@cleocode/core 2026.5.133 → 2026.6.0

package/migrations/drizzle-cleo-project/20260602000002_t11649-token-usage-transport-mcp/migration.sql

@@ -0,0 +1,146 @@
+-- T11649 — Widen `tasks_token_usage.transport` CHECK to preserve 'mcp'.
+--
+-- Background:
+--   The consolidation migration (20260531000001_t11363) created
+--   `tasks_token_usage` with `CHECK ("transport" IN ('cli','api','agent','unknown'))`.
+--   `'mcp'` was NOT in the enum, so the exodus migrate layer coerced
+--   `transport = 'mcp'` → `'agent'` (T11548) to satisfy the CHECK. The full
+--   cutover dry-run flagged this as a SILENT SEMANTIC ALTERATION: ~194 real
+--   telemetry rows had their true origin (MCP-gateway, `source: "mcp"`) rewritten
+--   to `'agent'`, with no preserving column capturing the lost value. Count was
+--   preserved; integrity was not.
+--
+-- Owner directive (T11649): 100% data integrity. `'mcp'` is a first-class
+--   transport origin, distinct from `'agent'`, and MUST be stored verbatim.
+--
+-- Change:
+--   Old CHECK: transport IN ('cli','api','agent','unknown')
+--   New CHECK: transport IN ('cli','api','agent','mcp','unknown')
+--
+--   The widened enum is the canonical `TOKEN_USAGE_TRANSPORTS` SSoT in
+--   packages/core/src/store/schema/audit.ts. The exodus `tasks_token_usage.transport`
+--   normalization rule is removed in the same change so `'mcp'` lands unmodified.
+--
+-- SQLite cannot ALTER a CHECK constraint in place, so this migration follows the
+-- canonical "table rebuild" recipe (same pattern as drizzle-tasks T9073 / T1408):
+--
+--   1. Create `__new_tasks_token_usage` with the widened CHECK (every other
+--      column / default / CHECK preserved verbatim from the T11363 DDL).
+--   2. INSERT … SELECT every row (no data transformation — existing values are
+--      all valid under the wider constraint).
+--   3. DROP `tasks_token_usage`; RENAME `__new_tasks_token_usage` TO it.
+--   4. Recreate all nine indexes.
+--
+-- This migration is purely additive at the schema level (the enum only GROWS),
+-- runs AFTER the consolidation CREATE, and leaves every other table untouched.
+--
+-- @task T11649
+-- @epic T11245
+-- @saga T11242
+
+PRAGMA foreign_keys = OFF;
+--> statement-breakpoint
+
+-- --------------------------------------------------------------------------
+-- Step 1 — Drop the nine indexes attached to `tasks_token_usage`
+--          (they are recreated against the rebuilt table in Step 4).
+-- --------------------------------------------------------------------------
+DROP INDEX IF EXISTS `idx_tasks_token_usage_created_at`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_request_id`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_session_id`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_task_id`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_provider`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_transport`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_domain_operation`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_method`;
+--> statement-breakpoint
+DROP INDEX IF EXISTS `idx_tasks_token_usage_gateway`;
+--> statement-breakpoint
+
+-- --------------------------------------------------------------------------
+-- Step 2 — Create `__new_tasks_token_usage` with the widened transport CHECK.
+--          All other columns / constraints / defaults are byte-identical to the
+--          T11363 consolidation DDL — the only change is the transport enum.
+-- --------------------------------------------------------------------------
+CREATE TABLE `__new_tasks_token_usage` (
+	`id` text PRIMARY KEY,
+	`created_at` text DEFAULT (datetime('now')) NOT NULL,
+	`provider` text DEFAULT 'unknown' NOT NULL,
+	`model` text,
+	`transport` text DEFAULT 'unknown' NOT NULL,
+	`gateway` text,
+	`domain` text,
+	`operation` text,
+	`session_id` text,
+	`task_id` text,
+	`request_id` text,
+	`input_chars` integer DEFAULT 0 NOT NULL,
+	`output_chars` integer DEFAULT 0 NOT NULL,
+	`input_tokens` integer DEFAULT 0 NOT NULL,
+	`output_tokens` integer DEFAULT 0 NOT NULL,
+	`total_tokens` integer DEFAULT 0 NOT NULL,
+	`method` text DEFAULT 'heuristic' NOT NULL,
+	`confidence` text DEFAULT 'coarse' NOT NULL,
+	`request_hash` text,
+	`response_hash` text,
+	`metadata_json` text DEFAULT '{}' NOT NULL,
+	-- consolidation CHECK constraints (T11363) — transport widened to include 'mcp' (T11649)
+	CHECK ("created_at" IS NULL OR "created_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*'),
+	CHECK ("transport" IN ('cli', 'api', 'agent', 'mcp', 'unknown')),
+	CHECK ("method" IN ('otel', 'provider_api', 'tokenizer', 'heuristic')),
+	CHECK ("confidence" IN ('real', 'high', 'estimated', 'coarse'))
+);
+--> statement-breakpoint
+
+-- --------------------------------------------------------------------------
+-- Step 3 — Copy every row (no transformation; every value is valid under the
+--          wider constraint) then swap tables.
+-- --------------------------------------------------------------------------
+INSERT INTO `__new_tasks_token_usage` (
+	`id`, `created_at`, `provider`, `model`, `transport`, `gateway`, `domain`,
+	`operation`, `session_id`, `task_id`, `request_id`, `input_chars`,
+	`output_chars`, `input_tokens`, `output_tokens`, `total_tokens`, `method`,
+	`confidence`, `request_hash`, `response_hash`, `metadata_json`
+)
+SELECT
+	`id`, `created_at`, `provider`, `model`, `transport`, `gateway`, `domain`,
+	`operation`, `session_id`, `task_id`, `request_id`, `input_chars`,
+	`output_chars`, `input_tokens`, `output_tokens`, `total_tokens`, `method`,
+	`confidence`, `request_hash`, `response_hash`, `metadata_json`
+FROM `tasks_token_usage`;
+--> statement-breakpoint
+DROP TABLE `tasks_token_usage`;
+--> statement-breakpoint
+ALTER TABLE `__new_tasks_token_usage` RENAME TO `tasks_token_usage`;
+--> statement-breakpoint
+
+-- --------------------------------------------------------------------------
+-- Step 4 — Recreate all nine indexes (verbatim from the T11363 DDL).
+-- --------------------------------------------------------------------------
+CREATE INDEX `idx_tasks_token_usage_created_at` ON `tasks_token_usage` (`created_at`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_request_id` ON `tasks_token_usage` (`request_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_session_id` ON `tasks_token_usage` (`session_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_task_id` ON `tasks_token_usage` (`task_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_provider` ON `tasks_token_usage` (`provider`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_transport` ON `tasks_token_usage` (`transport`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_domain_operation` ON `tasks_token_usage` (`domain`,`operation`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_method` ON `tasks_token_usage` (`method`);
+--> statement-breakpoint
+CREATE INDEX `idx_tasks_token_usage_gateway` ON `tasks_token_usage` (`gateway`);
+--> statement-breakpoint
+
+PRAGMA foreign_keys = ON;

package/migrations/drizzle-conduit/20260601000003_t11523-conduit-inline-schema/migration.sql

@@ -0,0 +1,82 @@
+-- T11523 (E6-L3) → T11578 (AC4 · COMPLETE-CUTOVER): conduit FTS5 quartet over the
+-- consolidated `conduit_*` tables.
+--
+-- ## History
+--
+-- E6-L3 (T11523) routed `ensureConduitDb()` through `openDualScopeDb('project')`
+-- (the consolidated `cleo.db` chokepoint, ADR-068/069) and reproduced the legacy
+-- BARE-table conduit shape (`conversations`, `messages`, `delivery_jobs`, …) here
+-- as a forward migration so the runtime writers kept working unchanged. The bare
+-- tables co-existed (disjoint names) with the consolidated `conduit_*` tables the
+-- exodus migration (T11248 / T11553) renames into.
+--
+-- ## AC4 cutover (T11578)
+--
+-- The conduit runtime READ + WRITE path now targets the PREFIXED consolidated
+-- tables (`conduit_conversations`, `conduit_messages`, `conduit_topics`, …) that
+-- the consolidated cleo-project migration
+-- (`drizzle-cleo-project/20260531000001_t11363-consolidation-cleo-project`)
+-- creates. Those 14 prefixed tables are therefore NO LONGER created here — the
+-- consolidated migration owns them (single SSoT; CHECK constraints + ISO-8601
+-- TEXT timestamp affinity are injected by T11363). This migration's sole
+-- remaining responsibility is the FTS5 full-text index over `conduit_messages`,
+-- which drizzle-orm sqlite-core cannot model (FTS5 virtual tables) and which the
+-- consolidated migration therefore omits.
+--
+-- ## FTS5 rename: `messages_fts` → `conduit_messages_fts` (T11578 decision)
+--
+-- The full-text index and its three sync triggers are renamed with the `conduit_`
+-- domain prefix for clarity and to stay disjoint inside the shared `cleo.db`
+-- (which also holds `brain_*_fts` indexes). The index content table is
+-- `conduit_messages` and `content_rowid='rowid'` is preserved. The exodus
+-- migration skips `*_fts` tables (rebuilt post-migration from their content
+-- table — see exodus/table-name-map.ts `isDerivedFtsTable`), so the
+-- `INSERT INTO conduit_messages_fts(conduit_messages_fts) VALUES('rebuild')` seed
+-- below reindexes whatever rows the consolidated migration + exodus already
+-- placed in `conduit_messages`. Every statement is `IF NOT EXISTS`, so re-running
+-- on a DB that already has the FTS index is idempotent.
+
+-- -------------------------------------------------------------------------
+-- FTS5 virtual table for full-text search on conduit_messages content.
+-- The INSERT … VALUES('rebuild') is idempotent — safe to run on every open;
+-- it (re)indexes the existing conduit_messages rows.
+-- -------------------------------------------------------------------------
+CREATE VIRTUAL TABLE IF NOT EXISTS conduit_messages_fts
+    USING fts5(content, from_agent_id, content='conduit_messages', content_rowid='rowid');
+--> statement-breakpoint
+INSERT INTO conduit_messages_fts(conduit_messages_fts) VALUES('rebuild');
+--> statement-breakpoint
+CREATE TRIGGER IF NOT EXISTS conduit_messages_ai AFTER INSERT ON conduit_messages BEGIN
+    INSERT INTO conduit_messages_fts(rowid, content, from_agent_id)
+        VALUES (new.rowid, new.content, new.from_agent_id);
+END;
+--> statement-breakpoint
+CREATE TRIGGER IF NOT EXISTS conduit_messages_ad AFTER DELETE ON conduit_messages BEGIN
+    INSERT INTO conduit_messages_fts(conduit_messages_fts, rowid, content, from_agent_id)
+        VALUES('delete', old.rowid, old.content, old.from_agent_id);
+END;
+--> statement-breakpoint
+CREATE TRIGGER IF NOT EXISTS conduit_messages_au AFTER UPDATE ON conduit_messages BEGIN
+    INSERT INTO conduit_messages_fts(conduit_messages_fts, rowid, content, from_agent_id)
+        VALUES('delete', old.rowid, old.content, old.from_agent_id);
+    INSERT INTO conduit_messages_fts(rowid, content, from_agent_id)
+        VALUES (new.rowid, new.content, new.from_agent_id);
+END;
+--> statement-breakpoint
+
+-- -------------------------------------------------------------------------
+-- Legacy meta tracking tables — retained for backwards-compatible health
+-- probes (`checkConduitDbHealth` reads `_conduit_meta.schema_version`).
+-- `__drizzle_migrations` is the canonical migration journal; these are kept
+-- only for the pre-T1407 health-check consumers.
+-- -------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS _conduit_meta (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS _conduit_migrations (
+    name TEXT PRIMARY KEY,
+    applied_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);

package/migrations/drizzle-nexus/20260421200001_t1165-baseline-reset/migration.sql

@@ -1,8 +1,26 @@
--- BASELINE MARKER — T1165 Hybrid Path A+ (ADR-054).
--- Schema state for nexus captured in snapshot.json. No DDL to apply here.
--- On fresh installs, the CREATE statements from the canonical tree
--- (prior migrations in this folder) produce the target schema.
--- On existing installs, reconcileJournal Scenario 1 will see that
--- all migrations in this folder are applied and skip this baseline.
--- Snapshot.json MUST be preserved — it is the anchor for drizzle-kit
--- generate going forward.
+-- BASELINE MARKER — T1165 Hybrid Path A+ (ADR-054) · rewritten for T11578 · AC3.
+-- No DDL to apply here (comment-only marker).
+--
+-- ## COMPLETE-CUTOVER (T11578 · AC3)
+--
+-- The nexus runtime now reads + writes the PREFIXED consolidated `nexus_*`
+-- tables that the consolidated cleo-global migration
+-- (`drizzle-cleo-global/…t11363-consolidation-cleo-global`) creates — it OWNS
+-- the 10 prefixed base tables (single SSoT). The former base-table-creating
+-- migrations in THIS folder (initial / t529 graph / t622 registry-paths /
+-- t998 plasticity / t1077 user_profile / t1148 sigils / t1839 fts5 / t9163
+-- is_external / t11025 aliases) were REMOVED — the consolidated migration
+-- supersedes them. This folder now carries ONLY the FTS5 quartet over
+-- `nexus_nodes` + the plasticity-partition CREATE (the delta drizzle-orm
+-- sqlite-core cannot model / the consolidated migration omits), see the
+-- T11545 forward migration alongside this marker.
+--
+-- On existing DBs the old per-table migration hashes are removed from disk,
+-- so reconcileJournal Scenario 2 (Sub-case B) treats them as true orphans,
+-- deletes the orphaned journal rows, and re-probes the surviving migrations.
+-- The col-drop half of the plasticity partition is handled idempotently in
+-- `nexus-sqlite.ts` (`ensureNexusRelationWeights`) so a destructive ALTER never
+-- sits in the journaled SQL.
+--
+-- Snapshot.json is retained as the drizzle-kit generate anchor; it is ignored
+-- at runtime (`readMigrationFiles` reads only migration.sql bodies).

package/migrations/drizzle-nexus/20260601000001_t11545-nexus-relation-weights-partition/migration.sql

@@ -0,0 +1,97 @@
+-- T11545 (ADR-090 §5.3) → T11578 (AC3 · COMPLETE-CUTOVER): nexus delta over the
+-- consolidated `nexus_*` tables.
+--
+-- ## History
+--
+-- T11545 partitioned the Hebbian plasticity columns (`weight`,
+-- `last_accessed_at`, `co_accessed_count`) out of `nexus_relations` into the
+-- sibling 1:1 `nexus_relation_weights` table.
+--
+-- ## AC3 cutover (T11578)
+--
+-- The nexus runtime READ + WRITE path now targets the PREFIXED consolidated
+-- tables (`nexus_project_registry`, `nexus_user_profile`, `nexus_sigils`,
+-- `nexus_project_id_aliases`, `nexus_nodes`, `nexus_relations`, …) that the
+-- consolidated cleo-global migration
+-- (`drizzle-cleo-global/…t11363-consolidation-cleo-global`) creates. Those 10
+-- prefixed base tables are therefore NO LONGER created here — the consolidated
+-- migration owns them (single SSoT; CHECK constraints + ISO-8601 TEXT timestamp
+-- affinity are injected by T11363). This migration's remaining responsibility is:
+--
+--   1. the `nexus_relation_weights` sibling table (the consolidated GLOBAL
+--      migration's `nexus_relations` still carries the inline plasticity columns
+--      — the matching column-DROP is applied idempotently in `nexus-sqlite.ts`
+--      `ensureNexusRelationWeights`, never as a non-idempotent journaled ALTER);
+--   2. the `nexus_symbols_fts` FTS5 virtual table + its three `nexus_nodes` sync
+--      triggers — drizzle-orm sqlite-core cannot model FTS5, so the consolidated
+--      migration omits them;
+--   3. the legacy `_nexus_meta` health-probe table — pinned as the reconcile
+--      sentinel (a table THIS migration creates, NOT a consolidated-owned one) so
+--      `reconcileJournal` Scenario 2 stays dormant until the nexus set is
+--      journaled (mirrors the conduit `_conduit_meta` sentinel, T11578 · AC4).
+--
+-- Every statement is `IF NOT EXISTS` / `DROP … IF EXISTS` — idempotent across
+-- repeated opens and the orphan re-probe path.
+
+-- -------------------------------------------------------------------------
+-- 1. Plasticity weights sibling (1:1 with nexus_relations.id).
+-- -------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS `nexus_relation_weights` (
+	`relation_id` text PRIMARY KEY NOT NULL,
+	`weight` real DEFAULT 0.0 NOT NULL,
+	`last_accessed_at` text,
+	`co_accessed_count` integer DEFAULT 0 NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_nexus_relation_weights_last_accessed` ON `nexus_relation_weights` (`last_accessed_at`);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS `idx_nexus_relation_weights_weight` ON `nexus_relation_weights` (`weight`);
+--> statement-breakpoint
+
+-- -------------------------------------------------------------------------
+-- 2. FTS5 full-text index over nexus_nodes (label + file_path) + triggers.
+--    The consolidated migration cannot model FTS5 virtual tables.
+-- -------------------------------------------------------------------------
+CREATE VIRTUAL TABLE IF NOT EXISTS nexus_symbols_fts USING fts5(
+	node_id UNINDEXED,
+	label,
+	file_path,
+	tokenize = 'unicode61 remove_diacritics 1'
+);
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS nexus_nodes_fts_ai;
+--> statement-breakpoint
+CREATE TRIGGER nexus_nodes_fts_ai
+AFTER INSERT ON nexus_nodes
+BEGIN
+	INSERT INTO nexus_symbols_fts(rowid, node_id, label, file_path)
+	VALUES (new.rowid, new.id, new.label, new.file_path);
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS nexus_nodes_fts_ad;
+--> statement-breakpoint
+CREATE TRIGGER nexus_nodes_fts_ad
+AFTER DELETE ON nexus_nodes
+BEGIN
+	DELETE FROM nexus_symbols_fts WHERE rowid = old.rowid;
+END;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS nexus_nodes_fts_au;
+--> statement-breakpoint
+CREATE TRIGGER nexus_nodes_fts_au
+AFTER UPDATE ON nexus_nodes
+BEGIN
+	DELETE FROM nexus_symbols_fts WHERE rowid = old.rowid;
+	INSERT INTO nexus_symbols_fts(rowid, node_id, label, file_path)
+	VALUES (new.rowid, new.id, new.label, new.file_path);
+END;
+--> statement-breakpoint
+
+-- -------------------------------------------------------------------------
+-- 3. Legacy meta health-probe table + reconcile sentinel (T11578 · AC3).
+-- -------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS _nexus_meta (
+	key TEXT PRIMARY KEY,
+	value TEXT NOT NULL,
+	updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/core",
-  "version": "2026.5.133",
+  "version": "2026.6.0",
   "description": "CLEO core business logic kernel — tasks, sessions, memory, orchestration, lifecycle, with bundled SQLite store",
   "type": "module",
   "main": "./dist/index.js",
@@ -360,6 +360,36 @@
       "types": "./dist/llm/*.d.ts",
       "import": "./dist/llm/*.js",
       "require": "./dist/llm/*.js"
+    },
+    "./paths": {
+      "types": "./dist/paths-export.d.ts",
+      "import": "./dist/paths-export.js",
+      "require": "./dist/paths-export.js"
+    },
+    "./lafs": {
+      "types": "./dist/lafs-export.d.ts",
+      "import": "./dist/lafs-export.js",
+      "require": "./dist/lafs-export.js"
+    },
+    "./skills-lib": {
+      "types": "./dist/skills-export.d.ts",
+      "import": "./dist/skills-export.js",
+      "require": "./dist/skills-export.js"
+    },
+    "./caamp": {
+      "types": "./dist/caamp-export.d.ts",
+      "import": "./dist/caamp-export.js",
+      "require": "./dist/caamp-export.js"
+    },
+    "./worktree": {
+      "types": "./dist/worktree-export.d.ts",
+      "import": "./dist/worktree-export.js",
+      "require": "./dist/worktree-export.js"
+    },
+    "./git-shim": {
+      "types": "./dist/git-shim-export.d.ts",
+      "import": "./dist/git-shim-export.js",
+      "require": "./dist/git-shim-export.js"
     }
   },
   "dependencies": {
@@ -399,16 +429,17 @@
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@cleocode/adapters": "2026.5.133",
-    "@cleocode/caamp": "2026.5.133",
-    "@cleocode/contracts": "2026.5.133",
-    "@cleocode/agents": "2026.5.133",
-    "@cleocode/lafs": "2026.5.133",
-    "@cleocode/nexus": "2026.5.133",
-    "@cleocode/paths": "2026.5.133",
-    "@cleocode/skills": "2026.5.133",
+    "@cleocode/adapters": "2026.6.0",
+    "@cleocode/agents": "2026.6.0",
+    "@cleocode/contracts": "2026.6.0",
+    "@cleocode/git-shim": "2026.6.0",
+    "@cleocode/caamp": "2026.6.0",
+    "@cleocode/lafs": "2026.6.0",
+    "@cleocode/paths": "2026.6.0",
+    "@cleocode/nexus": "2026.6.0",
+    "@cleocode/skills": "2026.6.0",
     "@cleocode/utils": "2026.5.122",
-    "@cleocode/worktree": "2026.5.133"
+    "@cleocode/worktree": "2026.6.0"
   },
   "engines": {
     "node": ">=24.16.0"
@@ -424,6 +455,7 @@
     "templates",
     "binaries",
     "scripts/install-supervisor-binary.mjs",
+    "scripts/napi-binary-picker.mjs",
     "README.md",
     "STABILITY.md"
   ],
@@ -440,7 +472,7 @@
   },
   "optionalDependencies": {
     "llmtxt": "^2026.5.15",
-    "@cleocode/studio": "^2026.5.133"
+    "@cleocode/studio": "^2026.6.0"
   },
   "scripts": {
     "build": "tsc",