@cleocode/core 2026.4.28 → 2026.4.29

package/dist/adrs/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/adrs/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA8ChD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgI9E"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/adrs/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA8ChD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqL9E"}

package/dist/adrs/types.d.ts

@@ -36,6 +36,7 @@ export interface AdrSyncResult {
         file: string;
         error: string;
     }>;
+    warnings: string[];
 }
 export interface AdrListResult {
     adrs: Array<{

package/dist/adrs/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adrs/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,CAAC;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAEhD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/adrs/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,CAAC;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,aAAa,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAEhD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,KAAK,CAAC;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/index.js

@@ -1546,10 +1546,10 @@ var init_subquery = __esm({
     init_entity();
     Subquery = class {
       static [entityKind] = "Subquery";
-      constructor(sql11, fields, alias, isWith = false, usedTables = []) {
+      constructor(sql12, fields, alias, isWith = false, usedTables = []) {
         this._ = {
           brand: "Subquery",
-          sql: sql11,
+          sql: sql12,
           selectedFields: fields,
           alias,
           isWith,
@@ -1929,8 +1929,8 @@ var init_sql = __esm({
         isSelectionField = false;
         /** @internal */
         origin;
-        constructor(sql11, fieldAlias) {
-          this.sql = sql11;
+        constructor(sql12, fieldAlias) {
+          this.sql = sql12;
           this.fieldAlias = fieldAlias;
         }
         getSQL() {
@@ -2634,17 +2634,17 @@ var init_custom = __esm({
       mapFromJsonValue(value) {
         return typeof this.mapJson === "function" ? this.mapJson(value) : this.mapFromDriverValue(value);
       }
-      jsonSelectIdentifier(identifier, sql11) {
-        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql11);
+      jsonSelectIdentifier(identifier, sql12) {
+        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql12);
         const rawType = this.getSQLType().toLowerCase();
         const parenPos = rawType.indexOf("(");
         switch (parenPos + 1 ? rawType.slice(0, parenPos) : rawType) {
           case "numeric":
           case "decimal":
           case "bigint":
-            return sql11`cast(${identifier} as text)`;
+            return sql12`cast(${identifier} as text)`;
           case "blob":
-            return sql11`hex(${identifier})`;
+            return sql12`hex(${identifier})`;
           default:
             return identifier;
         }
@@ -3812,8 +3812,8 @@ var init_custom2 = __esm({
       mapFromJsonValue(value) {
         return typeof this.mapJson === "function" ? this.mapJson(value) : this.mapFromDriverValue(value);
       }
-      jsonSelectIdentifier(identifier, sql11, arrayDimensions) {
-        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql11, arrayDimensions);
+      jsonSelectIdentifier(identifier, sql12, arrayDimensions) {
+        if (typeof this.forJsonSelect === "function") return this.forJsonSelect(identifier, sql12, arrayDimensions);
         const rawType = this.getSQLType().toLowerCase();
         const parenPos = rawType.indexOf("(");
         switch (parenPos + 1 ? rawType.slice(0, parenPos) : rawType) {
@@ -3823,7 +3823,7 @@ var init_custom2 = __esm({
           case "numeric":
           case "bigint": {
             const arrVal = "[]".repeat(arrayDimensions ?? 0);
-            return sql11`${identifier}::text${sql11.raw(arrVal).if(arrayDimensions)}`;
+            return sql12`${identifier}::text${sql12.raw(arrVal).if(arrayDimensions)}`;
           }
           default:
             return identifier;
@@ -7704,8 +7704,8 @@ var init_dialect = __esm({
         const returningSql = returning ? sql` returning ${this.buildSelection(returning, { isSingleTable: true })}` : void 0;
         return sql`${withSql}insert into ${table} ${insertOrder} ${valuesSql}${onConflict?.length ? sql.join(onConflict) : void 0}${returningSql}`;
       }
-      sqlToQuery(sql11, invokeSource) {
-        return sql11.toQuery({
+      sqlToQuery(sql12, invokeSource) {
+        return sql12.toQuery({
           casing: this.casing,
           escapeName: this.escapeName,
           escapeParam: this.escapeParam,
@@ -8802,8 +8802,8 @@ var init_db = __esm({
 });
 
 // node_modules/.pnpm/drizzle-orm@1.0.0-beta.19-d95b7a4_@sinclair+typebox@0.34.49_@types+mssql@9.1.9_@azure+c_7d603f9dc53f6bedf2f8e8db5954b691/node_modules/drizzle-orm/cache/core/cache.js
-async function hashQuery(sql11, params) {
-  const dataToHash = `${sql11}-${JSON.stringify(params, (_, v) => typeof v === "bigint" ? `${v}n` : v)}`;
+async function hashQuery(sql12, params) {
+  const dataToHash = `${sql12}-${JSON.stringify(params, (_, v) => typeof v === "bigint" ? `${v}n` : v)}`;
   const data = new TextEncoder().encode(dataToHash);
   const hashBuffer = await crypto.subtle.digest("SHA-256", data);
   return [...new Uint8Array(hashBuffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
@@ -8982,8 +8982,8 @@ var init_session3 = __esm({
       values(query) {
         return this.prepareOneTimeQuery(this.dialect.sqlToQuery(query), void 0, "run", false).values();
       }
-      async count(sql11) {
-        return (await this.values(sql11))[0][0];
+      async count(sql12) {
+        return (await this.values(sql12))[0][0];
       }
       /** @internal */
       extractRawValuesValueFromBatchResult(_result) {
@@ -11074,8 +11074,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
     const dbEntries = nativeDb.prepare('SELECT hash FROM "__drizzle_migrations"').all();
     const hasOrphanedEntries = dbEntries.some((e) => !localHashes.has(e.hash));
     if (hasOrphanedEntries) {
-      const log9 = getLogger(logSubsystem);
-      log9.warn(
+      const log10 = getLogger(logSubsystem);
+      log10.warn(
         { orphaned: dbEntries.filter((e) => !localHashes.has(e.hash)).length },
         `Detected stale migration journal entries from a previous CLEO version. Reconciling.`
       );
@@ -11107,8 +11107,8 @@ function reconcileJournal(nativeDb, migrationsFolder, existenceTable, logSubsyst
         return cols.some((c) => c.name === column);
       });
       if (allColumnsExist) {
-        const log9 = getLogger(logSubsystem);
-        log9.warn(
+        const log10 = getLogger(logSubsystem);
+        log10.warn(
           { migration: migration.name, columns: alterMatches },
           `Detected partially-applied migration ${migration.name} \u2014 columns exist but journal entry missing. Auto-reconciling.`
         );
@@ -11153,8 +11153,8 @@ function ensureColumns(nativeDb, tableName, requiredColumns, logSubsystem) {
   const existingCols = new Set(columns.map((c) => c.name));
   for (const req of requiredColumns) {
     if (!existingCols.has(req.name)) {
-      const log9 = getLogger(logSubsystem);
-      log9.warn(
+      const log10 = getLogger(logSubsystem);
+      log10.warn(
         { column: req.name },
         `Adding missing column ${tableName}.${req.name} via ALTER TABLE`
       );
@@ -11273,12 +11273,12 @@ function detachAgentFromProject(db, agentId) {
 }
 function listProjectAgentRefs(db, opts) {
   const enabledOnly = opts?.enabledOnly ?? true;
-  const sql11 = enabledOnly ? `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
+  const sql12 = enabledOnly ? `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
        FROM project_agent_refs WHERE enabled = 1
        ORDER BY attached_at DESC` : `SELECT agent_id, attached_at, role, capabilities_override, last_used_at, enabled
        FROM project_agent_refs
        ORDER BY attached_at DESC`;
-  const rows = db.prepare(sql11).all();
+  const rows = db.prepare(sql12).all();
   return rows.map((r) => ({
     agentId: r.agent_id,
     attachedAt: r.attached_at,
@@ -12929,7 +12929,7 @@ function getDbPath(cwd) {
   return join9(getCleoDirAbsolute(cwd), DB_FILENAME2);
 }
 async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
-  const log9 = getLogger("sqlite");
+  const log10 = getLogger("sqlite");
   try {
     const countResult = nativeDb.prepare("SELECT COUNT(*) as cnt FROM tasks").get();
     const taskCount = countResult?.cnt ?? 0;
@@ -12950,7 +12950,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     if (backupTaskCount < MIN_BACKUP_TASK_COUNT) {
       return;
     }
-    log9.warn(
+    log10.warn(
       { dbPath, backupPath: newestBackup.path, backupTasks: backupTaskCount },
       `Empty database detected with ${backupTaskCount}-task backup available. Auto-recovering from backup. This likely happened because git-tracked WAL/SHM files were overwritten during a branch switch (T5188).`
     );
@@ -12968,7 +12968,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     const tempPath = dbPath + ".recovery-tmp";
     copyFileSync4(newestBackup.path, tempPath);
     renameSync(tempPath, dbPath);
-    log9.info(
+    log10.info(
       { dbPath, backupPath: newestBackup.path, restoredTasks: backupTaskCount },
       "Database auto-recovered from backup successfully."
     );
@@ -12978,7 +12978,7 @@ async function autoRecoverFromBackup(nativeDb, dbPath, cwd) {
     runMigrations(restoredNativeDb, restoredDb);
     _db = restoredDb;
   } catch (err) {
-    log9.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
+    log10.error({ err, dbPath }, "Auto-recovery from backup failed. Continuing with empty database.");
   }
 }
 async function getDb(cwd) {
@@ -13012,7 +13012,7 @@ async function getDb(cwd) {
         const { execFileSync: execFileSync12 } = await import("node:child_process");
         const gitCwd = resolve3(dbPath, "..", "..");
         const filesToCheck = [dbPath, dbPath + "-wal", dbPath + "-shm"];
-        const log9 = getLogger("sqlite");
+        const log10 = getLogger("sqlite");
         for (const fileToCheck of filesToCheck) {
           try {
             execFileSync12("git", ["ls-files", "--error-unmatch", fileToCheck], {
@@ -13021,7 +13021,7 @@ async function getDb(cwd) {
             });
             const basename18 = fileToCheck.split(/[\\/]/).pop();
             const relPath = fileToCheck.replace(gitCwd + sep, "");
-            log9.warn(
+            log10.warn(
               { path: fileToCheck },
               `${basename18} is tracked by project git \u2014 this risks data loss on branch switch. Resolution (ADR-013 \xA79): \`git rm --cached ${relPath}\` and rely on \`.cleo/backups/sqlite/\` snapshots + \`cleo backup add\` for recovery.`
             );
@@ -17156,8 +17156,7 @@ function taskListItemNext(taskId) {
 }
 function sessionListItemNext(sessionId) {
   return {
-    show: `cleo session show ${sessionId}`,
-    serialize: `cleo session serialize ${sessionId}`
+    show: `cleo session show ${sessionId}`
   };
 }
 function sessionStartNext() {
@@ -17330,8 +17329,8 @@ function checkFts5Available(nativeDb) {
   }
   return _fts5Available;
 }
-function execDDL(nativeDb, sql11) {
-  nativeDb.prepare(sql11).run();
+function execDDL(nativeDb, sql12) {
+  nativeDb.prepare(sql12).run();
 }
 function ensureFts5Tables(nativeDb) {
   if (!checkFts5Available(nativeDb)) {
@@ -18446,8 +18445,8 @@ __export(memory_bridge_exports, {
 });
 import { existsSync as existsSync28, mkdirSync as mkdirSync7, readFileSync as readFileSync17, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join32 } from "node:path";
-function typedAll2(db, sql11, ...params) {
-  return db.prepare(sql11).all(...params);
+function typedAll2(db, sql12, ...params) {
+  return db.prepare(sql12).all(...params);
 }
 async function generateMemoryBridgeContent(projectRoot, config2) {
   const cfg = { ...DEFAULT_CONFIG, ...config2 };
@@ -28857,7 +28856,7 @@ function collectAdrFiles(dir) {
 }
 async function syncAdrsToDb(projectRoot) {
   const adrsDir = join19(projectRoot, ".cleo", "adrs");
-  const result = { inserted: 0, updated: 0, skipped: 0, errors: [] };
+  const result = { inserted: 0, updated: 0, skipped: 0, errors: [], warnings: [] };
   if (!existsSync16(adrsDir)) {
     return result;
   }
@@ -28875,9 +28874,36 @@ async function syncAdrsToDb(projectRoot) {
       const fm = record2.frontmatter;
       const dbRelPath = `.cleo/adrs/${relPath}`;
       const content = readFileSync6(filePath, "utf-8");
-      const supersedesId = fm.Supersedes ? extractAdrIdFromRef(fm.Supersedes) : null;
-      const supersededById = fm["Superseded By"] ? extractAdrIdFromRef(fm["Superseded By"]) : null;
-      const amendsId = fm.Amends ? extractAdrIdFromRef(fm.Amends) : null;
+      let supersedesId = fm.Supersedes ? extractAdrIdFromRef(fm.Supersedes) : null;
+      let supersededById = fm["Superseded By"] ? extractAdrIdFromRef(fm["Superseded By"]) : null;
+      let amendsId = fm.Amends ? extractAdrIdFromRef(fm.Amends) : null;
+      if (supersedesId) {
+        const exists2 = await db.select({ id: architectureDecisions.id }).from(architectureDecisions).where(eq13(architectureDecisions.id, supersedesId)).all();
+        if (exists2.length === 0) {
+          result.warnings.push(
+            `${record2.id}: supersedes target ${supersedesId} not found in DB, setting to null`
+          );
+          supersedesId = null;
+        }
+      }
+      if (supersededById) {
+        const exists2 = await db.select({ id: architectureDecisions.id }).from(architectureDecisions).where(eq13(architectureDecisions.id, supersededById)).all();
+        if (exists2.length === 0) {
+          result.warnings.push(
+            `${record2.id}: supersededBy target ${supersededById} not found in DB, setting to null`
+          );
+          supersededById = null;
+        }
+      }
+      if (amendsId) {
+        const exists2 = await db.select({ id: architectureDecisions.id }).from(architectureDecisions).where(eq13(architectureDecisions.id, amendsId)).all();
+        if (exists2.length === 0) {
+          result.warnings.push(
+            `${record2.id}: amends target ${amendsId} not found in DB, setting to null`
+          );
+          amendsId = null;
+        }
+      }
       const rowBase = {
         id: record2.id,
         title: record2.title,
@@ -28907,6 +28933,13 @@ async function syncAdrsToDb(projectRoot) {
       await db.delete(adrTaskLinks).where(eq13(adrTaskLinks.adrId, record2.id));
       if (fm["Related Tasks"]) {
         for (const taskId of parseTaskIds2(fm["Related Tasks"])) {
+          const taskExists = await db.select({ id: tasks.id }).from(tasks).where(eq13(tasks.id, taskId)).all();
+          if (taskExists.length === 0) {
+            result.warnings.push(
+              `${record2.id}: related task ${taskId} not found in DB, skipping link`
+            );
+            continue;
+          }
           await db.insert(adrTaskLinks).values({ adrId: record2.id, taskId, linkType: "related" });
         }
       }
@@ -40299,10 +40332,12 @@ import { randomUUID as randomUUID6 } from "node:crypto";
 init_logger();
 
 // packages/core/src/reconciliation/link-store.ts
+init_logger();
 init_sqlite2();
 init_tasks_schema();
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { and as and8, eq as eq11 } from "drizzle-orm";
+import { and as and8, eq as eq11, sql as sql11 } from "drizzle-orm";
+var log6 = getLogger("link-store");
 async function getLinksByProvider(providerId, cwd) {
   const db = await getDb(cwd);
   const rows = await db.select().from(externalTaskLinks).where(eq11(externalTaskLinks.providerId, providerId));
@@ -40323,7 +40358,46 @@ async function getLinksByTaskId(taskId, cwd) {
   const rows = await db.select().from(externalTaskLinks).where(eq11(externalTaskLinks.taskId, taskId));
   return rows.map(rowToLink);
 }
+async function ensureExternalTaskLinksTable(cwd) {
+  const db = await getDb(cwd);
+  try {
+    db.run(
+      sql11.raw(`
+        CREATE TABLE IF NOT EXISTS external_task_links (
+          id text PRIMARY KEY NOT NULL,
+          task_id text NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+          provider_id text NOT NULL,
+          external_id text NOT NULL,
+          external_url text,
+          external_title text,
+          link_type text NOT NULL,
+          sync_direction text NOT NULL DEFAULT 'inbound',
+          metadata_json text DEFAULT '{}',
+          linked_at text NOT NULL DEFAULT (datetime('now')),
+          last_sync_at text
+        )
+      `)
+    );
+    db.run(
+      sql11.raw(
+        `CREATE UNIQUE INDEX IF NOT EXISTS uq_ext_links_task_provider_external ON external_task_links(task_id, provider_id, external_id)`
+      )
+    );
+    db.run(
+      sql11.raw(`CREATE INDEX IF NOT EXISTS idx_ext_links_task_id ON external_task_links(task_id)`)
+    );
+    db.run(
+      sql11.raw(
+        `CREATE INDEX IF NOT EXISTS idx_ext_links_provider_id ON external_task_links(provider_id)`
+      )
+    );
+  } catch (err) {
+    log6.warn({ err }, "Failed to ensure external_task_links table exists");
+    throw err;
+  }
+}
 async function createLink(params, cwd) {
+  await ensureExternalTaskLinksTable(cwd);
   const db = await getDb(cwd);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const id = randomUUID5();
@@ -40392,7 +40466,7 @@ init_brain_accessor();
 init_brain_sqlite();
 init_data_accessor();
 init_registry3();
-var log6 = getLogger("nexus:transfer");
+var log7 = getLogger("nexus:transfer");
 async function previewTransfer(params) {
   return executeTransferInternal({ ...params, dryRun: true });
 }
@@ -40488,48 +40562,55 @@ async function executeTransferInternal(params) {
     return result;
   }
   let linksCreated = 0;
-  const targetAccessor = await getAccessor(targetProject.path);
-  const { tasks: targetTasks } = await targetAccessor.queryTasks({});
-  const targetTaskIds = new Set(targetTasks.map((t) => t.id));
-  for (const entry of entries) {
-    if (importResult.idRemap[entry.sourceId] && targetTaskIds.has(entry.targetId)) {
-      await createLink(
-        {
-          taskId: entry.targetId,
-          providerId: `nexus:${sourceProject.name}`,
-          externalId: entry.sourceId,
-          externalTitle: entry.title,
-          linkType: "transferred",
-          syncDirection: "inbound",
-          metadata: {
-            transferMode: mode,
-            transferScope: scope,
-            sourceProject: sourceProject.name,
-            transferredAt: (/* @__PURE__ */ new Date()).toISOString()
-          }
-        },
-        targetProject.path
-      );
-      linksCreated++;
-      await createLink(
-        {
-          taskId: entry.sourceId,
-          providerId: `nexus:${targetProject.name}`,
-          externalId: entry.targetId,
-          externalTitle: entry.title,
-          linkType: "transferred",
-          syncDirection: "outbound",
-          metadata: {
-            transferMode: mode,
-            transferScope: scope,
-            targetProject: targetProject.name,
-            transferredAt: (/* @__PURE__ */ new Date()).toISOString()
-          }
-        },
-        sourceProject.path
-      );
-      linksCreated++;
+  try {
+    const targetAccessor = await getAccessor(targetProject.path);
+    const { tasks: targetTasks } = await targetAccessor.queryTasks({});
+    const targetTaskIds = new Set(targetTasks.map((t) => t.id));
+    for (const entry of entries) {
+      if (importResult.idRemap[entry.sourceId] && targetTaskIds.has(entry.targetId)) {
+        await createLink(
+          {
+            taskId: entry.targetId,
+            providerId: `nexus:${sourceProject.name}`,
+            externalId: entry.sourceId,
+            externalTitle: entry.title,
+            linkType: "transferred",
+            syncDirection: "inbound",
+            metadata: {
+              transferMode: mode,
+              transferScope: scope,
+              sourceProject: sourceProject.name,
+              transferredAt: (/* @__PURE__ */ new Date()).toISOString()
+            }
+          },
+          targetProject.path
+        );
+        linksCreated++;
+        await createLink(
+          {
+            taskId: entry.sourceId,
+            providerId: `nexus:${targetProject.name}`,
+            externalId: entry.targetId,
+            externalTitle: entry.title,
+            linkType: "transferred",
+            syncDirection: "outbound",
+            metadata: {
+              transferMode: mode,
+              transferScope: scope,
+              targetProject: targetProject.name,
+              transferredAt: (/* @__PURE__ */ new Date()).toISOString()
+            }
+          },
+          sourceProject.path
+        );
+        linksCreated++;
+      }
     }
+  } catch (err) {
+    log7.warn(
+      { err, linksCreated },
+      "Failed to create external_task_links during transfer \u2014 tasks were transferred successfully but provenance links could not be written"
+    );
   }
   result.linksCreated = linksCreated;
   try {
@@ -40554,7 +40635,7 @@ async function executeTransferInternal(params) {
       })
     });
   } catch (err) {
-    log6.warn({ err }, "nexus transfer audit write failed");
+    log7.warn({ err }, "nexus transfer audit write failed");
   }
   if (mode === "move") {
     let archived = 0;
@@ -40567,7 +40648,7 @@ async function executeTransferInternal(params) {
           });
           archived++;
         } catch (err) {
-          log6.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
+          log7.warn({ err, taskId: entry.sourceId }, "failed to archive source task after transfer");
         }
       }
     }
@@ -40605,7 +40686,7 @@ async function executeTransferInternal(params) {
         }
       }
     } catch (err) {
-      log6.warn({ err }, "brain observation transfer failed");
+      log7.warn({ err }, "brain observation transfer failed");
     }
     result.brainObservationsTransferred = brainTransferred;
     result.manifest.brainObservationsTransferred = brainTransferred;
@@ -40653,8 +40734,8 @@ async function loadProjectACL(projectPath) {
 async function logAclFailure(projectPath) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log9 = getLogger2("nexus.acl");
-    log9.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
+    const log10 = getLogger2("nexus.acl");
+    log10.warn({ projectPath }, "Failed to load ACL configuration, defaulting to deny-all");
   } catch {
   }
 }
@@ -40809,9 +40890,9 @@ async function executeOperation(operation, taskId, projectPath, accessor, direct
 async function logRouteAudit(directive, projectName, taskId, operation, success2, error48) {
   try {
     const { getLogger: getLogger2 } = await Promise.resolve().then(() => (init_logger(), logger_exports));
-    const log9 = getLogger2("nexus.route");
+    const log10 = getLogger2("nexus.route");
     const level = success2 ? "info" : "warn";
-    log9[level](
+    log10[level](
       {
         directive: directive.verb,
         agentId: directive.agentId,
@@ -46906,8 +46987,11 @@ function sanitizeParams(params, projectRoot, context) {
       continue;
     }
     if (typeof value === "string" && (key === "path" || key === "file") && projectRoot) {
-      sanitized[key] = sanitizePath(value, projectRoot);
-      continue;
+      const allowExternalPath = context?.domain === "nexus" && (context?.operation === "register" || context?.operation === "reconcile");
+      if (!allowExternalPath) {
+        sanitized[key] = sanitizePath(value, projectRoot);
+        continue;
+      }
     }
     if (typeof value === "string" && (key === "title" || key === "description" || key === "content")) {
       const maxLen = key === "title" ? 200 : DEFAULT_MAX_CONTENT_LENGTH;
@@ -49311,7 +49395,7 @@ init_data_accessor();
 
 // packages/core/src/stats/workflow-telemetry.ts
 init_logger();
-var log7 = getLogger("workflow-telemetry");
+var log8 = getLogger("workflow-telemetry");
 async function queryTasks(cwd, since) {
   try {
     const { getDb: getDb3 } = await Promise.resolve().then(() => (init_sqlite2(), sqlite_exports));
@@ -49333,7 +49417,7 @@ async function queryTasks(cwd, since) {
     }).from(tasks2).where(conditions.length > 0 ? and10(...conditions) : void 0).all();
     return rows;
   } catch (err) {
-    log7.warn({ err }, "Failed to query tasks for workflow telemetry");
+    log8.warn({ err }, "Failed to query tasks for workflow telemetry");
     return [];
   }
 }
@@ -49367,7 +49451,7 @@ async function queryCompletionAuditRows(cwd, since) {
       return isComplete;
     });
   } catch (err) {
-    log7.warn({ err }, "Failed to query audit log for workflow telemetry");
+    log8.warn({ err }, "Failed to query audit log for workflow telemetry");
     return [];
   }
 }
@@ -50154,13 +50238,22 @@ function rowToStickyNote3(row) {
 }
 async function listStickies(params, projectRoot) {
   const accessor = await getBrainAccessor(projectRoot);
+  const hasTagFilter = params.tags && params.tags.length > 0;
   const rows = await accessor.findStickyNotes({
     status: params.status,
     color: params.color,
     priority: params.priority,
-    limit: params.limit
+    limit: hasTagFilter ? void 0 : params.limit
   });
-  return rows.map(rowToStickyNote3);
+  let notes = rows.map(rowToStickyNote3);
+  if (hasTagFilter) {
+    const requiredTags = params.tags;
+    notes = notes.filter((note) => requiredTags.every((t) => note.tags.includes(t)));
+    if (params.limit && notes.length > params.limit) {
+      notes = notes.slice(0, params.limit);
+    }
+  }
+  return notes;
 }
 
 // packages/core/src/sticky/purge.ts
@@ -50812,11 +50905,11 @@ import { join as join87 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
-var log8 = getLogger("prune");
+var log9 = getLogger("prune");
 async function pruneAuditLog(cleoDir, config2) {
   try {
     if (!config2.auditRetentionDays || config2.auditRetentionDays <= 0) {
-      log8.debug("auditRetentionDays is 0 or unset; skipping audit prune");
+      log9.debug("auditRetentionDays is 0 or unset; skipping audit prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     const cutoff = new Date(Date.now() - config2.auditRetentionDays * 864e5).toISOString();
@@ -50827,7 +50920,7 @@ async function pruneAuditLog(cleoDir, config2) {
     const db = await getDb3(projectRoot);
     const oldRows = await db.select().from(auditLog2).where(lt3(auditLog2.timestamp, cutoff));
     if (oldRows.length === 0) {
-      log8.debug("No audit_log rows older than cutoff; nothing to prune");
+      log9.debug("No audit_log rows older than cutoff; nothing to prune");
       return { rowsArchived: 0, rowsDeleted: 0 };
     }
     let archivePath;
@@ -50845,17 +50938,17 @@ async function pruneAuditLog(cleoDir, config2) {
         const inStream = Readable.from([jsonlContent]);
         await pipeline(inStream, gzip, outStream);
         rowsArchived = oldRows.length;
-        log8.info(
+        log9.info(
           { archivePath, rowsArchived },
           `Archived ${rowsArchived} audit rows to ${archivePath}`
         );
       } catch (archiveErr) {
-        log8.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
+        log9.warn({ err: archiveErr }, "Failed to archive audit rows; continuing with deletion");
         archivePath = void 0;
       }
     }
     await db.delete(auditLog2).where(lt3(auditLog2.timestamp, cutoff)).run();
-    log8.info(
+    log9.info(
       { rowsDeleted: oldRows.length, cutoff },
       `Pruned ${oldRows.length} audit_log rows older than ${cutoff}`
     );
@@ -50865,7 +50958,7 @@ async function pruneAuditLog(cleoDir, config2) {
       archivePath
     };
   } catch (err) {
-    log8.warn({ err }, "audit log pruning failed");
+    log9.warn({ err }, "audit log pruning failed");
     return { rowsArchived: 0, rowsDeleted: 0 };
   }
 }