@cleocode/core 2026.9.16 → 2026.9.18

package/migrations/drizzle-nexus/20260924000000_t12315-nexus-parse-cache/migration.sql

@@ -0,0 +1,21 @@
+-- T12315: per-file extraction memo for exact incremental code-graph indexing.
+--
+-- Cross-file resolution needs every file's extraction (raw call sites, access
+-- sites, re-export records, import bindings), most of which is never stored in
+-- `nexus_nodes` / `nexus_relations`. Rather than approximate those facts from
+-- published rows, the pipeline persists each file's extraction here, keyed by
+-- path and valid only for the exact bytes (`content_hash`) and extractor build
+-- (`fingerprint`) that produced it. `generation` names the publication
+-- generation embedded in the payload's anonymous identities so reuse can
+-- rebind it. Rows are replaced in the same transaction as the graph they
+-- describe (`publishNexusGraph`), so the cache never outlives or precedes its
+-- generation.
+--
+-- Underscore-prefixed like `_nexus_meta`: pipeline bookkeeping, not graph data.
+CREATE TABLE IF NOT EXISTS _nexus_parse_cache (
+	path TEXT PRIMARY KEY NOT NULL,
+	content_hash TEXT NOT NULL,
+	fingerprint TEXT NOT NULL,
+	generation TEXT NOT NULL,
+	payload BLOB NOT NULL
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/core",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "description": "CLEO core business logic kernel — tasks, sessions, memory, orchestration, lifecycle, with bundled SQLite store",
   "type": "module",
   "main": "./dist/index.js",
@@ -471,16 +471,16 @@
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@cleocode/adapters": "2026.9.16",
-    "@cleocode/agents": "2026.9.16",
-    "@cleocode/caamp": "2026.9.16",
-    "@cleocode/contracts": "2026.9.16",
-    "@cleocode/git-shim": "2026.9.16",
-    "@cleocode/lafs": "2026.9.16",
-    "@cleocode/nexus": "2026.9.16",
-    "@cleocode/paths": "2026.9.16",
-    "@cleocode/skills": "2026.9.16",
-    "@cleocode/worktree": "2026.9.16"
+    "@cleocode/adapters": "2026.9.18",
+    "@cleocode/caamp": "2026.9.18",
+    "@cleocode/contracts": "2026.9.18",
+    "@cleocode/agents": "2026.9.18",
+    "@cleocode/git-shim": "2026.9.18",
+    "@cleocode/lafs": "2026.9.18",
+    "@cleocode/nexus": "2026.9.18",
+    "@cleocode/paths": "2026.9.18",
+    "@cleocode/worktree": "2026.9.18",
+    "@cleocode/skills": "2026.9.18"
   },
   "engines": {
     "node": ">=24.16.0"
@@ -506,7 +506,7 @@
     "@types/proper-lockfile": "^4.1.4",
     "@types/tar": "^6.1.13",
     "@types/write-file-atomic": "^4.0.3",
-    "@cleocode/utils": "2026.9.16"
+    "@cleocode/utils": "2026.9.18"
   },
   "repository": {
     "type": "git",
@@ -515,7 +515,7 @@
   },
   "optionalDependencies": {
     "llmtxt": "^2026.5.15",
-    "@cleocode/studio": "^2026.9.16"
+    "@cleocode/studio": "^2026.9.18"
   },
   "scripts": {
     "build": "tsc && node scripts/copy-selfimprove-fixtures.mjs",

package/templates/CLEO-INJECTION.md

@@ -1,6 +1,6 @@
 # CLEO Protocol
 
-Version: 2.20.5 | CLI-only dispatch | `cleo <command> [args]`
+Version: 2.20.6 | CLI-only dispatch | `cleo <command> [args]`
 
 <!-- CLEO-INJECTION:section=session-start -->
 ## Universal protocol
@@ -194,9 +194,9 @@ Small legacy DBs beside large snapshots do not prove corruption. `cleo doctor su
 | Symbols touched by a task | `cleo nexus task-symbols <taskId>` |
 | Why does this symbol exist / who needs it | `cleo nexus why <symbol>` |
 | Detected communities / execution flows | `cleo nexus clusters` / `flows` |
-| Rebuild the index | `cleo nexus analyze` |
+| Refresh the index | `cleo nexus analyze` |
 
-**FIRST CALL IS `cleo nexus status`.** Check `nodeCount`, `lastIndexedAt`, `staleFileCount`/`fileCount`. No auto-refresh: newer symbols may return `E_NOT_FOUND`. For stale coverage, run `cleo nexus analyze` or inspect source with `git grep` and disclose that basis. Impact/context `E_NOT_FOUND` includes index size, median age and a repair command; inspect these first.
+**FIRST CALL IS `cleo nexus status`.** Check `nodeCount`, `lastIndexedAt`, `staleFileCount`/`fileCount`. Queries report `_nexus.freshness` and auto-refresh ≤25 stale files; beyond that they warn `W_NEXUS_INDEX_STALE`. `analyze` is incremental (`--full` rebuilds). For stale coverage, refresh or inspect source with `git grep` and disclose that basis. Impact/context `E_NOT_FOUND` includes index size, median age and a repair command; inspect these first.
 
 **Project resolution**: `--project-id` > `--path` > `cwd`.
 Default ID = `base64url(path).slice(0,32)`.

package/templates/cleo-gitignore

@@ -19,6 +19,11 @@
 #   parent-repo ignore rules, this file must NOT re-include those four
 #   files — doing so would unignore them at the project repository level
 #   and re-open the T5158 data-loss vector.
+#
+# ADR-094 (amends ADR-013 §9, 2026-09-24, T12325): `project-id` IS tracked. It holds
+#   the write-once portable project identity. CLEO creates it once and never
+#   rewrites it, so git has nothing to overwrite — unlike the four mutable
+#   files above, whose hazard was git replacing live state CLEO rewrites.
 # =============================================================================
 
 # Step 1: Ignore everything in .cleo/
@@ -34,6 +39,8 @@
 # Step 3: Allow project configuration files that are SAFE to track
 # (detected project facts and bootstrap scripts — not runtime state).
 !project-context.json
+# T12325: write-once portable project identity (ADR-094, amends ADR-013 §9).
+!project-id
 !setup-otel.sh
 !DATA-SAFETY-IMPLEMENTATION-SUMMARY.md