@cleocode/core 2026.10.13-rc.ci.682 → 2026.10.14-rc.ci.683

package/dist/build-provenance.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "gitHead": "32ce32e144291cc78287a473408c0650fa6fe158",
-  "builtAt": "2026-10-14T12:33:57.771Z",
+  "gitHead": "11d70922471bbfe81677f74e2b4f027a0eb7316f",
+  "builtAt": "2026-10-15T07:13:00.806Z",
   "linkedWorktree": null
 }

package/dist/cloud/nexus-vault.d.ts

@@ -241,13 +241,17 @@ export declare function cloudSync(opts?: NexusVaultCommandOptions & {
 }): Promise<CloudSyncResult>;
 /**
  * `cleo cloud pull` / `cleo cloud restore`: verify and activate a snapshot.
+ * A restore then turns sync on for the store and the home stream (T13718).
  *
- * @param opts - Mode, snapshot, project and target overrides.
+ * @param opts - Mode, snapshot, project and target overrides;
+ *   `allowUnreleased` for tests and staging only.
  * @returns What was restored.
  * @throws {NexusAccountError} `E_NEXUS_VAULT_LOCAL_CHANGES`, `E_NEXUS_VAULT_VERIFY_FAILED`,
  *   `E_NEXUS_VAULT_EMPTY`, `E_NEXUS_VAULT_KEY_UNAVAILABLE`, or a mapped API error.
  */
-export declare function restoreNexusVault(opts: NexusVaultRestoreOptions): Promise<CloudRestoreResult>;
+export declare function restoreNexusVault(opts: NexusVaultRestoreOptions & {
+    allowUnreleased?: boolean;
+}): Promise<CloudRestoreResult>;
 /**
  * `cleo cloud vault`: the vault's lineage, last push per device, pending changes and leases.
  *

package/dist/cloud/nexus-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAkD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAsChE,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAmhED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAuJD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AA63BlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAkD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAuChE,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAmhED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAuJD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AA63BlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA0CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/dist/cloud/nexus-vault.js

@@ -82,6 +82,7 @@ import { sealPending } from '../store/sync/sealer.js';
 import { firstBadTxnSignature, signTxn } from '../store/sync/txn-signing.js';
 import { buildVaultManifest, carryMachineState, compareVaultManifests, emptyVaultTableHash, isVaultAnnotationKey, isVaultForkManifest, sameVaultManifest, VAULT_FILES_KEY, VAULT_FORK_KEY, VAULT_FORMAT_KEY, VAULT_GLOBAL_CONFIG_LOCAL_KEYS, VAULT_MANIFEST_FORMAT_VERSION, vaultDatabaseEntry, vaultDatabaseKey, vaultFileDigest, vaultFilesEntry, vaultForkEntry, vaultFormatEntry, vaultManifestFormat, vaultStripColumns, } from '../store/vault-manifest.js';
 import { foreignWriterLeases, storeOpenElsewhere } from '../store/writer-lease.js';
+import { autoSyncSuppressedBy } from './auto-sync.js';
 import { deriveKey, uuidv7 } from './crypto.js';
 import { NexusError } from './http.js';
 import { cursorFromCheckpoint, initialPullCursor, Journal } from './journal.js';
@@ -3075,14 +3076,63 @@ export function cloudSync(opts = {}) {
 }
 /**
  * `cleo cloud pull` / `cleo cloud restore`: verify and activate a snapshot.
+ * A restore then turns sync on for the store and the home stream (T13718).
  *
- * @param opts - Mode, snapshot, project and target overrides.
+ * @param opts - Mode, snapshot, project and target overrides;
+ *   `allowUnreleased` for tests and staging only.
  * @returns What was restored.
  * @throws {NexusAccountError} `E_NEXUS_VAULT_LOCAL_CHANGES`, `E_NEXUS_VAULT_VERIFY_FAILED`,
  *   `E_NEXUS_VAULT_EMPTY`, `E_NEXUS_VAULT_KEY_UNAVAILABLE`, or a mapped API error.
  */
-export function restoreNexusVault(opts) {
-    return mapped(() => restoreNexusVaultImpl(opts));
+export async function restoreNexusVault(opts) {
+    const result = await mapped(() => restoreNexusVaultImpl(opts));
+    if (opts.mode !== 'restore' || result.status !== 'restored')
+        return result;
+    const { mode, checkpointId, force, projectId, into, relink, ...vault } = opts;
+    return {
+        ...result,
+        warnings: [...result.warnings, ...(await turnSyncOnAfterJoin(vault, result))],
+    };
+}
+/**
+ * After a restore places a store on this device (`cleo cloud restore`, or the
+ * login first run's restore), turn sync on for it and for the account's home
+ * stream, the way login does once a project is linked, so a device that joins
+ * by restore is syncing with no enable step (T13718). Inert while `sync.push`
+ * is unreleased; skipped under a test runner or CI and by the opt-outs
+ * `CLEO_DISABLE_AUTO_SYNC=1` or `cloud.autoSync: false`. A failure warns
+ * `W_NEXUS_FIRST_RUN_SYNC`; the restore stands.
+ */
+async function turnSyncOnAfterJoin(opts, restored) {
+    if (UNRELEASED_FLAGS.has('sync.push') && opts.allowUnreleased !== true)
+        return [];
+    if (autoSyncSuppressedBy(process.env) !== null)
+        return [];
+    if (process.env['CLEO_DISABLE_AUTO_SYNC'] === '1')
+        return [];
+    const projectRoot = restored.scope === 'project' ? restored.target : (opts.projectRoot ?? process.cwd()); // CWD-OK: global restore, root only feeds the cloud.autoSync lookup
+    try {
+        const { getConfigValue } = await import('../config/registry.js');
+        if ((await getConfigValue('cloud.autoSync', { projectRoot })) === false)
+            return [];
+    }
+    catch {
+        // An unreadable config is not an opt-out.
+    }
+    const scopes = restored.scope === 'project' ? ['project', 'global'] : ['global'];
+    const warnings = [];
+    for (const scope of scopes) {
+        try {
+            await enableSyncPush({ ...opts, projectRoot, scope });
+        }
+        catch (err) {
+            warnings.push({
+                code: 'W_NEXUS_FIRST_RUN_SYNC',
+                message: `restored, but sync is not on for the ${scope} store: ${err instanceof Error ? err.message : String(err)}; run \`cleo sync enable push --scope ${scope}\``,
+            });
+        }
+    }
+    return warnings;
 }
 /**
  * `cleo cloud vault`: the vault's lineage, last push per device, pending changes and leases.