@cleocode/core 2026.10.8 → 2026.10.9

package/dist/sentient/worktree-dispatch.js

@@ -35,6 +35,24 @@ async function backend() {
 // ---------------------------------------------------------------------------
 // Public dispatch API
 // ---------------------------------------------------------------------------
+/**
+ * Admit one worktree dependency install as a `scoped-build` run, without
+ * waiting: the release on a grant, `null` when the budget is busy.
+ *
+ * @task T13524
+ */
+export async function admitWorktreeInstall() {
+    const { governor } = await import('../resources/governor.js');
+    try {
+        const grant = await governor.acquire('scoped-build', { blocking: false });
+        return grant.deferred ? null : () => grant.release();
+    }
+    catch {
+        // Admission state cannot be kept here (sandbox, read-only home): fail open,
+        // as every other governed run does.
+        return async () => { };
+    }
+}
 /**
  * Create a worktree for an agent task via the native backend.
  *
@@ -50,7 +68,25 @@ async function backend() {
  */
 export async function spawnWorktree(projectRoot, options) {
     const { createWorktree } = await backend();
-    return createWorktree(projectRoot, options);
+    const { createProjectHookExecutor } = await import('../hooks/project-runner.js');
+    const hookOptions = {
+        ...options,
+        projectHookExecutor: options.projectHookExecutor ?? createProjectHookExecutor(projectRoot),
+    };
+    // T13522: install the git shim before the worktree advertises strict protection.
+    let withShim = hookOptions;
+    if (!options.gitShim) {
+        const { ensureGitShimDir } = await import('../spawn/branch-lock.js');
+        const shim = ensureGitShimDir(projectRoot);
+        withShim = { ...hookOptions, gitShim: { dir: shim.dir, installed: shim.installed } };
+    }
+    // T13524: admit the dependency install through the machine-wide heavy queue
+    // (the same `scoped-build` class as `cleo run --class build`); a busy budget
+    // defers it to the worker instead of blocking the spawn.
+    const admitted = withShim.skipInstall || withShim.admitInstall
+        ? withShim
+        : { ...withShim, admitInstall: admitWorktreeInstall };
+    return createWorktree(projectRoot, admitted);
 }
 /**
  * Destroy a worktree for a completed task via the native backend.

package/dist/sentient/worktree-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"worktree-dispatch.js","sourceRoot":"","sources":["../../src/sentient/worktree-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,OAAO;IACpB,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,OAA8B;IAE9B,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IAC3C,OAAO,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgC,EAAE;IACrE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,aAA0B;IAE1B,OAAO,mBAAmB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8EAA8E;AAE9E,IAAI,qBAAqB,GAA+D,IAAI,CAAC;AAC7F,IAAI,mBAAmB,GAA6D,IAAI,CAAC;AACzF,IAAI,oBAAoB,GAA8D,IAAI,CAAC;AAE3F;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA6B;IACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,sCAAsC;IACnD,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,OAA0E;IAE1E,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,CAAC;YACd,gBAAgB,EAAE,EAAE;YACpB,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,qBAAqB;QAAE,OAAO,CAAC,qBAAqB;IAExD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,qBAAqB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC5C,mBAAmB,GAAG,GAAG,CAAC,aAAa,CAAC;IACxC,oBAAoB,GAAG,GAAG,CAAC,cAAc,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"worktree-dispatch.js","sourceRoot":"","sources":["../../src/sentient/worktree-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,OAAO;IACpB,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,oCAAoC;QACpC,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,OAA8B;IAE9B,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG;QAClB,GAAG,OAAO;QACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,yBAAyB,CAAC,WAAW,CAAC;KAC3F,CAAC;IACF,iFAAiF;IACjF,IAAI,QAAQ,GAA0B,WAAW,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3C,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,QAAQ,GACZ,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,YAAY;QAC3C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC;IAC1D,OAAO,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAgC,EAAE;IACrE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,aAA0B;IAE1B,OAAO,mBAAmB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8EAA8E;AAE9E,IAAI,qBAAqB,GAA+D,IAAI,CAAC;AAC7F,IAAI,mBAAmB,GAA6D,IAAI,CAAC;AACzF,IAAI,oBAAoB,GAA8D,IAAI,CAAC;AAE3F;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAA6B;IACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,sCAAsC;IACnD,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,OAA0E;IAE1E,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,CAAC;YACd,gBAAgB,EAAE,EAAE;YACpB,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,qBAAqB;QAAE,OAAO,CAAC,qBAAqB;IAExD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;IAC5B,qBAAqB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC5C,mBAAmB,GAAG,GAAG,CAAC,aAAa,CAAC;IACxC,oBAAoB,GAAG,GAAG,CAAC,cAAc,CAAC;AAC5C,CAAC"}

package/dist/sessions/session-end-snapshot-entry.d.ts

@@ -19,12 +19,15 @@
  * reader, and CLEO keeps stdout for LAFS envelopes).
  *
  * After the snapshot it embeds one bounded batch of observations that one-shot
- * processes stored unembedded (T13126, `memory/embedding-backfill.ts`).
+ * processes stored unembedded (T13126, `memory/embedding-backfill.ts`), then
+ * runs the automatic cloud sync (T13468, `cloud/auto-sync.ts`). Both run only
+ * here, in the detached worker, never in the process that ended the session.
  *
  * argv: `<projectRoot> <markerToken>`
  *
  * @task T12508
  * @task T13126
+ * @task T13468
  */
 export {};
 //# sourceMappingURL=session-end-snapshot-entry.d.ts.map

package/dist/sessions/session-end-snapshot-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-end-snapshot-entry.d.ts","sourceRoot":"","sources":["../../src/sessions/session-end-snapshot-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}
+{"version":3,"file":"session-end-snapshot-entry.d.ts","sourceRoot":"","sources":["../../src/sessions/session-end-snapshot-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG"}

package/dist/sessions/session-end-snapshot-entry.js

@@ -19,15 +19,19 @@
  * reader, and CLEO keeps stdout for LAFS envelopes).
  *
  * After the snapshot it embeds one bounded batch of observations that one-shot
- * processes stored unembedded (T13126, `memory/embedding-backfill.ts`).
+ * processes stored unembedded (T13126, `memory/embedding-backfill.ts`), then
+ * runs the automatic cloud sync (T13468, `cloud/auto-sync.ts`). Both run only
+ * here, in the detached worker, never in the process that ended the session.
  *
  * argv: `<projectRoot> <markerToken>`
  *
  * @task T12508
  * @task T13126
+ * @task T13468
  */
 import { appendFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { autoCloudSync } from '../cloud/auto-sync.js';
 import { runBoundedEmbeddingBackfill } from '../memory/embedding-backfill.js';
 import { getCleoDir } from '../paths.js';
 import { SNAPSHOT_LOCK_WAIT_RETRIES } from '../store/snapshot-gate.js';
@@ -50,6 +54,9 @@ releaseSessionEndWorkerMarker(projectRoot, markerToken);
 // class, so the model loads once per session instead of once per observe. It is
 // a no-op when nothing is pending. Best-effort: it never throws.
 const embeddings = await runBoundedEmbeddingBackfill(projectRoot);
+// T13468: sync the main brain (and the project) with the cloud. Best-effort,
+// throttled, single-flight and bounded; it never throws.
+const autoSync = await autoCloudSync(projectRoot, 'session-end');
 try {
     const logsDir = join(getCleoDir(projectRoot), 'logs');
     mkdirSync(logsDir, { recursive: true });
@@ -60,6 +67,7 @@ try {
         projectRoot,
         result,
         embeddings,
+        autoSync,
     })}\n`);
 }
 catch {

package/dist/sessions/session-end-snapshot-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-end-snapshot-entry.js","sourceRoot":"","sources":["../../src/sessions/session-end-snapshot-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE1C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE;IACxD,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,WAAW,EAAE,WAAW,CAAC;CAC9E,CAAC,CAAC;AACH,2EAA2E;AAC3E,6BAA6B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAExD,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAElE,IAAI,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,cAAc,CACZ,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,EACzC,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,KAAK,EAAE,sBAAsB;QAC7B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW;QACX,MAAM;QACN,UAAU;KACX,CAAC,IAAI,CACP,CAAC;AACJ,CAAC;AAAC,MAAM,CAAC;IACP,mEAAmE;AACrE,CAAC;AACD,6DAA6D;AAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"session-end-snapshot-entry.js","sourceRoot":"","sources":["../../src/sessions/session-end-snapshot-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE1C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE;IACxD,eAAe,EAAE,0BAA0B;IAC3C,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,WAAW,EAAE,WAAW,CAAC;CAC9E,CAAC,CAAC;AACH,2EAA2E;AAC3E,6BAA6B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAExD,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,iEAAiE;AACjE,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;AAElE,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAEjE,IAAI,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,cAAc,CACZ,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,EACzC,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,KAAK,EAAE,sBAAsB;QAC7B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;KACT,CAAC,IAAI,CACP,CAAC;AACJ,CAAC;AAAC,MAAM,CAAC;IACP,mEAAmE;AACrE,CAAC;AACD,6DAA6D;AAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/spawn/agent-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-identity.d.ts","sourceRoot":"","sources":["../../src/spawn/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAQnD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,SAAS,CAIrF;AAED,2FAA2F;AAC3F,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAwB,GACzF,OAAO,CAAC,sBAAsB,CAAC,CA6CjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,GACxD,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"agent-identity.d.ts","sourceRoot":"","sources":["../../src/spawn/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAa,MAAM,qBAAqB,CAAC;AAS9D,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,SAAS,CAIrF;AAED,2FAA2F;AAC3F,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAwB,GACzF,OAAO,CAAC,sBAAsB,CAAC,CAsDjC;AAwGD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,OAAO,CAAC,sBAAsB,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,GACxD,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/spawn/agent-identity.js

@@ -25,7 +25,8 @@ import { generateSessionId } from '../sessions/session-id.js';
 import { getTaskAccessor } from '../store/data-accessor.js';
 import { withLock } from '../store/lock.js';
 import { endSession } from '../store/session-store.js';
-import { claimSpawnedTask, releaseSpawnClaim, } from '../task-work/claims.js';
+import { isClaimExpired, taskClaimedError, taskClaimLeaseMs } from '../store/task-claim.js';
+import { claimSpawnedTask, releaseOwnClaim, releaseSpawnClaim, } from '../task-work/claims.js';
 /**
  * Derive a deterministic agent handle for a spawned task.
  *
@@ -154,6 +155,16 @@ export async function requireSpawnSession(projectRoot, taskId, allocate = alloca
             cause,
         };
     }
+    if (identity.reused) {
+        const verdict = await assessReusedSession(projectRoot, taskId, identity);
+        if (verdict.kind === 'refuse')
+            return verdict.refusal;
+        // An unused session keeps its spawn lease untouched: renewing it here would
+        // read as worker activity to the next re-spawn.
+        if (verdict.kind === 'unused') {
+            return { ok: true, identity, claim: { claim: verdict.lease, previous: verdict.lease } };
+        }
+    }
     let claim;
     try {
         claim = await claimSpawnedTask(projectRoot, taskId, {
@@ -179,6 +190,90 @@ export async function requireSpawnSession(projectRoot, taskId, allocate = alloca
     }
     return { ok: true, identity, claim };
 }
+/**
+ * Decide what a re-spawn may do with the task's per-agent session (T13491,
+ * axiom T1544). A re-spawn reuses that session; a second agent bound to a
+ * session a live worker is using would bleed into it.
+ *
+ * The worker signal is the lease itself: spawn grants `claimedAt + lease`,
+ * and every mutation the holder makes renews it at once (no throttle, unlike
+ * `lastActivity`). A live lease that runs past what its spawn granted means a
+ * worker has done work under the session: refuse with `E_TASK_CLAIMED` naming
+ * the holder and a hand-off. A live lease still at its spawn value means no
+ * worker has used the session yet (the orchestrator asks for the prompt
+ * again): reuse it without renewing, so the next re-spawn still reads it as
+ * unused.
+ *
+ * The holder stops counting as live through the existing rules only: ending
+ * its session releases the lease and worktree lock (T13425, SQL trigger), and
+ * a lease its worker stopped renewing expires. An expired lease is released
+ * (audited as `spawn_session_reclaim`) so the re-claim starts a fresh lease
+ * with a new `claimedAt`.
+ *
+ * shortcut: the comparison uses the current `CLEO_CLAIM_LEASE_MINUTES`; a
+ * lease length changed between spawn and re-spawn misreads one lease period.
+ *
+ * @param projectRoot - Project root.
+ * @param taskId - The task being spawned.
+ * @param identity - The reused per-agent session.
+ * @returns Claim as usual, reuse the unused lease, or refuse.
+ * @task T13491
+ * @task T13498
+ */
+async function assessReusedSession(projectRoot, taskId, identity) {
+    const acc = await getTaskAccessor(projectRoot);
+    const held = (await acc.loadSingleTask(taskId))?.claim;
+    if (!held || held.sessionId !== identity.sessionId)
+        return { kind: 'claim' };
+    const now = new Date().toISOString();
+    if (isClaimExpired(held, now)) {
+        await releaseOwnClaim(acc, taskId, identity.sessionId);
+        await acc.appendLog({
+            action: 'spawn_session_reclaim',
+            taskId,
+            actor: identity.agentId,
+            sessionId: identity.sessionId,
+            timestamp: now,
+            details: { reason: 'lease-expired', leaseExpiresAt: held.leaseExpiresAt },
+            before: held,
+        });
+        return { kind: 'claim' };
+    }
+    const granted = Date.parse(held.claimedAt) + taskClaimLeaseMs();
+    // Spawn writes claimedAt and the expiry from one instant, so an untouched lease is exact.
+    if (Date.parse(held.leaseExpiresAt) <= granted) {
+        return { kind: 'unused', lease: held };
+    }
+    const err = taskClaimedError(taskId, held, { sessionId: null, agentId: null }, now, 'orchestrate spawn');
+    const who = held.agentId
+        ? `session ${held.sessionId} (agent ${held.agentId})`
+        : `session ${held.sessionId}`;
+    const message = `Refusing to spawn ${taskId}: a live worker is using ${who}, the session this spawn would hand the child; ` +
+        `it renewed its lease after the spawn (lease now expires ${held.leaseExpiresAt}).`;
+    return {
+        kind: 'refuse',
+        refusal: {
+            ok: false,
+            // @sync-invariant none:local-only refuses before any write; lease liveness is this device's spawn coordination
+            code: 'E_TASK_CLAIMED',
+            exitCode: ExitCode.TASK_CLAIMED,
+            message,
+            fix: `Hand off instead of spawning over it: coordinate with that worker, or once it has stopped end its session ` +
+                `(cleo session end --session ${held.sessionId}), which releases its claim and worktree lock, then spawn again. ` +
+                `A worker that stops renewing loses the lease at ${held.leaseExpiresAt}; the next spawn then reclaims the session (audited).`,
+            cause: message,
+            details: {
+                ...(err.details ?? {}),
+                handoff: {
+                    holderSessionId: held.sessionId,
+                    holderAgentId: held.agentId,
+                    claimedAt: held.claimedAt,
+                    leaseExpiresAt: held.leaseExpiresAt,
+                },
+            },
+        },
+    };
+}
 /**
  * Undo a {@link requireSpawnSession} whose spawn then failed (T12502): give
  * the task claim back to its previous holder (the orchestrator on a

package/dist/spawn/agent-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-identity.js","sourceRoot":"","sources":["../../src/spawn/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAqBhC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,SAAS,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,MAAc,EACd,OAA2B,EAAE;IAE7B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IAEpD,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,QAAQ,CACb,IAAI,CAAC,OAAO,EAAE,iBAAiB,WAAW,EAAE,CAAC,EAC7C,KAAK,IAAI,EAAE;QACT,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CACxF,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,SAAS,WAAW,EAAE;YAC5B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;YAC/E,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;YAChC,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,WAAW;YACX,eAAe,EAAE,WAAW;YAC5B,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,CAAC;SACf,CAAC;QACF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC,EACD,EAAE,OAAO,EAAE,EAAE,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B;IAC9D,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAChG,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAkCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAAc,EACd,WAAsE,oBAAoB;IAE1F,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,YAAY;YACvC,QAAQ,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa;YACtE,OAAO,EACL,iDAAiD,MAAM,KAAK,KAAK,IAAI;gBACrE,iDAAiD;YACnD,GAAG,EACD,iFAAiF;gBACjF,gFAAgF;YAClF,KAAK;SACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YAClD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,EAAE,WAAW,CAAC,CAAC,KAAK,CACpF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY;YACvE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,aAAa;YAC9C,OAAO,EAAE,qBAAqB,MAAM,KAAK,KAAK,EAAE;YAChD,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,gEAAgE;YAClF,KAAK;YACL,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAAc,EACd,UAAyD;IAEzD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IACvC,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,8BAA8B,EAAE,WAAW,CAAC,CAAC,KAAK,CACrF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"agent-identity.js","sourceRoot":"","sources":["../../src/spawn/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAqBhC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,SAAS,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,MAAc,EACd,OAA2B,EAAE;IAE7B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IAEpD,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,QAAQ,CACb,IAAI,CAAC,OAAO,EAAE,iBAAiB,WAAW,EAAE,CAAC,EAC7C,KAAK,IAAI,EAAE;QACT,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CACxF,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,SAAS,WAAW,EAAE;YAC5B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;YAC/E,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE;YAChC,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,WAAW;YACX,eAAe,EAAE,WAAW;YAC5B,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,CAAC;SACf,CAAC;QACF,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC,EACD,EAAE,OAAO,EAAE,EAAE,EAAE,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B;IAC9D,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAChG,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAkCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAAc,EACd,WAAsE,oBAAoB;IAE1F,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,YAAY;YACvC,QAAQ,EAAE,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa;YACtE,OAAO,EACL,iDAAiD,MAAM,KAAK,KAAK,IAAI;gBACrE,iDAAiD;YACnD,GAAG,EACD,iFAAiF;gBACjF,gFAAgF;YAClF,KAAK;SACN,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QACtD,4EAA4E;QAC5E,gDAAgD;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE;YAClD,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,EAAE,WAAW,CAAC,CAAC,KAAK,CACpF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,CAAC,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY;YACvE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,aAAa;YAC9C,OAAO,EAAE,qBAAqB,MAAM,KAAK,KAAK,EAAE;YAChD,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,gEAAgE;YAClF,KAAK;YACL,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,MAAc,EACd,QAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;IACvD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC,SAAS,CAAC;YAClB,MAAM,EAAE,uBAAuB;YAC/B,MAAM;YACN,KAAK,EAAE,QAAQ,CAAC,OAAO;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACzE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAChE,0FAA0F;IAC1F,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,OAAO,EAAE,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAC1B,MAAM,EACN,IAAI,EACJ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAClC,GAAG,EACH,mBAAmB,CACpB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO;QACtB,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,OAAO,GAAG;QACrD,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GACX,qBAAqB,MAAM,4BAA4B,GAAG,iDAAiD;QAC3G,2DAA2D,IAAI,CAAC,cAAc,IAAI,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,EAAE,EAAE,KAAK;YACT,+GAA+G;YAC/G,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ,CAAC,YAAY;YAC/B,OAAO;YACP,GAAG,EACD,4GAA4G;gBAC5G,+BAA+B,IAAI,CAAC,SAAS,mEAAmE;gBAChH,mDAAmD,IAAI,CAAC,cAAc,uDAAuD;YAC/H,KAAK,EAAE,OAAO;YACd,OAAO,EAAE;gBACP,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBACtB,OAAO,EAAE;oBACP,eAAe,EAAE,IAAI,CAAC,SAAS;oBAC/B,aAAa,EAAE,IAAI,CAAC,OAAO;oBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,MAAc,EACd,UAAyD;IAEzD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IACvC,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,8BAA8B,EAAE,WAAW,CAAC,CAAC,KAAK,CACrF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/spawn/branch-lock.d.ts

@@ -67,7 +67,9 @@ export declare function createAgentWorktree(taskId: string, projectRoot: string)
  * env block and prompt preamble that bind the agent to its worktree.
  *
  * @param worktree - The created worktree state.
- * @param shimDir - Directory containing the git shim symlink.
+ * @param shim - The {@link ensureGitShimDir} result; strict protection and the
+ *   PATH entry apply only when it is installed (T13522). A bare directory
+ *   string is taken as installed (legacy callers).
  * @param identity - Per-agent session + agent identity to inject (T11343).
  *   `sessionId` → `CLEO_SESSION_ID`, `agentId` → `CLEO_AGENT_ID`. Only set
  *   when non-empty so an unallocated identity never clobbers an inherited env.
@@ -78,7 +80,7 @@ export declare function createAgentWorktree(taskId: string, projectRoot: string)
  * @task T1121
  * @task T11343
  */
-export declare function buildWorktreeSpawnResult(worktree: AgentWorktreeState, shimDir: string, identity?: {
+export declare function buildWorktreeSpawnResult(worktree: AgentWorktreeState, shim: string | GitShimInstall, identity?: {
     sessionId?: string | null;
     agentId?: string | null;
 }): WorktreeSpawnResult;
@@ -352,18 +354,35 @@ export declare function completeAgentWorktreeIntegration(taskId: string, project
     skipFetch?: boolean;
     auditLogPath?: string;
 }): WorktreeIntegrationResult;
+/** Result of {@link ensureGitShimDir}. */
+export interface GitShimInstall {
+    /** Directory to prepend to a worker's PATH. */
+    readonly dir: string;
+    /** True only when an executable `git` launcher now points at the real shim. */
+    readonly installed: boolean;
+    /** The shim entry point used, when one was found. */
+    readonly shimBinPath: string | null;
+    /** Why the shim is not installed. */
+    readonly reason?: string;
+}
 /**
- * Ensure the git shim symlink exists in the project's `.cleo/bin/git-shim/` dir.
+ * Install the git shim launcher in the project's `.cleo/bin/git-shim/` dir
+ * (T1118, wired in by T13522). Idempotent.
  *
- * The shim directory is prepended to PATH in agent spawn env. Idempotent.
+ * The shim is resolved from the `@cleocode/git-shim` package the running CLI
+ * was installed with, not from the project's node_modules, so a standalone
+ * project gets it too. When it cannot be found or the launcher cannot be
+ * written, nothing is installed and `installed` is `false`: callers then
+ * advertise `CLEO_BRANCH_PROTECTION=unavailable` rather than a fence that is
+ * not there.
  *
  * @param projectRoot - Absolute path to the project root.
- * @returns Absolute path to the shim directory (to prepend to PATH).
- *
+ * @param shimBinPath - The shim entry point (tests); defaults to the installed package's.
+ * @returns Where the shim lives and whether it is installed.
  * @task T1118
- * @task T1121
+ * @task T13522
  */
-export declare function ensureGitShimDir(projectRoot: string): string;
+export declare function ensureGitShimDir(projectRoot: string, shimBinPath?: string): GitShimInstall;
 /**
  * Detect platform capabilities for filesystem hardening.
  *

package/dist/spawn/branch-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-lock.d.ts","sourceRoot":"","sources":["../../src/spawn/branch-lock.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAgBH,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EAEL,UAAU,EAOX,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,UAAU,EAAE,CAAC;AAMtB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAqE3F;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACpE,mBAAmB,CA+CrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,qBAAqB,CASvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,kDAAkD;IAClD,eAAe,EAAE,OAAO,CAAC;IACzB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,mBAAmB,CAkJrB;AAiBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4C5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,mCAAmC;IACnC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,uFAAuF;IACvF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAiGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3E,6BAA6B,CA+F/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,mBAAmB,CAiKrB;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,yBAAyB,CAgC3B;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA2C5D;AAMD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,oBAAoB,CA+BjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,aAAa,CAyC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,aAAa,GAAG,IAAI,CA0B/D;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,cAAc,EAAE,mBAAmB,EACnC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAyC,GACtE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}
+{"version":3,"file":"branch-lock.d.ts","sourceRoot":"","sources":["../../src/spawn/branch-lock.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EAEL,UAAU,EAOX,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,UAAU,EAAE,CAAC;AAMtB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAqE3F;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,cAAc,EAC7B,QAAQ,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACpE,mBAAmB,CAuDrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,qBAAqB,CASvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,kDAAkD;IAClD,eAAe,EAAE,OAAO,CAAC;IACzB,2CAA2C;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,mBAAmB,CAkJrB;AAiBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CA4C5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,mCAAmC;IACnC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,uFAAuF;IACvF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAiGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3E,6BAA6B,CA+F/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,mBAAmB,CAiKrB;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,yBAAyB,CAgC3B;AAMD,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,WAAW,GAAE,MAA6B,GACzC,cAAc,CA4BhB;AAMD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,oBAAoB,CA+BjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,aAAa,CAyC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,aAAa,GAAG,IAAI,CA0B/D;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,cAAc,EAAE,mBAAmB,EACnC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAyC,GACtE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB"}

package/dist/spawn/branch-lock.js

@@ -20,10 +20,10 @@
  * @adr ADR-062
  */
 import { execFileSync } from 'node:child_process';
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
+import { accessSync, appendFileSync, chmodSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, } from 'node:fs';
 import { platform } from 'node:os';
 import { dirname, isAbsolute, join, relative } from 'node:path';
-import { installGitShimLaunchers } from '@cleocode/git-shim';
+import { installGitShimLaunchers, resolveShimBinPath } from '@cleocode/git-shim';
 import { computeProjectHash, findOnPath, pathEnvKey, prependPathEntry, resolveWorktreeRootForHash, } from '@cleocode/paths';
 // ---------------------------------------------------------------------------
 // Re-exports from @cleocode/worktree
@@ -155,7 +155,9 @@ function shellQuote(value) {
  * env block and prompt preamble that bind the agent to its worktree.
  *
  * @param worktree - The created worktree state.
- * @param shimDir - Directory containing the git shim symlink.
+ * @param shim - The {@link ensureGitShimDir} result; strict protection and the
+ *   PATH entry apply only when it is installed (T13522). A bare directory
+ *   string is taken as installed (legacy callers).
  * @param identity - Per-agent session + agent identity to inject (T11343).
  *   `sessionId` → `CLEO_SESSION_ID`, `agentId` → `CLEO_AGENT_ID`. Only set
  *   when non-empty so an unallocated identity never clobbers an inherited env.
@@ -166,20 +168,26 @@ function shellQuote(value) {
  * @task T1121
  * @task T11343
  */
-export function buildWorktreeSpawnResult(worktree, shimDir, identity = {}) {
+export function buildWorktreeSpawnResult(worktree, shim, identity = {}) {
     const pathKey = pathEnvKey();
+    const shimDir = typeof shim === 'string' ? shim : shim.dir;
+    const shimActive = typeof shim === 'string' || shim.installed;
     const envVars = {
         CLEO_AGENT_ROLE: 'worker',
         CLEO_AGENT_CWD: worktree.path,
         CLEO_WORKTREE_ROOT: worktree.path,
         CLEO_WORKTREE_BRANCH: worktree.branch,
         CLEO_PROJECT_HASH: worktree.projectHash,
-        CLEO_BRANCH_PROTECTION: 'strict',
-        CLEO_SHIM_MARKER: '.cleo/bin/git-shim',
-        // Prepend the shim directory so `git` resolves to the shim. The platform
-        // delimiter matters: `${shimDir}:${PATH}` on Windows fuses the shim dir
-        // with the first real entry and loses both (T12605).
-        [pathKey]: prependPathEntry(shimDir, process.env[pathKey]),
+        CLEO_BRANCH_PROTECTION: shimActive ? 'strict' : 'unavailable',
+        ...(shimActive
+            ? {
+                CLEO_SHIM_MARKER: '.cleo/bin/git-shim',
+                // Prepend the shim directory so `git` resolves to the shim. The platform
+                // delimiter matters: `${shimDir}:${PATH}` on Windows fuses the shim dir
+                // with the first real entry and loses both (T12605).
+                [pathKey]: prependPathEntry(shimDir, process.env[pathKey]),
+            }
+            : {}),
     };
     // T11343 — bind the spawned agent's OWN session + identity into the worker
     // env so every short-lived `cleo` call inside the worktree resolves THIS
@@ -204,7 +212,9 @@ export function buildWorktreeSpawnResult(worktree, shimDir, identity = {}) {
         '  git checkout, git switch, git branch -b/-D, git reset --hard,',
         '  git worktree add/remove, git rebase, git stash pop, git push --force',
         '',
-        'A git shim is active on your PATH that will exit 77 if you attempt these.',
+        shimActive
+            ? 'A git shim is active on your PATH that will exit 77 if you attempt these, or a push to main.'
+            : 'No git shim could be installed for this worktree: these rules are NOT enforced, so follow them yourself.',
         `Your working directory is: ${worktree.path}`,
         'All your commits must land on YOUR branch only.',
         '',
@@ -982,78 +992,52 @@ export function completeAgentWorktreeIntegration(taskId, projectRoot, opts = {})
     }
     return { ...mergeResult, auditLogEntry };
 }
-// ---------------------------------------------------------------------------
-// L2 — Shim materialisation
-// ---------------------------------------------------------------------------
-/** Minimal stub shim script content for when the package isn't installed. */
-const STUB_SHIM_CONTENT = `#!/usr/bin/env node
-// git-shim stub (install @cleocode/git-shim for the full binary)
-import { spawnSync } from 'node:child_process';
-const RESTRICTED = new Set(['worker','lead','subagent']);
-const BLOCKED = new Set(['checkout','switch','rebase']);
-const role = process.env['CLEO_AGENT_ROLE'];
-const sub = process.argv[2];
-if (role && RESTRICTED.has(role) && sub && BLOCKED.has(sub) && !process.env['CLEO_ALLOW_BRANCH_OPS']) {
-  process.stderr.write('[git-shim] BLOCKED: ' + sub + ' is not allowed for role ' + role + '\\n');
-  process.exit(77);
-}
-const git = process.env['CLEO_REAL_GIT_PATH'] || '/usr/bin/git';
-const r = spawnSync(git, process.argv.slice(2), { stdio: 'inherit' });
-process.exit(r.status ?? 0);
-`;
 /**
- * Ensure the git shim symlink exists in the project's `.cleo/bin/git-shim/` dir.
+ * Install the git shim launcher in the project's `.cleo/bin/git-shim/` dir
+ * (T1118, wired in by T13522). Idempotent.
  *
- * The shim directory is prepended to PATH in agent spawn env. Idempotent.
+ * The shim is resolved from the `@cleocode/git-shim` package the running CLI
+ * was installed with, not from the project's node_modules, so a standalone
+ * project gets it too. When it cannot be found or the launcher cannot be
+ * written, nothing is installed and `installed` is `false`: callers then
+ * advertise `CLEO_BRANCH_PROTECTION=unavailable` rather than a fence that is
+ * not there.
  *
  * @param projectRoot - Absolute path to the project root.
- * @returns Absolute path to the shim directory (to prepend to PATH).
- *
+ * @param shimBinPath - The shim entry point (tests); defaults to the installed package's.
+ * @returns Where the shim lives and whether it is installed.
  * @task T1118
- * @task T1121
+ * @task T13522
  */
-export function ensureGitShimDir(projectRoot) {
-    const shimDir = join(projectRoot, '.cleo', 'bin', 'git-shim');
-    mkdirSync(shimDir, { recursive: true });
-    // Resolve the shim binary from @cleocode/git-shim package.
-    let shimBinPath = null;
-    try {
-        // Node.js require.resolve to find the installed package binary.
-        // We use a dynamic import approach compatible with ESM.
-        const candidatePaths = [
-            join(projectRoot, 'node_modules', '@cleocode', 'git-shim', 'dist', 'shim.js'),
-            join(projectRoot, '..', '..', 'node_modules', '@cleocode', 'git-shim', 'dist', 'shim.js'),
-        ];
-        for (const p of candidatePaths) {
-            if (existsSync(p)) {
-                shimBinPath = p;
-                break;
-            }
-        }
-    }
-    catch {
-        // ignore
-    }
-    if (!shimBinPath) {
-        // Write a minimal stub shim.
-        shimBinPath = join(shimDir, '_shim_bin.cjs');
-        try {
-            writeFileSync(shimBinPath, STUB_SHIM_CONTENT, { encoding: 'utf-8', mode: 0o755 });
-        }
-        catch {
-            // ignore — best effort
-        }
+export function ensureGitShimDir(projectRoot, shimBinPath = resolveShimBinPath()) {
+    const dir = join(projectRoot, '.cleo', 'bin', 'git-shim');
+    if (!existsSync(shimBinPath)) {
+        return {
+            dir,
+            installed: false,
+            shimBinPath: null,
+            reason: `git shim not found at ${shimBinPath}`,
+        };
     }
-    // Create/update the `git` launcher: a symlink on POSIX; on Windows a
-    // `git.cmd` + sh launcher, since PATHEXT ignores extensionless files and
-    // file symlinks need privileges (T12605).
     try {
-        installGitShimLaunchers(shimDir, shimBinPath);
+        // A symlink on POSIX; on Windows a `git.cmd` + sh launcher, since PATHEXT
+        // ignores extensionless files and file symlinks need privileges (T12605).
+        const launchers = installGitShimLaunchers(dir, shimBinPath);
+        // Windows has no execute bit: there the launcher existing is the check.
+        for (const launcher of launchers) {
+            accessSync(launcher, process.platform === 'win32' ? constants.F_OK : constants.X_OK);
+        }
+        return { dir, installed: true, shimBinPath };
     }
-    catch {
-        // Launcher install may fail on some filesystems — non-fatal.
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return {
+            dir,
+            installed: false,
+            shimBinPath,
+            reason: `git shim launcher not installed: ${reason}`,
+        };
     }
-    return shimDir;
 }
 // ---------------------------------------------------------------------------
 // L3 — Filesystem hardening