@cleocode/cleo 2026.9.25 → 2026.10.1

package/dist/cli/index.js

@@ -395,6 +395,16 @@ function resolveFieldContext(opts) {
   };
   return resolveFieldExtraction(input2);
 }
+async function withoutOutputPointer(step) {
+  const saved = currentContext;
+  const { field: _field, ...rest } = saved;
+  currentContext = rest;
+  try {
+    return await step();
+  } finally {
+    currentContext = saved;
+  }
+}
 var currentContext;
 var init_field_context = __esm({
   "packages/cleo/src/cli/field-context.ts"() {
@@ -1234,7 +1244,6 @@ var init_tree = __esm({
 // packages/animations/src/render/index.ts
 var init_render = __esm({
   "packages/animations/src/render/index.ts"() {
-    "use strict";
     init_legend();
     init_tree();
   }
@@ -1352,6 +1361,7 @@ var init_spinner_handle = __esm({
 var init_src = __esm({
   "packages/animations/src/index.ts"() {
     init_animate_context();
+    init_render();
     init_spinner_handle();
   }
 });
@@ -4968,7 +4978,7 @@ var init_output_contracts_data = __esm({
               // T12503: the optimistic-concurrency version agents pass to --if-match.
               updatedAt: {
                 type: ["string", "null"],
-                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`."
+                description: "Task version for optimistic concurrency: pass it to `cleo update|complete --if-match`. A stale version fails with E_CONFLICT (23); E_TASK_RENAMED (26) when sync re-numbered the task you read (details.expected is its new id)."
               },
               // T12502: the human assignee and the agent claim lease are separate.
               assignee: {
@@ -16454,6 +16464,7 @@ var init_exit_codes = __esm({
       ExitCode2[ExitCode2["VERSION_CONFLICT"] = 23] = "VERSION_CONFLICT";
       ExitCode2[ExitCode2["SESSION_UNBOUND"] = 24] = "SESSION_UNBOUND";
       ExitCode2[ExitCode2["WORKTREE_LOCKED"] = 25] = "WORKTREE_LOCKED";
+      ExitCode2[ExitCode2["TASK_RENAMED"] = 26] = "TASK_RENAMED";
       ExitCode2[ExitCode2["SESSION_EXISTS"] = 30] = "SESSION_EXISTS";
       ExitCode2[ExitCode2["SESSION_NOT_FOUND"] = 31] = "SESSION_NOT_FOUND";
       ExitCode2[ExitCode2["SCOPE_CONFLICT"] = 32] = "SCOPE_CONFLICT";
@@ -22728,7 +22739,30 @@ var init_nexus_account = __esm({
       "E_NEXUS_REVOKE_FAILED",
       "E_NEXUS_REQUEST_FAILED",
       "E_NEXUS_NOT_A_PROJECT",
-      "E_NEXUS_INVALID_LABEL"
+      "E_NEXUS_INVALID_LABEL",
+      // Device credentials (cleo-nexus device contract §3.3, §4.0.4; T12868).
+      /** No answer from the API (network error or timeout). */
+      "E_NEXUS_UNREACHABLE",
+      /** `cleo login nexus` while a revoke of this device is unconfirmed (§3.3, v2.9). */
+      "E_NEXUS_REVOKE_PENDING",
+      /** The device was signed out (E9, E11): 401 `device-signed-out`. */
+      "E_NEXUS_DEVICE_SIGNED_OUT",
+      /** The device was revoked (E10, E12): 401 `device-revoked`. */
+      "E_NEXUS_DEVICE_REVOKED",
+      /** A credential replaced or revoked elsewhere, or a `rotation-conflict` (R2). */
+      "E_NEXUS_CREDENTIAL_COMPROMISED",
+      /** The device credential lacks the scope (a read-only device): 403 `insufficient-scope`. */
+      "E_NEXUS_INSUFFICIENT_SCOPE",
+      /** A replica attach from a second device: 409 `replica-copied`. */
+      "E_NEXUS_REPLICA_COPIED",
+      /** Another cleo process holds the device file or an upgrade in flight; retry. */
+      "E_NEXUS_BUSY",
+      /** Several accounts hold a device credential on one origin and none was named. */
+      "E_NEXUS_ACCOUNT_AMBIGUOUS",
+      /** An option that needs device credentials (`--read-only`) with `CLEO_NEXUS_DEVICE=0`. */
+      "E_NEXUS_DEVICE_REQUIRED",
+      /** `.cleo/nexus-link.json` is in a format this CLEO cannot update (written by a newer CLEO). */
+      "E_NEXUS_LINK_FILE_UNSUPPORTED"
     ];
     nexusAccountUserSchema = z25.object({
       id: z25.string(),
@@ -22750,6 +22784,340 @@ var init_nexus_account = __esm({
   }
 });
 
+// packages/contracts/src/nexus-cloud.ts
+import { z as z26 } from "zod";
+var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_LIST_STATES, NEXUS_PAGE_LIMIT_MAX, NEXUS_CLOUD_MAX_PAGES, NEXUS_PRESENCE_FRESH_SECONDS, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema, NEXUS_UNAUTHENTICATED_REASONS, NEXUS_FORBIDDEN_REASONS, NEXUS_REVOKED_REASONS, LOGIN, COMPROMISED, DEVICE_REVOKED, SESSION_EXPIRED_LOGIN, SERVER_REFUSED, NEXUS_REVOKED_REASON_ERRORS, NEXUS_UNAUTHENTICATED_ERRORS, NEXUS_FORBIDDEN_ERRORS, NEXUS_CONFLICT_ERRORS, NEXUS_UNREACHABLE_ERROR;
+var init_nexus_cloud = __esm({
+  "packages/contracts/src/nexus-cloud.ts"() {
+    "use strict";
+    NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
+    NEXUS_CLOUD_PROFILES = ["device", "read-only"];
+    NEXUS_DEVICE_LIST_STATES = ["active", "signed-out", "revoked", "all"];
+    NEXUS_PAGE_LIMIT_MAX = 200;
+    NEXUS_CLOUD_MAX_PAGES = 25;
+    NEXUS_PRESENCE_FRESH_SECONDS = 86400;
+    NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
+    isoTime = z26.iso.datetime({ offset: true });
+    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z26.object({
+      kind: z26.enum(["device", "session"]),
+      credentialId: z26.string().nullable().optional(),
+      profile: profile.optional(),
+      scopes: z26.array(z26.string()).default([]),
+      createdAt: isoTime.nullable().optional(),
+      lastUsedAt: isoTime.nullable().optional(),
+      /** When the credential expires if it is not used again; null for sessions. */
+      idleExpiresAt: isoTime.nullable().optional()
+    });
+    nexusCloudDeviceSchema = z26.object({
+      deviceId: z26.string(),
+      name: z26.string(),
+      platform: z26.string().optional(),
+      arch: z26.string().nullable().optional(),
+      cliVersion: z26.string().nullable().optional(),
+      createdAt: isoTime.optional(),
+      lastSeenAt: isoTime.nullable().optional(),
+      state: deviceState,
+      signedOutAt: isoTime.nullable().optional(),
+      /** Base64 device certificate; null until the device holds a key grant. */
+      certificate: z26.string().nullable().optional(),
+      /** The current credential's profile, or null with none (signed out or revoked). */
+      profile: profile.optional(),
+      /** True for the device whose credential made this request. */
+      current: z26.boolean().default(false),
+      projects: z26.number().int().nonnegative().optional(),
+      replicas: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional()
+    });
+    nexusCloudOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
+      personal: z26.boolean().optional()
+    });
+    nexusCloudUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusCloudWhoamiSchema = z26.object({
+      serverTime: isoTime.optional(),
+      user: nexusCloudUserSchema,
+      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      credential: nexusCloudCredentialSchema,
+      /** The calling device; null for a session caller. */
+      device: nexusCloudDeviceSchema.nullable()
+    });
+    nexusCloudDevicePageSchema = z26.object({
+      devices: z26.array(nexusCloudDeviceSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    nexusCloudPresenceSchema = z26.looseObject({
+      observedAt: isoTime.optional(),
+      sync: z26.object({ enabled: z26.boolean() }).optional()
+    });
+    nexusCloudReplicaSchema = z26.object({
+      projectId: z26.string(),
+      replicaId: z26.string(),
+      deviceId: z26.string(),
+      deviceName: z26.string(),
+      deviceState: deviceState.optional(),
+      attachedAt: isoTime.optional(),
+      lastSyncAt: isoTime.nullable(),
+      presence: nexusCloudPresenceSchema.nullable(),
+      presenceAt: isoTime.nullable()
+    });
+    nexusCloudDeviceCountsSchema = z26.object({
+      active: z26.number().int().nonnegative(),
+      total: z26.number().int().nonnegative()
+    });
+    projectFields = {
+      projectId: z26.string(),
+      label: z26.string().nullable(),
+      organizationId: z26.string(),
+      organizationName: z26.string().optional(),
+      remoteUrl: z26.string().nullable().optional(),
+      createdAt: isoTime.optional()
+    };
+    nexusCloudProjectListItemSchema = z26.object({
+      ...projectFields,
+      role: z26.string(),
+      streamId: z26.string().optional(),
+      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      openConflicts: z26.number().int().nonnegative().optional(),
+      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional(),
+      /** This project's replica list was cut at 50 (T12858). */
+      replicasTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectPageSchema = z26.object({
+      projects: z26.array(nexusCloudProjectListItemSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      /** Anything in the page was cut (the project list or a replica list). */
+      truncated: z26.boolean().default(false),
+      /** The project list itself was cut at 1000 (T12858). */
+      projectsTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectDetailSchema = z26.object({
+      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z26.string(),
+      canTrash: z26.boolean().optional(),
+      openConflicts: z26.number().int().nonnegative(),
+      /** At most 50, oldest attachment first. */
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema,
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      /** `replicas` was cut at 50. */
+      truncated: z26.boolean().default(false),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable()
+      }).nullable()
+    });
+    nexusCloudReplicaPageSchema = z26.object({
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    NEXUS_STATUS_CHECK_IDS = [
+      "credential.valid",
+      "device.registered",
+      "device.active",
+      "device.certified",
+      "project.registered",
+      "project.writable",
+      "replica.attached",
+      "presence.fresh",
+      "replica.synced",
+      "conflicts.none"
+    ];
+    NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
+    CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
+    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z26.object({
+      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z26.boolean(),
+      required: z26.boolean(),
+      detail: z26.string()
+    });
+    nexusCloudStatusSchema = z26.object({
+      serverTime: isoTime.optional(),
+      apiVersion: z26.string().optional(),
+      user: nexusCloudUserSchema,
+      credential: nexusCloudCredentialSchema,
+      device: nexusCloudDeviceSchema.nullable(),
+      project: z26.object({
+        projectId: z26.string(),
+        registered: z26.boolean(),
+        organizationId: z26.string().nullable(),
+        organizationName: z26.string().nullable(),
+        role: z26.string().nullable()
+      }).nullable(),
+      replica: z26.object({
+        replicaId: z26.string(),
+        attached: z26.boolean(),
+        attachedElsewhere: z26.boolean(),
+        attachedAt: isoTime.nullable(),
+        lastSyncAt: isoTime.nullable(),
+        presenceAt: isoTime.nullable(),
+        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+      }).nullable(),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable(),
+        openConflicts: z26.number().int().nonnegative(),
+        devices: nexusCloudDeviceCountsSchema
+      }).nullable(),
+      /** Check ids added by a newer server are dropped, never a parse failure. */
+      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+        (list) => list.flatMap((c) => {
+          const id = knownCheckId.safeParse(c.id);
+          return id.success ? [{ ...c, id: id.data }] : [];
+        })
+      ),
+      /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
+      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+    });
+    NEXUS_UNAUTHENTICATED_REASONS = [
+      "missing",
+      "invalid",
+      "credential-revoked",
+      "credential-expired",
+      "device-signed-out",
+      "device-revoked",
+      "session-bearer-retired",
+      "session-used"
+    ];
+    NEXUS_FORBIDDEN_REASONS = [
+      "insufficient-scope",
+      "session-required",
+      "device-required",
+      "device-mismatch",
+      "not-self",
+      "project-role",
+      "route-undeclared",
+      "bearer-session-required",
+      "session-not-fresh",
+      "device-limit"
+    ];
+    NEXUS_REVOKED_REASONS = ["signed-out", "revoked", "rotated", "reenrolled"];
+    LOGIN = "run `cleo login nexus`";
+    COMPROMISED = {
+      code: "E_NEXUS_CREDENTIAL_COMPROMISED",
+      message: "this device's credential was replaced or revoked elsewhere, possibly used from another machine",
+      fix: "revoke this device on cleocode.dev and sign in again with `cleo login nexus`"
+    };
+    DEVICE_REVOKED = {
+      code: "E_NEXUS_DEVICE_REVOKED",
+      message: "this device was revoked",
+      fix: "run `cleo login nexus` to enrol this machine as a new device"
+    };
+    SESSION_EXPIRED_LOGIN = {
+      code: "E_NEXUS_SESSION_EXPIRED",
+      message: "the session is too old for this request",
+      fix: "run `cleo login nexus` (needs a browser: on a headless machine a human must complete the login)"
+    };
+    SERVER_REFUSED = {
+      code: "E_NEXUS_REQUEST_FAILED",
+      message: null,
+      fix: null
+    };
+    NEXUS_REVOKED_REASON_ERRORS = {
+      reenrolled: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device's credential was replaced by a newer login of the same device",
+        fix: LOGIN
+      },
+      "signed-out": {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device was signed out and later signed in again with another credential",
+        fix: LOGIN
+      },
+      revoked: DEVICE_REVOKED,
+      rotated: COMPROMISED
+    };
+    NEXUS_UNAUTHENTICATED_ERRORS = {
+      missing: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "not signed in to Cleo Nexus (the credential is missing or invalid)",
+        fix: LOGIN
+      },
+      invalid: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "not signed in to Cleo Nexus (the credential is missing or invalid)",
+        fix: LOGIN
+      },
+      // Resolved by `details.revokedReason` through NEXUS_REVOKED_REASON_ERRORS.
+      "credential-revoked": COMPROMISED,
+      "credential-expired": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "the device credential expired after 90 days without use",
+        fix: LOGIN
+      },
+      "device-signed-out": {
+        code: "E_NEXUS_DEVICE_SIGNED_OUT",
+        message: "this device was signed out",
+        fix: LOGIN
+      },
+      "device-revoked": DEVICE_REVOKED,
+      "session-bearer-retired": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "bearer sessions are no longer accepted",
+        fix: "run `cleo login nexus` with the current CLI"
+      },
+      "session-used": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "the 9.24 session was already used by another enrolment",
+        fix: LOGIN
+      }
+    };
+    NEXUS_FORBIDDEN_ERRORS = {
+      "insufficient-scope": {
+        code: "E_NEXUS_INSUFFICIENT_SCOPE",
+        message: "this device's credential lacks the scope for that request",
+        fix: "run `cleo login nexus` without --read-only to enrol with the full device profile"
+      },
+      "session-required": SERVER_REFUSED,
+      "device-required": SERVER_REFUSED,
+      "device-mismatch": SERVER_REFUSED,
+      "not-self": SERVER_REFUSED,
+      "project-role": SERVER_REFUSED,
+      "route-undeclared": SERVER_REFUSED,
+      "bearer-session-required": SESSION_EXPIRED_LOGIN,
+      "session-not-fresh": SESSION_EXPIRED_LOGIN,
+      "device-limit": {
+        code: "E_NEXUS_REQUEST_FAILED",
+        message: "the account has reached its device limit",
+        fix: "revoke unused devices on cleocode.dev, then retry"
+      }
+    };
+    NEXUS_CONFLICT_ERRORS = {
+      "replica-copied": {
+        code: "E_NEXUS_REPLICA_COPIED",
+        message: "this project store is attached from another device (a copied store)",
+        fix: null
+      },
+      "rotation-conflict": COMPROMISED
+    };
+    NEXUS_UNREACHABLE_ERROR = {
+      code: "E_NEXUS_UNREACHABLE",
+      message: null,
+      fix: "check your network and retry"
+    };
+  }
+});
+
 // packages/contracts/src/task-id.ts
 function isTaskId(value) {
   return typeof value === "string" && TASK_ID_REGEX.test(value);
@@ -22817,6 +23185,7 @@ __export(src_exports, {
   CHANNEL_BOUNDARY_REGISTRY: () => CHANNEL_BOUNDARY_REGISTRY,
   CLEO_CONFIG_MANIFEST: () => CLEO_CONFIG_MANIFEST,
   CLI_CATEGORY_ORDER: () => CLI_CATEGORY_ORDER,
+  CLOUD_STATUS_VERDICTS: () => CLOUD_STATUS_VERDICTS,
   COLLECTION_IDENTITY_FIELDS: () => COLLECTION_IDENTITY_FIELDS,
   COLLECTION_KEYS: () => COLLECTION_KEYS,
   CONFIG_MANIFEST_ENTRIES: () => CONFIG_MANIFEST_ENTRIES,
@@ -22931,10 +23300,27 @@ __export(src_exports, {
   MonitorResponseSchema: () => MonitorResponseSchema,
   NEXUS_ACCOUNT_ERROR_CODES: () => NEXUS_ACCOUNT_ERROR_CODES,
   NEXUS_CLI_CLIENT_ID: () => NEXUS_CLI_CLIENT_ID,
+  NEXUS_CLOUD_MAX_PAGES: () => NEXUS_CLOUD_MAX_PAGES,
+  NEXUS_CLOUD_PROFILES: () => NEXUS_CLOUD_PROFILES,
+  NEXUS_CONFLICT_ERRORS: () => NEXUS_CONFLICT_ERRORS,
   NEXUS_DEFAULT_API_URL: () => NEXUS_DEFAULT_API_URL,
+  NEXUS_DEVICE_LIST_STATES: () => NEXUS_DEVICE_LIST_STATES,
+  NEXUS_DEVICE_STATES: () => NEXUS_DEVICE_STATES,
+  NEXUS_DEVICE_STATE_UNKNOWN: () => NEXUS_DEVICE_STATE_UNKNOWN,
   NEXUS_FLEET_SCHEMA_VERSION: () => NEXUS_FLEET_SCHEMA_VERSION,
+  NEXUS_FORBIDDEN_ERRORS: () => NEXUS_FORBIDDEN_ERRORS,
+  NEXUS_FORBIDDEN_REASONS: () => NEXUS_FORBIDDEN_REASONS,
   NEXUS_LOGIN_TARGET: () => NEXUS_LOGIN_TARGET,
+  NEXUS_PAGE_LIMIT_MAX: () => NEXUS_PAGE_LIMIT_MAX,
+  NEXUS_PRESENCE_FRESH_SECONDS: () => NEXUS_PRESENCE_FRESH_SECONDS,
+  NEXUS_REVOKED_REASONS: () => NEXUS_REVOKED_REASONS,
+  NEXUS_REVOKED_REASON_ERRORS: () => NEXUS_REVOKED_REASON_ERRORS,
   NEXUS_SCOPE_MAP: () => NEXUS_SCOPE_MAP,
+  NEXUS_STATUS_CHECK_IDS: () => NEXUS_STATUS_CHECK_IDS,
+  NEXUS_STATUS_VERDICTS: () => NEXUS_STATUS_VERDICTS,
+  NEXUS_UNAUTHENTICATED_ERRORS: () => NEXUS_UNAUTHENTICATED_ERRORS,
+  NEXUS_UNAUTHENTICATED_REASONS: () => NEXUS_UNAUTHENTICATED_REASONS,
+  NEXUS_UNREACHABLE_ERROR: () => NEXUS_UNREACHABLE_ERROR,
   OPEN_SYSTEM_KEY_PREFIXES: () => OPEN_SYSTEM_KEY_PREFIXES,
   OPERATIONS: () => OPERATIONS,
   OPERATION_RESULT_SCHEMAS: () => OPERATION_RESULT_SCHEMAS,
@@ -23214,6 +23600,21 @@ __export(src_exports, {
   nexusAccountMeSchema: () => nexusAccountMeSchema,
   nexusAccountOrganizationSchema: () => nexusAccountOrganizationSchema,
   nexusAccountUserSchema: () => nexusAccountUserSchema,
+  nexusCloudCredentialSchema: () => nexusCloudCredentialSchema,
+  nexusCloudDeviceCountsSchema: () => nexusCloudDeviceCountsSchema,
+  nexusCloudDevicePageSchema: () => nexusCloudDevicePageSchema,
+  nexusCloudDeviceSchema: () => nexusCloudDeviceSchema,
+  nexusCloudOrganizationSchema: () => nexusCloudOrganizationSchema,
+  nexusCloudPresenceSchema: () => nexusCloudPresenceSchema,
+  nexusCloudProjectDetailSchema: () => nexusCloudProjectDetailSchema,
+  nexusCloudProjectListItemSchema: () => nexusCloudProjectListItemSchema,
+  nexusCloudProjectPageSchema: () => nexusCloudProjectPageSchema,
+  nexusCloudReplicaPageSchema: () => nexusCloudReplicaPageSchema,
+  nexusCloudReplicaSchema: () => nexusCloudReplicaSchema,
+  nexusCloudStatusCheckSchema: () => nexusCloudStatusCheckSchema,
+  nexusCloudStatusSchema: () => nexusCloudStatusSchema,
+  nexusCloudUserSchema: () => nexusCloudUserSchema,
+  nexusCloudWhoamiSchema: () => nexusCloudWhoamiSchema,
   normalizeError: () => normalizeError,
   noteAtomSchema: () => noteAtomSchema,
   noulDecisionAnswerSchema: () => noulDecisionAnswerSchema,
@@ -23394,6 +23795,7 @@ var init_src2 = __esm({
     init_decide();
     init_decide_sites();
     init_nexus_account();
+    init_nexus_cloud();
     init_task_id();
   }
 });
@@ -36321,7 +36723,7 @@ function parseAgenticNode(raw, base, index) {
     inputs = acc;
   }
   const context_files = parseStringArray(raw.context_files, `nodes[${index}].context_files`);
-  const profile = parseOptionalNonEmptyString(raw.profile, `nodes[${index}].profile`);
+  const profile2 = parseOptionalNonEmptyString(raw.profile, `nodes[${index}].profile`);
   const model = parseOptionalNonEmptyString(raw.model, `nodes[${index}].model`);
   const provider = parseOptionalNonEmptyString(raw.provider, `nodes[${index}].provider`);
   const allowed_skills = parseStringArray(raw.allowed_skills, `nodes[${index}].allowed_skills`);
@@ -36334,7 +36736,7 @@ function parseAgenticNode(raw, base, index) {
     role,
     inputs,
     ...context_files !== void 0 ? { context_files } : {},
-    ...profile !== void 0 ? { profile } : {},
+    ...profile2 !== void 0 ? { profile: profile2 } : {},
     ...model !== void 0 ? { model } : {},
     ...provider !== void 0 ? { provider } : {},
     ...allowed_skills !== void 0 ? { allowed_skills } : {},
@@ -37997,8 +38399,8 @@ async function loadPlaybookByName(name) {
     return null;
   }
   try {
-    const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
-    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot74();
+    const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
+    const projectRoot = __playbookRuntimeOverrides.projectRoot ?? getProjectRoot75();
     const resolved = resolvePlaybook(name, {
       projectRoot,
       globalPlaybooksDir: __playbookRuntimeOverrides.globalPlaybooksDir,
@@ -38043,7 +38445,7 @@ async function buildDefaultDispatcher() {
   if (__playbookRuntimeOverrides.dispatcher) return __playbookRuntimeOverrides.dispatcher;
   const { orchestrateSpawnExecute: orchestrateSpawnExecute2 } = await import("@cleocode/runtime/gateway");
   const {
-    getProjectRoot: getProjectRoot74,
+    getProjectRoot: getProjectRoot75,
     createToolGuard,
     runSkillNodeOrSpawn,
     maybeCreatePiRunner,
@@ -38051,7 +38453,7 @@ async function buildDefaultDispatcher() {
     hasCantbookProfilePin,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot74();
+  const projectRoot = getProjectRoot75();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38144,12 +38546,12 @@ async function buildDefaultDeterministicRunner() {
     return void 0;
   }
   const {
-    getProjectRoot: getProjectRoot74,
+    getProjectRoot: getProjectRoot75,
     createToolGuard,
     createGuardedDeterministicRunner,
     DEFAULT_DETERMINISTIC_DENIED_COMMANDS
   } = await import("@cleocode/core/internal");
-  const projectRoot = getProjectRoot74();
+  const projectRoot = getProjectRoot75();
   const tools = createToolGuard({
     allowedRoots: [projectRoot],
     deniedCommands: DEFAULT_DETERMINISTIC_DENIED_COMMANDS,
@@ -38307,8 +38709,8 @@ var init_playbook2 = __esm({
             projectRoot = __playbookRuntimeOverrides.projectRoot;
           } else {
             try {
-              const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
-              projectRoot = getProjectRoot74();
+              const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
+              projectRoot = getProjectRoot75();
             } catch {
               projectRoot = void 0;
             }
@@ -38373,14 +38775,14 @@ var init_playbook2 = __esm({
         const deterministicRunner = await buildDefaultDeterministicRunner();
         let result;
         try {
-          const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/internal");
+          const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/internal");
           const opts = {
             db,
             playbook: parsed.definition,
             playbookHash: parsed.sourceHash,
             initialContext,
             dispatcher,
-            projectRoot: getProjectRoot74()
+            projectRoot: getProjectRoot75()
           };
           if (deterministicRunner !== void 0) opts.deterministicRunner = deterministicRunner;
           if (__playbookRuntimeOverrides.approvalSecret !== void 0) {
@@ -38739,6 +39141,7 @@ async function orchestratePivotOp(params) {
     else if (code === 38) errorCode = "E_NOT_ACTIVE";
     else if (code === 35) errorCode = "E_TASK_CLAIMED";
     else if (code === 24) errorCode = "E_SESSION_UNBOUND";
+    else if (code === 26) errorCode = "E_TASK_RENAMED";
     const cleo = err instanceof CleoError ? err : void 0;
     return {
       success: false,
@@ -45718,11 +46121,11 @@ var init_security = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/sanitizer.ts
-function createSanitizer(getProjectRoot74) {
+function createSanitizer(getProjectRoot75) {
   return async (req, next) => {
     if (req.params) {
       try {
-        const root = getProjectRoot74 ? getProjectRoot74() : void 0;
+        const root = getProjectRoot75 ? getProjectRoot75() : void 0;
         req.params = sanitizeParams(req.params, root, {
           domain: req.domain,
           operation: req.operation
@@ -45824,14 +46227,14 @@ var init_session_resolver = __esm({
 });
 
 // packages/cleo/src/dispatch/middleware/store-write-guard.ts
-function createStoreWriteGuard(getProjectRoot74) {
+function createStoreWriteGuard(getProjectRoot75) {
   return async (req, next) => {
     if (req.gateway !== "mutate" || ALLOWED_WHILE_READ_ONLY.has(`${req.domain}.${req.operation}`)) {
       return next();
     }
     let projectRoot;
     try {
-      projectRoot = getProjectRoot74();
+      projectRoot = getProjectRoot75();
     } catch {
       return next();
     }
@@ -46258,6 +46661,7 @@ var init_cli = __esm({
       E_CONFLICT: 23,
       E_SESSION_UNBOUND: 24,
       E_WORKTREE_LOCKED: 25,
+      E_TASK_RENAMED: 26,
       E_TWIN_COLLAPSE_FAILED: 55,
       E_SESSION_EXISTS: 30,
       E_SESSION_NOT_FOUND: 31,
@@ -47576,8 +47980,8 @@ var init_agent_outputs = __esm({
 });
 
 // packages/cleo/src/cli/commands/agent-profile-status.ts
-function computeProfileStatus(profile, validation) {
-  if (profile === null) return "none";
+function computeProfileStatus(profile2, validation) {
+  if (profile2 === null) return "none";
   if (validation === null) return "loaded (unvalidated)";
   if (validation.valid) return "validated";
   return `invalid (${validation.errors.length} errors)`;
@@ -47882,16 +48286,16 @@ agent ${agentId}:
             process.exitCode = 1;
             return;
           }
-          let profile = null;
+          let profile2 = null;
           let cantValidation = null;
           const cantPath = args.cant ?? join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           if (existsSync22(cantPath)) {
-            profile = readFileSync22(cantPath, "utf-8");
+            profile2 = readFileSync22(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
               if (validate) {
-                const result = validate(profile);
+                const result = validate(profile2);
                 cantValidation = {
                   valid: result.valid,
                   errors: result.diagnostics?.map((d) => d.message) ?? []
@@ -47934,7 +48338,7 @@ agent ${agentId}:
                 transport: runtime.transport.name,
                 // Surfaced for operator visibility only — see
                 // computeProfileStatus tsdoc for the four possible values.
-                profile: computeProfileStatus(profile, cantValidation),
+                profile: computeProfileStatus(profile2, cantValidation),
                 services: {
                   poller: "running",
                   heartbeat: runtime.heartbeat ? "running" : "disabled",
@@ -50613,15 +51017,24 @@ function nexusApiUrlArg(args) {
 function failNexus(err, operation) {
   const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
   const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
-  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" ? 6 : 1;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : 1;
+  const details = err instanceof Error && "publicDetails" in err && typeof err.publicDetails === "object" && err.publicDetails ? err.publicDetails : void 0;
   cliError(
     err instanceof Error ? err.message : String(err),
     exitCode,
-    { name: code ?? "E_NEXUS_REQUEST_FAILED", ...fix ? { fix } : {} },
+    {
+      name: code ?? "E_NEXUS_REQUEST_FAILED",
+      ...fix ? { fix } : {},
+      ...details ? { details } : {}
+    },
     { operation }
   );
   process.exit(exitCode);
 }
+function writeNexusWarnings(warnings) {
+  for (const warning of warnings) process.stderr.write(`warning: ${warning}
+`);
+}
 function emitNexusResult(data, summary, command, operation) {
   if (isHumanOutput()) humanLine(summary);
   else cliOutput(data, { command, operation });
@@ -50631,17 +51044,65 @@ async function runNexusLogin(args, openBrowser2) {
     /* webpackIgnore: true */
     "@cleocode/core/cloud/nexus-auth.js"
   );
+  const { isNexusDeviceEnabled } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-device.js"
+  );
   const noBrowser = negatedFlag(args, "browser");
+  let codeShown = false;
+  const hooks2 = {
+    apiUrl: nexusApiUrlArg(args),
+    onCode: (code) => {
+      codeShown = true;
+      writeDeviceCodePrompt(code, SERVICE_NAME);
+      if (!noBrowser) openBrowser2(code.verificationUriComplete ?? code.verificationUri);
+    },
+    onPending: writeDeviceCodePending
+  };
+  const readOnly = args["read-only"] === true;
+  const name = typeof args["name"] === "string" && args["name"] !== "" ? args["name"] : void 0;
+  if (readOnly && !isNexusDeviceEnabled()) {
+    throw Object.assign(
+      new Error(
+        "--read-only needs device credentials, which are not enabled; nothing was signed in"
+      ),
+      {
+        code: "E_NEXUS_DEVICE_REQUIRED",
+        fix: "unset CLEO_NEXUS_DEVICE (=0 turns device credentials off) to enrol a read-only device, or log in without --read-only"
+      }
+    );
+  }
   try {
-    const result = await loginToNexus({
-      apiUrl: nexusApiUrlArg(args),
-      onCode: (code) => {
-        writeDeviceCodePrompt(code, SERVICE_NAME);
-        if (!noBrowser) openBrowser2(code.verificationUriComplete ?? code.verificationUri);
-      },
-      onPending: writeDeviceCodePending
-    });
-    writeDeviceCodeApproved(SERVICE_NAME);
+    let result;
+    if (isNexusDeviceEnabled()) {
+      const { loginToNexusDevice } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      result = await loginToNexusDevice({
+        ...hooks2,
+        readOnly,
+        ...name !== void 0 ? { name } : {}
+      });
+    } else {
+      if (name !== void 0) {
+        process.stderr.write(
+          "warning: --name needs device credentials, which CLEO_NEXUS_DEVICE=0 turns off; ignored\n"
+        );
+      }
+      const { NEXUS_TEST_BEARER_ENV, W_NEXUS_TEST_BEARER_IGNORED } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      if ((process.env[NEXUS_TEST_BEARER_ENV]?.trim() ?? "") !== "") {
+        process.stderr.write(
+          `warning: ${W_NEXUS_TEST_BEARER_IGNORED}: ${NEXUS_TEST_BEARER_ENV} needs device credentials, which CLEO_NEXUS_DEVICE turns off; ignored
+`
+        );
+      }
+      result = await loginToNexus(hooks2);
+    }
+    if (codeShown) writeDeviceCodeApproved(SERVICE_NAME);
     for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
 `);
     return result;
@@ -50653,7 +51114,43 @@ async function runNexusLogin(args, openBrowser2) {
 function nexusLoginSummary(r) {
   const who = r.user?.email ?? "your account";
   const org = r.organization ? ` (${r.organization.name})` : "";
-  return `Signed in to ${r.apiUrl} as ${who}${org}.`;
+  const device = r.device ? ` This machine is device ${r.device.deviceId}${r.device.name ? ` (${r.device.name})` : ""}, profile ${r.device.profile ?? "unknown"}.` : "";
+  return `Signed in to ${r.apiUrl} as ${who}${org}.${device}`;
+}
+function nexusDeviceLogoutSummary(r) {
+  const count = (o) => r.devices.filter((d) => d.outcome === o).length;
+  const confirmed = count("confirmed");
+  const open2 = r.devices.length - confirmed;
+  const what = r.action === "revoke" ? "Revoke" : "Sign-out";
+  if (r.devices.length === 0 && r.session === null) {
+    return r.warnings.length > 0 ? `${what} on ${r.apiUrl}: nothing was sent (see warnings).` : `Not signed in to ${r.apiUrl}; nothing to do.`;
+  }
+  const parts = [];
+  if (r.devices.length > 0)
+    parts.push(`${confirmed} of ${r.devices.length} device request(s) confirmed`);
+  if (open2 > 0) parts.push(`${open2} NOT confirmed (see warnings)`);
+  if (r.session !== null) parts.push(`9.24 session ${r.session.revocation}`);
+  const notConfirmed = open2 > 0 || r.devices.length > 0 && confirmed === 0 || r.session?.revocation === "failed";
+  const lead = notConfirmed ? `${what} NOT fully confirmed on` : `${what} confirmed on`;
+  return `${lead} ${r.apiUrl}: ${parts.join("; ")}.`;
+}
+async function runNexusDeviceLogout(args) {
+  let result;
+  try {
+    const { logoutNexusDevice } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-logout.js"
+    );
+    result = await logoutNexusDevice({
+      apiUrl: nexusApiUrlArg(args),
+      revoke: args["revoke"] === true
+    });
+  } catch (err) {
+    failNexus(err, "logout.run");
+  }
+  for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+  emitNexusResult(result, nexusDeviceLogoutSummary(result), "logout", "logout.run");
 }
 var SERVICE_NAME, NEXUS_API_URL_ARG;
 var init_nexus_account_cli = __esm({
@@ -51000,13 +51497,13 @@ function _errorResult(code, message, meta) {
 }
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-  const profile = await getProviderProfile(provider);
-  const oauthMode = profile?.oauth?.mode;
+  const profile2 = await getProviderProfile(provider);
+  const oauthMode = profile2?.oauth?.mode;
   if (provider === "kimi-code" || oauthMode === "device-code") {
     return _runKimiCodeLogin(opts, meta);
   }
   if (oauthMode === "pkce") {
-    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
+    return _runPkceLogin(profile2.name, profile2.oauth, opts, meta);
   }
   return _errorResult(
     "E_NOT_IMPLEMENTED",
@@ -51542,6 +52039,14 @@ var init_login = __esm({
         description: "Open the verification URL in a browser (nexus). --no-browser only prints it (SSH, containers).",
         default: true
       },
+      "read-only": {
+        type: "boolean",
+        description: "nexus: enrol this machine with the read-only device profile (account, devices and project reads only). Refused with CLEO_NEXUS_DEVICE=0."
+      },
+      name: {
+        type: "string",
+        description: "nexus: device name shown on cleocode.dev (default: OS, arch and a short id; never the hostname). Ignored with CLEO_NEXUS_DEVICE=0."
+      },
       auth: {
         type: "string",
         description: "Auth method: 'oauth' (browser) or 'api_key'. Inferred from the provider when omitted."
@@ -52846,14 +53351,14 @@ var init_backup = __esm({
           return;
         }
         const { exportPortableBundle, PortableBundleError } = await import("@cleocode/core/store/portable-bundle.js");
-        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
         const passphrase = args.encrypt === true ? await resolvePassphrase() : void 0;
         if (args.encrypt === true && passphrase === void 0) return;
         const encSuffix = args.encrypt === true ? "enc." : "";
         try {
           const result = await exportPortableBundle({
             scope,
-            projectRoot: scope === "project" || scope === "all" ? getProjectRoot74() : void 0,
+            projectRoot: scope === "project" || scope === "all" ? getProjectRoot75() : void 0,
             outputPath: args.out ?? `./${args.name}.${encSuffix}cleobundle.tar.gz`,
             encrypt: args.encrypt === true,
             passphrase,
@@ -52910,12 +53415,12 @@ var init_backup = __esm({
           );
           return;
         }
-        const { getProjectRoot: getProjectRoot74, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot75, getCleoHome: getCleoHome8, getCleoVersion } = await import("@cleocode/core");
         const { BundleError, cleanupStaging, unpackBundle } = await import("@cleocode/core/store/backup-unpack.js");
         const { regenerateConfigJson, regenerateProjectContextJson, regenerateProjectInfoJson } = await import("@cleocode/core/store/regenerators.js");
         const { regenerateAndCompare } = await import("@cleocode/core/store/restore-json-merge.js");
         const { buildConflictReport, writeConflictReport } = await import("@cleocode/core/store/restore-conflict-report.js");
-        const projectRoot = getProjectRoot74();
+        const projectRoot = getProjectRoot75();
         const { assertOwnerStoreRewriteConfirmed } = await import("@cleocode/core/store/worktree-isolation-guard.js");
         try {
           assertOwnerStoreRewriteConfirmed("backup import", path2.join(projectRoot, ".cleo"), {
@@ -55560,6 +56065,252 @@ var init_classify = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/nexus-cloud-cli.ts
+function stringArg(args, name) {
+  const raw = args[name];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function writeWarnings(warnings) {
+  for (const w of warnings) process.stderr.write(`warning: ${w.message} (${w.code})
+`);
+}
+function deviceStateArg(args) {
+  const raw = stringArg(args, "state");
+  if (raw === void 0) return void 0;
+  const known = NEXUS_DEVICE_LIST_STATES.find((s) => s === raw);
+  if (known !== void 0) return known;
+  throw Object.assign(new Error(`unknown --state '${raw}'`), {
+    code: "E_VALIDATION",
+    fix: `use one of: ${NEXUS_DEVICE_LIST_STATES.join(", ")}`
+  });
+}
+function cloudStatusSummary(r) {
+  if (r.verdict === "not-signed-in") {
+    return `Cloud status: not signed in to ${r.local.apiUrl}. Run \`cleo login nexus\`.`;
+  }
+  const s = r.summary;
+  const parts = [`device ${r.local.nexusDeviceId ?? "unknown"} (${s.profile ?? "no profile"})`];
+  if (r.local.projectId !== null) {
+    parts.push(`project ${r.local.projectId} ${s.linked ? "linked" : "NOT linked"}`);
+    parts.push(s.replicaAttached ? "replica attached" : "replica NOT attached");
+    parts.push(`${s.devices} device(s)`);
+    if (s.headSeq !== null) parts.push(`head ${s.headSeq}`);
+    if (s.openConflicts !== null) parts.push(`${s.openConflicts} open conflict(s)`);
+  }
+  return `Cloud status: ${r.verdict}. ${parts.join("; ")}.`;
+}
+async function runCloudRead(operation, call, summary) {
+  let result;
+  try {
+    result = await call();
+  } catch (err) {
+    const { NexusCloudOfflineError } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-cloud-status.js"
+    );
+    if (err instanceof NexusCloudOfflineError) writeWarnings(err.publicDetails.warnings);
+    failNexus(err, operation);
+  }
+  writeWarnings(result.warnings);
+  emitNexusResult(result, summary(result), "cloud", operation);
+}
+async function runCloudStatus(args) {
+  await runCloudRead(
+    "cloud.status",
+    async () => {
+      const { getNexusCloudStatus } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud-status.js"
+      );
+      const projectId = stringArg(args, "project");
+      return getNexusCloudStatus({
+        apiUrl: nexusApiUrlArg(args),
+        ...projectId !== void 0 ? { projectId } : {}
+      });
+    },
+    cloudStatusSummary
+  );
+}
+async function runCloudWhoami(args) {
+  await runCloudRead(
+    "cloud.whoami",
+    async () => {
+      const { nexusCloudWhoami } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return nexusCloudWhoami({ apiUrl: nexusApiUrlArg(args) });
+    },
+    (r) => `Signed in to ${r.apiUrl} as ${r.user.email} with a ${r.credential.kind} credential${r.device ? ` (device ${r.device.deviceId}, profile ${r.credential.profile ?? "none"})` : ""}.`
+  );
+}
+async function runCloudDevices(args) {
+  await runCloudRead(
+    "cloud.devices.list",
+    async () => {
+      const state = deviceStateArg(args);
+      const { listNexusCloudDevices } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudDevices({
+        apiUrl: nexusApiUrlArg(args),
+        ...state !== void 0 ? { state } : {}
+      });
+    },
+    (r) => `${r.count} device(s) on ${r.apiUrl}${r.state ? ` (state ${r.state})` : ""}: ${r.devices.map((d) => `${d.name} ${d.deviceId} ${d.state}${d.current ? " (this machine)" : ""}`).join("; ")}`
+  );
+}
+async function runCloudProjects(args) {
+  const action = stringArg(args, "action");
+  if (action === "show") {
+    await runCloudRead(
+      "cloud.projects.show",
+      async () => {
+        const projectId = stringArg(args, "id");
+        const { showNexusCloudProject } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-cloud.js"
+        );
+        return showNexusCloudProject({
+          apiUrl: nexusApiUrlArg(args),
+          ...projectId !== void 0 ? { projectId } : {}
+        });
+      },
+      (r) => `Project ${r.projectId} "${r.project.label ?? ""}" (${r.role}): ${r.devices.active} active device(s), ${r.replicas.length} replica(s), head ${r.stream?.headSeq ?? "none"}, ${r.openConflicts} open conflict(s).`
+    );
+    return;
+  }
+  if (action !== void 0 && action !== "list") {
+    failNexus(
+      Object.assign(new Error(`unknown action '${action}'`), {
+        code: "E_VALIDATION",
+        fix: "use `cleo cloud projects` or `cleo cloud projects show [<id>]`"
+      }),
+      "cloud.projects.list"
+    );
+  }
+  await runCloudRead(
+    "cloud.projects.list",
+    async () => {
+      const organizationId = stringArg(args, "org");
+      const { listNexusCloudProjects } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudProjects({
+        apiUrl: nexusApiUrlArg(args),
+        ...organizationId !== void 0 ? { organizationId } : {}
+      });
+    },
+    (r) => `${r.count} project(s) on ${r.apiUrl}: ${r.projects.map((p) => `${p.label ?? p.projectId} (${p.role})`).join("; ")}`
+  );
+}
+var init_nexus_cloud_cli = __esm({
+  "packages/cleo/src/cli/lib/nexus-cloud-cli.ts"() {
+    "use strict";
+    init_src2();
+    init_nexus_account_cli();
+  }
+});
+
+// packages/cleo/src/cli/commands/cloud.ts
+var cloud_exports = {};
+__export(cloud_exports, {
+  cloudCommand: () => cloudCommand
+});
+var JSON_ARG, statusSubCommand, whoamiSubCommand, devicesSubCommand, projectsSubCommand, cloudCommand;
+var init_cloud = __esm({
+  "packages/cleo/src/cli/commands/cloud.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_nexus_account_cli();
+    init_nexus_cloud_cli();
+    JSON_ARG = { type: "boolean", description: "Output as JSON envelope" };
+    statusSubCommand = defineCommand({
+      meta: {
+        name: "status",
+        description: "Verify this machine against Cleo Nexus in one call: device, credential, project link, replica and stream. Returns { verdict, summary, local, remote, warnings }; verdict is ok, attention, not-linked, not-registered or not-signed-in. Reads only (GET; never binds a replica), except that getting the credential may upgrade a 9.24 session (E1) and retry unsettled logouts (E9/E10)."
+      },
+      args: {
+        project: {
+          type: "string",
+          description: "Project id to check (default: the current project)."
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudStatus(args);
+      }
+    });
+    whoamiSubCommand = defineCommand({
+      meta: {
+        name: "whoami",
+        description: "Show the Cleo Nexus user, organizations, credential and device for this machine."
+      },
+      args: { "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+      async run({ args }) {
+        await runCloudWhoami(args);
+      }
+    });
+    devicesSubCommand = defineCommand({
+      meta: {
+        name: "devices",
+        description: "List the account's devices (newest first), following every page; reports truncation."
+      },
+      args: {
+        state: {
+          type: "string",
+          description: `Filter: ${NEXUS_DEVICE_LIST_STATES.join(", ")} (default: active).`
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudDevices(args);
+      }
+    });
+    projectsSubCommand = defineCommand({
+      meta: {
+        name: "projects",
+        description: "List visible Cleo Nexus projects, following every page (cleo cloud projects [--org <id>]), or show one with its replicas and device counts (cleo cloud projects show [<id>], default: the current project)."
+      },
+      args: {
+        action: {
+          type: "positional",
+          description: "'list' (default) or 'show'.",
+          required: false
+        },
+        id: {
+          type: "positional",
+          description: "Project id for show (default: the current project).",
+          required: false
+        },
+        org: { type: "string", description: "Only this organization id (list)." },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudProjects(args);
+      }
+    });
+    cloudCommand = defineCommand({
+      meta: {
+        name: "cloud",
+        description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show]."
+      },
+      subCommands: {
+        status: statusSubCommand,
+        whoami: whoamiSubCommand,
+        devices: devicesSubCommand,
+        projects: projectsSubCommand
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/code.ts
 var code_exports = {};
 __export(code_exports, {
@@ -63477,6 +64228,40 @@ var init_doctor_db_substrate = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/doctor-dep-cycles.ts
+var doctor_dep_cycles_exports = {};
+__export(doctor_dep_cycles_exports, {
+  doctorDepCyclesCommand: () => doctorDepCyclesCommand
+});
+import { scanDependencyCycles } from "@cleocode/core/doctor/dependency-cycles.js";
+import { getProjectRoot as getProjectRoot45 } from "@cleocode/core/paths.js";
+var doctorDepCyclesCommand;
+var init_doctor_dep_cycles = __esm({
+  "packages/cleo/src/cli/commands/doctor-dep-cycles.ts"() {
+    "use strict";
+    init_define_cli_command();
+    init_renderers();
+    doctorDepCyclesCommand = defineCommand({
+      meta: {
+        name: "dep-cycles",
+        description: "Report task dependency cycles already stored (edges written before the T12886 cycle guard) with a repair plan: the edges whose removal breaks every cycle, each with its `cleo update <id> --remove-depends <dep>` command. Read-only; never removes an edge."
+      },
+      args: {
+        json: { type: "boolean", description: "Output as JSON" },
+        human: { type: "boolean", description: "Force human-readable output" },
+        quiet: { type: "boolean", description: "Suppress non-essential output" }
+      },
+      async run() {
+        const report = await scanDependencyCycles(getProjectRoot45());
+        cliOutput(report, { command: "doctor", operation: "doctor.dep-cycles.run" });
+        if (report.cycleCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 2;
+        }
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/doctor-exodus-residue.ts
 var doctor_exodus_residue_exports = {};
 __export(doctor_exodus_residue_exports, {
@@ -63794,7 +64579,7 @@ var doctor_legacy_backups_exports = {};
 __export(doctor_legacy_backups_exports, {
   doctorLegacyBackupsCommand: () => doctorLegacyBackupsCommand
 });
-import { getProjectRoot as getProjectRoot45 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
 import { pruneLegacyBackups, scanLegacyBackups } from "@cleocode/core/doctor/legacy-backups.js";
 function parsePositiveInt(raw, fallback) {
   if (raw === void 0 || raw === null) return fallback;
@@ -63838,7 +64623,7 @@ var init_doctor_legacy_backups = __esm({
       async run({ args }) {
         const softRetentionDays = parsePositiveInt(args["soft-retention-days"], 30);
         const hardRetentionDays = parsePositiveInt(args["hard-retention-days"], 90);
-        const projectRoot = getProjectRoot45();
+        const projectRoot = getProjectRoot46();
         let result;
         if (args.prune === true) {
           const dryRun = args["dry-run"] !== false;
@@ -63904,7 +64689,7 @@ var doctor_malformed_ids_exports = {};
 __export(doctor_malformed_ids_exports, {
   doctorMalformedIdsCommand: () => doctorMalformedIdsCommand
 });
-import { getProjectRoot as getProjectRoot46 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot47 } from "@cleocode/core";
 import { scanMalformedTaskIds } from "@cleocode/core/doctor/malformed-task-ids.js";
 var doctorMalformedIdsCommand;
 var init_doctor_malformed_ids = __esm({
@@ -63927,7 +64712,7 @@ var init_doctor_malformed_ids = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const report = await scanMalformedTaskIds(getProjectRoot46(), { fix: args.fix === true });
+        const report = await scanMalformedTaskIds(getProjectRoot47(), { fix: args.fix === true });
         cliOutput(report, {
           command: "doctor",
           operation: "doctor.malformed-ids.run"
@@ -63954,7 +64739,7 @@ import {
   repairMalformedManifestRows,
   rollbackManifestRepair
 } from "@cleocode/core/memory/pipeline-manifest-sqlite.js";
-import { getProjectRoot as getProjectRoot47 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot48 } from "@cleocode/core/paths.js";
 var doctorManifestRowsCommand;
 var init_doctor_manifest_rows = __esm({
   "packages/cleo/src/cli/commands/doctor-manifest-rows.ts"() {
@@ -63985,7 +64770,7 @@ var init_doctor_manifest_rows = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot47();
+        const projectRoot = getProjectRoot48();
         if (typeof args.rollback === "string" && args.rollback !== "") {
           const result = await rollbackManifestRepair(args.rollback, projectRoot);
           cliOutput(result, { command: "doctor", operation: "doctor.manifest-rows.rollback" });
@@ -64087,7 +64872,7 @@ var doctor_nexus_residency_exports = {};
 __export(doctor_nexus_residency_exports, {
   doctorNexusResidencyCommand: () => doctorNexusResidencyCommand
 });
-import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot48 } from "@cleocode/core";
+import { getCleoHome as getCleoHome6, getProjectRoot as getProjectRoot49 } from "@cleocode/core";
 import { scanNexusSchemaResidency } from "@cleocode/core/doctor/nexus-schema-residency.js";
 var doctorNexusResidencyCommand;
 var init_doctor_nexus_residency = __esm({
@@ -64106,7 +64891,7 @@ var init_doctor_nexus_residency = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run() {
-        const result = scanNexusSchemaResidency(getProjectRoot48(), getCleoHome6());
+        const result = scanNexusSchemaResidency(getProjectRoot49(), getCleoHome6());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.nexus-residency.run"
@@ -64124,7 +64909,7 @@ var doctor_project_identity_exports = {};
 __export(doctor_project_identity_exports, {
   doctorProjectIdentityCommand: () => doctorProjectIdentityCommand
 });
-import { getProjectRoot as getProjectRoot49 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot50 } from "@cleocode/core";
 import {
   inspectProjectIdentity,
   inspectProjectNameDrift,
@@ -64149,7 +64934,7 @@ var init_doctor_project_identity = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot49();
+        const projectRoot = getProjectRoot50();
         if (!args.resolve) {
           const report = inspectProjectIdentity(projectRoot);
           const nameDrift = await inspectProjectNameDrift(projectRoot);
@@ -64688,7 +65473,7 @@ var doctor_repair_exports = {};
 __export(doctor_repair_exports, {
   doctorRepairCommand: () => doctorRepairCommand
 });
-import { getLogger as getLogger21, getProjectRoot as getProjectRoot50 } from "@cleocode/core";
+import { getLogger as getLogger21, getProjectRoot as getProjectRoot51 } from "@cleocode/core";
 import { repairMalformedDbs } from "@cleocode/core/store/repair-malformed-dbs.js";
 var doctorRepairCommand;
 var init_doctor_repair = __esm({
@@ -64737,7 +65522,7 @@ var init_doctor_repair = __esm({
           return;
         }
         const result = repairMalformedDbs({
-          projectRoot: getProjectRoot50(),
+          projectRoot: getProjectRoot51(),
           roles: roleArg.length > 0 ? [roleArg] : void 0,
           dryRun,
           logger: getLogger21("doctor-repair"),
@@ -64939,7 +65724,7 @@ var doctor_superseded_store_exports = {};
 __export(doctor_superseded_store_exports, {
   doctorSupersededStoreCommand: () => doctorSupersededStoreCommand
 });
-import { getProjectRoot as getProjectRoot51 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot52 } from "@cleocode/core";
 import { scanSupersededStores } from "@cleocode/core/doctor/superseded-store.js";
 import { reconcileSupersededStores } from "@cleocode/core/store/exodus/index.js";
 var doctorSupersededStoreCommand;
@@ -64972,7 +65757,7 @@ var init_doctor_superseded_store = __esm({
       },
       async run({ args }) {
         if (args.reconcile === true) {
-          const receipt = await reconcileSupersededStores(getProjectRoot51(), {
+          const receipt = await reconcileSupersededStores(getProjectRoot52(), {
             dryRun: args["dry-run"] === true,
             additive: args.additive === true
           });
@@ -64994,7 +65779,7 @@ var init_doctor_superseded_store = __esm({
           );
           return;
         }
-        const result = scanSupersededStores(getProjectRoot51());
+        const result = scanSupersededStores(getProjectRoot52());
         cliOutput(result, {
           command: "doctor",
           operation: "doctor.superseded-store.run"
@@ -65095,7 +65880,7 @@ import {
   rollbackTwinCollapse
 } from "@cleocode/core/doctor/twin-collapse.js";
 import { CleoError as CleoError8 } from "@cleocode/core/errors";
-import { getProjectRoot as getProjectRoot52 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot53 } from "@cleocode/core/paths.js";
 function reportTwinCollapseError(error, retry) {
   if (retry && !(error instanceof CleoError8)) throw error;
   const message = error instanceof Error ? error.message : String(error);
@@ -65166,7 +65951,7 @@ var init_doctor_twin_collapse = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot52();
+        const projectRoot = getProjectRoot53();
         const guard = { cwd: process.cwd(), confirmOwnerStore: args["confirm-owner-store"] === true };
         const actions = twinCollapseActions(args);
         if (actions.length > 1) {
@@ -65244,7 +66029,7 @@ __export(doctor_worktree_stores_exports, {
   doctorWorktreeStoresCommand: () => doctorWorktreeStoresCommand
 });
 import { scanWorktreeStores } from "@cleocode/core/doctor/worktree-stores.js";
-import { getProjectRoot as getProjectRoot53, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot54, resolveStoreOwnerRoot } from "@cleocode/core/paths.js";
 var doctorWorktreeStoresCommand;
 var init_doctor_worktree_stores = __esm({
   "packages/cleo/src/cli/commands/doctor-worktree-stores.ts"() {
@@ -65266,7 +66051,7 @@ var init_doctor_worktree_stores = __esm({
         quiet: { type: "boolean", description: "Suppress non-essential output" }
       },
       async run({ args }) {
-        const projectRoot = resolveStoreOwnerRoot(getProjectRoot53());
+        const projectRoot = resolveStoreOwnerRoot(getProjectRoot54());
         const result = scanWorktreeStores(projectRoot, { skipCompare: args["skip-compare"] === true });
         cliOutput(result, {
           command: "doctor",
@@ -65418,7 +66203,7 @@ import {
   resumePreparedKnowledgeRepair,
   runKnowledgeDoctor as runKnowledgeDoctor2
 } from "@cleocode/core/doctor/knowledge.js";
-import { getProjectRoot as getProjectRoot54 } from "@cleocode/core/paths.js";
+import { getProjectRoot as getProjectRoot55 } from "@cleocode/core/paths.js";
 var doctorKnowledgeSubcommand;
 var init_doctor_knowledge = __esm({
   "packages/cleo/src/cli/commands/doctor-knowledge.ts"() {
@@ -65493,7 +66278,7 @@ var init_doctor_knowledge = __esm({
       },
       async run({ args }) {
         const startedAt = Date.now();
-        const root = getProjectRoot54();
+        const root = getProjectRoot55();
         let context;
         let pending;
         try {
@@ -65661,7 +66446,7 @@ import { join as join24 } from "node:path";
 import {
   ensureGlobalAgentRegistryDb,
   getGlobalAgentRegistryNativeDb,
-  getProjectRoot as getProjectRoot55,
+  getProjectRoot as getProjectRoot56,
   installAgentFromCant
 } from "@cleocode/core/internal";
 function sha256Hex(bytes) {
@@ -65849,7 +66634,7 @@ var init_migrate_agents_v2 = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot55();
+        const projectRoot = getProjectRoot56();
         const verbose = args.quiet !== true;
         if (verbose) {
           humanInfo("Scanning .cleo/cant/agents/ and .cleo/agents/ for unregistered agents...");
@@ -65893,7 +66678,7 @@ __export(doctor_exports, {
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join25 } from "node:path";
-import { getProjectRoot as getProjectRoot56, pushWarning as pushWarning5 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot57, pushWarning as pushWarning5 } from "@cleocode/core";
 import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
 import {
   quarantineRogueCleoDir,
@@ -66013,6 +66798,7 @@ var init_doctor = __esm({
     init_doctor_acceptance_drift();
     init_doctor_credentials();
     init_doctor_db_substrate();
+    init_doctor_dep_cycles();
     init_doctor_exodus();
     init_doctor_exodus_residue();
     init_doctor_fk_check();
@@ -66079,6 +66865,8 @@ var init_doctor = __esm({
         "acceptance-drift": doctorAcceptanceDriftCommand,
         // T12790 — evidence bindings whose AC row is gone (no FK): report + --fix (audited)
         "ac-bindings": doctorAcBindingsCommand,
+        // T12886 — stored task dependency cycles + repair plan (read-only)
+        "dep-cycles": doctorDepCyclesCommand,
         // T12158 — tables nexus resolves by bare name must actually live where it assumes
         "nexus-residency": doctorNexusResidencyCommand,
         // T12113 (gh#1222) — evidence-tool semaphore holders + orphan reaping
@@ -66297,7 +67085,7 @@ var init_doctor = __esm({
             const { join: pathJoin } = await import("node:path");
             const { existsSync: existsSync22 } = await import("node:fs");
             const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             let gitRoot = projectRoot;
             try {
               gitRoot = execFile2("git", ["rev-parse", "--show-toplevel"], {
@@ -66349,7 +67137,7 @@ var init_doctor = __esm({
           }
           if (args.brain) {
             const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const dashboard = await computeBrainHealthDashboard(projectRoot);
             cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
             if (dashboard.hasP0Failure) {
@@ -66358,7 +67146,7 @@ var init_doctor = __esm({
             return;
           }
           if (args["scan-test-fixtures-in-prod"]) {
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const matches = await scanTestFixturesInProd(projectRoot);
             const dryRun = args["dry-run"] !== false && args.quarantine !== true;
             const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
@@ -66446,7 +67234,7 @@ var init_doctor = __esm({
             progress.complete("Comprehensive diagnostics complete");
           } else if (args["scan-rogue-cleo-dirs"]) {
             progress.step(0, "Scanning for rogue .cleo/ directories");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const reports = scanRogueCleoDirs(projectRoot);
             progress.complete(
               `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
@@ -66455,7 +67243,7 @@ var init_doctor = __esm({
           } else if (args["quarantine-rogue-cleo-dirs"]) {
             const isDryRun = args["dry-run"] === true;
             progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const reports = scanRogueCleoDirs(projectRoot);
             if (reports.length === 0) {
               progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
@@ -66509,7 +67297,7 @@ var init_doctor = __esm({
             const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
             const { getCleoHome: getCleoHome8 } = await import("@cleocode/core");
             const cleoHome = getCleoHome8();
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
             const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
             const isDryRun = args["dry-run"] === true;
@@ -66542,7 +67330,7 @@ var init_doctor = __esm({
           } else if (args["audit-worktree-orphans"]) {
             progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
             const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -66599,7 +67387,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
             );
             const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
             const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
             const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
@@ -66678,7 +67466,7 @@ var init_doctor = __esm({
               `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
             );
             const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
             progress.complete(`Migration ${result.action}`);
             cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
@@ -66697,7 +67485,7 @@ var init_doctor = __esm({
             const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
             progress.step(0, stepLabel);
             const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
-            const projectRoot = getProjectRoot56();
+            const projectRoot = getProjectRoot57();
             const result = await auditInvariantRegistry(projectRoot, { adrFilter });
             const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
             const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
@@ -66719,7 +67507,7 @@ var init_doctor = __esm({
               { command: "doctor", operation: "admin.health" }
             );
             try {
-              const projectRoot = getProjectRoot56();
+              const projectRoot = getProjectRoot57();
               const conflicts = readMigrationConflicts(projectRoot);
               if (conflicts.length > 0) {
                 progress.complete(
@@ -66750,7 +67538,7 @@ var init_doctor = __esm({
               progress.complete("Health check complete");
             }
             try {
-              const projectRoot = getProjectRoot56();
+              const projectRoot = getProjectRoot57();
               const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
               const sagaAudit = await auditSagaHierarchy(projectRoot);
               if (sagaAudit.sagas.length === 0) {
@@ -66777,6 +67565,26 @@ Saga Hierarchy (${sagaAudit.sagas.length} saga(s), ${sagaAudit.count} violation(
               humanLine(`
 Saga Hierarchy: audit skipped (${msg})`);
             }
+            try {
+              const { scanDependencyCycles: scanDependencyCycles2 } = await import("@cleocode/core/doctor/dependency-cycles.js");
+              const cycles = await scanDependencyCycles2(getProjectRoot57());
+              humanLine(
+                `
+Dependency cycles: ${cycles.cycleCount} (${cycles.edgeCount} edge(s) checked)`
+              );
+              for (const c of cycles.components) humanLine(`  ${c.cycle.join(" \u2192 ")}`);
+              if (cycles.repairPlan.length > 0) {
+                humanLine("  Repair plan (review first; `cleo doctor dep-cycles` for JSON):");
+                for (const r of cycles.repairPlan) humanLine(`    ${r.command}`);
+              }
+              if (cycles.cycleCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+                process.exitCode = 2;
+              }
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              humanLine(`
+Dependency cycles: check skipped (${msg})`);
+            }
           }
         } catch (err) {
           progress.error("Health check failed");
@@ -66798,7 +67606,7 @@ async function batchEntry(taskId, result, args) {
     return { taskId, completed: false, error: code, message, next: fix };
   }
   const params = completeDispatchParams({ ...args, taskId, "if-match": void 0 });
-  const done = await dispatchRaw("mutate", "tasks", "complete", params);
+  const done = await withoutOutputPointer(() => dispatchRaw("mutate", "tasks", "complete", params));
   const recordedGates = result.data.recordedGates;
   if (done.success) return { taskId, recordedGates, completed: true };
   const failure = { error: "E_DONE_BLOCKED", message: done.error?.message, next: done.error?.fix };
@@ -66834,6 +67642,7 @@ var init_done = __esm({
   "packages/cleo/src/cli/commands/done.ts"() {
     "use strict";
     init_cli();
+    init_field_context();
     init_define_cli_command();
     init_renderers();
     init_complete();
@@ -66869,8 +67678,8 @@ var init_done = __esm({
           process.exitCode = 2;
           return;
         }
-        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/paths.js");
-        const options = { projectRoot: getProjectRoot74(), ...parsed.options };
+        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/paths.js");
+        const options = { projectRoot: getProjectRoot75(), ...parsed.options };
         const requested = [
           ...new Set([args.taskId, ...args._ ?? []].map(String))
         ];
@@ -66920,11 +67729,13 @@ var init_done = __esm({
           process.exitCode = recorded.error.exitCode ?? 1;
           return;
         }
-        const completed = await dispatchRaw(
-          "mutate",
-          "tasks",
-          "complete",
-          completeDispatchParams({ ...args, "if-match": void 0 })
+        const completed = await withoutOutputPointer(
+          () => dispatchRaw(
+            "mutate",
+            "tasks",
+            "complete",
+            completeDispatchParams({ ...args, "if-match": void 0 })
+          )
         );
         if (!completed.success) {
           const details = {
@@ -67420,7 +68231,7 @@ function showStatus() {
   }
   cliOutput(result, { command: "exodus status" });
 }
-var migrateSubCommand, verifySubCommand, sealSubCommand, statusSubCommand, exodusCommand;
+var migrateSubCommand, verifySubCommand, sealSubCommand, statusSubCommand2, exodusCommand;
 var init_exodus = __esm({
   "packages/cleo/src/cli/commands/exodus.ts"() {
     "use strict";
@@ -67730,7 +68541,7 @@ Passing tables (${passing.length}):`);
         );
       }
     });
-    statusSubCommand = defineCommand({
+    statusSubCommand2 = defineCommand({
       meta: {
         name: "status",
         description: "Show exodus migration status (staging, source DBs, target DBs)"
@@ -67748,7 +68559,7 @@ Passing tables (${passing.length}):`);
         migrate: migrateSubCommand,
         verify: verifySubCommand,
         seal: sealSubCommand,
-        status: statusSubCommand
+        status: statusSubCommand2
       },
       async run({ cmd, rawArgs }) {
         if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
@@ -68230,7 +69041,7 @@ __export(gateway_exports, {
   gatewayOpenapiSubCommand: () => gatewayOpenapiSubCommand
 });
 import { resolve as resolve8 } from "node:path";
-import { generateOpenApi, getProjectRoot as getProjectRoot57 } from "@cleocode/core";
+import { generateOpenApi, getProjectRoot as getProjectRoot58 } from "@cleocode/core";
 var gatewayOpenapiSubCommand, gatewayCommand;
 var init_gateway = __esm({
   "packages/cleo/src/cli/commands/gateway.ts"() {
@@ -68262,7 +69073,7 @@ var init_gateway = __esm({
         const pathCount = Object.keys(doc.paths).length;
         if (typeof args.out === "string" && args.out.length > 0) {
           const { writeFileSync: writeFileSync8 } = await import("node:fs");
-          const target = resolve8(getProjectRoot57(), args.out);
+          const target = resolve8(getProjectRoot58(), args.out);
           writeFileSync8(target, json2, "utf8");
           cliOutput(
             { out: target, pathCount, version: doc.info.version, openapi: doc.openapi },
@@ -68723,7 +69534,7 @@ var go_exports = {};
 __export(go_exports, {
   goCommand: () => goCommand
 });
-import { getProjectRoot as getProjectRoot58, go } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot59, go } from "@cleocode/core";
 var goCommand;
 var init_go = __esm({
   "packages/cleo/src/cli/commands/go.ts"() {
@@ -68749,7 +69560,7 @@ var init_go = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot58();
+        const projectRoot = getProjectRoot59();
         const { getCurrentSessionId, resolveBoundSessionId } = await import("@cleocode/core/internal");
         let sessionId = getCurrentSessionId(projectRoot) ?? void 0;
         if (sessionId === void 0) {
@@ -68777,7 +69588,7 @@ var goal_exports = {};
 __export(goal_exports, {
   goalCommand: () => goalCommand
 });
-import { getProjectRoot as getProjectRoot59, goal } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot60, goal } from "@cleocode/core";
 function resolveGoalKind(task) {
   if (typeof task === "string" && task.length > 0) {
     if (!isValidGoalTargetTaskId(task)) {
@@ -68824,7 +69635,7 @@ var init_goal2 = __esm({
         }
         const record = await goal.createGoal(
           { goalKind: kindResult.kind, intent, turnBudget: resolveTurnBudget(args.turns) },
-          getProjectRoot59()
+          getProjectRoot60()
         );
         cliOutput(record, { command: "goal set", operation: "goal.set" });
       }
@@ -68835,7 +69646,7 @@ var init_goal2 = __esm({
         description: "Show the current agent's active goal (per-agent scoped)."
       },
       async run() {
-        const record = await goal.getActiveGoal(getProjectRoot59());
+        const record = await goal.getActiveGoal(getProjectRoot60());
         cliOutput(record ?? { active: null }, { command: "goal status", operation: "goal.status" });
       }
     });
@@ -68857,7 +69668,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot59();
+        const cwd = getProjectRoot60();
         const parent = await goal.getActiveGoal(cwd);
         if (!parent) {
           cliError(
@@ -68905,7 +69716,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot59();
+        const cwd = getProjectRoot60();
         const result = await goal.advanceGoalWithPersist(goalId, { cwd });
         if (!result) {
           cliError(`Goal '${goalId}' not found.`, 4 /* NOT_FOUND */, { name: "E_NOT_FOUND" });
@@ -68930,7 +69741,7 @@ var init_goal2 = __esm({
           });
           return;
         }
-        const cwd = getProjectRoot59();
+        const cwd = getProjectRoot60();
         const active = await goal.getActiveGoal(cwd);
         if (!active) {
           cliError(
@@ -69977,7 +70788,7 @@ var hygiene_exports = {};
 __export(hygiene_exports, {
   hygieneCommand: () => hygieneCommand
 });
-import { getProjectRoot as getProjectRoot60 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot61 } from "@cleocode/core";
 import { runSpawnReadinessHygieneCli } from "@cleocode/core/hygiene/validate-spawn-readiness.js";
 var hygieneCommand;
 var init_hygiene = __esm({
@@ -70006,7 +70817,7 @@ var init_hygiene = __esm({
             }
           },
           async run({ args }) {
-            const projectRoot = args["project-root"] || getProjectRoot60() || process.cwd();
+            const projectRoot = args["project-root"] || getProjectRoot61() || process.cwd();
             const worktreePath = args["worktree-path"];
             await runSpawnReadinessHygieneCli(projectRoot, worktreePath);
           }
@@ -71349,7 +72160,7 @@ var llm_cost_exports = {};
 __export(llm_cost_exports, {
   costCommand: () => costCommand
 });
-import { getProjectRoot as getProjectRoot61 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot62 } from "@cleocode/core/internal";
 import { computeCost } from "@cleocode/core/llm/usage-pricing";
 function resolveSessionId(raw) {
   if (raw === "current") {
@@ -71422,7 +72233,7 @@ var init_llm_cost = __esm({
           process.exit(6);
         }
         const sessionId = resolveSessionId(rawSessionId);
-        const projectRoot = getProjectRoot61(process.cwd());
+        const projectRoot = getProjectRoot62(process.cwd());
         let breakdown;
         try {
           breakdown = await loadSessionCostBreakdown(projectRoot, sessionId);
@@ -71521,8 +72332,8 @@ async function resolveDefaultModel(provider) {
       "@cleocode/core/llm/role-resolver.js"
     )
   ]);
-  const profile = await getProviderProfile2(provider);
-  return profile?.defaultModel ?? IMPLICIT_FALLBACK_MODEL;
+  const profile2 = await getProviderProfile2(provider);
+  return profile2?.defaultModel ?? IMPLICIT_FALLBACK_MODEL;
 }
 async function runLlmStream(opts) {
   const stdout2 = opts.stdout ?? process.stdout;
@@ -72380,14 +73191,8 @@ var init_log = __esm({
 // packages/cleo/src/cli/commands/logout.ts
 var logout_exports = {};
 __export(logout_exports, {
-  logoutCommand: () => logoutCommand,
-  nexusLogoutSummary: () => nexusLogoutSummary
+  logoutCommand: () => logoutCommand
 });
-function nexusLogoutSummary(r) {
-  if (!r.removedLocally) return `Not signed in to ${r.apiUrl}; nothing to do.`;
-  const server = r.revocation === "revoked" ? "session revoked" : r.revocation === "already-invalid" ? "session was already invalid" : "server-side revocation FAILED (the session ends when it expires)";
-  return `Signed out of ${r.apiUrl}: ${server}; local token deleted.`;
-}
 var logoutCommand;
 var init_logout = __esm({
   "packages/cleo/src/cli/commands/logout.ts"() {
@@ -72399,7 +73204,7 @@ var init_logout = __esm({
     logoutCommand = defineCommand({
       meta: {
         name: "logout",
-        description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential)."
+        description: "Sign out. cleo logout [nexus] signs this machine out of Cleo Nexus (the device keeps its id for the next login; --revoke burns it), confirmed by the server; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential)."
       },
       args: {
         target: {
@@ -72413,6 +73218,10 @@ var init_logout = __esm({
           required: false
         },
         "api-url": NEXUS_API_URL_ARG,
+        revoke: {
+          type: "boolean",
+          description: "Hard-revoke this device: destroys its key grant and burns the device id; the next login enrols a new device. Without it, logout signs the device out and keeps it for the next login."
+        },
         json: { type: "boolean", description: "Output as JSON envelope" }
       },
       async run({ args }) {
@@ -72427,17 +73236,7 @@ var init_logout = __esm({
           emitLlmCredentialRemoval(await removeLlmCredential(target, label), "logout", "logout.run");
           return;
         }
-        const { logoutFromNexus } = await import(
-          /* webpackIgnore: true */
-          "@cleocode/core/cloud/nexus-auth.js"
-        );
-        let result;
-        try {
-          result = await logoutFromNexus({ apiUrl: nexusApiUrlArg(a) });
-        } catch (err) {
-          failNexus(err, "logout.run");
-        }
-        emitNexusResult(result, nexusLogoutSummary(result), "logout", "logout.run");
+        await runNexusDeviceLogout(a);
       }
     });
   }
@@ -72811,7 +73610,7 @@ var memory_exports = {};
 __export(memory_exports, {
   memoryCommand: () => memoryCommand
 });
-import { getProjectRoot as getProjectRoot62 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot63 } from "@cleocode/core";
 import {
   getBrainDb as getBrainDb2,
   getDreamStatus,
@@ -73769,7 +74568,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         try {
           const result = await runConsolidation(root);
           cliOutput(result, { command: "memory-consolidate", operation: "memory.consolidate" });
@@ -73793,7 +74592,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         if (args.status) {
           try {
             const status = await getDreamStatus(root);
@@ -73830,7 +74629,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         try {
           const { runObserver, runReflector } = await import("@cleocode/core/memory");
           const observerResult = await runObserver(root, args.session, {
@@ -73870,7 +74669,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         await getBrainDb2(root);
         const { getBrainNativeDb: getBrainNativeDb3 } = await import("@cleocode/core/internal");
         const nativeDb = getBrainNativeDb3();
@@ -73908,7 +74707,7 @@ var init_memory3 = __esm({
       },
       async run({ args }) {
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot62());
+        const nexusDb = await core2.getNexusDb(getProjectRoot63());
         const result = args.restore ? await core2.restorePrunedTraits(
           nexusDb,
           String(args.restore),
@@ -73938,7 +74737,7 @@ var init_memory3 = __esm({
           return;
         }
         const core2 = await import("@cleocode/core/internal");
-        const nexusDb = await core2.getNexusDb(getProjectRoot62());
+        const nexusDb = await core2.getNexusDb(getProjectRoot63());
         const previous = await core2.setUserProfileTraitScope(nexusDb, String(args.key), scope);
         if (previous === null) {
           cliError(`No user-profile trait "${args.key}"`, "E_NOT_FOUND", { name: "E_NOT_FOUND" });
@@ -73962,7 +74761,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         try {
           await getBrainDb2(root);
           const { totalDuplicateRows, groups } = await scanDuplicateEntries();
@@ -74008,7 +74807,7 @@ var init_memory3 = __esm({
       async run({ args }) {
         const sourceDir = args.from;
         const isDryRun = !!args["dry-run"];
-        const projectRoot = getProjectRoot62();
+        const projectRoot = getProjectRoot63();
         try {
           const result = await importMemoryFiles({
             sourceDir,
@@ -74159,7 +74958,7 @@ var init_memory3 = __esm({
       },
       args: {},
       async run() {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         try {
           await getBrainDb2(root);
           const result = await getTierStats(root);
@@ -74202,7 +75001,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["medium", "long"];
@@ -74268,7 +75067,7 @@ var init_memory3 = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot62();
+        const root = getProjectRoot63();
         const targetTier = args.to;
         const reason = args.reason;
         const validTiers = ["short", "medium"];
@@ -74741,7 +75540,7 @@ var migrate_claude_mem_exports = {};
 __export(migrate_claude_mem_exports, {
   migrateClaudeMemCommand: () => migrateClaudeMemCommand
 });
-import { getProjectRoot as getProjectRoot63, migrateClaudeMem } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot64, migrateClaudeMem } from "@cleocode/core/internal";
 import { ingestLooseAgentOutputs, ingestRcasdDirectories } from "@cleocode/core/memory";
 import { getDb as getDb2 } from "@cleocode/core/store/sqlite";
 var storageCommand, claudeMemCommand, manifestIngestCommand, migrateClaudeMemCommand;
@@ -74804,7 +75603,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const root = getProjectRoot63();
+        const root = getProjectRoot64();
         try {
           const result = await migrateClaudeMem(root, {
             sourcePath: args.source,
@@ -74853,7 +75652,7 @@ var init_migrate_claude_mem = __esm({
         }
       },
       async run({ args }) {
-        const projectRoot = getProjectRoot63();
+        const projectRoot = getProjectRoot64();
         try {
           const db = await getDb2(projectRoot);
           const rcasdFlag = Boolean(args.rcasd);
@@ -74971,7 +75770,7 @@ __export(nexus_exports, {
 import { statSync as statSync2 } from "node:fs";
 import { appendFile as appendFile2, mkdir as mkdir5 } from "node:fs/promises";
 import path4 from "node:path";
-import { getProjectRoot as getProjectRoot64 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot65 } from "@cleocode/core";
 import { getSymbolImpact } from "@cleocode/core/nexus";
 import { runNexusAnalysis } from "@cleocode/core/nexus/analyze-orchestrator.js";
 import {
@@ -75142,7 +75941,7 @@ var init_nexus3 = __esm({
       async run({ args }) {
         applyJsonFlag2(args.json);
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const startTime = Date.now();
         if (args.path) {
           let isDir = false;
@@ -75202,7 +76001,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648), so the coun
           process.exitCode = 2 /* INVALID_INPUT */;
           return;
         }
-        const currentRoot = getProjectRoot64();
+        const currentRoot = getProjectRoot65();
         if (args.path && path4.resolve(repoPath) !== path4.resolve(currentRoot)) {
           cliError(
             `nexus status cannot report on '${repoPath}' from this project.
@@ -75756,7 +76555,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "clusters", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -75800,7 +76599,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "flows", { projectId, repoPath });
         const durationMs = Date.now() - startTime;
@@ -75843,7 +76642,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         void appendDeprecationTelemetry("nexus.context", "cleo graph context");
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot64();
+        const repoPath = getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const limit = parseInt(args.limit, 10);
         const symbolName = args.symbol;
@@ -75906,7 +76705,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const whyFlag = !!args.why;
         const projectIdOverride = args["project-id"];
-        const repoPath = getProjectRoot64();
+        const repoPath = getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const maxDepth = Math.min(parseInt(args.depth, 10), 5);
         const symbolName = args.symbol;
@@ -76010,7 +76809,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const projectIdOverride = args["project-id"];
         const full = !!args.full;
         const ctx = getFormatContext();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         if (args.incremental)
           humanWarn(
             "[nexus] --incremental is deprecated and has no effect: incremental is the default."
@@ -76140,7 +76939,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const name = args.name;
         const response = await dispatchRaw("mutate", "nexus", "projects.register", {
           path: repoPath,
@@ -76659,7 +77458,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "refresh-bridge", {
           repoPath,
@@ -76765,7 +77564,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectIdOverride = args["project-id"];
         const beforeRef = args.before ?? "HEAD~1";
         const afterRef = args.after ?? "HEAD";
@@ -76883,7 +77682,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         applyJsonFlag2(args.json);
         const startTime = Date.now();
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "route-map", { projectId });
         const durationMs = Date.now() - startTime;
@@ -76939,7 +77738,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const startTime = Date.now();
         const routeSymbol = args.routeSymbol;
         const projectIdOverride = args["project-id"];
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("query", "nexus", "shape-check", { routeSymbol, projectId });
         const durationMs = Date.now() - startTime;
@@ -77335,7 +78134,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectIdOverride = args["project-id"];
         const projectId = projectIdOverride ?? Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-sync", {
@@ -77445,7 +78244,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
       async run({ args }) {
         applyJsonFlag2(args.json);
         const startTime = Date.now();
-        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot64();
+        const repoPath = args.path ? path4.resolve(args.path) : getProjectRoot65();
         const projectId = Buffer.from(repoPath).toString("base64url").slice(0, 32);
         const response = await dispatchRaw("mutate", "nexus", "contracts-link-tasks", {
           projectId,
@@ -77529,7 +78328,7 @@ The code-intelligence graph is project-scoped (ADR-090 \xB7 T11648): one store p
         const isIncremental = !!args.incremental;
         try {
           const result = await runNexusWiki({
-            projectRoot: getProjectRoot64(),
+            projectRoot: getProjectRoot65(),
             outputDir,
             communityFilter,
             incremental: isIncremental
@@ -77879,7 +78678,7 @@ __export(orchestrate_exports, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { orchestration } from "@cleocode/core";
-import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot65 } from "@cleocode/core/internal";
+import { BUILD_CONFIG as BUILD_CONFIG2, getProjectRoot as getProjectRoot66 } from "@cleocode/core/internal";
 function formatRollupTable(rollup) {
   const waves = "waves" in rollup ? rollup.waves : [rollup];
   const lines = [];
@@ -78022,7 +78821,7 @@ var init_orchestrate3 = __esm({
       },
       async run({ args }) {
         const rateWindowHours = args.window !== void 0 ? Number.parseFloat(String(args.window)) : void 0;
-        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot65(), {
+        const metrics = await orchestration.collectOrchestrateDashboard(getProjectRoot66(), {
           ...rateWindowHours !== void 0 && Number.isFinite(rateWindowHours) && rateWindowHours > 0 ? { rateWindowHours } : {}
         });
         cliOutput(metrics, {
@@ -79482,7 +80281,7 @@ __export(project_exports, {
 import { resolve as resolve9 } from "node:path";
 import {
   CleoError as CleoError11,
-  getProjectRoot as getProjectRoot66,
+  getProjectRoot as getProjectRoot67,
   moveProject,
   projectLifecycle,
   renameProject,
@@ -79504,7 +80303,7 @@ function emitEngineFailure(error, operation) {
 }
 function resolveRootOrFail(operation) {
   try {
-    return getProjectRoot66();
+    return getProjectRoot67();
   } catch (err) {
     const code = err instanceof CleoError11 && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
     emitEngineFailure(
@@ -79735,6 +80534,10 @@ var init_project = __esm({
           type: "string",
           description: "Name shown in Nexus, sent in plaintext (default: the project name). A name, never a path."
         },
+        rebind: {
+          type: "boolean",
+          description: "Use only after E_NEXUS_REPLICA_COPIED: give this copy of the project a new replica id before attaching it (this machine was re-enrolled, or the store was copied). Each run mints a new id and leaves the old one on the server as stale history."
+        },
         "api-url": NEXUS_API_URL_ARG,
         json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
       },
@@ -79747,14 +80550,17 @@ var init_project = __esm({
         try {
           result = await linkProjectToNexus({
             apiUrl: nexusApiUrlArg(args),
-            ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {}
+            ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {},
+            ...args["rebind"] === true ? { rebind: true } : {}
           });
         } catch (err) {
           failNexus(err, "project.link");
         }
-        const { link } = result;
+        const { link, replica } = result;
         const verb = result.alreadyLinked ? "Already linked" : "Linked";
-        const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.`;
+        const attached = replica ? ` This machine (device ${replica.deviceId}) holds it as replica ${replica.replicaId}${replica.reboundFrom ? ` (rebound from ${replica.reboundFrom})` : ""}${replica.presenceAt ? "; presence reported" : ""}.` : "";
+        const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.${attached}`;
+        writeNexusWarnings(result.warnings);
         emitNexusResult(result, summary, "project", "project.link");
       }
     });
@@ -80332,7 +81138,7 @@ var refresh_memory_exports = {};
 __export(refresh_memory_exports, {
   refreshMemoryCommand: () => refreshMemoryCommand
 });
-import { getProjectRoot as getProjectRoot67 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot68 } from "@cleocode/core";
 var refreshMemoryCommand;
 var init_refresh_memory = __esm({
   "packages/cleo/src/cli/commands/refresh-memory.ts"() {
@@ -80345,7 +81151,7 @@ var init_refresh_memory = __esm({
         description: "Regenerate .cleo/memory-bridge.md from brain.db"
       },
       async run() {
-        const projectDir = getProjectRoot67();
+        const projectDir = getProjectRoot68();
         const { writeMemoryBridge } = await import("@cleocode/core/internal");
         const result = await writeMemoryBridge(projectDir);
         if (result.written) {
@@ -81931,7 +82737,7 @@ import fs3 from "node:fs";
 import path5 from "node:path";
 import {
   CleoError as CleoError13,
-  getProjectRoot as getProjectRoot68,
+  getProjectRoot as getProjectRoot69,
   getTaskAccessor as getTaskAccessor3,
   parseConflictReport,
   setAtPath
@@ -81952,7 +82758,7 @@ var init_restore = __esm({
         description: "Apply manually-resolved conflicts from .cleo/restore-conflicts.md"
       },
       async run() {
-        const projectRoot = getProjectRoot68();
+        const projectRoot = getProjectRoot69();
         const reportPath = path5.join(projectRoot, CLEO_DIR_NAME3, RESTORE_CONFLICTS_MD);
         if (!fs3.existsSync(reportPath)) {
           humanLine("No pending restore conflicts. Nothing to finalize.");
@@ -82881,8 +83687,8 @@ var init_saga = __esm({
         }
       },
       async run({ args }) {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
-        const projectRoot = getProjectRoot74();
+        const { sagas: sagas2, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot75();
         const sagaId = typeof args.sagaId === "string" && args.sagaId.length > 0 ? args.sagaId : void 0;
         const result = await sagas2.sagaNext(projectRoot, { sagaId });
         cliOutput(result.success ? result.data : result, { command: "saga", operation: "saga.next" });
@@ -84713,7 +85519,7 @@ var sequence_exports = {};
 __export(sequence_exports, {
   sequenceCommand: () => sequenceCommand
 });
-import { getProjectRoot as getProjectRoot69 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot70 } from "@cleocode/core/internal";
 var showCommand12, checkCommand7, repairCommand3, sequenceCommand;
 var init_sequence = __esm({
   "packages/cleo/src/cli/commands/sequence.ts"() {
@@ -84749,7 +85555,7 @@ var init_sequence = __esm({
       meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
       async run() {
         const { repairSequence } = await import("@cleocode/core/internal");
-        const projectRoot = getProjectRoot69();
+        const projectRoot = getProjectRoot70();
         const repair = await repairSequence(projectRoot);
         const result = {
           repaired: repair.repaired,
@@ -85346,8 +86152,8 @@ var init_session4 = __esm({
         "audit-scope": { type: "string", description: "Audit log scope (global|local)" }
       },
       async run({ args }) {
-        const { detectSessionDrift, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
-        const projectRoot = await getProjectRoot74();
+        const { detectSessionDrift, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
+        const projectRoot = await getProjectRoot75();
         const scope = args["audit-scope"] === "local" ? "local" : "global";
         const report = await detectSessionDrift({ projectRoot, auditScope: scope });
         cliOutput(report, { command: "session drift", operation: "session.drift" });
@@ -88048,13 +88854,13 @@ var init_telemetry2 = __esm({
 // packages/cleo/src/cli/commands/templates/lib.ts
 import { readFileSync as readFileSync13 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve10 } from "node:path";
-import { getProjectRoot as getProjectRoot70 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot71 } from "@cleocode/core";
 import { resolveSourcePathAbsolute } from "@cleocode/core/templates/registry";
 function resolveProjectRoot6(raw) {
   if (typeof raw === "string" && raw.length > 0) {
     return isAbsolute3(raw) ? raw : resolve10(process.cwd(), raw);
   }
-  return getProjectRoot70();
+  return getProjectRoot71();
 }
 function readTemplateSource(entry) {
   const sourceAbsolute = resolveSourcePathAbsolute(entry);
@@ -88838,7 +89644,7 @@ __export(token_exports, {
   tokenCommand: () => tokenCommand
 });
 import { readFileSync as readFileSync17 } from "node:fs";
-import { getProjectRoot as getProjectRoot71, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot72, measureTokenExchange, recordTokenExchange as recordTokenExchange2 } from "@cleocode/core/internal";
 function readPayload(args, textKey, fileKey) {
   const text = args[textKey];
   const file = args[fileKey];
@@ -89002,7 +89808,7 @@ var init_token = __esm({
           domain: args.domain,
           operation: args.operation
         };
-        const result = args.record ? await recordTokenExchange2(getProjectRoot71(), input2) : await measureTokenExchange(input2);
+        const result = args.record ? await recordTokenExchange2(getProjectRoot72(), input2) : await measureTokenExchange(input2);
         cliOutput(result, {
           command: "token",
           operation: args.record ? "admin.token.record" : "token.estimate"
@@ -89038,7 +89844,7 @@ __export(transcript_exports, {
 });
 import { homedir as homedir3 } from "node:os";
 import { join as join35 } from "node:path";
-import { getProjectRoot as getProjectRoot72 } from "@cleocode/core";
+import { getProjectRoot as getProjectRoot73 } from "@cleocode/core";
 import {
   parseDurationMs,
   pruneTranscripts,
@@ -89068,7 +89874,7 @@ var init_transcript = __esm({
       async run({ args }) {
         if (args.pending) {
           try {
-            const projectRoot = getProjectRoot72();
+            const projectRoot = getProjectRoot73();
             const { scanPendingTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
             const pending = await scanPendingTranscripts(projectRoot);
             cliOutput(
@@ -89165,7 +89971,7 @@ var init_transcript = __esm({
       async run({ args }) {
         const tier = args.tier ?? "warm";
         const dryRun = args["dry-run"] ?? false;
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { findSessionTranscriptPath, listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -89281,7 +90087,7 @@ var init_transcript = __esm({
         const dryRun = args["dry-run"] ?? false;
         const olderThanHours = args["older-than-hours"] ? Number.parseInt(args["older-than-hours"], 10) : 24;
         const limit = args.limit ? Number.parseInt(args.limit, 10) : void 0;
-        const projectRoot = getProjectRoot72();
+        const projectRoot = getProjectRoot73();
         try {
           const { extractTranscript } = await import("@cleocode/core/memory/transcript-extractor.js");
           const { listAllTranscripts } = await import("@cleocode/core/memory/transcript-scanner.js");
@@ -91219,9 +92025,9 @@ var init_verify = __esm({
             return;
           }
           const { recordTaskDone } = await import("@cleocode/core/tasks/done-record.js");
-          const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core/paths.js");
+          const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core/paths.js");
           const r = await recordTaskDone(args.taskId, {
-            projectRoot: getProjectRoot74(),
+            projectRoot: getProjectRoot75(),
             ...parsed.options,
             ...args.agent ? { agent: args.agent } : {}
           });
@@ -91644,9 +92450,9 @@ var init_workgraph2 = __esm({
       },
       async run({ args }) {
         const { generatePlanningDoc } = await import("@cleocode/core/workgraph");
-        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot74();
+        const projectRoot = getProjectRoot75();
         const audience = String(args.audience) === "agent" ? "agent" : "maintainer";
         const result = await generatePlanningDoc(projectRoot, {
           sagaId: String(args.sagaId),
@@ -91663,9 +92469,9 @@ var init_workgraph2 = __esm({
       async run() {
         const { validateWorkGraphStructure } = await import("@cleocode/core/workgraph");
         const { taskList: taskList2 } = await import("@cleocode/core/internal");
-        const { getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const { getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot74();
+        const projectRoot = getProjectRoot75();
         const listResult = await taskList2(projectRoot, { limit: 5e3 });
         const tasks = listResult.success ? listResult.data?.tasks ?? [] : [];
         const nodes = tasks.map((t) => ({
@@ -91684,9 +92490,9 @@ var init_workgraph2 = __esm({
         description: "One-shot saga-to-saga workgraph dashboard (tracking checklist)"
       },
       async run() {
-        const { sagas: sagas2, getProjectRoot: getProjectRoot74 } = await import("@cleocode/core");
+        const { sagas: sagas2, getProjectRoot: getProjectRoot75 } = await import("@cleocode/core");
         const { cliOutput: cliOutput2 } = await Promise.resolve().then(() => (init_renderers(), renderers_exports));
-        const projectRoot = getProjectRoot74();
+        const projectRoot = getProjectRoot75();
         const listResult = await sagas2.sagaList(projectRoot);
         if (!listResult.success) {
           cliOutput2(listResult, { command: "workgraph", operation: "workgraph.status" });
@@ -91752,7 +92558,7 @@ __export(worktree_exports, {
   worktreeCommand: () => worktreeCommand
 });
 import readline4 from "node:readline";
-import { getProjectRoot as getProjectRoot73, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
+import { getProjectRoot as getProjectRoot74, listWorktrees as listWorktrees2 } from "@cleocode/core/internal";
 async function promptYesNo2(question) {
   return new Promise((resolve13) => {
     const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
@@ -91857,7 +92663,7 @@ var init_worktree3 = __esm({
         const staleDays = staleDaysRaw !== void 0 ? Number.parseInt(staleDaysRaw, 10) : void 0;
         const idleDaysRaw = typeof args["idle-days"] === "string" ? args["idle-days"] : void 0;
         const idleDays = idleDaysRaw !== void 0 ? Number.parseInt(idleDaysRaw, 10) : void 0;
-        const projectRoot = getProjectRoot73();
+        const projectRoot = getProjectRoot74();
         const listResult = await listWorktrees2({
           projectRoot,
           ...staleDays !== void 0 && !Number.isNaN(staleDays) ? { staleDays } : {}
@@ -92307,6 +93113,12 @@ var COMMAND_MANIFEST = [
     description: "Classify a task: readiness verdict (proceed|grill) + persona routing (agent, confidence)",
     load: async () => (await Promise.resolve().then(() => (init_classify(), classify_exports))).classifyCommand
   },
+  {
+    exportName: "cloudCommand",
+    name: "cloud",
+    description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show].",
+    load: async () => (await Promise.resolve().then(() => (init_cloud(), cloud_exports))).cloudCommand
+  },
   {
     exportName: "codeCommand",
     name: "code",
@@ -92475,6 +93287,12 @@ var COMMAND_MANIFEST = [
     description: "Walk every DB in the inventory + report integrity, row counts, orphan dirs. ",
     load: async () => (await Promise.resolve().then(() => (init_doctor_db_substrate(), doctor_db_substrate_exports))).doctorDbSubstrateCommand
   },
+  {
+    exportName: "doctorDepCyclesCommand",
+    name: "dep-cycles",
+    description: "Report task dependency cycles already stored (edges written before the T12886 cycle ",
+    load: async () => (await Promise.resolve().then(() => (init_doctor_dep_cycles(), doctor_dep_cycles_exports))).doctorDepCyclesCommand
+  },
   {
     exportName: "doctorExodusResidueCommand",
     name: "exodus-residue",
@@ -92826,7 +93644,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "logoutCommand",
     name: "logout",
-    description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential).",
+    description: "Sign out. cleo logout [nexus] signs this machine out of Cleo Nexus (the device keeps its id for the next login; --revoke burns it), confirmed by the server; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential).",
     load: async () => (await Promise.resolve().then(() => (init_logout(), logout_exports))).logoutCommand
   },
   {
@@ -93823,7 +94641,7 @@ async function runStartupMaintenance() {
     detectAndRemoveStrayProjectNexus,
     getGlobalSalt,
     getLogger: getLogger22,
-    getProjectRoot: getProjectRoot74,
+    getProjectRoot: getProjectRoot75,
     isCleanupMarkerSet,
     isMissingProjectError,
     migrateSignaldockToConduit,
@@ -93833,7 +94651,7 @@ async function runStartupMaintenance() {
   } = await import("@cleocode/core/internal");
   let projectRootForCleanup = "";
   try {
-    projectRootForCleanup = getProjectRoot74();
+    projectRootForCleanup = getProjectRoot75();
   } catch {
   }
   if (!isCleanupMarkerSet(CLI_VERSION, projectRootForCleanup)) {
@@ -93853,7 +94671,7 @@ async function runStartupMaintenance() {
   const isInitInvocation = process.argv.slice(2).some((a) => a === "init");
   if (!isInitInvocation) {
     try {
-      const _projectRootForMigration = getProjectRoot74();
+      const _projectRootForMigration = getProjectRoot75();
       if (needsSignaldockToConduitMigration(_projectRootForMigration)) {
         const migrationResult = await migrateSignaldockToConduit(_projectRootForMigration);
         if (migrationResult.status === "failed") {