@cleocode/cleo 2026.9.22 → 2026.9.24

package/studio-dist/server/chunks/{internal-BlXMjztN.js → internal-OCcHamz2.js}

@@ -1430,7 +1430,7 @@ var options = {
 		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\" data-theme=\"dark\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <link rel=\"icon\" href=\"" + assets + "/favicon.png\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"color-scheme\" content=\"dark\" />\n    <title>CLEO Studio</title>\n    " + head + "\n  </head>\n  <body class=\"cleo-root\" data-sveltekit-preload-data=\"hover\">\n    <div style=\"display: contents\">" + body + "</div>\n  </body>\n</html>\n",
 		error: ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n"
 	},
-	version_hash: "1ludhy0"
+	version_hash: "1ldrd4p"
 };
 async function get_hooks() {
 	let handle;
@@ -1438,7 +1438,7 @@ async function get_hooks() {
 	let handleError;
 	let handleValidationError;
 	let init;
-	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-CWBRp8NI.js'));
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-D2qbf3Zp.js'));
 	let reroute;
 	let transport;
 	return {
@@ -1453,4 +1453,4 @@ async function get_hooks() {
 }
 
 export { stringify as A, make_trackable as B, stringify$1 as C, read_implementation as D, split_remote_key as E, set_read_implementation as F, IN_WEBCONTAINER as I, NULL_BODY_STATUS as N, TRAILING_SLASH_PARAM as T, get_message as a, get_hooks as b, coalesce_to_error as c, INVALIDATED_PARAM as d, decode_pathname as e, find_route as f, get_status as g, normalize_path as h, disable_search as i, validate_layout_exports as j, validate_page_server_exports as k, validate_page_exports as l, merge_tracing as m, noop as n, options as o, parse as p, noop_span as q, create_remote_key as r, hash as s, compact as t, once as u, validate_layout_server_exports as v, with_request_store as w, normalize_error as x, resolve as y, parse_remote_arg as z };
-//# sourceMappingURL=internal-BlXMjztN.js.map
+//# sourceMappingURL=internal-OCcHamz2.js.map

package/studio-dist/server/chunks/{project-context-BAXQmgch.js → project-context-CX-nfwL2.js}

@@ -1,8 +1,9 @@
 import { g as getNexusDbPath, a as getTasksDbPath, b as getCleoProjectDir, w as withStudioProjectScope } from './cleo-home-_XIqkZaL.js';
 import { existsSync } from 'node:fs';
-import { dirname, join, basename } from 'node:path';
-import { getProjectInfoSync } from '@cleocode/core';
+import { dirname, join } from 'node:path';
+import { getProjectDisplayName, getProjectInfoSync } from '@cleocode/core';
 import { openCleoDbSnapshot } from '@cleocode/core/store/open-cleo-db';
+import { projectLastActivitySqlText } from '@cleocode/core/nexus/project-activity.js';
 
 //#region src/lib/server/project-context.ts
 /**
@@ -106,7 +107,7 @@ function resolveDefaultProjectContext() {
 	if (!info && existsSync(join(projectDir, "project-info.json"))) throw new Error(`Cannot read Studio project identity at ${projectDir}/project-info.json`);
 	return {
 		projectId: info?.projectId || info?.projectHash || "",
-		name: basename(projectPath) || "default",
+		name: getProjectDisplayName(projectPath) || "default",
 		projectPath,
 		brainDbPath,
 		tasksDbPath,
@@ -134,6 +135,7 @@ function listRegisteredProjects() {
 		applyPragmas: false
 	});
 	try {
+		const columns = new Set(snap.db.prepare("SELECT name FROM pragma_table_info('nexus_project_registry')").all().map((c) => c.name));
 		const rows = snap.db.prepare(`SELECT
           project_id,
           name,
@@ -144,7 +146,7 @@ function listRegisteredProjects() {
           last_seen,
           health_status
         FROM nexus_project_registry
-        ORDER BY last_seen DESC`).all();
+        ORDER BY ${projectLastActivitySqlText(columns)} DESC`).all();
 		/**
 		* Strict server-side exclusion: any project whose path contains a `.temp/`
 		* segment is filtered out before reaching the client. This rule is
@@ -185,4 +187,4 @@ function listRegisteredProjects() {
 }
 
 export { resolveDefaultProjectContext as a, clearActiveProjectId as c, getActiveProjectId as g, listRegisteredProjects as l, resolveProjectContext as r, setActiveProjectId as s };
-//# sourceMappingURL=project-context-BAXQmgch.js.map
+//# sourceMappingURL=project-context-CX-nfwL2.js.map

package/studio-dist/server/chunks/{src-RK_h29uK.js → src-CeLZUrEE.js}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { existsSync, realpathSync, readFileSync } from 'node:fs';
+import { existsSync, statSync, realpathSync, readFileSync } from 'node:fs';
 import path, { join, dirname, resolve, isAbsolute } from 'node:path';
 import { applyPerfPragmas } from '@cleocode/core/store/sqlite-pragmas.js';
 import 'node:crypto';
@@ -177,25 +177,40 @@ function createPlatformPathsResolver(appName, homeEnvVar, configEnvVar) {
 //#endregion
 //#region ../paths/dist/portable-project-id.js
 /**
-* The tracked, write-once portable project identity (`.cleo/project-id`).
+* The tracked, write-once portable project identity.
 *
 * Every other project identifier CLEO computes hashes the absolute path, and
 * the random `projectId` in `.cleo/project-info.json` is gitignored (ADR-013
-* §9), so a fresh clone used to mint a brand-new identity at `cleo init`. This
-* file is the one identifier that travels with the repository: CLEO writes it
-* once, commits nothing else beside it, and never rewrites it. Because nothing
-* ever writes it a second time, git has nothing to overwrite — the geometry
-* that made ADR-013 untrack the mutable state files does not apply
-* (ADR-094, T12325).
+* §9), so a fresh clone used to mint a brand-new identity at `cleo init`. The
+* tracked identity travels with the repository instead. Two files carry it:
 *
-* This module only READS. Writing (create-only) and re-linking live in
-* `@cleocode/core` (`scaffold/project-identity.ts`).
+* - `.cleo/project.json` — canonical since T12716: `{schemaVersion, id, name}`.
+*   The id is write-once; the name is the project's committed display name and
+*   changes only through `cleo project rename`.
+* - `.cleo/project-id` — the ADR-094 id-only file (T12325). Kept as a legacy
+*   mirror so builds that know only this file keep resolving the same id.
+*
+* {@link readPortableProjectId} is the ONE resolver over both: `project.json`
+* wins, `project-id` is the fallback. Because nothing rewrites the id, git has
+* nothing to overwrite — the geometry that made ADR-013 untrack the mutable
+* state files does not apply (ADR-094, T12325; ADR-096, T12716).
+*
+* This module only READS. Writing (create-only), renaming and migration live
+* in `@cleocode/core` (`scaffold/project-identity.ts`, `project-manifest.ts`,
+* `doctor/project-identity.ts`).
 *
 * @packageDocumentation
 * @task T12325
+* @task T12716
+*/
+/**
+* Basename of the legacy id-only identity file inside a project's `.cleo/`
+* (ADR-094). Superseded by {@link PROJECT_MANIFEST_FILE}; still read as a
+* fallback and kept as a mirror for older builds (T12716).
 */
-/** Basename of the tracked portable identity file inside a project's `.cleo/`. */
 var PORTABLE_PROJECT_ID_FILE = "project-id";
+/** Basename of the canonical tracked identity manifest inside `.cleo/` (T12716). */
+var PROJECT_MANIFEST_FILE = "project.json";
 /**
 * Accepted identity shape: every id CLEO has ever minted (UUIDv4, 12-hex,
 * the 29-char legacy form) fits, and nothing that could smuggle a path
@@ -258,24 +273,178 @@ function parsePortableProjectId(content) {
 	};
 }
 /**
-* Read the tracked portable identity of a project, synchronously.
+* Read ONLY the legacy `.cleo/project-id` file, synchronously.
+*
+* Callers that need the project's id use {@link readPortableProjectId}, which
+* prefers `project.json`. This is for code that manages the legacy file
+* itself (the doctor, the mirror writer, identity retirement).
 *
 * @param projectRoot - Absolute project root (the directory containing `.cleo/`).
-* @returns `absent` when no file exists, `valid` with the id, or `invalid`
-*   with a reason when the file exists but cannot be used.
+* @returns `absent`, `valid` with the id, or `invalid` with a reason.
+*
+* @example
+* ```ts
+* readProjectIdFile('/repo'); // { status: 'valid', projectId: 'c78d09c3a8ee', file: 'project-id' }
+* ```
+*
+* @public
+* @task T12716
+*/
+function readProjectIdFile(projectRoot) {
+	const content = readTextFile(portableProjectIdPath(projectRoot));
+	if (content.status !== "read") return withFile(content, PORTABLE_PROJECT_ID_FILE);
+	return withFile(parsePortableProjectId(content.content), PORTABLE_PROJECT_ID_FILE);
+}
+/**
+* Whether a string is an acceptable display name: 1-{@link PROJECT_DISPLAY_NAME_MAX}
+* characters after trimming, no path separator, no leading `~`, no control
+* character. A name is a label, never a path.
+*
+* @param name - Candidate name.
+* @returns `true` when the name is acceptable as-is (already trimmed).
+*
+* @example
+* ```ts
+* isValidProjectDisplayName('cleocode'); // true
+* isValidProjectDisplayName('../x');     // false
+* ```
+*
+* @public
+* @task T12716
+*/
+function isValidProjectDisplayName(name) {
+	return name.length > 0 && name === name.trim() && name.length <= 120 && !name.startsWith("~") && !/[/\\\u0000-\u001f\u007f]/.test(name);
+}
+/**
+* Absolute path of the canonical identity manifest for a project root.
+*
+* @param projectRoot - Absolute project root (the directory containing `.cleo/`).
+* @returns `<projectRoot>/.cleo/project.json`.
+*
+* @public
+* @task T12716
+*/
+function projectManifestPath(projectRoot) {
+	return join(projectRoot, ".cleo", PROJECT_MANIFEST_FILE);
+}
+/**
+* Parse the body of `.cleo/project.json`.
+*
+* Strict on the three fields: `schemaVersion` must be
+* {@link PROJECT_MANIFEST_SCHEMA_VERSION} (a newer format is `invalid`, so an
+* old build never guesses at it), `id` must pass
+* {@link isValidPortableProjectId}, and `name` must pass
+* {@link isValidProjectDisplayName}. Unknown extra keys are ignored.
+*
+* @param content - Raw file content.
+* @returns `valid` with the manifest, or `invalid` with a reason.
+*
+* @public
+* @task T12716
+*/
+function parseProjectManifest(content) {
+	let data;
+	try {
+		data = JSON.parse(content);
+	} catch (error) {
+		return {
+			status: "invalid",
+			reason: `not JSON: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (data === null || typeof data !== "object" || Array.isArray(data)) return {
+		status: "invalid",
+		reason: "expected a JSON object"
+	};
+	const record = data;
+	if (record["schemaVersion"] !== 1) return {
+		status: "invalid",
+		reason: `unsupported schemaVersion ${JSON.stringify(record["schemaVersion"])} (this build reads 1)`
+	};
+	const id = record["id"];
+	if (typeof id !== "string" || !isValidPortableProjectId(id)) return {
+		status: "invalid",
+		reason: `malformed id ${JSON.stringify(id)?.slice(0, 64)}`
+	};
+	const name = record["name"];
+	if (typeof name !== "string" || !isValidProjectDisplayName(name)) return {
+		status: "invalid",
+		reason: `malformed name ${JSON.stringify(name)?.slice(0, 64)}`
+	};
+	return {
+		status: "valid",
+		manifest: {
+			schemaVersion: 1,
+			id,
+			name
+		}
+	};
+}
+/**
+* Read `.cleo/project.json`, synchronously.
+*
+* @param projectRoot - Absolute project root (the directory containing `.cleo/`).
+* @returns `absent`, `valid` with the manifest, or `invalid` with a reason.
+*
+* @example
+* ```ts
+* const read = readProjectManifest('/repo');
+* if (read.status === 'valid') console.log(read.manifest.name);
+* ```
+*
+* @public
+* @task T12716
+*/
+function readProjectManifest(projectRoot) {
+	const content = readTextFile(projectManifestPath(projectRoot));
+	if (content.status !== "read") return content;
+	return parseProjectManifest(content.content);
+}
+/**
+* Read the tracked portable identity of a project, synchronously — the ONE
+* resolver over the tracked files (T12716).
+*
+* Precedence: `.cleo/project.json`, then the legacy `.cleo/project-id`. A
+* malformed `project.json` is `invalid` and does NOT fall through to
+* `project-id`: a broken canonical file is restored from version control,
+* never papered over. When both files are valid and disagree, `project.json`
+* wins here and `cleo doctor project-identity` reports the mirror conflict.
+*
+* @param projectRoot - Absolute project root (the directory containing `.cleo/`).
+* @returns `absent` when neither file exists, `valid` with the id (and the
+*   `file` it came from, plus the `name` when `project.json` supplied it), or
+*   `invalid` with a reason and the unusable `file`.
 *
 * @example
 * ```ts
 * const read = readPortableProjectId('/repo');
-* if (read.status === 'valid') console.log(read.projectId);
+* if (read.status === 'valid') console.log(read.projectId, read.file);
 * ```
 *
 * @public
 */
 function readPortableProjectId(projectRoot) {
-	let content;
+	const manifest = readProjectManifest(projectRoot);
+	if (manifest.status === "valid") return {
+		status: "valid",
+		projectId: manifest.manifest.id,
+		file: PROJECT_MANIFEST_FILE,
+		name: manifest.manifest.name
+	};
+	if (manifest.status === "invalid") return {
+		status: "invalid",
+		reason: manifest.reason,
+		file: PROJECT_MANIFEST_FILE
+	};
+	return readProjectIdFile(projectRoot);
+}
+/** Read a small text file; `absent` on ENOENT, `invalid` on any other error. */
+function readTextFile(path) {
 	try {
-		content = readFileSync(portableProjectIdPath(projectRoot), "utf-8");
+		return {
+			status: "read",
+			content: readFileSync(path, "utf-8")
+		};
 	} catch (error) {
 		if (error instanceof Error && "code" in error && error.code === "ENOENT") return { status: "absent" };
 		return {
@@ -283,7 +452,14 @@ function readPortableProjectId(projectRoot) {
 			reason: `unreadable: ${error instanceof Error ? error.message : String(error)}`
 		};
 	}
-	return parsePortableProjectId(content);
+}
+/** Tag a read outcome with the file it came from (absent stays untagged). */
+function withFile(read, file) {
+	if (read.status === "absent") return read;
+	return {
+		...read,
+		file
+	};
 }
 //#endregion
 //#region ../paths/dist/cleo-paths.js
@@ -324,11 +500,15 @@ function _readProjectInfoId(projectRoot) {
 	}
 }
 /**
-* Read the identity a project root DECLARES, in precedence order (T12470):
+* Read the identity a project root DECLARES, in precedence order (T12470,
+* T12716):
 *
-*   1. the tracked, write-once `.cleo/project-id` (ADR-094);
-*   2. the `projectId` in `.cleo/project-info.json`.
+*   1. the tracked, write-once id: `.cleo/project.json`, else the legacy
+*      `.cleo/project-id` ({@link readPortableProjectId}, ADR-094);
+*   2. the `projectId` cached in `.cleo/project-info.json`.
 *
+* The tracked id always wins; a disagreeing cache is reported by
+* `cleo doctor project-identity` and re-keyed only by its `--resolve`.
 * A malformed tracked file is skipped here (it is reported by
 * `cleo doctor project-identity`) and never replaced by a derived value.
 * Nothing about the path — its spelling, realpath, git root or remote — takes
@@ -351,6 +531,8 @@ function readDeclaredProjectIdentity(projectRoot) {
 	if (tracked.status === "valid") return {
 		projectId: tracked.projectId,
 		source: "tracked",
+		...tracked.file !== void 0 && { trackedFile: tracked.file },
+		...tracked.name !== void 0 && { name: tracked.name },
 		...infoProjectId !== void 0 && { infoProjectId }
 	};
 	if (infoProjectId !== void 0) return {
@@ -361,6 +543,18 @@ function readDeclaredProjectIdentity(projectRoot) {
 	return null;
 }
 /**
+* Whether `<dir>/.git` is a DIRECTORY (a git toplevel). A linked worktree's
+* `.git` is a gitlink FILE: a tracked-only `.cleo/` there is not a project
+* root, matching core's `validateProjectRoot` (T12716 review finding 8).
+*/
+function _isGitDirectory(dir) {
+	try {
+		return statSync(join(dir, ".git")).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/**
 * Canonicalize a filesystem path across operating systems — resolve symlinks
 * and mount/alias divergence (macOS `/var` → `/private/var`, Windows
 * drive-letter case + 8.3 short names, Linux bind-mounts) via
@@ -464,7 +658,7 @@ function resolveProjectByCwd(cwd) {
 		if (existsSync(join(current, ".cleo"))) {
 			const declared = readDeclaredProjectIdentity(current);
 			const trackedOnly = declared?.source === "tracked" && declared.infoProjectId === void 0;
-			if (declared !== null && (!trackedOnly || existsSync(join(current, ".git")))) return {
+			if (declared !== null && (!trackedOnly || _isGitDirectory(current))) return {
 				projectId: declared.projectId,
 				projectRoot: canonicalizePath(current),
 				...declared.infoProjectId !== void 0 && { legacyUUID: declared.infoProjectId },
@@ -572,7 +766,7 @@ function resolveCanonicalCleoDir(projectId) {
 *
 * Resolution order:
 * 1. {@link resolveProjectByCwd} — reads the declared `projectId`
-*    (`.cleo/project-id`, then `project-info.json`) and the checkout root. The
+*    (`.cleo/project.json` / legacy `.cleo/project-id`, then `project-info.json`) and the checkout root. The
 *    registry path from {@link resolveCanonicalCleoDir} is used only when it
 *    names this same checkout (T12470); otherwise `<projectRoot>/.cleo`.
 * 2. Fallback: `CLEO_ROOT` env var or `process.cwd()` + `'.cleo'` for
@@ -1603,4 +1797,4 @@ function getAllSubstrates(options = {}) {
 }
 
 export { getAgentRegistryDb as a, getNexusDb as b, getConduitDb as c, getTasksDb as d, getBrainDb as e, getAllSubstrates as g };
-//# sourceMappingURL=src-RK_h29uK.js.map
+//# sourceMappingURL=src-CeLZUrEE.js.map

package/studio-dist/server/chunks/{stores-C8kmowVZ.js → stores-Dyo9kN1m.js}

@@ -1,6 +1,6 @@
 import { g as getContext } from './dev-Br5zieNA.js';
 import 'node:module';
-import './client-BqWu1TLm.js';
+import './client-NfsjQdjU.js';
 
 //#region ../../node_modules/.pnpm/@sveltejs+kit@2.57.1_@opentelemetry+api@1.9.0_@sveltejs+vite-plugin-svelte@5.1.1_svelte_e94e6db60b0c5f7146157d0facbe8042/node_modules/@sveltejs/kit/src/runtime/app/stores.js
 /**
@@ -30,4 +30,4 @@ var page = { subscribe(fn) {
 } };
 
 export { page as p };
-//# sourceMappingURL=stores-C8kmowVZ.js.map
+//# sourceMappingURL=stores-Dyo9kN1m.js.map

package/studio-dist/server/index.js

@@ -1,5 +1,5 @@
 import { _ as __commonJSMin } from './chunks/index-server-BgfA6C0S.js';
-import { c as coalesce_to_error, g as get_status, a as get_message, w as with_request_store, p as parse, o as options, I as IN_WEBCONTAINER, b as get_hooks, n as noop, T as TRAILING_SLASH_PARAM, d as INVALIDATED_PARAM, e as decode_pathname, f as find_route, h as normalize_path, i as disable_search, m as merge_tracing, v as validate_layout_server_exports, j as validate_layout_exports, k as validate_page_server_exports, l as validate_page_exports, q as noop_span, r as create_remote_key, s as hash, t as compact, u as once, x as normalize_error, y as resolve, z as parse_remote_arg, A as stringify, B as make_trackable, C as stringify$1, D as read_implementation, E as split_remote_key, N as NULL_BODY_STATUS, F as set_read_implementation } from './chunks/internal-BlXMjztN.js';
+import { c as coalesce_to_error, g as get_status, a as get_message, w as with_request_store, p as parse, o as options, I as IN_WEBCONTAINER, b as get_hooks, n as noop, T as TRAILING_SLASH_PARAM, d as INVALIDATED_PARAM, e as decode_pathname, f as find_route, h as normalize_path, i as disable_search, m as merge_tracing, v as validate_layout_server_exports, j as validate_layout_exports, k as validate_page_server_exports, l as validate_page_exports, q as noop_span, r as create_remote_key, s as hash, t as compact, u as once, x as normalize_error, y as resolve, z as parse_remote_arg, A as stringify, B as make_trackable, C as stringify$1, D as read_implementation, E as split_remote_key, N as NULL_BODY_STATUS, F as set_read_implementation } from './chunks/internal-OCcHamz2.js';
 import { H as HttpError, a as text_decoder, S as SvelteKitError, h as has_resolution_suffix, c as has_data_suffix, s as strip_resolution_suffix, d as strip_data_suffix, e as add_data_suffix, f as add_resolution_suffix, R as Redirect, t as text_encoder, A as ActionFailure, g as get_relative_path, i as base64_encode } from './chunks/utils-g564cUMV.js';
 import { j as json, t as text, e as error, i as isRedirect } from './chunks/exports-Dg-gdPPq.js';
 import { u as uneval, aa as writable, ab as readable } from './chunks/dev-Br5zieNA.js';