantPath : null,
                 cantScaffolded
               }
             },
@@ -37172,7 +37180,7 @@ agent ${agentId}:
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync21, readFileSync: readFileSync22 } = await import("node:fs");
+          const { existsSync: existsSync22, readFileSync: readFileSync22 } = await import("node:fs");
           const { join: join38 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
@@ -37194,7 +37202,7 @@ agent ${agentId}:
           let profile = null;
           let cantValidation = null;
           const cantPath = args.cant ?? join38(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          if (existsSync21(cantPath)) {
+          if (existsSync22(cantPath)) {
             profile = readFileSync22(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
@@ -37718,7 +37726,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
         try {
           const { AgentRegistryAccessor } = await import("@cleocode/core/agents");
           const { createRuntime } = await import("@cleocode/runtime");
-          const { existsSync: existsSync21 } = await import("node:fs");
+          const { existsSync: existsSync22 } = await import("node:fs");
           const { join: join38 } = await import("node:path");
           await openCleoDb("project");
           const registry = new AgentRegistryAccessor(getProjectRoot24());
@@ -37737,7 +37745,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           await registry.update(args.agentId, { isActive: true });
           await registry.markUsed(args.agentId);
           const cantPath = join38(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
-          const hasProfile = existsSync21(cantPath);
+          const hasProfile = existsSync22(cantPath);
           const runtime = await createRuntime(registry, {
             agentId: args.agentId,
             pollIntervalMs: 5e3,
@@ -38530,10 +38538,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       async run({ args }) {
         let tempDir = null;
         try {
-          const { existsSync: existsSync21 } = await import("node:fs");
+          const { existsSync: existsSync22 } = await import("node:fs");
           const { basename, resolve: resolve11 } = await import("node:path");
           const resolvedPath = resolve11(args.path);
-          if (!existsSync21(resolvedPath)) {
+          if (!existsSync22(resolvedPath)) {
             cliOutput(
               {
                 success: false,
@@ -38658,11 +38666,11 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync21, statSync: statSync2 } = await import("node:fs");
+          const { existsSync: existsSync22, statSync: statSync2 } = await import("node:fs");
           const { resolve: resolve11, basename, dirname: dirname12 } = await import("node:path");
           const { execFileSync: execFileSync5 } = await import("node:child_process");
           const resolvedDir = resolve11(args.dir);
-          if (!existsSync21(resolvedDir) || !statSync2(resolvedDir).isDirectory()) {
+          if (!existsSync22(resolvedDir) || !statSync2(resolvedDir).isDirectory()) {
             cliOutput(
               {
                 success: false,
@@ -38678,7 +38686,7 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
           }
           const { join: join38 } = await import("node:path");
           const personaPath = join38(resolvedDir, "persona.cant");
-          if (!existsSync21(personaPath)) {
+          if (!existsSync22(personaPath)) {
             cliOutput(
               {
                 success: false,
@@ -38973,10 +38981,10 @@ Task ${args.taskId} reassigned to you by ${active.agentId}. Run: cleo show ${arg
       },
       async run({ args }) {
         try {
-          const { existsSync: existsSync21, readFileSync: readFileSync22, mkdirSync: mkdirSync7 } = await import("node:fs");
+          const { existsSync: existsSync22, readFileSync: readFileSync22, mkdirSync: mkdirSync7 } = await import("node:fs");
           const { resolve: resolve11, join: join38 } = await import("node:path");
           const specPath = resolve11(args.spec);
-          if (!existsSync21(specPath)) {
+          if (!existsSync22(specPath)) {
             cliError(`spec file not found: ${specPath}`, 4, { name: "E_NOT_FOUND" });
             process.exitCode = 4;
             return;
@@ -41928,11 +41936,11 @@ var init_caamp = __esm({
         }
         if (args["dry-run"]) {
           const { parseCaampBlocks } = await import("@cleocode/caamp");
-          const { existsSync: existsSync21 } = await import("node:fs");
+          const { existsSync: existsSync22 } = await import("node:fs");
           const { readFile: readFile9 } = await import("node:fs/promises");
           const dryResults = [];
           for (const filePath of filePaths) {
-            if (!existsSync21(filePath)) {
+            if (!existsSync22(filePath)) {
               dryResults.push({ filePath, exists: false, blockCount: 0, wouldRemove: 0 });
               continue;
             }
@@ -43026,7 +43034,7 @@ var init_check2 = __esm({
       },
       async run({ args }) {
         const { spawnSync } = await import("node:child_process");
-        const { existsSync: existsSync21 } = await import("node:fs");
+        const { existsSync: existsSync22 } = await import("node:fs");
         const { join: join38, resolve: resolve11 } = await import("node:path");
         const strict = Boolean(args.strict);
         const jsonOnly = Boolean(args.json);
@@ -43068,7 +43076,7 @@ var init_check2 = __esm({
         let anyFailed = false;
         for (const gate of gates) {
           const scriptPath = join38(repoRoot, gate.script);
-          if (!existsSync21(scriptPath)) {
+          if (!existsSync22(scriptPath)) {
             results.push({
               id: gate.id,
               task: gate.task,
@@ -50684,6 +50692,97 @@ ${this.prefix}: \u2717 ${message}
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-exodus-residue.ts
+import {
+  archiveStrandedResidue,
+  buildExodusPlan,
+  detectStrandedResidue
+} from "@cleocode/core/store/exodus/index.js";
+var doctorExodusResidueCommand;
+var init_doctor_exodus_residue = __esm({
+  "packages/cleo/src/cli/commands/doctor-exodus-residue.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorExodusResidueCommand = defineCommand({
+      meta: {
+        name: "exodus-residue",
+        description: "Detect legacy exodus source DBs still present after a cutover (stranded residue that re-arms the exodus-on-open corruption trigger). Use --fix to archive them into _archive/ (reversible move, never deletes)."
+      },
+      args: {
+        fix: {
+          type: "boolean",
+          description: "Archive stranded legacy source DBs into _archive/ (move, never delete)",
+          default: false
+        }
+      },
+      run({ args }) {
+        const fix = args.fix === true;
+        const cwd = process.cwd();
+        const plan = buildExodusPlan(cwd);
+        const stranded = detectStrandedResidue(plan.sources, cwd);
+        if (stranded.length === 0) {
+          cliOutput(
+            {
+              kind: "generic",
+              ok: true,
+              strandedCount: 0,
+              stranded: [],
+              fixed: false
+            },
+            {
+              command: "doctor exodus-residue",
+              message: "No stranded legacy exodus source DBs (clean cutover or pre-migration install)."
+            }
+          );
+          return;
+        }
+        for (const entry of stranded) {
+          humanInfo(`  STRANDED [${entry.scope}] ${entry.name} \u2192 ${entry.path}`);
+        }
+        if (!fix) {
+          cliOutput(
+            {
+              kind: "generic",
+              ok: false,
+              strandedCount: stranded.length,
+              stranded: stranded.map((s) => ({ name: s.name, path: s.path, scope: s.scope })),
+              fixed: false
+            },
+            {
+              command: "doctor exodus-residue",
+              message: `${stranded.length} stranded legacy source DB(s) found. Run \`cleo doctor exodus-residue --fix\` to archive them.`
+            }
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const archived = archiveStrandedResidue(stranded, plan.sources, cwd);
+        const movedCount = archived.filter((a) => a.action === "archived").length;
+        humanInfo(`  Archived ${movedCount} stranded source DB(s) \u2192 _archive/.`);
+        cliOutput(
+          {
+            kind: "generic",
+            ok: true,
+            strandedCount: stranded.length,
+            stranded: stranded.map((s) => ({ name: s.name, path: s.path, scope: s.scope })),
+            fixed: true,
+            archived: archived.map((a) => ({
+              name: a.name,
+              action: a.action,
+              archivedTo: a.archivedTo
+            }))
+          },
+          {
+            command: "doctor exodus-residue",
+            message: `Archived ${movedCount} stranded legacy source DB(s) into _archive/.`
+          }
+        );
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/migrate-agents-v2.ts
 var migrate_agents_v2_exports = {};
 __export(migrate_agents_v2_exports, {
@@ -51048,6 +51147,7 @@ var init_doctor = __esm({
     init_progress();
     init_renderers();
     init_doctor_db_substrate();
+    init_doctor_exodus_residue();
     init_doctor_legacy_backups();
     init_doctor_projects();
     init_doctor_release_readiness();
@@ -51066,6 +51166,8 @@ var init_doctor = __esm({
         "db-substrate": doctorDbSubstrateCommand,
         // T10309 / Saga T10281 / Epic T10282 — Legacy-backup walker
         "legacy-backups": doctorLegacyBackupsCommand,
+        // T11777 / Saga T11242 / Epic T11249 — exodus stranded-residue check (+ --fix)
+        "exodus-residue": doctorExodusResidueCommand,
         // T10458 / Saga T10431 / Epic T10436 — Release-readiness preflight
         "release-readiness": doctorReleaseReadinessCommand
       },
@@ -51268,7 +51370,7 @@ var init_doctor = __esm({
           if (args["check-worktree-config"]) {
             const { execFileSync: execFile2 } = await import("node:child_process");
             const { join: pathJoin } = await import("node:path");
-            const { existsSync: existsSync21 } = await import("node:fs");
+            const { existsSync: existsSync22 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
             const projectRoot = getProjectRoot42();
             let gitRoot = projectRoot;
@@ -51285,7 +51387,7 @@ var init_doctor = __esm({
             if (isDryRun) {
               const gitConfigPath = pathJoin(gitRoot, ".git", "config");
               let leakedValue;
-              if (existsSync21(gitConfigPath)) {
+              if (existsSync22(gitConfigPath)) {
                 try {
                   leakedValue = execFile2("git", ["config", "--file", gitConfigPath, "--get", "core.worktree"], {
                     encoding: "utf-8",
@@ -52188,14 +52290,18 @@ var exodus_exports = {};
 __export(exodus_exports, {
   exodusCommand: () => exodusCommand
 });
+import { existsSync as existsSync15 } from "node:fs";
 import { resolveDualScopeDbPath } from "@cleocode/core/store/dual-scope-db.js";
 import {
-  buildExodusPlan,
+  archiveMigratedSources,
+  buildExodusPlan as buildExodusPlan2,
   runExodusMigrate,
   runExodusStatus,
   runExodusVerify,
-  sourcesPresent
+  sourcesPresent,
+  verifyMigration
 } from "@cleocode/core/store/exodus/index.js";
+import { isDataContinuityOk } from "@cleocode/core/store/exodus/on-open.js";
 function fmtBytes2(n) {
   if (n < 1024) return `${n} B`;
   if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
@@ -52249,7 +52355,7 @@ var init_exodus = __esm({
       async run({ args }) {
         const dryRun = args["dry-run"] === true;
         const forceCrossVersion = args["force-cross-version"] === true;
-        const plan = buildExodusPlan(process.cwd());
+        const plan = buildExodusPlan2(process.cwd());
         humanInfo(`Exodus migration plan:`);
         humanInfo(
           `  Source DBs (${plan.sources.length} total, ${fmtBytes2(plan.totalSourceBytes)} combined):`
@@ -52323,6 +52429,25 @@ var init_exodus = __esm({
         }
         const copied = result.tables.filter((t) => !t.skipped).reduce((n, t) => n + t.rowsCopied, 0);
         const skipped = result.tables.filter((t) => t.skipped).length;
+        const verifyResult = verifyMigration(
+          plan.sources,
+          plan.projectDbPath,
+          plan.globalDbPath,
+          (msg) => humanInfo(`  verify: ${msg}`)
+        );
+        let archived = [];
+        if (isDataContinuityOk(verifyResult)) {
+          const consumed = plan.sources.filter((s) => existsSync15(s.path));
+          const archiveResult = archiveMigratedSources(consumed, process.cwd());
+          archived = archiveResult.sources.filter((s) => s.action === "archived").map((s) => s.name);
+          humanInfo(
+            `  Archived ${archived.length} legacy source DB(s) \u2192 _archive/ and sealed completion marker(s): ${archiveResult.markersWritten.join(", ")}`
+          );
+        } else {
+          humanInfo(
+            "  Parity validation did NOT pass \u2014 legacy sources LEFT IN PLACE (not archived). Run `cleo exodus verify` to inspect."
+          );
+        }
         cliOutput(
           {
             kind: "generic",
@@ -52332,7 +52457,9 @@ var init_exodus = __esm({
               rowsCopied: copied,
               tablesSkipped: skipped,
               stagingDir: result.stagingDir,
-              backupCount: result.backupPaths.length
+              backupCount: result.backupPaths.length,
+              archivedSources: archived,
+              archived: archived.length > 0
             },
             tables: result.tables
           },
@@ -52357,7 +52484,7 @@ var init_exodus = __esm({
       },
       run({ args }) {
         const showPassing = args["show-passing"] === true;
-        const plan = buildExodusPlan(process.cwd());
+        const plan = buildExodusPlan2(process.cwd());
         const projectDbPath = resolveDualScopeDbPath("project", process.cwd());
         const globalDbPath = resolveDualScopeDbPath("global");
         humanInfo("Running equivalence verification\u2026");
@@ -54571,7 +54698,7 @@ __export(init_exports, {
   getWorkflowTemplatesDir: () => getWorkflowTemplatesDir2,
   initCommand: () => initCommand2
 });
-import { existsSync as existsSync15, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
 import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import {
@@ -54588,8 +54715,8 @@ function getGitignoreTemplate() {
     const packageRoot = join27(thisFile, "..", "..", "..", "..");
     const localTemplatePath = join27(packageRoot, "templates", "cleo-gitignore");
     const monorepoTemplatePath = join27(packageRoot, "..", "..", "templates", "cleo-gitignore");
-    const templatePath = existsSync15(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
-    if (existsSync15(templatePath)) {
+    const templatePath = existsSync16(localTemplatePath) ? localTemplatePath : monorepoTemplatePath;
+    if (existsSync16(templatePath)) {
       return readFileSync14(templatePath, "utf-8");
     }
   } catch {
@@ -55892,7 +56019,7 @@ import {
   refreshPkceToken
 } from "@cleocode/core/llm/oauth/pkce.js";
 import { getKimiCodeMshHeaders } from "@cleocode/core/llm/provider-registry/builtin/kimi-code.js";
-import { getProviderProfile } from "@cleocode/core/llm/provider-registry/index.js";
+import { getProviderProfile, listProviders } from "@cleocode/core/llm/provider-registry/index.js";
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
   const profile = await getProviderProfile(provider);
@@ -55901,34 +56028,48 @@ async function runLlmLogin(provider, opts) {
     return _runKimiCodeLogin(opts, meta);
   }
   if (oauthMode === "pkce") {
-    return _runPkceLogin(provider, profile.oauth, opts, meta);
+    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
   }
   return {
     success: false,
     error: {
       code: "E_NOT_IMPLEMENTED",
       codeName: "E_NOT_IMPLEMENTED",
-      message: `OAuth login for '${provider}' is not yet wired. Supported providers: 'anthropic' (PKCE), 'kimi-code' (device-code). To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+      message: `OAuth login for '${provider}' is not yet wired. ${await _supportedOauthProvidersHint()} For any other provider, add an API key with 'cleo llm add <provider> --api-key-stdin'.`
     },
     meta
   };
 }
+async function _supportedOauthProvidersHint() {
+  try {
+    const profiles = await listProviders();
+    const oauthable = profiles.flatMap((p) => p.oauth ? [`'${p.name}' (${p.oauth.mode})`] : []);
+    return oauthable.length > 0 ? `Providers with OAuth login: ${oauthable.join(", ")}.` : "No providers currently expose OAuth login.";
+  } catch {
+    return "Providers with OAuth login: 'anthropic' (pkce), 'openai' (pkce), 'kimi-code' (device-code).";
+  }
+}
 async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   const { codeVerifier, codeChallenge } = await generatePkcePair();
   const state = _generateState();
   const isHeadless = opts.headless || process.env["CLEO_HEADLESS"] === "1";
-  const port = isHeadless ? 0 : await _findFreePort();
-  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : `http://localhost:${port}/callback`;
+  const fixedPort = isHeadless ? null : _parseFixedLoopbackPort(oauthCfg.redirectUri);
+  const isNonLoopbackPasteBack = !isHeadless && fixedPort === null && !_isLoopbackUri(oauthCfg.redirectUri);
+  const effectiveHeadless = isHeadless || isNonLoopbackPasteBack;
+  const port = effectiveHeadless ? 0 : fixedPort ?? await _findFreePort();
+  const randomRedirect = `http://localhost:${port}/callback`;
+  const redirectUri = effectiveHeadless ? oauthCfg.redirectUri ?? "http://localhost" : fixedPort != null ? oauthCfg.redirectUri ?? randomRedirect : randomRedirect;
   const authUrl = buildAuthorizationUrl({
     authorizationEndpoint: oauthCfg.authorizationEndpoint ?? "",
     clientId: oauthCfg.clientId,
     redirectUri,
     scope: oauthCfg.scope ?? "",
     codeChallenge,
-    state
+    state,
+    extraParams: oauthCfg.extraAuthParams
   });
   let code;
-  if (isHeadless) {
+  if (effectiveHeadless) {
     code = await _headlessPkceFlow(provider, authUrl);
   } else {
     const result = await _localCallbackPkceFlow(provider, authUrl, state, port);
@@ -55962,6 +56103,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   process.stderr.write("\r  Authorization approved.              \n\n");
   const label = opts.label ?? "oauth-login";
   const expiresAt = typeof tokens.expiresIn === "number" ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+  const oauthExtraHeaders = provider === "anthropic" ? { "anthropic-beta": "oauth-2025-04-20" } : void 0;
   try {
     await addCredential({
       provider,
@@ -55972,7 +56114,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
       expiresAt,
       priority: 10,
       source: "oauth-pkce",
-      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+      ...oauthExtraHeaders ? { extraHeaders: oauthExtraHeaders } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -55992,6 +56134,27 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
     meta
   };
 }
+function _parseFixedLoopbackPort(redirectUri) {
+  if (!redirectUri) return null;
+  try {
+    const u = new URL(redirectUri);
+    const isLoopback = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+    if (!isLoopback || !u.port) return null;
+    const port = Number(u.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
+function _isLoopbackUri(redirectUri) {
+  if (!redirectUri) return false;
+  try {
+    const u = new URL(redirectUri);
+    return u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  } catch {
+    return false;
+  }
+}
 async function _headlessPkceFlow(provider, authUrl) {
   process.stderr.write("\n");
   process.stderr.write(`  Provider: ${provider}
@@ -56278,11 +56441,11 @@ __export(llm_exports, {
 });
 import { pushWarning as pushWarning7 } from "@cleocode/core";
 async function getListProviders() {
-  const { listProviders } = await import(
+  const { listProviders: listProviders2 } = await import(
     /* webpackIgnore: true */
     "@cleocode/core/llm/provider-registry"
   );
-  return listProviders;
+  return listProviders2;
 }
 async function readApiKeyFromStdin() {
   if (process.stdin.isTTY) return "";
@@ -56593,8 +56756,8 @@ var init_llm3 = __esm({
         }
       },
       async run() {
-        const listProviders = await getListProviders();
-        const profiles = await listProviders();
+        const listProviders2 = await getListProviders();
+        const profiles = await listProviders2();
         const providers = profiles.map((p) => ({
           name: p.name,
           displayName: p.displayName,
@@ -56654,12 +56817,12 @@ var init_llm3 = __esm({
     loginCommand = defineCommand({
       meta: {
         name: "login",
-        description: "Authenticate with a provider via OAuth device-code flow. Supported providers: anthropic (MVP). Prints the verification URL and user code, then polls until the user approves."
+        description: "Authenticate an LLM provider via OAuth. PKCE (browser): anthropic, openai/codex. Device-code: kimi-code. Example: `cleo llm login openai`. For any other provider use `cleo llm add <provider> --api-key-stdin`. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
       },
       args: {
         provider: {
           type: "positional",
-          description: "Provider to authenticate with (e.g. anthropic)",
+          description: "Provider to authenticate: anthropic | openai | codex | kimi-code",
           required: true
         },
         label: {
@@ -63395,7 +63558,7 @@ var project_exports = {};
 __export(project_exports, {
   projectCommand: () => projectCommand
 });
-import { existsSync as existsSync16, statSync } from "node:fs";
+import { existsSync as existsSync17, statSync } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 import { moveProject, projectLifecycle, renameProject } from "@cleocode/core";
 function formatSuccessSection(header, icon, items) {
@@ -63438,7 +63601,7 @@ var init_project = __esm({
         const newPathRaw = args["newPath"];
         const dryRun = args["dry-run"] ?? false;
         const newPath = resolve7(newPathRaw);
-        if (!dryRun && existsSync16(newPath) && statSync(newPath).isFile()) {
+        if (!dryRun && existsSync17(newPath) && statSync(newPath).isFile()) {
           cliOutput(formatErrorSection("E_INVALID_PATH", `newPath is not a directory: ${newPath}`), {
             command: "project",
             operation: "project.move"
@@ -71524,7 +71687,7 @@ var init_lib = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/diff.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
 import { join as join31 } from "node:path";
 import { getTemplateById } from "@cleocode/core/templates/registry";
 function unifiedDiff(a, b) {
@@ -71606,7 +71769,7 @@ var init_diff = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (!existsSync17(installPath)) {
+        if (!existsSync18(installPath)) {
           const missingResult = {
             id,
             installPath,
@@ -71645,7 +71808,7 @@ ${unifiedDiff("", rendered)}`
 });
 
 // packages/cleo/src/cli/commands/templates/install.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname9, join as join32 } from "node:path";
 import { getTemplateById as getTemplateById2 } from "@cleocode/core/templates/registry";
 var templatesInstallCommand;
@@ -71713,7 +71876,7 @@ var init_install = __esm({
           process.exit(1 /* GENERAL_ERROR */);
           return;
         }
-        if (existsSync18(installPath)) {
+        if (existsSync19(installPath)) {
           const current = readFileSync17(installPath, "utf8");
           if (current === rendered) {
             const noopResult = {
@@ -71862,7 +72025,7 @@ var init_show3 = __esm({
 });
 
 // packages/cleo/src/cli/commands/templates/upgrade.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname10, join as join33 } from "node:path";
 import { getTemplateById as getTemplateById4 } from "@cleocode/core/templates/registry";
 var templatesUpgradeCommand;
@@ -71938,7 +72101,7 @@ var init_upgrade2 = __esm({
         }
         const previewOnly = args["diff"] === true;
         const accept = args["accept"] === true;
-        const current = existsSync19(installPath) ? readFileSync18(installPath, "utf8") : null;
+        const current = existsSync20(installPath) ? readFileSync18(installPath, "utf8") : null;
         const diffBody = current === null ? "" : current === rendered ? "" : unifiedDiff(current, rendered);
         let outcome;
         let reason;
@@ -75735,14 +75898,14 @@ function lazyCommand(meta, loader2) {
 init_did_you_mean();
 
 // packages/cleo/src/cli/lib/first-run-detection.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { join as join36 } from "node:path";
 async function detectFirstRun() {
   const envKey = process.env["ANTHROPIC_API_KEY"];
   if (typeof envKey === "string" && envKey.length > 0) return false;
   const { getCleoPlatformPaths } = await import("@cleocode/paths");
   const configPath = join36(getCleoPlatformPaths().config, "config.json");
-  if (existsSync20(configPath)) return false;
+  if (existsSync21(configPath)) return false;
   try {
     const { getCredentialPool } = await import("@cleocode/core/llm/credential-pool.js");
     const pool = getCredentialPool();