@cleocode/core 2026.8.1 → 2026.8.3

package/dist/llm/plugin-facade.js

@@ -10043,6 +10043,27 @@ var init_operations_registry = __esm({
             type: "boolean",
             required: false,
             description: "Commit plan file before dispatching"
+          },
+          // T12089: the plan SCOPE. The workflow regenerates the plan when no
+          // committed plan is supplied, and `cleo release plan` requires
+          // `--saga | --epic | --tasks` — so without one of these the dispatched
+          // run dies at "Prepare bump-PR" after a fully green preflight.
+          //
+          // A param absent from this registry is STRIPPED before the domain handler
+          // sees it, silently. `--tasks` was accepted by the CLI, forwarded by the
+          // handler and by `releaseOpen`, and still arrived empty at the workflow
+          // because this declaration was the fourth hop in the chain.
+          {
+            name: "epic",
+            type: "string",
+            required: false,
+            description: "Epic task ID forwarded as the plan scope (e.g. T9999)"
+          },
+          {
+            name: "tasks",
+            type: "string",
+            required: false,
+            description: "Comma-separated task IDs forwarded as the plan scope for a task-scoped release"
           }
         ]
       },
@@ -15722,6 +15743,25 @@ var init_service_provider = __esm({
   }
 });
 
+// packages/contracts/src/caamp-markers.ts
+var H, damagedMarkerSource, CAAMP_DAMAGED_START_PATTERN_SOURCE, CAAMP_DAMAGED_END_PATTERN_SOURCE;
+var init_caamp_markers = __esm({
+  "packages/contracts/src/caamp-markers.ts"() {
+    "use strict";
+    H = "[ \\t\\r]";
+    damagedMarkerSource = (keyword) => `^${H}*[<!-]{1,4}${H}*CAAMP${H}*:${H}*${keyword}${H}*[->]{1,3}${H}*$`;
+    CAAMP_DAMAGED_START_PATTERN_SOURCE = damagedMarkerSource("START");
+    CAAMP_DAMAGED_END_PATTERN_SOURCE = damagedMarkerSource("END");
+  }
+});
+
+// packages/contracts/src/collection-keys.ts
+var init_collection_keys = __esm({
+  "packages/contracts/src/collection-keys.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/index.ts
 var init_src = __esm({
   "packages/contracts/src/index.ts"() {
@@ -15789,6 +15829,8 @@ var init_src = __esm({
     init_validator();
     init_service_provider();
     init_workgraph();
+    init_caamp_markers();
+    init_collection_keys();
   }
 });
 
@@ -23511,7 +23553,7 @@ function resolveDbIdentity(db) {
   return identity;
 }
 function sleepAsync(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, Math.max(0, Math.round(ms))));
+  return new Promise((resolve7) => setTimeout(resolve7, Math.max(0, Math.round(ms))));
 }
 function isPidAlive(pid) {
   try {
@@ -24329,7 +24371,7 @@ async function sendResourceRelease(socketPath, cls, holderId) {
   return { unavailable: true, reason: `unexpected response kind: ${result.kind}` };
 }
 function sendLeaseRequest(socketPath, request, expectedKind) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const id = `ra-${process.pid}-${request.kind}`;
     const envelope = LeaseIpcRequestEnvelopeSchema.parse({
       protocol_version: LEASE_IPC_PROTOCOL_VERSION,
@@ -24347,7 +24389,7 @@ function sendLeaseRequest(socketPath, request, expectedKind) {
       settled = true;
       socket.removeAllListeners();
       socket.destroy();
-      resolve6(value);
+      resolve7(value);
     };
     const degrade = (reason) => done({ unavailable: true, reason });
     socket.setTimeout(REQUEST_TIMEOUT_MS);
@@ -24470,7 +24512,9 @@ function computeClassBudget(cls, sample, opts = {}) {
       return Math.max(1, cpus - 2);
     case "test-run":
     case "scoped-build": {
-      const base = Math.max(1, Math.floor(cpus / 4));
+      const estRamBytes = (opts.testRunEstRamMb ?? 24576) * MB;
+      const byMem = Math.floor((availBytes - headroomBytes) / estRamBytes);
+      const base = clamp(1, byMem, Math.max(1, Math.floor(cpus / 4)));
       if (some > floor) return 1;
       if (some > hold) return Math.max(1, Math.floor(base / 2));
       return base;
@@ -24963,6 +25007,11 @@ var init_registry = __esm({
        * });
        * ```
        */
+      // T12071: keyed on the EVENT so the payload shape is checked against
+      // `HookEventPayloadMap`. The previous `<T extends HookPayload>` form inferred
+      // T from the argument, relating the event and the payload not at all — which
+      // is how `PostToolUse` came to be dispatched with `newStatus` instead of
+      // `status` and filled 29% of BRAIN with "status: undefined".
       async dispatch(event, projectRoot, payload) {
         if (!this.config.enabled) return;
         const resolvedEvent = this.resolveEvent(event);
@@ -27772,8 +27821,8 @@ async function openDualScopeDbAtPath(scope, dbPath, exodusCwd, options) {
   }
   let initResolve = null;
   let initReject = null;
-  const initPromise = new Promise((resolve6, reject) => {
-    initResolve = resolve6;
+  const initPromise = new Promise((resolve7, reject) => {
+    initResolve = resolve7;
     initReject = reject;
   });
   _cache.set(key, {
@@ -28026,24 +28075,35 @@ var init_dual_scope_db = __esm({
       async openProject(dbPath, options) {
         const normalized = resolve3(dbPath);
         if (options?.dedicated) {
-          const handle = await openDualScopeDbAtPath("project", normalized, void 0, {
+          const handle = await openDualScopeDbAtPath("project", normalized, options?.exodusCwd, {
             dedicated: true
           });
           return this.buildStore("project", handle, 0);
         }
-        return this.openEntry("project", normalized);
+        return this.openEntry("project", normalized, 0, options?.exodusCwd);
       }
       /** @inheritdoc */
       async openGlobal(options) {
         const dbPath = resolveDualScopeDbPath("global");
         const normalized = resolve3(dbPath);
         if (options?.dedicated) {
-          const handle = await openDualScopeDbAtPath("global", normalized, void 0, {
+          const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
+            dedicated: true
+          });
+          return this.buildStore("global", handle, 0);
+        }
+        return this.openEntry("global", normalized, 0, options?.exodusCwd);
+      }
+      /** @inheritdoc */
+      async openGlobalAt(dbPath, options) {
+        const normalized = resolve3(dbPath);
+        if (options?.dedicated) {
+          const handle = await openDualScopeDbAtPath("global", normalized, options?.exodusCwd, {
             dedicated: true
           });
           return this.buildStore("global", handle, 0);
         }
-        return this.openEntry("global", normalized);
+        return this.openEntry("global", normalized, 0, options?.exodusCwd);
       }
       /** @inheritdoc */
       closeProject(dbPath) {
@@ -28069,7 +28129,7 @@ var init_dual_scope_db = __esm({
        *   retry calls this with `depth + 1`. A second dead handle at depth 1
        *   throws {@link LivenessExhaustedError} instead of recursing further.
        */
-      async openEntry(scope, dbPath, depth = 0) {
+      async openEntry(scope, dbPath, depth = 0, exodusCwd) {
         const key = cacheKey(scope, dbPath);
         const existing = this._registry.get(key);
         if (existing) {
@@ -28084,8 +28144,8 @@ var init_dual_scope_db = __esm({
         const entryId = ++this._nextId;
         let initResolve;
         let initReject;
-        const initPromise = new Promise((resolve6, reject) => {
-          initResolve = resolve6;
+        const initPromise = new Promise((resolve7, reject) => {
+          initResolve = resolve7;
           initReject = reject;
         });
         this._registry.set(key, { id: entryId, store: null, initPromise });
@@ -28096,7 +28156,7 @@ var init_dual_scope_db = __esm({
           }
         });
         try {
-          const dualHandle = scope === "project" ? await this.openDualScopeFn("project", dbPath) : await this.openDualScopeFn("global", dbPath);
+          const dualHandle = scope === "project" ? await this.openDualScopeFn("project", dbPath, exodusCwd) : await this.openDualScopeFn("global", dbPath, exodusCwd);
           const current = this._registry.get(key);
           if (!current || current.id !== entryId) {
             throw new EntryCancelledError(scope, dbPath);
@@ -28107,7 +28167,7 @@ var init_dual_scope_db = __esm({
             if (depth >= 1) {
               throw new LivenessExhaustedError(scope, dbPath);
             }
-            const retryStore = await this.openEntry(scope, dbPath, depth + 1);
+            const retryStore = await this.openEntry(scope, dbPath, depth + 1, exodusCwd);
             initResolve(retryStore);
             return retryStore;
           }
@@ -28203,6 +28263,151 @@ var init_dual_scope_db = __esm({
   }
 });
 
+// packages/core/src/store/ports/domain-binding.ts
+import { resolve as resolve4 } from "node:path";
+function getCleoRuntime() {
+  if (!_runtime) {
+    _runtime = createCleoRuntime();
+  }
+  return _runtime;
+}
+function bindingKey(scope, dbPath, domain2) {
+  return `${scope}::${dbPath}::${domain2}`;
+}
+function nativeOf(store) {
+  const native = store.db.$client;
+  if (!native) {
+    throw new Error(
+      `T12037: CleoRuntime store for ${store.scope}::${store.dbPath} exposed no $client \u2014 cannot bind a domain schema to it.`
+    );
+  }
+  return native;
+}
+function reuseValid(key, store) {
+  const row = _bindings.get(key);
+  if (!row) return void 0;
+  if (row.store !== store || !store.isOpen || !row.native.isOpen) {
+    _bindings.delete(key);
+    return void 0;
+  }
+  return row;
+}
+async function bindAgainst(key, store, establish) {
+  const cached3 = reuseValid(key, store);
+  if (cached3) return cached3;
+  const pending = _inflight.get(key);
+  if (pending) {
+    const row = await pending;
+    if (row.store === store && row.native.isOpen) return row;
+    return bindAgainst(key, store, establish);
+  }
+  const native = nativeOf(store);
+  const flight = (async () => {
+    const db = await establish(native, store);
+    const row = { store, native, db };
+    if (store.isOpen && native.isOpen) {
+      _bindings.set(key, row);
+    }
+    return row;
+  })();
+  _inflight.set(key, flight);
+  try {
+    return await flight;
+  } finally {
+    if (_inflight.get(key) === flight) {
+      _inflight.delete(key);
+    }
+  }
+}
+async function bindLive(scope, key, dbPath, openStore, establish) {
+  let lastError;
+  for (let attempt = 0; attempt < MAX_LIVENESS_ATTEMPTS; attempt += 1) {
+    let store;
+    try {
+      store = await openStore();
+    } catch (err) {
+      lastError = err;
+      releaseDomainBindings({ scope, dbPath });
+      if (attempt + 1 >= MAX_LIVENESS_ATTEMPTS) throw err;
+      continue;
+    }
+    try {
+      const row = await bindAgainst(key, store, establish);
+      if (row.store.isOpen && row.native.isOpen) return row;
+    } catch (err) {
+      lastError = err;
+      if (store.isOpen) throw err;
+    }
+    releaseDomainBindings({ scope, dbPath });
+    try {
+      store.close();
+    } catch {
+    }
+  }
+  if (lastError !== void 0) throw lastError;
+  throw new Error(
+    `T12037: could not bind ${key} over a live connection after ${MAX_LIVENESS_ATTEMPTS} attempts \u2014 the consolidated handle was closed each time.`
+  );
+}
+async function bindProjectDomain(domain2, cwd, establish) {
+  const dbPath = resolve4(resolveDualScopeDbPath("project", cwd));
+  const row = await bindLive(
+    "project",
+    bindingKey("project", dbPath, domain2),
+    dbPath,
+    () => getCleoRuntime().openProject(dbPath, { exodusCwd: cwd }),
+    establish
+  );
+  return row;
+}
+function releaseDomainBindings(filter2) {
+  if (!filter2) {
+    _bindings.clear();
+    return;
+  }
+  const wantPath = filter2.dbPath === void 0 ? void 0 : resolve4(filter2.dbPath);
+  for (const key of [..._bindings.keys()]) {
+    const sep = key.indexOf("::");
+    const lastSep = key.lastIndexOf("::");
+    const scope = key.slice(0, sep);
+    const dbPath = key.slice(sep + 2, lastSep);
+    const domain2 = key.slice(lastSep + 2);
+    if (filter2.scope !== void 0 && scope !== filter2.scope) continue;
+    if (wantPath !== void 0 && dbPath !== wantPath) continue;
+    if (filter2.domain !== void 0 && domain2 !== filter2.domain) continue;
+    _bindings.delete(key);
+  }
+}
+function boundProjectNative(domain2, cwd) {
+  return peekProjectDomain(domain2, cwd)?.native ?? null;
+}
+function peekProjectDomain(domain2, cwd) {
+  const dbPath = resolve4(resolveDualScopeDbPath("project", cwd));
+  const row = _bindings.get(bindingKey("project", dbPath, domain2));
+  if (row?.native.isOpen) return row;
+  if (cwd !== void 0) return null;
+  const suffix = `::${domain2}`;
+  let sole;
+  for (const [key, candidate] of _bindings) {
+    if (!key.startsWith("project::") || !key.endsWith(suffix)) continue;
+    if (!candidate.native.isOpen) continue;
+    if (sole) return null;
+    sole = candidate;
+  }
+  return sole ?? null;
+}
+var _runtime, _bindings, _inflight, MAX_LIVENESS_ATTEMPTS;
+var init_domain_binding = __esm({
+  "packages/core/src/store/ports/domain-binding.ts"() {
+    "use strict";
+    init_dual_scope_db();
+    _runtime = null;
+    _bindings = /* @__PURE__ */ new Map();
+    _inflight = /* @__PURE__ */ new Map();
+    MAX_LIVENESS_ATTEMPTS = 2;
+  }
+});
+
 // packages/core/src/store/schema/nexus-schema.ts
 var nexus_schema_exports = {};
 __export(nexus_schema_exports, {
@@ -28711,6 +28916,7 @@ var nexus_sqlite_exports = {};
 __export(nexus_sqlite_exports, {
   NEXUS_SCHEMA_VERSION: () => NEXUS_SCHEMA_VERSION,
   _resetNestedNexusWarningGate: () => _resetNestedNexusWarningGate,
+  bindNexusDomain: () => bindNexusDomain,
   closeNexusDb: () => closeNexusDb,
   detectAndWarnOnNestedNexus: () => detectAndWarnOnNestedNexus,
   getNestedNexusSentinelPath: () => getNestedNexusSentinelPath,
@@ -28919,13 +29125,13 @@ function ensureNexusRelationWeights(nativeDb) {
     nativeDb.exec(`PRAGMA foreign_keys=${fkWasOn ? "ON" : "OFF"}`);
   }
 }
-function runNexusMigrations(nativeDb, db) {
+function runNexusMigrations(nativeDb, db, dbPath) {
   const migrationsFolder = resolveNexusMigrationsFolder();
-  if (tableExists4(nativeDb, "nexus_nodes") && _nexusDbPath) {
-    const backupPath = _nexusDbPath.replace(/\.db$/, "-pre-cleo.db.bak");
+  if (tableExists4(nativeDb, "nexus_nodes")) {
+    const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
     if (!existsSync14(backupPath)) {
       try {
-        copyFileSync4(_nexusDbPath, backupPath);
+        copyFileSync4(dbPath, backupPath);
       } catch {
       }
     }
@@ -28967,75 +29173,45 @@ function runNexusMigrations(nativeDb, db) {
   ensureNexusFts5(nativeDb);
 }
 async function getNexusDb() {
-  const requestedPath = getNexusDbPath();
+  return (await bindNexusDomain()).db.drizzle;
+}
+async function bindNexusDomain() {
   const requestedRegistryPath = getNexusRegistryDbPath();
-  if (_nexusDb && _nexusDbPath !== requestedPath) {
-    resetNexusDbState();
+  const bound = peekProjectDomain("nexus");
+  if (bound && bound.db.registryPath !== requestedRegistryPath) {
+    releaseDomainBindings({ scope: "project", domain: "nexus" });
   }
-  if (_nexusDb && _nexusRegistryPath !== requestedRegistryPath) {
-    resetNexusDbState();
-  }
-  if (_nexusDb && (_nexusNativeDb === null || !_nexusNativeDb.isOpen)) {
-    resetNexusDbState();
-  }
-  if (_nexusDb) {
-    if (_nexusNativeDb) {
-      try {
-        ensureGlobalRegistryAttached(_nexusNativeDb);
-      } catch {
-        resetNexusDbState();
-      }
-    }
-    if (_nexusDb) return _nexusDb;
-  }
-  if (_nexusInitPromise) return _nexusInitPromise;
-  _nexusInitPromise = (async () => {
-    const dbPath = requestedPath;
-    _nexusDbPath = dbPath;
-    _nexusRegistryPath = requestedRegistryPath;
-    detectAndWarnOnNestedNexus();
-    await openDualScopeDb("global");
-    const dualHandle = await openDualScopeDb("project");
-    const nativeDb = dualHandle.db.$client ?? null;
-    if (!nativeDb) {
-      throw new Error(
-        "T11648: openDualScopeDb returned a handle without $client \u2014 cannot extract DatabaseSync for the nexus-schema drizzle wrapping."
-      );
-    }
-    _nexusNativeDb = nativeDb;
+  detectAndWarnOnNestedNexus();
+  await openDualScopeDb("global");
+  const binding = await bindProjectDomain("nexus", void 0, (nativeDb, store) => {
     ensureGlobalRegistryAttached(nativeDb);
     const db = drizzle({ client: nativeDb });
-    runNexusMigrations(nativeDb, db);
+    runNexusMigrations(nativeDb, db, store.dbPath);
     nativeDb.prepare(
       `INSERT OR IGNORE INTO nexus_schema_meta (key, value) VALUES ('schemaVersion', '${NEXUS_SCHEMA_VERSION}')`
     ).run();
-    _nexusDb = db;
-    return db;
-  })();
+    return { drizzle: db, registryPath: requestedRegistryPath };
+  });
   try {
-    return await _nexusInitPromise;
-  } finally {
-    _nexusInitPromise = null;
+    ensureGlobalRegistryAttached(binding.native);
+  } catch {
+    releaseDomainBindings({ scope: "project", domain: "nexus" });
+    throw new Error(
+      "T12039: nexus binding lost its GLOBAL registry ATTACH and could not re-attach."
+    );
   }
+  return binding;
 }
 function closeNexusDb() {
-  _nexusNativeDb = null;
-  _nexusDb = null;
-  _nexusDbPath = null;
-  _nexusRegistryPath = null;
-  _nexusInitPromise = null;
+  releaseDomainBindings({ scope: "project", domain: "nexus" });
 }
 function resetNexusDbState() {
-  _nexusNativeDb = null;
-  _nexusDb = null;
-  _nexusDbPath = null;
-  _nexusRegistryPath = null;
-  _nexusInitPromise = null;
+  releaseDomainBindings({ scope: "project", domain: "nexus" });
 }
 function getNexusNativeDb() {
-  return _nexusNativeDb;
+  return boundProjectNative("nexus");
 }
-var NEXUS_SCHEMA_VERSION, _nexusDb, _nexusNativeDb, _nexusDbPath, _nexusRegistryPath, _nexusInitPromise, NEXUS_GLOBAL_ATTACH_ALIAS, NESTED_NEXUS_SENTINEL, _warnedNestedPaths;
+var NEXUS_SCHEMA_VERSION, NEXUS_GLOBAL_ATTACH_ALIAS, NESTED_NEXUS_SENTINEL, _warnedNestedPaths;
 var init_nexus_sqlite = __esm({
   "packages/core/src/store/nexus-sqlite.ts"() {
     "use strict";
@@ -29044,15 +29220,11 @@ var init_nexus_sqlite = __esm({
     init_paths();
     init_dual_scope_db();
     init_migration_manager();
+    init_domain_binding();
     init_resolve_migrations_folder();
     init_nexus_schema();
     init_with_retry();
     NEXUS_SCHEMA_VERSION = "1.0.0";
-    _nexusDb = null;
-    _nexusNativeDb = null;
-    _nexusDbPath = null;
-    _nexusRegistryPath = null;
-    _nexusInitPromise = null;
     NEXUS_GLOBAL_ATTACH_ALIAS = "nexus_global";
     NESTED_NEXUS_SENTINEL = "nexus.db";
     _warnedNestedPaths = /* @__PURE__ */ new Set();
@@ -29064,7 +29236,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { existsSync as existsSync15, readFileSync as readFileSync4, statSync as statSync5 } from "node:fs";
 import { createRequire as createRequire5 } from "node:module";
 import { homedir } from "node:os";
-import { basename as basename4, dirname as dirname6, join as join15, resolve as resolve4 } from "node:path";
+import { basename as basename4, dirname as dirname6, join as join15, resolve as resolve5 } from "node:path";
 import {
   computeCanonicalProjectId as _computeCanonicalProjectId,
   getCanonicalTemplatesTildePath as _getCanonicalTemplatesTildePath,
@@ -29131,24 +29303,24 @@ function getCleoDirAbsolute(cwd, opts) {
     try {
       const projectRoot = getProjectRoot(cwd);
       const canonical = _resolveCanonicalCleoDir(project.projectId);
-      if (canonical !== null && canonical === resolve4(projectRoot, cleoDir)) {
+      if (canonical !== null && canonical === resolve5(projectRoot, cleoDir)) {
         return canonical;
       }
-      return resolve4(projectRoot, cleoDir);
+      return resolve5(projectRoot, cleoDir);
     } catch {
-      return resolve4(project.projectRoot, cleoDir);
+      return resolve5(project.projectRoot, cleoDir);
     }
   }
   try {
-    return resolve4(getProjectRoot(cwd), cleoDir);
+    return resolve5(getProjectRoot(cwd), cleoDir);
   } catch (err) {
     if (opts?.bootstrap) {
-      return resolve4(cwd ?? process.cwd(), cleoDir);
+      return resolve5(cwd ?? process.cwd(), cleoDir);
     }
     if (_cwdHasGitAncestor(cwd)) {
       throw err;
     }
-    return resolve4(cwd ?? process.cwd(), cleoDir);
+    return resolve5(cwd ?? process.cwd(), cleoDir);
   }
 }
 function _resolveProjectByCwdFromNexus(cwd) {
@@ -29156,7 +29328,7 @@ function _resolveProjectByCwdFromNexus(cwd) {
     const cleoHome = getCleoHome();
     const globalDbPath = join15(cleoHome, "cleo.db");
     if (!existsSync15(globalDbPath)) return null;
-    const start = resolve4(cwd ?? process.cwd());
+    const start = resolve5(cwd ?? process.cwd());
     let current = start;
     const DatabaseSync2 = _getDatabaseSyncCtor();
     const db = new DatabaseSync2(globalDbPath, { readOnly: true });
@@ -29189,7 +29361,7 @@ function _cleoDirEnvOverride() {
 }
 function _findCleoDirRoot(cwd) {
   const homeRoot = homedir();
-  let current = resolve4(cwd ?? process.cwd());
+  let current = resolve5(cwd ?? process.cwd());
   while (true) {
     const isDangerousRoot = current === homeRoot || current === "/" || current === "";
     if (!isDangerousRoot) {
@@ -29219,7 +29391,7 @@ function resolveCleoDir(cwd) {
   if (root !== null) {
     return join15(root, ".cleo");
   }
-  const start = resolve4(cwd ?? process.cwd());
+  const start = resolve5(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const mainRepo = _resolveMainRepoFromGitlink(current);
@@ -29255,15 +29427,15 @@ function _resolveCleoDir(cwd) {
   const project = _pathsResolveProjectByCwd(cwd);
   if (project !== null) {
     try {
-      return resolve4(getProjectRoot(cwd), cleoDir);
+      return resolve5(getProjectRoot(cwd), cleoDir);
     } catch {
-      return resolve4(project.projectRoot, cleoDir);
+      return resolve5(project.projectRoot, cleoDir);
     }
   }
   return getCleoDirAbsolute(cwd);
 }
 function _cwdHasGitAncestor(cwd) {
-  const start = resolve4(cwd ?? process.cwd());
+  const start = resolve5(cwd ?? process.cwd());
   let current = start;
   while (true) {
     const gitMarker = join15(current, ".git");
@@ -29363,7 +29535,7 @@ function getProjectRoot(cwd) {
     }
     return cleoDirEnv;
   }
-  const start = resolve4(cwd ?? process.cwd());
+  const start = resolve5(cwd ?? process.cwd());
   let current = start;
   const mainRepoFromStart = _resolveMainRepoFromGitlink(start);
   if (mainRepoFromStart !== null) return mainRepoFromStart;
@@ -29456,7 +29628,7 @@ async function registerProjectOnEncounter(projectRoot, infoProjectId) {
     const db = await getNexusDb2();
     const existingRows = await db.select().from(projectRegistry2).where(eq2(projectRegistry2.projectId, immutableId)).limit(1);
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const resolvedPath = resolve4(projectRoot);
+    const resolvedPath = resolve5(projectRoot);
     const projectName = _readProjectNameFromInfo(resolvedPath) || basename4(projectRoot) || "unnamed";
     if (existingRows.length > 0) {
       const existingPath = existingRows[0].projectPath;
@@ -33317,7 +33489,7 @@ function storedToResolved(stored) {
   };
 }
 function sleep2(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function backoffMs(policy, attempt) {
   const base = policy.baseDelayMs * 2 ** attempt;
@@ -35931,9 +36103,9 @@ var init_chat_completions = __esm({
           outputTokens: response.usage?.completion_tokens ?? 0
         };
         const promptDetails = response.usage?.["prompt_tokens_details"];
-        const cached2 = promptDetails?.["cached_tokens"];
-        if (typeof cached2 === "number" && cached2 > 0) {
-          usage.cachedTokens = cached2;
+        const cached3 = promptDetails?.["cached_tokens"];
+        if (typeof cached3 === "number" && cached3 > 0) {
+          usage.cachedTokens = cached3;
         }
         return {
           id: response.id ?? `chat-${Date.now().toString(36)}`,
@@ -36175,9 +36347,9 @@ function normalizeUsage(usage) {
   const outputTokens = usage["output_tokens"] ?? 0;
   const normalized = { inputTokens, outputTokens };
   const details = usage["input_tokens_details"];
-  const cached2 = details?.["cached_tokens"];
-  if (typeof cached2 === "number" && cached2 > 0) {
-    normalized.cachedTokens = cached2;
+  const cached3 = details?.["cached_tokens"];
+  if (typeof cached3 === "number" && cached3 > 0) {
+    normalized.cachedTokens = cached3;
   }
   return normalized;
 }
@@ -37211,7 +37383,7 @@ function normalizeOllamaToolCall(tc) {
   };
 }
 function sleep3(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 var OLLAMA_DEFAULT_BASE_URL, MAX_RETRIES, INITIAL_BACKOFF_MS, RETRYABLE_STATUS_CODES, OllamaTransport;
 var init_ollama2 = __esm({
@@ -57725,7 +57897,7 @@ function createProviderToolFactoryWithOutputSchema({
     supportsDeferredResults
   });
 }
-async function resolve5(value) {
+async function resolve6(value) {
   if (typeof value === "function") {
     value = value();
   }
@@ -61759,14 +61931,14 @@ var init_dist4 = __esm({
         headers
       }) {
         return combineHeaders(
-          await resolve5(this.config.headers),
+          await resolve6(this.config.headers),
           headers,
           betas.size > 0 ? { "anthropic-beta": Array.from(betas).join(",") } : {}
         );
       }
       async getBetasFromHeaders(requestHeaders) {
         var _a17, _b16;
-        const configHeaders = await resolve5(this.config.headers);
+        const configHeaders = await resolve6(this.config.headers);
         const configBetaHeader = (_a17 = configHeaders["anthropic-beta"]) != null ? _a17 : "";
         const requestBetaHeader = (_b16 = requestHeaders == null ? void 0 : requestHeaders["anthropic-beta"]) != null ? _b16 : "";
         return new Set(
@@ -65350,6 +65522,76 @@ var init_model_runner = __esm({
   }
 });
 
+// packages/core/src/llm/local-inference-probe.ts
+function extractModels(body) {
+  if (body === null || typeof body !== "object") return [];
+  const rec = body;
+  if (Array.isArray(rec.models)) {
+    return rec.models.map(
+      (m) => m !== null && typeof m === "object" ? m.name ?? m.model : void 0
+    ).filter((n) => typeof n === "string");
+  }
+  if (Array.isArray(rec.data)) {
+    return rec.data.map((m) => m !== null && typeof m === "object" ? m.id : void 0).filter((n) => typeof n === "string");
+  }
+  return [];
+}
+async function detectLocalInference(opts = {}) {
+  if (process.env["CLEO_DISABLE_LOCAL_INFERENCE"]?.trim()) return null;
+  if (!opts.force && cached2 !== void 0) return cached2;
+  for (const endpoint of LOCAL_ENDPOINTS) {
+    try {
+      const response = await fetch(endpoint.tagsUrl, {
+        signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+      });
+      if (!response.ok) continue;
+      const models = extractModels(await response.json());
+      if (models.length === 0) continue;
+      cached2 = {
+        name: endpoint.name,
+        baseUrl: endpoint.baseUrl,
+        openAiBaseUrl: endpoint.openAiBaseUrl,
+        models
+      };
+      return cached2;
+    } catch {
+    }
+  }
+  cached2 = null;
+  return cached2;
+}
+async function listOllamaModels(baseUrl) {
+  try {
+    const url2 = `${baseUrl.replace(/\/+$/, "")}/api/tags`;
+    const response = await fetch(url2, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+    if (!response.ok) return [];
+    return extractModels(await response.json());
+  } catch {
+    return [];
+  }
+}
+var LOCAL_ENDPOINTS, PROBE_TIMEOUT_MS, cached2;
+var init_local_inference_probe = __esm({
+  "packages/core/src/llm/local-inference-probe.ts"() {
+    "use strict";
+    LOCAL_ENDPOINTS = [
+      {
+        name: "ollama",
+        tagsUrl: "http://127.0.0.1:11434/api/tags",
+        baseUrl: "http://127.0.0.1:11434",
+        openAiBaseUrl: "http://127.0.0.1:11434/v1"
+      },
+      {
+        name: "lm-studio",
+        tagsUrl: "http://127.0.0.1:1234/v1/models",
+        baseUrl: "http://127.0.0.1:1234",
+        openAiBaseUrl: "http://127.0.0.1:1234/v1"
+      }
+    ];
+    PROBE_TIMEOUT_MS = 300;
+  }
+});
+
 // packages/core/src/llm/catalog-model-resolver.ts
 var catalog_model_resolver_exports = {};
 __export(catalog_model_resolver_exports, {
@@ -65434,9 +65676,9 @@ var init_catalog_model_resolver = __esm({
 // packages/core/src/llm/cross-provider-selector.ts
 import { totalmem as totalmem2 } from "node:os";
 async function probeOllamaAlive(baseUrl) {
-  const cached2 = _ollamaProbeCache.get(baseUrl);
-  if (cached2 && Date.now() - cached2.checkedAt < OLLAMA_PROBE_TTL_MS) {
-    return cached2.alive;
+  const cached3 = _ollamaProbeCache.get(baseUrl);
+  if (cached3 && Date.now() - cached3.checkedAt < OLLAMA_PROBE_TTL_MS) {
+    return cached3.alive;
   }
   let alive = false;
   try {
@@ -65478,6 +65720,16 @@ function isProvisioned(provider) {
   const cred = resolveCredentials(provider);
   return (cred.apiKey?.trim().length ?? 0) > 0;
 }
+function reconcileOllamaModel(preferred, installed) {
+  if (installed.length === 0) return preferred;
+  if (installed.includes(preferred)) return preferred;
+  const family = preferred.split(":")[0];
+  if (family !== void 0 && family !== "") {
+    const sameFamily = installed.find((m) => m.split(":")[0] === family);
+    if (sameFamily !== void 0) return sameFamily;
+  }
+  return installed[0] ?? preferred;
+}
 function scoreProvider(provider, providerTier, taskTier, ollamaAlive, costInputPerMillion) {
   let score = TIER_BASE[providerTier];
   if (taskTier === "frontier" && providerTier === "frontier") {
@@ -65510,6 +65762,7 @@ function roleTierFor(role) {
 }
 async function selectBestProvisioned(role, opts) {
   const taskTier = roleTierFor(role);
+  const excluded = new Set(opts.exclude ?? []);
   for (const id of BUILTIN_PROVIDER_IDS) {
     const creds = await listCredentials(id);
     const hasExpiredOAuth = creds.some(
@@ -65534,10 +65787,23 @@ async function selectBestProvisioned(role, opts) {
   }
   const provisionedIds = [];
   for (const id of BUILTIN_PROVIDER_IDS) {
+    if (excluded.has(id)) continue;
     if (isProvisioned(id)) {
       provisionedIds.push(id);
     }
   }
+  let localModels = [];
+  if (!excluded.has("ollama") && !provisionedIds.includes("ollama")) {
+    const local = await detectLocalInference();
+    if (local !== null && local.name === "ollama") {
+      provisionedIds.push("ollama");
+      localModels = local.models;
+      logger4.debug(
+        { baseUrl: local.baseUrl, models: local.models },
+        "cross-provider-selector: unlisted ollama daemon is live \u2014 admitting as provisioned"
+      );
+    }
+  }
   if (provisionedIds.length === 0) {
     logger4.warn(
       {
@@ -65554,11 +65820,12 @@ async function selectBestProvisioned(role, opts) {
   const { resolveProviderDefaultModel: resolveProviderDefaultModel2, catalogKeyForProvider: catalogKeyForProvider2 } = await Promise.resolve().then(() => (init_catalog_model_resolver(), catalog_model_resolver_exports));
   const { pickCredentialForProvider: pickCredentialForProvider2 } = await Promise.resolve().then(() => (init_credentials_store(), credentials_store_exports));
   const ollamaProvisioned = provisionedIds.includes("ollama");
-  let ollamaAlive = false;
-  if (ollamaProvisioned) {
+  let ollamaAlive = localModels.length > 0;
+  if (ollamaProvisioned && !ollamaAlive) {
     const profile = await getProviderProfile2("ollama");
     const ollamaBase = profile?.baseUrl ?? "http://localhost:11434";
     ollamaAlive = await probeOllamaAlive(ollamaBase);
+    if (ollamaAlive) localModels = await listOllamaModels(ollamaBase);
   }
   const scored = [];
   for (const id of provisionedIds) {
@@ -65588,6 +65855,7 @@ async function selectBestProvisioned(role, opts) {
     } else {
       model = ollamaDefaultModelForTier(winner.tier, ramBytes);
     }
+    model = reconcileOllamaModel(model, localModels);
     const catalogKey = catalogKeyForProvider2(winner.id);
     const catalogModel = resolveProviderDefaultModel2(catalogKey);
     if (!catalogModel?.startsWith("gemma4")) {
@@ -65631,6 +65899,7 @@ var init_cross_provider_selector = __esm({
     init_credential_pool();
     init_credentials2();
     init_credentials_store();
+    init_local_inference_probe();
     logger4 = getLogger("llm-cross-provider-selector");
     BUILTIN_PROVIDER_IDS = [
       "anthropic",
@@ -65747,6 +66016,7 @@ __export(role_resolver_exports, {
   HYGIENE_FALLBACK_MODEL: () => HYGIENE_FALLBACK_MODEL,
   IMPLICIT_FALLBACK_MODEL: () => IMPLICIT_FALLBACK_MODEL,
   IMPLICIT_FALLBACK_PROVIDER: () => IMPLICIT_FALLBACK_PROVIDER,
+  LOCAL_PLACEHOLDER_TOKEN: () => LOCAL_PLACEHOLDER_TOKEN,
   resolveAnthropicForRole: () => resolveAnthropicForRole,
   resolveLLMForRole: () => resolveLLMForRole
 });
@@ -65850,6 +66120,16 @@ async function selectProviderModel(llm, role, systemKey, profileOverride, projec
     source: "implicit-fallback"
   };
 }
+async function applyProviderExclusions(selected, role, projectRoot, exclude) {
+  if (exclude === void 0 || exclude.length === 0) return selected;
+  if (!exclude.includes(selected.provider)) return selected;
+  try {
+    const substitute = await selectBestProvisioned(role, { projectRoot, exclude });
+    if (substitute !== null) return substitute;
+  } catch {
+  }
+  return selected;
+}
 async function resolveCredentialForRole(provider, credentialLabel, projectRoot) {
   try {
     await new CredentialPool(provider).refreshExpiredOAuth();
@@ -65864,7 +66144,9 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
           provider,
           apiKey: stored.accessToken,
           source: "cred-file",
-          authType: wireAuthType
+          authType: wireAuthType,
+          // T12081: preserve the stored endpoint (Ollama/LM Studio/vLLM/…).
+          baseUrl: stored.baseUrl ?? null
         },
         usedLabel: stored.label
       };
@@ -65880,7 +66162,9 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
           provider,
           apiKey: picked.accessToken,
           source: "cred-file",
-          authType: wireAuthType
+          authType: wireAuthType,
+          // T12081: preserve the stored endpoint (Ollama/LM Studio/vLLM/…).
+          baseUrl: picked.baseUrl ?? null
         },
         usedLabel: picked.label
       };
@@ -65890,6 +66174,23 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
   if (cred.apiKey) {
     return { credential: cred, usedLabel: void 0 };
   }
+  if (provider === "ollama") {
+    const local = await detectLocalInference();
+    if (local !== null && local.name === "ollama") {
+      return {
+        credential: {
+          provider,
+          apiKey: LOCAL_PLACEHOLDER_TOKEN,
+          source: "local-daemon",
+          authType: "api_key",
+          // ROOT url, not the `/v1` form: `deriveApiWire('ollama')` selects the
+          // NATIVE transport, which appends `/api/chat` itself.
+          baseUrl: local.baseUrl
+        },
+        usedLabel: void 0
+      };
+    }
+  }
   return { credential: null, usedLabel: void 0 };
 }
 async function resolveLLMForRole(role, opts) {
@@ -65902,13 +66203,19 @@ async function resolveLLMForRole(role, opts) {
     config2 = void 0;
   }
   const llmBlock = readLlmBlock(config2);
-  const { provider, model, credentialLabel, source } = await selectProviderModel(
+  const selected = await selectProviderModel(
     llmBlock,
     role,
     opts?.systemKey,
     opts?.profileOverride,
     projectRoot
   );
+  const { provider, model, credentialLabel, source } = await applyProviderExclusions(
+    selected,
+    role,
+    projectRoot,
+    opts?.excludeProviders
+  );
   const { credential, usedLabel } = await resolveCredentialForRole(
     provider,
     credentialLabel,
@@ -65934,7 +66241,12 @@ async function resolveLLMForRole(role, opts) {
     credentialMetadata = {
       provider: credential.provider,
       source: credential.source,
-      authType: wireAuthType
+      authType: wireAuthType,
+      // T12081: carry the credential's OWN endpoint. Without it a consumer
+      // building a transport cannot tell that this credential targets a local
+      // or proxied host, and falls back to the provider's public API — which
+      // rejected every Ollama / LM Studio / vLLM / OpenRouter credential 401.
+      baseUrl: credential.baseUrl ?? null
     };
     sealedCredential = makeSealedCredential({
       provider: credential.provider,
@@ -65976,7 +66288,7 @@ async function resolveAnthropicForRole(role, opts) {
     model: llm.model
   };
 }
-var IMPLICIT_FALLBACK_PROVIDER, HYGIENE_FALLBACK_MODEL;
+var IMPLICIT_FALLBACK_PROVIDER, LOCAL_PLACEHOLDER_TOKEN, HYGIENE_FALLBACK_MODEL;
 var init_role_resolver = __esm({
   "packages/core/src/llm/role-resolver.ts"() {
     "use strict";
@@ -65987,10 +66299,12 @@ var init_role_resolver = __esm({
     init_credentials_store();
     init_cross_provider_selector();
     init_fallback_model();
+    init_local_inference_probe();
     init_sealed_credential();
     init_system_of_use_registry();
     init_anthropic_client_factory();
     IMPLICIT_FALLBACK_PROVIDER = "anthropic";
+    LOCAL_PLACEHOLDER_TOKEN = "local";
     HYGIENE_FALLBACK_MODEL = "claude-sonnet-4-6";
   }
 });
@@ -66849,8 +67163,8 @@ var _engineRegistry = /* @__PURE__ */ new Map([
 registerContextEngine("llm-summarization", _engineRegistry.get("compression"));
 var _executorCache = /* @__PURE__ */ new Map();
 async function getLlmExecutor(role) {
-  const cached2 = _executorCache.get(role);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = _executorCache.get(role);
+  if (cached3 !== void 0) return cached3;
   const contextEngine = _engineRegistry.get(role);
   const factory11 = new DefaultLlmExecutorFactory({ contextEngine });
   const executor = await factory11.createForRole(role);