@cleocode/cleo 2026.9.26 → 2026.10.1

package/dist/cli/index.js

@@ -22759,8 +22759,10 @@ var init_nexus_account = __esm({
       "E_NEXUS_BUSY",
       /** Several accounts hold a device credential on one origin and none was named. */
       "E_NEXUS_ACCOUNT_AMBIGUOUS",
-      /** An option that needs device credentials (`--read-only`) without `CLEO_NEXUS_DEVICE=1`. */
-      "E_NEXUS_DEVICE_REQUIRED"
+      /** An option that needs device credentials (`--read-only`) with `CLEO_NEXUS_DEVICE=0`. */
+      "E_NEXUS_DEVICE_REQUIRED",
+      /** `.cleo/nexus-link.json` is in a format this CLEO cannot update (written by a newer CLEO). */
+      "E_NEXUS_LINK_FILE_UNSUPPORTED"
     ];
     nexusAccountUserSchema = z25.object({
       id: z25.string(),
@@ -22782,6 +22784,340 @@ var init_nexus_account = __esm({
   }
 });
 
+// packages/contracts/src/nexus-cloud.ts
+import { z as z26 } from "zod";
+var NEXUS_DEVICE_STATES, NEXUS_CLOUD_PROFILES, NEXUS_DEVICE_LIST_STATES, NEXUS_PAGE_LIMIT_MAX, NEXUS_CLOUD_MAX_PAGES, NEXUS_PRESENCE_FRESH_SECONDS, NEXUS_DEVICE_STATE_UNKNOWN, isoTime, profile, deviceState, nexusCloudCredentialSchema, nexusCloudDeviceSchema, nexusCloudOrganizationSchema, nexusCloudUserSchema, nexusCloudWhoamiSchema, nexusCloudDevicePageSchema, nexusCloudPresenceSchema, nexusCloudReplicaSchema, nexusCloudDeviceCountsSchema, projectFields, nexusCloudProjectListItemSchema, nexusCloudProjectPageSchema, nexusCloudProjectDetailSchema, nexusCloudReplicaPageSchema, NEXUS_STATUS_CHECK_IDS, NEXUS_STATUS_VERDICTS, CLOUD_STATUS_VERDICTS, knownCheckId, nexusCloudStatusCheckSchema, nexusCloudStatusSchema, NEXUS_UNAUTHENTICATED_REASONS, NEXUS_FORBIDDEN_REASONS, NEXUS_REVOKED_REASONS, LOGIN, COMPROMISED, DEVICE_REVOKED, SESSION_EXPIRED_LOGIN, SERVER_REFUSED, NEXUS_REVOKED_REASON_ERRORS, NEXUS_UNAUTHENTICATED_ERRORS, NEXUS_FORBIDDEN_ERRORS, NEXUS_CONFLICT_ERRORS, NEXUS_UNREACHABLE_ERROR;
+var init_nexus_cloud = __esm({
+  "packages/contracts/src/nexus-cloud.ts"() {
+    "use strict";
+    NEXUS_DEVICE_STATES = ["active", "signed-out", "revoked"];
+    NEXUS_CLOUD_PROFILES = ["device", "read-only"];
+    NEXUS_DEVICE_LIST_STATES = ["active", "signed-out", "revoked", "all"];
+    NEXUS_PAGE_LIMIT_MAX = 200;
+    NEXUS_CLOUD_MAX_PAGES = 25;
+    NEXUS_PRESENCE_FRESH_SECONDS = 86400;
+    NEXUS_DEVICE_STATE_UNKNOWN = "unknown";
+    isoTime = z26.iso.datetime({ offset: true });
+    profile = z26.enum(NEXUS_CLOUD_PROFILES).nullable().catch(null);
+    deviceState = z26.enum([...NEXUS_DEVICE_STATES, NEXUS_DEVICE_STATE_UNKNOWN]).catch(NEXUS_DEVICE_STATE_UNKNOWN);
+    nexusCloudCredentialSchema = z26.object({
+      kind: z26.enum(["device", "session"]),
+      credentialId: z26.string().nullable().optional(),
+      profile: profile.optional(),
+      scopes: z26.array(z26.string()).default([]),
+      createdAt: isoTime.nullable().optional(),
+      lastUsedAt: isoTime.nullable().optional(),
+      /** When the credential expires if it is not used again; null for sessions. */
+      idleExpiresAt: isoTime.nullable().optional()
+    });
+    nexusCloudDeviceSchema = z26.object({
+      deviceId: z26.string(),
+      name: z26.string(),
+      platform: z26.string().optional(),
+      arch: z26.string().nullable().optional(),
+      cliVersion: z26.string().nullable().optional(),
+      createdAt: isoTime.optional(),
+      lastSeenAt: isoTime.nullable().optional(),
+      state: deviceState,
+      signedOutAt: isoTime.nullable().optional(),
+      /** Base64 device certificate; null until the device holds a key grant. */
+      certificate: z26.string().nullable().optional(),
+      /** The current credential's profile, or null with none (signed out or revoked). */
+      profile: profile.optional(),
+      /** True for the device whose credential made this request. */
+      current: z26.boolean().default(false),
+      projects: z26.number().int().nonnegative().optional(),
+      replicas: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional()
+    });
+    nexusCloudOrganizationSchema = z26.object({
+      id: z26.string(),
+      name: z26.string(),
+      slug: z26.string().nullable().optional(),
+      role: z26.string().optional(),
+      personal: z26.boolean().optional()
+    });
+    nexusCloudUserSchema = z26.object({
+      id: z26.string(),
+      email: z26.string(),
+      name: z26.string().nullable().optional()
+    });
+    nexusCloudWhoamiSchema = z26.object({
+      serverTime: isoTime.optional(),
+      user: nexusCloudUserSchema,
+      organizations: z26.array(nexusCloudOrganizationSchema).default([]),
+      credential: nexusCloudCredentialSchema,
+      /** The calling device; null for a session caller. */
+      device: nexusCloudDeviceSchema.nullable()
+    });
+    nexusCloudDevicePageSchema = z26.object({
+      devices: z26.array(nexusCloudDeviceSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    nexusCloudPresenceSchema = z26.looseObject({
+      observedAt: isoTime.optional(),
+      sync: z26.object({ enabled: z26.boolean() }).optional()
+    });
+    nexusCloudReplicaSchema = z26.object({
+      projectId: z26.string(),
+      replicaId: z26.string(),
+      deviceId: z26.string(),
+      deviceName: z26.string(),
+      deviceState: deviceState.optional(),
+      attachedAt: isoTime.optional(),
+      lastSyncAt: isoTime.nullable(),
+      presence: nexusCloudPresenceSchema.nullable(),
+      presenceAt: isoTime.nullable()
+    });
+    nexusCloudDeviceCountsSchema = z26.object({
+      active: z26.number().int().nonnegative(),
+      total: z26.number().int().nonnegative()
+    });
+    projectFields = {
+      projectId: z26.string(),
+      label: z26.string().nullable(),
+      organizationId: z26.string(),
+      organizationName: z26.string().optional(),
+      remoteUrl: z26.string().nullable().optional(),
+      createdAt: isoTime.optional()
+    };
+    nexusCloudProjectListItemSchema = z26.object({
+      ...projectFields,
+      role: z26.string(),
+      streamId: z26.string().optional(),
+      headSeq: z26.number().int().nonnegative().nullable().optional(),
+      openConflicts: z26.number().int().nonnegative().optional(),
+      replicas: z26.array(nexusCloudReplicaSchema).default([]),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      lastPresenceAt: isoTime.nullable().optional(),
+      /** This project's replica list was cut at 50 (T12858). */
+      replicasTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectPageSchema = z26.object({
+      projects: z26.array(nexusCloudProjectListItemSchema),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      /** Anything in the page was cut (the project list or a replica list). */
+      truncated: z26.boolean().default(false),
+      /** The project list itself was cut at 1000 (T12858). */
+      projectsTruncated: z26.boolean().default(false)
+    });
+    nexusCloudProjectDetailSchema = z26.object({
+      project: z26.object({ ...projectFields, deletedAt: isoTime.nullable().optional() }),
+      role: z26.string(),
+      canTrash: z26.boolean().optional(),
+      openConflicts: z26.number().int().nonnegative(),
+      /** At most 50, oldest attachment first. */
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema,
+      replicaCount: z26.number().int().nonnegative().optional(),
+      lastSyncAt: isoTime.nullable().optional(),
+      /** `replicas` was cut at 50. */
+      truncated: z26.boolean().default(false),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable()
+      }).nullable()
+    });
+    nexusCloudReplicaPageSchema = z26.object({
+      replicas: z26.array(nexusCloudReplicaSchema),
+      devices: nexusCloudDeviceCountsSchema.optional(),
+      nextCursor: z26.string().max(512).nullable().default(null),
+      truncated: z26.boolean().default(false)
+    });
+    NEXUS_STATUS_CHECK_IDS = [
+      "credential.valid",
+      "device.registered",
+      "device.active",
+      "device.certified",
+      "project.registered",
+      "project.writable",
+      "replica.attached",
+      "presence.fresh",
+      "replica.synced",
+      "conflicts.none"
+    ];
+    NEXUS_STATUS_VERDICTS = ["ok", "attention", "not-linked", "not-registered"];
+    CLOUD_STATUS_VERDICTS = [...NEXUS_STATUS_VERDICTS, "not-signed-in"];
+    knownCheckId = z26.enum(NEXUS_STATUS_CHECK_IDS);
+    nexusCloudStatusCheckSchema = z26.object({
+      id: z26.enum(NEXUS_STATUS_CHECK_IDS),
+      ok: z26.boolean(),
+      required: z26.boolean(),
+      detail: z26.string()
+    });
+    nexusCloudStatusSchema = z26.object({
+      serverTime: isoTime.optional(),
+      apiVersion: z26.string().optional(),
+      user: nexusCloudUserSchema,
+      credential: nexusCloudCredentialSchema,
+      device: nexusCloudDeviceSchema.nullable(),
+      project: z26.object({
+        projectId: z26.string(),
+        registered: z26.boolean(),
+        organizationId: z26.string().nullable(),
+        organizationName: z26.string().nullable(),
+        role: z26.string().nullable()
+      }).nullable(),
+      replica: z26.object({
+        replicaId: z26.string(),
+        attached: z26.boolean(),
+        attachedElsewhere: z26.boolean(),
+        attachedAt: isoTime.nullable(),
+        lastSyncAt: isoTime.nullable(),
+        presenceAt: isoTime.nullable(),
+        lastReplicaSeq: z26.number().int().nonnegative().nullable().optional()
+      }).nullable(),
+      stream: z26.object({
+        streamId: z26.string(),
+        headSeq: z26.number().int().nonnegative(),
+        headCheckpointId: z26.string().nullable(),
+        openConflicts: z26.number().int().nonnegative(),
+        devices: nexusCloudDeviceCountsSchema
+      }).nullable(),
+      /** Check ids added by a newer server are dropped, never a parse failure. */
+      checks: z26.array(nexusCloudStatusCheckSchema.extend({ id: z26.string() })).transform(
+        (list) => list.flatMap((c) => {
+          const id = knownCheckId.safeParse(c.id);
+          return id.success ? [{ ...c, id: id.data }] : [];
+        })
+      ),
+      /** A verdict added by a newer server reads as `attention`: never `ok` by accident. */
+      verdict: z26.enum(NEXUS_STATUS_VERDICTS).catch("attention")
+    });
+    NEXUS_UNAUTHENTICATED_REASONS = [
+      "missing",
+      "invalid",
+      "credential-revoked",
+      "credential-expired",
+      "device-signed-out",
+      "device-revoked",
+      "session-bearer-retired",
+      "session-used"
+    ];
+    NEXUS_FORBIDDEN_REASONS = [
+      "insufficient-scope",
+      "session-required",
+      "device-required",
+      "device-mismatch",
+      "not-self",
+      "project-role",
+      "route-undeclared",
+      "bearer-session-required",
+      "session-not-fresh",
+      "device-limit"
+    ];
+    NEXUS_REVOKED_REASONS = ["signed-out", "revoked", "rotated", "reenrolled"];
+    LOGIN = "run `cleo login nexus`";
+    COMPROMISED = {
+      code: "E_NEXUS_CREDENTIAL_COMPROMISED",
+      message: "this device's credential was replaced or revoked elsewhere, possibly used from another machine",
+      fix: "revoke this device on cleocode.dev and sign in again with `cleo login nexus`"
+    };
+    DEVICE_REVOKED = {
+      code: "E_NEXUS_DEVICE_REVOKED",
+      message: "this device was revoked",
+      fix: "run `cleo login nexus` to enrol this machine as a new device"
+    };
+    SESSION_EXPIRED_LOGIN = {
+      code: "E_NEXUS_SESSION_EXPIRED",
+      message: "the session is too old for this request",
+      fix: "run `cleo login nexus` (needs a browser: on a headless machine a human must complete the login)"
+    };
+    SERVER_REFUSED = {
+      code: "E_NEXUS_REQUEST_FAILED",
+      message: null,
+      fix: null
+    };
+    NEXUS_REVOKED_REASON_ERRORS = {
+      reenrolled: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device's credential was replaced by a newer login of the same device",
+        fix: LOGIN
+      },
+      "signed-out": {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "this device was signed out and later signed in again with another credential",
+        fix: LOGIN
+      },
+      revoked: DEVICE_REVOKED,
+      rotated: COMPROMISED
+    };
+    NEXUS_UNAUTHENTICATED_ERRORS = {
+      missing: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "not signed in to Cleo Nexus (the credential is missing or invalid)",
+        fix: LOGIN
+      },
+      invalid: {
+        code: "E_NEXUS_NOT_SIGNED_IN",
+        message: "not signed in to Cleo Nexus (the credential is missing or invalid)",
+        fix: LOGIN
+      },
+      // Resolved by `details.revokedReason` through NEXUS_REVOKED_REASON_ERRORS.
+      "credential-revoked": COMPROMISED,
+      "credential-expired": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "the device credential expired after 90 days without use",
+        fix: LOGIN
+      },
+      "device-signed-out": {
+        code: "E_NEXUS_DEVICE_SIGNED_OUT",
+        message: "this device was signed out",
+        fix: LOGIN
+      },
+      "device-revoked": DEVICE_REVOKED,
+      "session-bearer-retired": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "bearer sessions are no longer accepted",
+        fix: "run `cleo login nexus` with the current CLI"
+      },
+      "session-used": {
+        code: "E_NEXUS_SESSION_EXPIRED",
+        message: "the 9.24 session was already used by another enrolment",
+        fix: LOGIN
+      }
+    };
+    NEXUS_FORBIDDEN_ERRORS = {
+      "insufficient-scope": {
+        code: "E_NEXUS_INSUFFICIENT_SCOPE",
+        message: "this device's credential lacks the scope for that request",
+        fix: "run `cleo login nexus` without --read-only to enrol with the full device profile"
+      },
+      "session-required": SERVER_REFUSED,
+      "device-required": SERVER_REFUSED,
+      "device-mismatch": SERVER_REFUSED,
+      "not-self": SERVER_REFUSED,
+      "project-role": SERVER_REFUSED,
+      "route-undeclared": SERVER_REFUSED,
+      "bearer-session-required": SESSION_EXPIRED_LOGIN,
+      "session-not-fresh": SESSION_EXPIRED_LOGIN,
+      "device-limit": {
+        code: "E_NEXUS_REQUEST_FAILED",
+        message: "the account has reached its device limit",
+        fix: "revoke unused devices on cleocode.dev, then retry"
+      }
+    };
+    NEXUS_CONFLICT_ERRORS = {
+      "replica-copied": {
+        code: "E_NEXUS_REPLICA_COPIED",
+        message: "this project store is attached from another device (a copied store)",
+        fix: null
+      },
+      "rotation-conflict": COMPROMISED
+    };
+    NEXUS_UNREACHABLE_ERROR = {
+      code: "E_NEXUS_UNREACHABLE",
+      message: null,
+      fix: "check your network and retry"
+    };
+  }
+});
+
 // packages/contracts/src/task-id.ts
 function isTaskId(value) {
   return typeof value === "string" && TASK_ID_REGEX.test(value);
@@ -22849,6 +23185,7 @@ __export(src_exports, {
   CHANNEL_BOUNDARY_REGISTRY: () => CHANNEL_BOUNDARY_REGISTRY,
   CLEO_CONFIG_MANIFEST: () => CLEO_CONFIG_MANIFEST,
   CLI_CATEGORY_ORDER: () => CLI_CATEGORY_ORDER,
+  CLOUD_STATUS_VERDICTS: () => CLOUD_STATUS_VERDICTS,
   COLLECTION_IDENTITY_FIELDS: () => COLLECTION_IDENTITY_FIELDS,
   COLLECTION_KEYS: () => COLLECTION_KEYS,
   CONFIG_MANIFEST_ENTRIES: () => CONFIG_MANIFEST_ENTRIES,
@@ -22963,10 +23300,27 @@ __export(src_exports, {
   MonitorResponseSchema: () => MonitorResponseSchema,
   NEXUS_ACCOUNT_ERROR_CODES: () => NEXUS_ACCOUNT_ERROR_CODES,
   NEXUS_CLI_CLIENT_ID: () => NEXUS_CLI_CLIENT_ID,
+  NEXUS_CLOUD_MAX_PAGES: () => NEXUS_CLOUD_MAX_PAGES,
+  NEXUS_CLOUD_PROFILES: () => NEXUS_CLOUD_PROFILES,
+  NEXUS_CONFLICT_ERRORS: () => NEXUS_CONFLICT_ERRORS,
   NEXUS_DEFAULT_API_URL: () => NEXUS_DEFAULT_API_URL,
+  NEXUS_DEVICE_LIST_STATES: () => NEXUS_DEVICE_LIST_STATES,
+  NEXUS_DEVICE_STATES: () => NEXUS_DEVICE_STATES,
+  NEXUS_DEVICE_STATE_UNKNOWN: () => NEXUS_DEVICE_STATE_UNKNOWN,
   NEXUS_FLEET_SCHEMA_VERSION: () => NEXUS_FLEET_SCHEMA_VERSION,
+  NEXUS_FORBIDDEN_ERRORS: () => NEXUS_FORBIDDEN_ERRORS,
+  NEXUS_FORBIDDEN_REASONS: () => NEXUS_FORBIDDEN_REASONS,
   NEXUS_LOGIN_TARGET: () => NEXUS_LOGIN_TARGET,
+  NEXUS_PAGE_LIMIT_MAX: () => NEXUS_PAGE_LIMIT_MAX,
+  NEXUS_PRESENCE_FRESH_SECONDS: () => NEXUS_PRESENCE_FRESH_SECONDS,
+  NEXUS_REVOKED_REASONS: () => NEXUS_REVOKED_REASONS,
+  NEXUS_REVOKED_REASON_ERRORS: () => NEXUS_REVOKED_REASON_ERRORS,
   NEXUS_SCOPE_MAP: () => NEXUS_SCOPE_MAP,
+  NEXUS_STATUS_CHECK_IDS: () => NEXUS_STATUS_CHECK_IDS,
+  NEXUS_STATUS_VERDICTS: () => NEXUS_STATUS_VERDICTS,
+  NEXUS_UNAUTHENTICATED_ERRORS: () => NEXUS_UNAUTHENTICATED_ERRORS,
+  NEXUS_UNAUTHENTICATED_REASONS: () => NEXUS_UNAUTHENTICATED_REASONS,
+  NEXUS_UNREACHABLE_ERROR: () => NEXUS_UNREACHABLE_ERROR,
   OPEN_SYSTEM_KEY_PREFIXES: () => OPEN_SYSTEM_KEY_PREFIXES,
   OPERATIONS: () => OPERATIONS,
   OPERATION_RESULT_SCHEMAS: () => OPERATION_RESULT_SCHEMAS,
@@ -23246,6 +23600,21 @@ __export(src_exports, {
   nexusAccountMeSchema: () => nexusAccountMeSchema,
   nexusAccountOrganizationSchema: () => nexusAccountOrganizationSchema,
   nexusAccountUserSchema: () => nexusAccountUserSchema,
+  nexusCloudCredentialSchema: () => nexusCloudCredentialSchema,
+  nexusCloudDeviceCountsSchema: () => nexusCloudDeviceCountsSchema,
+  nexusCloudDevicePageSchema: () => nexusCloudDevicePageSchema,
+  nexusCloudDeviceSchema: () => nexusCloudDeviceSchema,
+  nexusCloudOrganizationSchema: () => nexusCloudOrganizationSchema,
+  nexusCloudPresenceSchema: () => nexusCloudPresenceSchema,
+  nexusCloudProjectDetailSchema: () => nexusCloudProjectDetailSchema,
+  nexusCloudProjectListItemSchema: () => nexusCloudProjectListItemSchema,
+  nexusCloudProjectPageSchema: () => nexusCloudProjectPageSchema,
+  nexusCloudReplicaPageSchema: () => nexusCloudReplicaPageSchema,
+  nexusCloudReplicaSchema: () => nexusCloudReplicaSchema,
+  nexusCloudStatusCheckSchema: () => nexusCloudStatusCheckSchema,
+  nexusCloudStatusSchema: () => nexusCloudStatusSchema,
+  nexusCloudUserSchema: () => nexusCloudUserSchema,
+  nexusCloudWhoamiSchema: () => nexusCloudWhoamiSchema,
   normalizeError: () => normalizeError,
   noteAtomSchema: () => noteAtomSchema,
   noulDecisionAnswerSchema: () => noulDecisionAnswerSchema,
@@ -23426,6 +23795,7 @@ var init_src2 = __esm({
     init_decide();
     init_decide_sites();
     init_nexus_account();
+    init_nexus_cloud();
     init_task_id();
   }
 });
@@ -36353,7 +36723,7 @@ function parseAgenticNode(raw, base, index) {
     inputs = acc;
   }
   const context_files = parseStringArray(raw.context_files, `nodes[${index}].context_files`);
-  const profile = parseOptionalNonEmptyString(raw.profile, `nodes[${index}].profile`);
+  const profile2 = parseOptionalNonEmptyString(raw.profile, `nodes[${index}].profile`);
   const model = parseOptionalNonEmptyString(raw.model, `nodes[${index}].model`);
   const provider = parseOptionalNonEmptyString(raw.provider, `nodes[${index}].provider`);
   const allowed_skills = parseStringArray(raw.allowed_skills, `nodes[${index}].allowed_skills`);
@@ -36366,7 +36736,7 @@ function parseAgenticNode(raw, base, index) {
     role,
     inputs,
     ...context_files !== void 0 ? { context_files } : {},
-    ...profile !== void 0 ? { profile } : {},
+    ...profile2 !== void 0 ? { profile: profile2 } : {},
     ...model !== void 0 ? { model } : {},
     ...provider !== void 0 ? { provider } : {},
     ...allowed_skills !== void 0 ? { allowed_skills } : {},
@@ -47610,8 +47980,8 @@ var init_agent_outputs = __esm({
 });
 
 // packages/cleo/src/cli/commands/agent-profile-status.ts
-function computeProfileStatus(profile, validation) {
-  if (profile === null) return "none";
+function computeProfileStatus(profile2, validation) {
+  if (profile2 === null) return "none";
   if (validation === null) return "loaded (unvalidated)";
   if (validation.valid) return "validated";
   return `invalid (${validation.errors.length} errors)`;
@@ -47916,16 +48286,16 @@ agent ${agentId}:
             process.exitCode = 1;
             return;
           }
-          let profile = null;
+          let profile2 = null;
           let cantValidation = null;
           const cantPath = args.cant ?? join40(CLEO_DIR_NAME3, AGENTS_SUBDIR, `${args.agentId}.cant`);
           if (existsSync22(cantPath)) {
-            profile = readFileSync22(cantPath, "utf-8");
+            profile2 = readFileSync22(cantPath, "utf-8");
             try {
               const cantModule = await import("@cleocode/cant");
               const validate = "validate" in cantModule ? cantModule.validate : null;
               if (validate) {
-                const result = validate(profile);
+                const result = validate(profile2);
                 cantValidation = {
                   valid: result.valid,
                   errors: result.diagnostics?.map((d) => d.message) ?? []
@@ -47968,7 +48338,7 @@ agent ${agentId}:
                 transport: runtime.transport.name,
                 // Surfaced for operator visibility only — see
                 // computeProfileStatus tsdoc for the four possible values.
-                profile: computeProfileStatus(profile, cantValidation),
+                profile: computeProfileStatus(profile2, cantValidation),
                 services: {
                   poller: "running",
                   heartbeat: runtime.heartbeat ? "running" : "disabled",
@@ -50647,15 +51017,24 @@ function nexusApiUrlArg(args) {
 function failNexus(err, operation) {
   const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0;
   const fix = err instanceof Error && "fix" in err && typeof err.fix === "string" ? err.fix : void 0;
-  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" ? 6 : 1;
+  const exitCode = code === "E_NEXUS_INVALID_API_URL" || code === "E_NEXUS_INVALID_LABEL" || code === "E_NEXUS_DEVICE_REQUIRED" || code === "E_VALIDATION" ? 6 : 1;
+  const details = err instanceof Error && "publicDetails" in err && typeof err.publicDetails === "object" && err.publicDetails ? err.publicDetails : void 0;
   cliError(
     err instanceof Error ? err.message : String(err),
     exitCode,
-    { name: code ?? "E_NEXUS_REQUEST_FAILED", ...fix ? { fix } : {} },
+    {
+      name: code ?? "E_NEXUS_REQUEST_FAILED",
+      ...fix ? { fix } : {},
+      ...details ? { details } : {}
+    },
     { operation }
   );
   process.exit(exitCode);
 }
+function writeNexusWarnings(warnings) {
+  for (const warning of warnings) process.stderr.write(`warning: ${warning}
+`);
+}
 function emitNexusResult(data, summary, command, operation) {
   if (isHumanOutput()) humanLine(summary);
   else cliOutput(data, { command, operation });
@@ -50670,9 +51049,11 @@ async function runNexusLogin(args, openBrowser2) {
     "@cleocode/core/cloud/nexus-device.js"
   );
   const noBrowser = negatedFlag(args, "browser");
+  let codeShown = false;
   const hooks2 = {
     apiUrl: nexusApiUrlArg(args),
     onCode: (code) => {
+      codeShown = true;
       writeDeviceCodePrompt(code, SERVICE_NAME);
       if (!noBrowser) openBrowser2(code.verificationUriComplete ?? code.verificationUri);
     },
@@ -50687,7 +51068,7 @@ async function runNexusLogin(args, openBrowser2) {
       ),
       {
         code: "E_NEXUS_DEVICE_REQUIRED",
-        fix: "set CLEO_NEXUS_DEVICE=1 to enrol a read-only device, or log in without --read-only"
+        fix: "unset CLEO_NEXUS_DEVICE (=0 turns device credentials off) to enrol a read-only device, or log in without --read-only"
       }
     );
   }
@@ -50706,12 +51087,22 @@ async function runNexusLogin(args, openBrowser2) {
     } else {
       if (name !== void 0) {
         process.stderr.write(
-          "warning: --name needs device credentials (CLEO_NEXUS_DEVICE=1); ignored\n"
+          "warning: --name needs device credentials, which CLEO_NEXUS_DEVICE=0 turns off; ignored\n"
+        );
+      }
+      const { NEXUS_TEST_BEARER_ENV, W_NEXUS_TEST_BEARER_IGNORED } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-enrol.js"
+      );
+      if ((process.env[NEXUS_TEST_BEARER_ENV]?.trim() ?? "") !== "") {
+        process.stderr.write(
+          `warning: ${W_NEXUS_TEST_BEARER_IGNORED}: ${NEXUS_TEST_BEARER_ENV} needs device credentials, which CLEO_NEXUS_DEVICE turns off; ignored
+`
         );
       }
       result = await loginToNexus(hooks2);
     }
-    writeDeviceCodeApproved(SERVICE_NAME);
+    if (codeShown) writeDeviceCodeApproved(SERVICE_NAME);
     for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
 `);
     return result;
@@ -50726,6 +51117,41 @@ function nexusLoginSummary(r) {
   const device = r.device ? ` This machine is device ${r.device.deviceId}${r.device.name ? ` (${r.device.name})` : ""}, profile ${r.device.profile ?? "unknown"}.` : "";
   return `Signed in to ${r.apiUrl} as ${who}${org}.${device}`;
 }
+function nexusDeviceLogoutSummary(r) {
+  const count = (o) => r.devices.filter((d) => d.outcome === o).length;
+  const confirmed = count("confirmed");
+  const open2 = r.devices.length - confirmed;
+  const what = r.action === "revoke" ? "Revoke" : "Sign-out";
+  if (r.devices.length === 0 && r.session === null) {
+    return r.warnings.length > 0 ? `${what} on ${r.apiUrl}: nothing was sent (see warnings).` : `Not signed in to ${r.apiUrl}; nothing to do.`;
+  }
+  const parts = [];
+  if (r.devices.length > 0)
+    parts.push(`${confirmed} of ${r.devices.length} device request(s) confirmed`);
+  if (open2 > 0) parts.push(`${open2} NOT confirmed (see warnings)`);
+  if (r.session !== null) parts.push(`9.24 session ${r.session.revocation}`);
+  const notConfirmed = open2 > 0 || r.devices.length > 0 && confirmed === 0 || r.session?.revocation === "failed";
+  const lead = notConfirmed ? `${what} NOT fully confirmed on` : `${what} confirmed on`;
+  return `${lead} ${r.apiUrl}: ${parts.join("; ")}.`;
+}
+async function runNexusDeviceLogout(args) {
+  let result;
+  try {
+    const { logoutNexusDevice } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-logout.js"
+    );
+    result = await logoutNexusDevice({
+      apiUrl: nexusApiUrlArg(args),
+      revoke: args["revoke"] === true
+    });
+  } catch (err) {
+    failNexus(err, "logout.run");
+  }
+  for (const warning of result.warnings) process.stderr.write(`warning: ${warning}
+`);
+  emitNexusResult(result, nexusDeviceLogoutSummary(result), "logout", "logout.run");
+}
 var SERVICE_NAME, NEXUS_API_URL_ARG;
 var init_nexus_account_cli = __esm({
   "packages/cleo/src/cli/lib/nexus-account-cli.ts"() {
@@ -51071,13 +51497,13 @@ function _errorResult(code, message, meta) {
 }
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
-  const profile = await getProviderProfile(provider);
-  const oauthMode = profile?.oauth?.mode;
+  const profile2 = await getProviderProfile(provider);
+  const oauthMode = profile2?.oauth?.mode;
   if (provider === "kimi-code" || oauthMode === "device-code") {
     return _runKimiCodeLogin(opts, meta);
   }
   if (oauthMode === "pkce") {
-    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
+    return _runPkceLogin(profile2.name, profile2.oauth, opts, meta);
   }
   return _errorResult(
     "E_NOT_IMPLEMENTED",
@@ -51615,11 +52041,11 @@ var init_login = __esm({
       },
       "read-only": {
         type: "boolean",
-        description: "nexus with CLEO_NEXUS_DEVICE=1: enrol this machine with the read-only device profile (account, devices and project reads only). Refused without CLEO_NEXUS_DEVICE=1."
+        description: "nexus: enrol this machine with the read-only device profile (account, devices and project reads only). Refused with CLEO_NEXUS_DEVICE=0."
       },
       name: {
         type: "string",
-        description: "nexus with CLEO_NEXUS_DEVICE=1: device name shown on cleocode.dev (default: OS, arch and a short id; never the hostname)."
+        description: "nexus: device name shown on cleocode.dev (default: OS, arch and a short id; never the hostname). Ignored with CLEO_NEXUS_DEVICE=0."
       },
       auth: {
         type: "string",
@@ -55639,6 +56065,252 @@ var init_classify = __esm({
   }
 });
 
+// packages/cleo/src/cli/lib/nexus-cloud-cli.ts
+function stringArg(args, name) {
+  const raw = args[name];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function writeWarnings(warnings) {
+  for (const w of warnings) process.stderr.write(`warning: ${w.message} (${w.code})
+`);
+}
+function deviceStateArg(args) {
+  const raw = stringArg(args, "state");
+  if (raw === void 0) return void 0;
+  const known = NEXUS_DEVICE_LIST_STATES.find((s) => s === raw);
+  if (known !== void 0) return known;
+  throw Object.assign(new Error(`unknown --state '${raw}'`), {
+    code: "E_VALIDATION",
+    fix: `use one of: ${NEXUS_DEVICE_LIST_STATES.join(", ")}`
+  });
+}
+function cloudStatusSummary(r) {
+  if (r.verdict === "not-signed-in") {
+    return `Cloud status: not signed in to ${r.local.apiUrl}. Run \`cleo login nexus\`.`;
+  }
+  const s = r.summary;
+  const parts = [`device ${r.local.nexusDeviceId ?? "unknown"} (${s.profile ?? "no profile"})`];
+  if (r.local.projectId !== null) {
+    parts.push(`project ${r.local.projectId} ${s.linked ? "linked" : "NOT linked"}`);
+    parts.push(s.replicaAttached ? "replica attached" : "replica NOT attached");
+    parts.push(`${s.devices} device(s)`);
+    if (s.headSeq !== null) parts.push(`head ${s.headSeq}`);
+    if (s.openConflicts !== null) parts.push(`${s.openConflicts} open conflict(s)`);
+  }
+  return `Cloud status: ${r.verdict}. ${parts.join("; ")}.`;
+}
+async function runCloudRead(operation, call, summary) {
+  let result;
+  try {
+    result = await call();
+  } catch (err) {
+    const { NexusCloudOfflineError } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-cloud-status.js"
+    );
+    if (err instanceof NexusCloudOfflineError) writeWarnings(err.publicDetails.warnings);
+    failNexus(err, operation);
+  }
+  writeWarnings(result.warnings);
+  emitNexusResult(result, summary(result), "cloud", operation);
+}
+async function runCloudStatus(args) {
+  await runCloudRead(
+    "cloud.status",
+    async () => {
+      const { getNexusCloudStatus } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud-status.js"
+      );
+      const projectId = stringArg(args, "project");
+      return getNexusCloudStatus({
+        apiUrl: nexusApiUrlArg(args),
+        ...projectId !== void 0 ? { projectId } : {}
+      });
+    },
+    cloudStatusSummary
+  );
+}
+async function runCloudWhoami(args) {
+  await runCloudRead(
+    "cloud.whoami",
+    async () => {
+      const { nexusCloudWhoami } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return nexusCloudWhoami({ apiUrl: nexusApiUrlArg(args) });
+    },
+    (r) => `Signed in to ${r.apiUrl} as ${r.user.email} with a ${r.credential.kind} credential${r.device ? ` (device ${r.device.deviceId}, profile ${r.credential.profile ?? "none"})` : ""}.`
+  );
+}
+async function runCloudDevices(args) {
+  await runCloudRead(
+    "cloud.devices.list",
+    async () => {
+      const state = deviceStateArg(args);
+      const { listNexusCloudDevices } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudDevices({
+        apiUrl: nexusApiUrlArg(args),
+        ...state !== void 0 ? { state } : {}
+      });
+    },
+    (r) => `${r.count} device(s) on ${r.apiUrl}${r.state ? ` (state ${r.state})` : ""}: ${r.devices.map((d) => `${d.name} ${d.deviceId} ${d.state}${d.current ? " (this machine)" : ""}`).join("; ")}`
+  );
+}
+async function runCloudProjects(args) {
+  const action = stringArg(args, "action");
+  if (action === "show") {
+    await runCloudRead(
+      "cloud.projects.show",
+      async () => {
+        const projectId = stringArg(args, "id");
+        const { showNexusCloudProject } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-cloud.js"
+        );
+        return showNexusCloudProject({
+          apiUrl: nexusApiUrlArg(args),
+          ...projectId !== void 0 ? { projectId } : {}
+        });
+      },
+      (r) => `Project ${r.projectId} "${r.project.label ?? ""}" (${r.role}): ${r.devices.active} active device(s), ${r.replicas.length} replica(s), head ${r.stream?.headSeq ?? "none"}, ${r.openConflicts} open conflict(s).`
+    );
+    return;
+  }
+  if (action !== void 0 && action !== "list") {
+    failNexus(
+      Object.assign(new Error(`unknown action '${action}'`), {
+        code: "E_VALIDATION",
+        fix: "use `cleo cloud projects` or `cleo cloud projects show [<id>]`"
+      }),
+      "cloud.projects.list"
+    );
+  }
+  await runCloudRead(
+    "cloud.projects.list",
+    async () => {
+      const organizationId = stringArg(args, "org");
+      const { listNexusCloudProjects } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudProjects({
+        apiUrl: nexusApiUrlArg(args),
+        ...organizationId !== void 0 ? { organizationId } : {}
+      });
+    },
+    (r) => `${r.count} project(s) on ${r.apiUrl}: ${r.projects.map((p) => `${p.label ?? p.projectId} (${p.role})`).join("; ")}`
+  );
+}
+var init_nexus_cloud_cli = __esm({
+  "packages/cleo/src/cli/lib/nexus-cloud-cli.ts"() {
+    "use strict";
+    init_src2();
+    init_nexus_account_cli();
+  }
+});
+
+// packages/cleo/src/cli/commands/cloud.ts
+var cloud_exports = {};
+__export(cloud_exports, {
+  cloudCommand: () => cloudCommand
+});
+var JSON_ARG, statusSubCommand, whoamiSubCommand, devicesSubCommand, projectsSubCommand, cloudCommand;
+var init_cloud = __esm({
+  "packages/cleo/src/cli/commands/cloud.ts"() {
+    "use strict";
+    init_src2();
+    init_define_cli_command();
+    init_nexus_account_cli();
+    init_nexus_cloud_cli();
+    JSON_ARG = { type: "boolean", description: "Output as JSON envelope" };
+    statusSubCommand = defineCommand({
+      meta: {
+        name: "status",
+        description: "Verify this machine against Cleo Nexus in one call: device, credential, project link, replica and stream. Returns { verdict, summary, local, remote, warnings }; verdict is ok, attention, not-linked, not-registered or not-signed-in. Reads only (GET; never binds a replica), except that getting the credential may upgrade a 9.24 session (E1) and retry unsettled logouts (E9/E10)."
+      },
+      args: {
+        project: {
+          type: "string",
+          description: "Project id to check (default: the current project)."
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudStatus(args);
+      }
+    });
+    whoamiSubCommand = defineCommand({
+      meta: {
+        name: "whoami",
+        description: "Show the Cleo Nexus user, organizations, credential and device for this machine."
+      },
+      args: { "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+      async run({ args }) {
+        await runCloudWhoami(args);
+      }
+    });
+    devicesSubCommand = defineCommand({
+      meta: {
+        name: "devices",
+        description: "List the account's devices (newest first), following every page; reports truncation."
+      },
+      args: {
+        state: {
+          type: "string",
+          description: `Filter: ${NEXUS_DEVICE_LIST_STATES.join(", ")} (default: active).`
+        },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudDevices(args);
+      }
+    });
+    projectsSubCommand = defineCommand({
+      meta: {
+        name: "projects",
+        description: "List visible Cleo Nexus projects, following every page (cleo cloud projects [--org <id>]), or show one with its replicas and device counts (cleo cloud projects show [<id>], default: the current project)."
+      },
+      args: {
+        action: {
+          type: "positional",
+          description: "'list' (default) or 'show'.",
+          required: false
+        },
+        id: {
+          type: "positional",
+          description: "Project id for show (default: the current project).",
+          required: false
+        },
+        org: { type: "string", description: "Only this organization id (list)." },
+        "api-url": NEXUS_API_URL_ARG,
+        json: JSON_ARG
+      },
+      async run({ args }) {
+        await runCloudProjects(args);
+      }
+    });
+    cloudCommand = defineCommand({
+      meta: {
+        name: "cloud",
+        description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show]."
+      },
+      subCommands: {
+        status: statusSubCommand,
+        whoami: whoamiSubCommand,
+        devices: devicesSubCommand,
+        projects: projectsSubCommand
+      }
+    });
+  }
+});
+
 // packages/cleo/src/cli/commands/code.ts
 var code_exports = {};
 __export(code_exports, {
@@ -67559,7 +68231,7 @@ function showStatus() {
   }
   cliOutput(result, { command: "exodus status" });
 }
-var migrateSubCommand, verifySubCommand, sealSubCommand, statusSubCommand, exodusCommand;
+var migrateSubCommand, verifySubCommand, sealSubCommand, statusSubCommand2, exodusCommand;
 var init_exodus = __esm({
   "packages/cleo/src/cli/commands/exodus.ts"() {
     "use strict";
@@ -67869,7 +68541,7 @@ Passing tables (${passing.length}):`);
         );
       }
     });
-    statusSubCommand = defineCommand({
+    statusSubCommand2 = defineCommand({
       meta: {
         name: "status",
         description: "Show exodus migration status (staging, source DBs, target DBs)"
@@ -67887,7 +68559,7 @@ Passing tables (${passing.length}):`);
         migrate: migrateSubCommand,
         verify: verifySubCommand,
         seal: sealSubCommand,
-        status: statusSubCommand
+        status: statusSubCommand2
       },
       async run({ cmd, rawArgs }) {
         if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
@@ -71660,8 +72332,8 @@ async function resolveDefaultModel(provider) {
       "@cleocode/core/llm/role-resolver.js"
     )
   ]);
-  const profile = await getProviderProfile2(provider);
-  return profile?.defaultModel ?? IMPLICIT_FALLBACK_MODEL;
+  const profile2 = await getProviderProfile2(provider);
+  return profile2?.defaultModel ?? IMPLICIT_FALLBACK_MODEL;
 }
 async function runLlmStream(opts) {
   const stdout2 = opts.stdout ?? process.stdout;
@@ -72519,14 +73191,8 @@ var init_log = __esm({
 // packages/cleo/src/cli/commands/logout.ts
 var logout_exports = {};
 __export(logout_exports, {
-  logoutCommand: () => logoutCommand,
-  nexusLogoutSummary: () => nexusLogoutSummary
+  logoutCommand: () => logoutCommand
 });
-function nexusLogoutSummary(r) {
-  if (!r.removedLocally) return `Not signed in to ${r.apiUrl}; nothing to do.`;
-  const server = r.revocation === "revoked" ? "session revoked" : r.revocation === "already-invalid" ? "session was already invalid" : "server-side revocation FAILED (the session ends when it expires)";
-  return `Signed out of ${r.apiUrl}: ${server}; local token deleted.`;
-}
 var logoutCommand;
 var init_logout = __esm({
   "packages/cleo/src/cli/commands/logout.ts"() {
@@ -72538,7 +73204,7 @@ var init_logout = __esm({
     logoutCommand = defineCommand({
       meta: {
         name: "logout",
-        description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential)."
+        description: "Sign out. cleo logout [nexus] signs this machine out of Cleo Nexus (the device keeps its id for the next login; --revoke burns it), confirmed by the server; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential)."
       },
       args: {
         target: {
@@ -72552,6 +73218,10 @@ var init_logout = __esm({
           required: false
         },
         "api-url": NEXUS_API_URL_ARG,
+        revoke: {
+          type: "boolean",
+          description: "Hard-revoke this device: destroys its key grant and burns the device id; the next login enrols a new device. Without it, logout signs the device out and keeps it for the next login."
+        },
         json: { type: "boolean", description: "Output as JSON envelope" }
       },
       async run({ args }) {
@@ -72566,17 +73236,7 @@ var init_logout = __esm({
           emitLlmCredentialRemoval(await removeLlmCredential(target, label), "logout", "logout.run");
           return;
         }
-        const { logoutFromNexus } = await import(
-          /* webpackIgnore: true */
-          "@cleocode/core/cloud/nexus-auth.js"
-        );
-        let result;
-        try {
-          result = await logoutFromNexus({ apiUrl: nexusApiUrlArg(a) });
-        } catch (err) {
-          failNexus(err, "logout.run");
-        }
-        emitNexusResult(result, nexusLogoutSummary(result), "logout", "logout.run");
+        await runNexusDeviceLogout(a);
       }
     });
   }
@@ -79874,6 +80534,10 @@ var init_project = __esm({
           type: "string",
           description: "Name shown in Nexus, sent in plaintext (default: the project name). A name, never a path."
         },
+        rebind: {
+          type: "boolean",
+          description: "Use only after E_NEXUS_REPLICA_COPIED: give this copy of the project a new replica id before attaching it (this machine was re-enrolled, or the store was copied). Each run mints a new id and leaves the old one on the server as stale history."
+        },
         "api-url": NEXUS_API_URL_ARG,
         json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
       },
@@ -79886,14 +80550,17 @@ var init_project = __esm({
         try {
           result = await linkProjectToNexus({
             apiUrl: nexusApiUrlArg(args),
-            ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {}
+            ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {},
+            ...args["rebind"] === true ? { rebind: true } : {}
           });
         } catch (err) {
           failNexus(err, "project.link");
         }
-        const { link } = result;
+        const { link, replica } = result;
         const verb = result.alreadyLinked ? "Already linked" : "Linked";
-        const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.`;
+        const attached = replica ? ` This machine (device ${replica.deviceId}) holds it as replica ${replica.replicaId}${replica.reboundFrom ? ` (rebound from ${replica.reboundFrom})` : ""}${replica.presenceAt ? "; presence reported" : ""}.` : "";
+        const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.${attached}`;
+        writeNexusWarnings(result.warnings);
         emitNexusResult(result, summary, "project", "project.link");
       }
     });
@@ -92446,6 +93113,12 @@ var COMMAND_MANIFEST = [
     description: "Classify a task: readiness verdict (proceed|grill) + persona routing (agent, confidence)",
     load: async () => (await Promise.resolve().then(() => (init_classify(), classify_exports))).classifyCommand
   },
+  {
+    exportName: "cloudCommand",
+    name: "cloud",
+    description: "Cleo Nexus reads with the device credential (GET only; getting the credential may upgrade a 9.24 session or retry unsettled logouts): status (one-call verification), whoami, devices, projects [show].",
+    load: async () => (await Promise.resolve().then(() => (init_cloud(), cloud_exports))).cloudCommand
+  },
   {
     exportName: "codeCommand",
     name: "code",
@@ -92971,7 +93644,7 @@ var COMMAND_MANIFEST = [
   {
     exportName: "logoutCommand",
     name: "logout",
-    description: "Sign out. cleo logout [nexus] revokes the Cleo Nexus session server-side and deletes the stored token; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential).",
+    description: "Sign out. cleo logout [nexus] signs this machine out of Cleo Nexus (the device keeps its id for the next login; --revoke burns it), confirmed by the server; cleo logout <provider> [label] removes an LLM credential exactly like cleo auth remove (the label may be omitted when the provider has one credential).",
     load: async () => (await Promise.resolve().then(() => (init_logout(), logout_exports))).logoutCommand
   },
   {