@bartolli/kmd 0.6.0 → 0.8.0

package/dist/kmd.mjs

@@ -116,7 +116,7 @@ CREATE TABLE IF NOT EXISTS meta (
   }
 });
 
-// ../cli/src/config.ts
+// ../db/src/vault-config.ts
 import { readFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { parse } from "yaml";
@@ -131,6 +131,9 @@ function isValidRegex(pattern) {
 function kindName(entry) {
   return typeof entry === "string" ? entry : entry.name;
 }
+function configJsonSchema() {
+  return z.toJSONSchema(VaultConfigSchema, { target: "draft-7" });
+}
 async function loadVaultConfig(vaultRoot2) {
   const path = join2(vaultRoot2, "vault.yaml");
   let raw;
@@ -147,43 +150,54 @@ ${issues}`);
   }
   return parsed.data;
 }
-var ScopeSchema, KindEntrySchema, WhenSchema, TriggerSchema, TriggersSchema, VaultConfigSchema, BUILT_IN_KINDS;
-var init_config = __esm({
-  "../cli/src/config.ts"() {
+var ScopeSchema, KindEntrySchema, WhenSchema, DedupSchema, TriggerSchema, TriggersSchema, VaultConfigSchema, BUILT_IN_KINDS;
+var init_vault_config = __esm({
+  "../db/src/vault-config.ts"() {
     "use strict";
-    ScopeSchema = z.object({
-      repo: z.string().optional(),
-      methodology: z.string().optional(),
-      status: z.string()
+    ScopeSchema = z.strictObject({
+      repo: z.string().optional().describe(
+        "Consumer repo path (~ expands). Load-bearing for kmd hook: the active scope resolves by matching the session cwd against it."
+      ),
+      methodology: z.string().optional().describe("Must appear in the methodologies list."),
+      status: z.string().describe("Free string; keep within statuses by convention.")
     });
     KindEntrySchema = z.union([
       z.string(),
-      z.object({
+      z.strictObject({
         name: z.string(),
-        signal: z.string(),
-        where: z.string()
+        signal: z.string().describe("When to pick this kind."),
+        where: z.string().describe("Path pattern pages of this kind follow.")
       })
     ]);
     WhenSchema = z.union([
       z.string(),
-      z.object({
+      z.strictObject({
         name: z.enum(["newer-than"]),
         fresh: z.array(z.string().min(1)).min(1),
         than: z.array(z.string().min(1)).min(1)
       })
     ]);
-    TriggerSchema = z.object({
-      id: z.string().min(1),
+    DedupSchema = z.union([
+      z.enum(["session", "never"]),
+      z.strictObject({ minutes: z.number().int().positive() })
+    ]);
+    TriggerSchema = z.strictObject({
+      id: z.string().min(1).describe("Unique per scope list; duplicates keep the first occurrence."),
       on: z.enum(["prompt", "pretool"]),
-      enforce: z.enum(["inject", "warn", "block"]),
-      keywords: z.array(z.string().min(1)).optional(),
-      intent: z.array(z.string()).optional(),
-      tool: z.string().optional(),
-      args_match: z.string().optional(),
-      files: z.array(z.string().min(1)).optional(),
-      when: WhenSchema.optional(),
-      text: z.string().optional(),
-      reason: z.string().optional()
+      enforce: z.enum(["inject", "warn", "block"]).describe("inject: context line \xB7 warn: stderr \xB7 block: deny with reason."),
+      keywords: z.array(z.string().min(1)).optional().describe("Word-boundary, porter-stemmed match. Prompt triggers need keywords or intent."),
+      intent: z.array(z.string()).optional().describe("Case-insensitive regexes over the raw prompt \u2014 the stemming escape hatch."),
+      tool: z.string().optional().describe("Exact tool name; pretool matchers AND-compose."),
+      args_match: z.string().optional().describe("Regex over the serialized tool input."),
+      files: z.array(z.string().min(1)).optional().describe("Globs against the paths the tool touches; pretool triggers only."),
+      when: WhenSchema.optional().describe(
+        "Precondition \u2014 the gate fires only when it is UNMET. newer-than: the newest page matching fresh must carry frontmatter updated at or after the newest matching than."
+      ),
+      text: z.string().optional().describe("Required for inject and warn \u2014 the line emitted."),
+      reason: z.string().optional().describe("Required for block \u2014 the denial the agent reads."),
+      dedup: DedupSchema.optional().describe(
+        "Re-fire policy: session (default, once per session), never, or {minutes: N} for at most once per bucket. Rejected on block triggers \u2014 blocks are dedup-exempt."
+      )
     }).superRefine((trigger, ctx) => {
       if (trigger.on === "prompt" && !trigger.keywords?.length && !trigger.intent?.length) {
         ctx.addIssue({
@@ -203,6 +217,12 @@ var init_config = __esm({
           message: `trigger "${trigger.id}": files applies to pretool triggers only`
         });
       }
+      if (trigger.enforce === "block" && trigger.dedup !== void 0) {
+        ctx.addIssue({
+          code: "custom",
+          message: `block trigger "${trigger.id}" may not set dedup \u2014 blocks fire on every matching event`
+        });
+      }
       if (trigger.enforce === "block" ? trigger.reason === void 0 : trigger.text === void 0) {
         ctx.addIssue({
           code: "custom",
@@ -221,22 +241,28 @@ var init_config = __esm({
       }
     });
     TriggersSchema = z.record(z.string(), z.array(TriggerSchema));
-    VaultConfigSchema = z.object({
-      scopes: z.record(z.string(), ScopeSchema),
-      kinds: z.array(KindEntrySchema),
-      statuses: z.array(z.string()),
-      methodologies: z.array(z.string()),
-      tags: z.object({
-        canonical: z.array(z.string()),
-        aliases: z.record(z.string(), z.string())
+    VaultConfigSchema = z.strictObject({
+      scopes: z.record(z.string(), ScopeSchema).describe("Scope name \u2192 entry; key = directory name under projects/."),
+      kinds: z.array(KindEntrySchema).describe(
+        "Page kind vocabulary; validate-enforced. Object form adds a kind-selector row to wiki://authoring."
+      ),
+      statuses: z.array(z.string()).describe("Page status vocabulary; validate-enforced."),
+      methodologies: z.array(z.string()).describe("Methodology vocabulary for pages and scope entries."),
+      tags: z.strictObject({
+        canonical: z.array(z.string()).describe("Approved tags."),
+        aliases: z.record(z.string(), z.string()).describe("Alias \u2192 canonical; validate warns on alias use.")
       }),
-      authoring_rules: z.string().optional(),
-      authoring_rules_extra: z.string().optional(),
-      sync_protocol: z.string().optional(),
-      sync_protocol_extra: z.string().optional(),
-      triggers: TriggersSchema.optional(),
-      triggers_extra: TriggersSchema.optional()
-    }).superRefine((config, ctx) => {
+      authoring_rules: z.string().optional().describe("Replaces the served \xA7 Authoring rules entirely \u2014 escape hatch."),
+      authoring_rules_extra: z.string().optional().describe("Appended after the served \xA7 Authoring rules."),
+      sync_protocol: z.string().optional().describe("Replaces the served \xA7 Resync protocol entirely \u2014 escape hatch."),
+      sync_protocol_extra: z.string().optional().describe("Appended after the served \xA7 Resync protocol."),
+      triggers: TriggersSchema.optional().describe(
+        'Full-replace of the trigger base per scope \u2014 escape hatch. "_all" is reserved for triggers_extra.'
+      ),
+      triggers_extra: TriggersSchema.optional().describe(
+        'Appended per scope after the engine defaults; the reserved "_all" key fires in every session.'
+      )
+    }).describe("kmd vault.yaml \u2014 controlled vocabulary and gate triggers.").superRefine((config, ctx) => {
       for (const [name, scope] of Object.entries(config.scopes)) {
         if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
           ctx.addIssue({
@@ -310,11 +336,287 @@ var init_frontmatter = __esm({
   }
 });
 
+// ../cli/src/init-templates.ts
+var VAULT_TEMPLATES;
+var init_init_templates = __esm({
+  "../cli/src/init-templates.ts"() {
+    "use strict";
+    VAULT_TEMPLATES = {
+      "note.md": '---\ntitle: {{title}}\ntags: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n',
+      "project-adr.md": '---\ntitle: {{title}}\nkind: adr\nscope:\nstatus: active\nsummary:\ntags: []\nsupersedes:\nsuperseded_by:\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Status\n\n> [!info] Active\n\n## Context\n\nThe forces in tension \u2014 what made this a decision rather than an\nobvious step. Name the constraints; skip the history recap.\n\n## Decision\n\nWhat was decided, precisely. Predicates only \u2014 falsifiable, not\naspirational.\n\n## Rationale\n\nWhy this side won: which alternatives were live, and what killed each.\nAn ADR with no rejected alternative is a spec in disguise.\n\n## Consequences\n\nWhat this commits the project to going forward \u2014 including the costs\naccepted, not just the benefits claimed.\n\n## Links\n\n-\n',
+      "project-index.md": `---
+title: {{title}}
+kind: project
+methodology: sdd
+phase: 1
+repo:
+scope:
+status: active
+tags: []
+summary:
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+One paragraph. What this project is and what it delivers.
+
+## Current Phase
+
+What's in flight right now. 1\u20133 sentences.
+
+## Links
+
+- [[projects/{{title}}/primer]]
+
+## Sources
+
+-
+`,
+      "project-ops.md": `---
+title: {{title}}
+kind: ops
+scope:
+status: active
+summary:
+tags: []
+sources: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+What this runbook operates and when it runs.
+
+## Context
+
+What triggers this flow; what breaks when it's skipped.
+
+## Details
+
+Numbered steps executable without asking: exact commands, expected
+output, failure modes and their recovery. Predicates only \u2014 if a step
+needs judgment, say whose.
+
+## Links
+
+-
+
+## Sources
+
+-
+`,
+      "project-plan.md": `---
+title: {{title}}
+kind: plan
+scope:
+status: active
+summary:
+tags: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Goal
+
+One sentence: what this phase delivers. If it needs two, it's two
+plans.
+
+## Scope
+
+What's in and \u2014 more important \u2014 what's out. Out-of-scope lines stop
+scope creep better than in-scope lines define it.
+
+## Milestones
+
+Checkable outcomes, not activities. Tick here; don't cascade ticks to
+index.md unless phase or status changed.
+
+1.
+2.
+
+## Dependencies
+
+-
+
+## Status Log
+
+Dated one-liners, newest first. This is the only history surface \u2014
+primer and index stay clean.
+
+- {{date}}: Phase started.
+`,
+      "project-primer.md": "---\ncreated: \"{{date}}\"\nupdated: {{date}}\n---\n\n# Primer\n\n## Current Focus\n\nWhat we're working on right now. 1\u20133 sentences. Not a history log \u2014\nprogress lives in plan checkboxes; history lives in git.\n\n## Open Questions\n\nCurrently-open questions only. Strip on resolution; reflect the\nresolution in the relevant ADR or spec, not here.\n\n-\n\n## Blocked On\n\nNothing currently. List only items genuinely blocking forward\nprogress.\n\n## Load-bearing invariants (optional)\n\nFacts not derivable from code or commits \u2014 pipeline orderings, sync\nconstraints, file-location rationales. The kind of fact a fresh-context\nagent would otherwise re-derive incorrectly. Durable across sessions.\n\n## Read Order (optional)\n\n\u22645 entries. Wiki/doc pointers \u2014 what to read to orient. Each entry\none line: `[[wikilink]] \u2014 why`.\n\n1.\n\n## Working set (optional)\n\n\u226410 entries. File pointers (code, fixtures, configs) for the\nimmediate Next Steps, with one-line context. Lets a fresh-context\nagent skip the discovery loop. Task-scoped \u2014 refresh when focus\nshifts. Most valuable when transitioning phases or starting a new\nfeature; can be skipped mid-slice when the immediate context already\ncarries it.\n\n- `path/to/file` \u2014 why it's relevant for the next steps.\n",
+      "project-spec.md": `---
+title: {{title}}
+kind: spec
+scope:
+status: active
+summary:
+tags: []
+sources: []
+created: "{{date}}"
+updated: {{date}}
+---
+
+# {{title}}
+
+## Summary
+
+One paragraph, in predicates \u2014 the system's current shape, not its
+history. If you're recording a *choice* between alternatives, stop:
+that's an ADR.
+
+## Context
+
+The question this spec answers and who asks it. One paragraph, no
+narrative arc.
+
+## Details
+
+The actual contract: inputs, outputs, invariants, failure modes. Use
+subsections per concern. Present tense \u2014 the spec describes what IS
+and must match current code at every commit.
+
+## Links
+
+-
+
+## Sources
+
+-
+`,
+      "project-story.md": '---\ntitle: {{title}}\nkind: story\nscope:\nparent:\nstatus: active\ntriage_state: needs-triage\ncategory: enhancement\nblocked_by: []\ntags: []\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## User Story\n\nAs a {{actor}}, I want {{capability}}, so that {{benefit}}.\n\n## Scenarios\n\nScenarios are the test specification \u2014 each becomes a failing test\nbefore implementation. Write observable outcomes, not implementation\nsteps.\n\n**Scenario: {{scenario name}}**\n- Given {{precondition}}\n- When {{action}}\n- Then {{expected outcome}}\n\n**Scenario: {{edge case name}}**\n- Given {{precondition}}\n- When {{action}}\n- Then {{expected outcome}}\n\n## Slices\n\nVertical tracer bullets: each slice ships signature + implementation +\ntests + wiring, independently committable. `AFK` = agent works alone;\n`HITL` = human in the loop.\n\n- [ ] **Slice 1** \u2014 {{description}} \xB7 `AFK` \xB7 [[spec-{{topic}}]]\n- [ ] **Slice 2** \u2014 {{description}} \xB7 `HITL` \xB7 [[adr-{{decision}}]]\n\n## References\n\n- [[spec-{{related-spec}}]]\n- [[adr-{{related-adr}}]]\n',
+      "research-article.md": '---\ntitle: {{title}}\nkind: article\ntopic:\nstatus: active\nsummary:\ntags: []\nsources: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nOne paragraph. What this page covers and why it matters.\n\n## Context\n\nWhy this page exists. The problem or question it addresses.\n\n## Details\n\nThe actual content. Use subsections as needed.\n\n## Links\n\n-\n\n## Sources\n\n-\n',
+      "research-index.md": '---\ntitle: {{title}}\nkind: topic\nstatus: active\nsummary:\nconfidence: medium\nsource_count: 0\ntags: []\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nOne paragraph. What this research topic covers.\n\n## Confidence\n\nWhy the confidence level is what it is. What would raise or lower it.\n\n## Pages\n\n-\n\n## Sources\n\n-\n',
+      "research-src.md": '---\ntitle: {{title}}\nkind: src\ntopic:\nstatus: active\nsummary:\ntags: []\nsource_url:\ncreated: "{{date}}"\nupdated: {{date}}\n---\n\n# {{title}}\n\n## Summary\n\nWhat this source is. Author, origin, year.\n\n## Key Points\n\n-\n\n## Quotes\n\n>\n\n## Relevance\n\nWhy this source matters to the topic.\n\n## Citation\n\n`{author, year, title, url}`\n'
+    };
+  }
+});
+
+// ../cli/src/init.ts
+import { mkdir, readdir, readFile as readFile2, writeFile } from "node:fs/promises";
+import { join as join3, resolve as resolve2 } from "node:path";
+import { stringify } from "yaml";
+async function refreshSchemaFile(root) {
+  const path = join3(root, SCHEMA_FILE);
+  const next = `${JSON.stringify(configJsonSchema(), null, 2)}
+`;
+  try {
+    if (await readFile2(path, "utf8") === next) return false;
+  } catch {
+  }
+  await writeFile(path, next);
+  return true;
+}
+async function scaffoldVault(dir) {
+  const root = resolve2(dir);
+  let entries = [];
+  try {
+    entries = await readdir(root);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  if (entries.includes("vault.yaml")) {
+    throw new Error(`already a vault: ${root} (vault.yaml exists)`);
+  }
+  if (entries.length > 0) {
+    throw new Error(
+      `target is not empty: ${root}
+  found: ${entries.join(", ")}
+  delete it or pick another directory`
+    );
+  }
+  for (const domain of DOMAIN_DIRS) {
+    await mkdir(join3(root, domain), { recursive: true });
+  }
+  await mkdir(join3(root, "templates"), { recursive: true });
+  for (const [file, content] of Object.entries(VAULT_TEMPLATES)) {
+    await writeFile(join3(root, "templates", file), content);
+  }
+  await refreshSchemaFile(root);
+  await writeFile(join3(root, "vault.yaml"), SCHEMA_MODELINE + stringify(STARTER_CONFIG));
+  return root;
+}
+async function promptYesNo(question, input = process.stdin, output = process.stderr) {
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input, output });
+  try {
+    const answer = await rl.question(question);
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+async function runInit(dir, yes = false) {
+  let target = dir;
+  if (!target) {
+    if (yes) {
+      target = ".";
+    } else if (process.stdin.isTTY) {
+      const ok = await promptYesNo(`initialize a vault in ${resolve2(".")}? [y/N] `);
+      if (!ok) {
+        console.error("init: aborted");
+        process.exit(1);
+      }
+      target = ".";
+    } else {
+      console.error("usage: kmd init <dir>  (or --yes to scaffold the current directory)");
+      process.exit(2);
+    }
+  }
+  let root;
+  try {
+    root = await scaffoldVault(target);
+  } catch (err) {
+    console.error(`init: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+  const templateCount = Object.keys(VAULT_TEMPLATES).length;
+  console.log(`initialized empty vault at ${root}
+
+  vault.yaml           starter vocabulary \u2014 add your first scope under scopes:
+  vault.schema.json    IDE validation via the yaml-language-server modeline
+  templates/           ${templateCount} built-in templates (served at wiki://template/...)
+  projects/  research/  notes/
+
+next steps:
+  export WIKI_VAULT=${root}
+  kmd mcp ${root}    # stdio MCP server (prime, search)`);
+}
+var SCHEMA_FILE, SCHEMA_MODELINE, STARTER_CONFIG, DOMAIN_DIRS;
+var init_init = __esm({
+  "../cli/src/init.ts"() {
+    "use strict";
+    init_vault_config();
+    init_init_templates();
+    SCHEMA_FILE = "vault.schema.json";
+    SCHEMA_MODELINE = `# yaml-language-server: $schema=./${SCHEMA_FILE}
+`;
+    STARTER_CONFIG = {
+      scopes: {},
+      kinds: ["project", "spec", "adr", "plan", "story", "ops", "topic", "article", "src", "note"],
+      statuses: ["draft", "active", "superseded", "archived"],
+      methodologies: ["sdd", "tdd", "hybrid"],
+      tags: { canonical: [], aliases: {} }
+    };
+    DOMAIN_DIRS = ["projects", "research", "notes"];
+  }
+});
+
 // ../cli/src/sync.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync } from "node:fs";
-import { readdir, readFile as readFile2 } from "node:fs/promises";
-import { dirname, join as join3, relative, sep } from "node:path";
+import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
+import { dirname, join as join4, relative, sep } from "node:path";
 import { z as z2 } from "zod";
 function loadEnv() {
   const parsed = EnvSchema.safeParse({
@@ -330,18 +632,18 @@ function loadEnv() {
 async function walkMarkdown(root, domain) {
   const out = [];
   async function recurse(dir) {
-    const entries = await readdir(dir, { withFileTypes: true }).catch(() => null);
+    const entries = await readdir2(dir, { withFileTypes: true }).catch(() => null);
     if (!entries) return;
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
       if (entry.isDirectory()) {
-        await recurse(join3(dir, entry.name));
+        await recurse(join4(dir, entry.name));
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        out.push(join3(dir, entry.name));
+        out.push(join4(dir, entry.name));
       }
     }
   }
-  await recurse(join3(root, domain));
+  await recurse(join4(root, domain));
   return out;
 }
 function toRelativePath(root, absolute) {
@@ -480,7 +782,7 @@ async function syncVault(vaultRoot2) {
     let skipped = 0;
     for (const file of files) {
       const path = toRelativePath(vaultRoot2, file);
-      const raw = await readFile2(file, "utf8");
+      const raw = await readFile3(file, "utf8");
       const parsed = parseFrontmatter(raw);
       const fields = buildPageFields(path, raw, parsed, scopes);
       if (!fields) {
@@ -507,6 +809,9 @@ async function syncVault(vaultRoot2) {
     db.exec("INSERT INTO pages_fts(pages_fts) VALUES('rebuild')");
     setMeta(db, "vault_root", canonicalVaultRoot(vaultRoot2));
     setMeta(db, "last_synced", (/* @__PURE__ */ new Date()).toISOString());
+    if (await refreshSchemaFile(vaultRoot2)) {
+      console.error("sync: vault.schema.json refreshed to the running engine");
+    }
     return {
       changed,
       unchanged,
@@ -535,8 +840,9 @@ var init_sync = __esm({
   "../cli/src/sync.ts"() {
     "use strict";
     init_database();
-    init_config();
+    init_vault_config();
     init_frontmatter();
+    init_init();
     EnvSchema = z2.object({
       WIKI_VAULT: z2.string().min(1)
     });
@@ -556,8 +862,8 @@ var init_sync = __esm({
 });
 
 // ../cli/src/validate.ts
-import { readFile as readFile3, stat } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { readFile as readFile4, stat } from "node:fs/promises";
+import { join as join5 } from "node:path";
 function hasIndexableTitle(data) {
   return typeof data.title === "string" && data.title.trim() !== "";
 }
@@ -915,7 +1221,7 @@ async function validateVault(root) {
   const pages = [];
   const linkPages = [];
   for (const { relPath, abs } of files) {
-    const raw = await readFile3(abs, "utf8");
+    const raw = await readFile4(abs, "utf8");
     findings.push(...validatePage(relPath, raw, cfg, refIndex));
     try {
       const parsed = parseFrontmatter(raw);
@@ -929,7 +1235,7 @@ async function validateVault(root) {
   for (const name of customKindNames(cfg)) {
     const file = `templates/${name}.md`;
     try {
-      await stat(join4(root, file));
+      await stat(join5(root, file));
     } catch {
       findings.push({
         path: file,
@@ -945,7 +1251,7 @@ var REQUIRED_FIELDS, TAG_OPTIONAL_KINDS, FOLDER_PATTERNS, UNIVERSAL_FLOOR;
 var init_validate = __esm({
   "../cli/src/validate.ts"() {
     "use strict";
-    init_config();
+    init_vault_config();
     init_frontmatter();
     init_sync();
     REQUIRED_FIELDS = {
@@ -1003,12 +1309,13 @@ __export(cli_exports, {
   resolveCli: () => resolveCli,
   runConfig: () => runConfig,
   runDbReset: () => runDbReset,
+  runInit: () => runInit,
   runSyncCommand: () => runSyncCommand,
   runValidate: () => runValidate,
   vaultRoot: () => vaultRoot
 });
 import { existsSync, readdirSync, rmSync } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { dirname as dirname2, join as join6 } from "node:path";
 import { parseArgs } from "node:util";
 function resolveCli(argv) {
   const { positionals: positionals2 } = parseArgs({ args: argv, allowPositionals: true, strict: false });
@@ -1078,7 +1385,7 @@ function knownVaults() {
   const known = [];
   for (const entry of readdirSync(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const index = join5(root, entry.name, "index.db");
+    const index = join6(root, entry.name, "index.db");
     if (!existsSync(index)) continue;
     const db = openDatabase(index);
     try {
@@ -1141,6 +1448,7 @@ var init_cli = __esm({
     init_database();
     init_sync();
     init_validate();
+    init_init();
   }
 });
 
@@ -1161,7 +1469,7 @@ ${issues}`);
   };
 }
 var EnvSchema2;
-var init_config2 = __esm({
+var init_config = __esm({
   "../mcp/src/config.ts"() {
     "use strict";
     EnvSchema2 = z3.object({
@@ -1193,7 +1501,7 @@ var init_db = __esm({
 // ../mcp/src/lib/diag.ts
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function diag(msg, data) {
   try {
     const line = data ? `${(/* @__PURE__ */ new Date()).toISOString()} pid=${process.pid} ${msg} ${JSON.stringify(data)}
@@ -1207,8 +1515,8 @@ var DIAG_DIR, DIAG_LOG_PATH;
 var init_diag = __esm({
   "../mcp/src/lib/diag.ts"() {
     "use strict";
-    DIAG_DIR = join6(homedir2(), ".local", "state", "wiki-mcp");
-    DIAG_LOG_PATH = join6(DIAG_DIR, "server.log");
+    DIAG_DIR = join7(homedir2(), ".local", "state", "wiki-mcp");
+    DIAG_LOG_PATH = join7(DIAG_DIR, "server.log");
     try {
       mkdirSync3(DIAG_DIR, { recursive: true });
     } catch {
@@ -1235,176 +1543,6 @@ var init_logger = __esm({
   }
 });
 
-// ../mcp/src/vault-config.ts
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join7 } from "node:path";
-import { parse as parse2 } from "yaml";
-import { z as z4 } from "zod";
-function isValidRegex2(pattern) {
-  try {
-    return Boolean(new RegExp(pattern));
-  } catch {
-    return false;
-  }
-}
-function kindName2(entry) {
-  return typeof entry === "string" ? entry : entry.name;
-}
-async function loadVaultConfig2(vaultRoot2) {
-  const path = join7(vaultRoot2, "vault.yaml");
-  let raw;
-  try {
-    raw = await readFile4(path, "utf8");
-  } catch (err) {
-    throw new Error(`vault.yaml not found at ${path}`, { cause: err });
-  }
-  const parsed = VaultConfigSchema2.safeParse(parse2(raw));
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-    throw new Error(`Invalid vault.yaml at ${path}:
-${issues}`);
-  }
-  return parsed.data;
-}
-var ScopeSchema2, KindEntrySchema2, WhenSchema2, TriggerSchema2, TriggersSchema2, VaultConfigSchema2, BUILT_IN_KINDS2;
-var init_vault_config = __esm({
-  "../mcp/src/vault-config.ts"() {
-    "use strict";
-    ScopeSchema2 = z4.object({
-      repo: z4.string().optional(),
-      methodology: z4.string().optional(),
-      status: z4.string()
-    });
-    KindEntrySchema2 = z4.union([
-      z4.string(),
-      z4.object({
-        name: z4.string(),
-        signal: z4.string(),
-        where: z4.string()
-      })
-    ]);
-    WhenSchema2 = z4.union([
-      z4.string(),
-      z4.object({
-        name: z4.enum(["newer-than"]),
-        fresh: z4.array(z4.string().min(1)).min(1),
-        than: z4.array(z4.string().min(1)).min(1)
-      })
-    ]);
-    TriggerSchema2 = z4.object({
-      id: z4.string().min(1),
-      on: z4.enum(["prompt", "pretool"]),
-      enforce: z4.enum(["inject", "warn", "block"]),
-      keywords: z4.array(z4.string().min(1)).optional(),
-      intent: z4.array(z4.string()).optional(),
-      tool: z4.string().optional(),
-      args_match: z4.string().optional(),
-      files: z4.array(z4.string().min(1)).optional(),
-      when: WhenSchema2.optional(),
-      text: z4.string().optional(),
-      reason: z4.string().optional()
-    }).superRefine((trigger, ctx) => {
-      if (trigger.on === "prompt" && !trigger.keywords?.length && !trigger.intent?.length) {
-        ctx.addIssue({
-          code: "custom",
-          message: `prompt trigger "${trigger.id}" needs keywords or intent`
-        });
-      }
-      if (trigger.on === "pretool" && trigger.tool === void 0 && trigger.args_match === void 0 && !trigger.files?.length) {
-        ctx.addIssue({
-          code: "custom",
-          message: `pretool trigger "${trigger.id}" needs a tool, args_match, or files matcher`
-        });
-      }
-      if (trigger.on === "prompt" && trigger.files !== void 0) {
-        ctx.addIssue({
-          code: "custom",
-          message: `trigger "${trigger.id}": files applies to pretool triggers only`
-        });
-      }
-      if (trigger.enforce === "block" ? trigger.reason === void 0 : trigger.text === void 0) {
-        ctx.addIssue({
-          code: "custom",
-          message: trigger.enforce === "block" ? `block trigger "${trigger.id}" needs a reason` : `${trigger.enforce} trigger "${trigger.id}" needs a text`
-        });
-      }
-      const patterns = [...trigger.intent ?? []];
-      if (trigger.args_match !== void 0) patterns.push(trigger.args_match);
-      for (const pattern of patterns) {
-        if (!isValidRegex2(pattern)) {
-          ctx.addIssue({
-            code: "custom",
-            message: `trigger "${trigger.id}" has an invalid regex: ${pattern}`
-          });
-        }
-      }
-    });
-    TriggersSchema2 = z4.record(z4.string(), z4.array(TriggerSchema2));
-    VaultConfigSchema2 = z4.object({
-      scopes: z4.record(z4.string(), ScopeSchema2),
-      kinds: z4.array(KindEntrySchema2),
-      statuses: z4.array(z4.string()),
-      methodologies: z4.array(z4.string()),
-      tags: z4.object({
-        canonical: z4.array(z4.string()),
-        aliases: z4.record(z4.string(), z4.string())
-      }),
-      authoring_rules: z4.string().optional(),
-      authoring_rules_extra: z4.string().optional(),
-      sync_protocol: z4.string().optional(),
-      sync_protocol_extra: z4.string().optional(),
-      triggers: TriggersSchema2.optional(),
-      triggers_extra: TriggersSchema2.optional()
-    }).superRefine((config, ctx) => {
-      for (const [name, scope] of Object.entries(config.scopes)) {
-        if (scope.methodology !== void 0 && !config.methodologies.includes(scope.methodology)) {
-          ctx.addIssue({
-            code: "custom",
-            path: ["scopes", name, "methodology"],
-            message: `"${scope.methodology}" is not in the methodologies list`
-          });
-        }
-      }
-      if (config.triggers?._all !== void 0) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["triggers", "_all"],
-          message: '"_all" is reserved for triggers_extra'
-        });
-      }
-      for (const field of ["triggers", "triggers_extra"]) {
-        for (const [scope, list] of Object.entries(config[field] ?? {})) {
-          const seen = /* @__PURE__ */ new Set();
-          for (const trigger of list) {
-            if (seen.has(trigger.id)) {
-              ctx.addIssue({
-                code: "custom",
-                path: [field, scope],
-                message: `duplicate trigger id "${trigger.id}"`
-              });
-            }
-            seen.add(trigger.id);
-          }
-        }
-      }
-    });
-    BUILT_IN_KINDS2 = /* @__PURE__ */ new Set([
-      "project",
-      "spec",
-      "adr",
-      "plan",
-      "story",
-      "ops",
-      "topic",
-      "article",
-      "src",
-      "note",
-      "artifact",
-      "prompt"
-    ]);
-  }
-});
-
 // ../mcp/src/resources/authoring.ts
 function buildAuthoringRules(config) {
   const parts = [(config.authoring_rules ?? DEFAULT_AUTHORING_RULES).trim()];
@@ -1419,13 +1557,13 @@ function buildSyncProtocol(config) {
 function buildKindSelector(kinds) {
   const lines = ["## Kind selector", "", "| Signal | Kind | Where |", "|---|---|---|"];
   for (const entry of kinds) {
-    const name = kindName2(entry);
+    const name = kindName(entry);
     const pedagogy = typeof entry === "string" ? KIND_PEDAGOGY.get(entry) : entry;
     const signal = pedagogy?.signal ?? "\u2014";
     const where = pedagogy?.where ?? "\u2014";
     lines.push(`| ${signal} | **${name}** | ${where} |`);
   }
-  const names = kinds.map(kindName2);
+  const names = kinds.map(kindName);
   const hasNote = names.includes("note");
   const hasAdrAndSpec = names.includes("adr") && names.includes("spec");
   if (hasNote || hasAdrAndSpec) {
@@ -1448,7 +1586,7 @@ function buildVocabulary(config) {
   const lines = [
     "## Controlled vocabulary",
     "",
-    `**Kinds:** ${config.kinds.map(kindName2).join(", ")}`,
+    `**Kinds:** ${config.kinds.map(kindName).join(", ")}`,
     buildStatusLine(config.statuses),
     `**Methodologies:** ${config.methodologies.join(", ")}`,
     `**Canonical tags:** ${config.tags.canonical.join(", ")}`
@@ -1612,7 +1750,7 @@ var init_authoring = __esm({
     ].join("\n");
     DEFAULT_SYNC_PROTOCOL = [
       "Edit the smallest set of files that reflects the change. A milestone tick is plan-only; don't cascade to index.md unless phase or status changed. Controlled-vocabulary edits (`vault.yaml`) need explicit user approval.",
-      "After editing wiki pages, run `kmd validate` and fix findings before `kmd sync` \u2014 it checks frontmatter shape, vocabulary membership, and link integrity."
+      "Harnesses with the posttool hook validate and sync automatically on every vault write. Check `kmd config`: if the `synced` line did not advance past your edits, the hook is not wired \u2014 run `kmd validate`, fix findings, then `kmd sync`."
     ].join("\n");
     CANONICAL_STATUS_FLOW = ["draft", "active", "superseded", "archived"];
   }
@@ -1624,7 +1762,7 @@ import { join as join8 } from "node:path";
 function customTemplates(config) {
   const specs = [];
   for (const entry of config.kinds) {
-    if (typeof entry === "string" || BUILT_IN_KINDS2.has(entry.name)) continue;
+    if (typeof entry === "string" || BUILT_IN_KINDS.has(entry.name)) continue;
     specs.push({
       uri: `wiki://template/${entry.name}`,
       name: entry.name.charAt(0).toUpperCase() + entry.name.slice(1),
@@ -1825,7 +1963,7 @@ var init_toolResponse = __esm({
 });
 
 // ../mcp/src/tools/search.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 function search(deps, input) {
   const ftsQuery = sanitizeFtsQuery(input.query);
   if (!ftsQuery) return { results: [] };
@@ -1872,15 +2010,15 @@ var init_search = __esm({
     "use strict";
     init_fts();
     init_toolResponse();
-    SearchInputSchema = z5.object({
-      query: z5.string().min(1).describe(
+    SearchInputSchema = z4.object({
+      query: z4.string().min(1).describe(
         "Natural-language search query. Matched against title, summary, and body via SQLite FTS5."
       ),
-      scope: z5.string().optional().describe('Optional: restrict to a project scope (e.g. "ontology", "sotto").'),
-      kind: z5.string().optional().describe(
+      scope: z4.string().optional().describe('Optional: restrict to a project scope (e.g. "ontology", "sotto").'),
+      kind: z4.string().optional().describe(
         "Optional: restrict to a kind. Project kinds: spec, adr, plan, ops. Research kinds: article, src. Misc: note."
       ),
-      limit: z5.number().int().min(1).max(50).default(5).describe("Maximum number of ranked results to return. Default 5.")
+      limit: z4.number().int().min(1).max(50).default(5).describe("Maximum number of ranked results to return. Default 5.")
     });
     FTS_RANK = "bm25(pages_fts, 10.0, 5.0, 1.0)";
   }
@@ -1889,7 +2027,7 @@ var init_search = __esm({
 // ../mcp/src/tools/prime.ts
 import { readFile as readFile6 } from "node:fs/promises";
 import { basename as basename3, join as join9 } from "node:path";
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 function pathSlug(p) {
   return basename3(p).replace(/\.md$/, "");
 }
@@ -2032,7 +2170,7 @@ function renderMarkdown(d, config, task) {
     lines.push(countEntries.map(([k, n]) => `${k}: ${n}`).join(" | "));
   }
   lines.push("", "## Vocabulary");
-  lines.push(`kinds: ${config.kinds.map(kindName2).join(", ")}`);
+  lines.push(`kinds: ${config.kinds.map(kindName).join(", ")}`);
   lines.push(`statuses: ${config.statuses.join(", ")}`);
   lines.push(`tags: ${config.tags.canonical.join(", ")}`);
   if (d.top_tags.length > 0) {
@@ -2093,14 +2231,14 @@ var init_prime = __esm({
   "../mcp/src/tools/prime.ts"() {
     "use strict";
     init_database();
+    init_vault_config();
     init_frontmatter2();
     init_fts();
     init_toolResponse();
-    init_vault_config();
     init_search();
-    PrimeInputSchema = z6.object({
-      scope: z6.string().min(1).describe("Project scope to prime (matches projects/{scope}/ in the vault)."),
-      task: z6.string().optional().describe("Optional task description; surfaces top-3 tsvector-ranked relevant pages.")
+    PrimeInputSchema = z5.object({
+      scope: z5.string().min(1).describe("Project scope to prime (matches projects/{scope}/ in the vault)."),
+      task: z5.string().optional().describe("Optional task description; surfaces top-3 tsvector-ranked relevant pages.")
     });
   }
 });
@@ -2152,7 +2290,7 @@ async function startMcpServer() {
   diag("main entered");
   const config = loadConfig();
   diag("config loaded", { vault: config.wikiVault, level: config.logLevel });
-  const vaultConfig = await loadVaultConfig2(config.wikiVault);
+  const vaultConfig = await loadVaultConfig(config.wikiVault);
   diag("vault config loaded", {
     scopes: Object.keys(vaultConfig.scopes).length,
     kinds: vaultConfig.kinds.length,
@@ -2195,12 +2333,12 @@ async function startMcpServer() {
 var init_start = __esm({
   "../mcp/src/start.ts"() {
     "use strict";
-    init_config2();
+    init_vault_config();
+    init_config();
     init_db();
     init_diag();
     init_logger();
     init_server();
-    init_vault_config();
   }
 });
 
@@ -2218,21 +2356,24 @@ __export(hook_exports, {
   matchPromptTriggers: () => matchPromptTriggers,
   parsePretoolEvent: () => parsePretoolEvent,
   parsePromptEvent: () => parsePromptEvent,
+  parseStopEvent: () => parseStopEvent,
   renderPosttool: () => renderPosttool,
   renderPretool: () => renderPretool,
+  renderStop: () => renderStop,
   resolveScope: () => resolveScope,
   runHookPosttool: () => runHookPosttool,
   runHookPretool: () => runHookPretool,
   runHookPrompt: () => runHookPrompt,
+  runHookStop: () => runHookStop,
   vaultPathTouched: () => vaultPathTouched
 });
 import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, rmSync as rmSync2, statSync, writeFileSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join10, resolve as resolve2, sep as sep2 } from "node:path";
+import { join as join10, resolve as resolve3, sep as sep2 } from "node:path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 import { parseArgs as parseArgs2 } from "node:util";
 import { parse as parseYaml3 } from "yaml";
-import { z as z7 } from "zod";
+import { z as z6 } from "zod";
 function eventFields(raw) {
   let data;
   try {
@@ -2258,7 +2399,7 @@ function kiroIdePromptEvent(now = Date.now()) {
 }
 function loadTriggerFile(path) {
   try {
-    const result = z7.array(TriggerSchema).safeParse(parseYaml3(readFileSync(path, "utf8")));
+    const result = z6.array(TriggerSchema).safeParse(parseYaml3(readFileSync(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
@@ -2330,7 +2471,11 @@ function matchPromptTriggers(prompt, triggers) {
         hit = trigger.intent.some((pattern) => new RegExp(pattern, "i").test(prompt));
       }
       if (hit) {
-        matches.push({ id: trigger.id, text: trigger.text });
+        matches.push({
+          id: trigger.id,
+          text: trigger.text,
+          ...trigger.dedup !== void 0 && { dedup: trigger.dedup }
+        });
       }
     }
   } finally {
@@ -2409,7 +2554,8 @@ function matchPretoolTriggers(toolName, toolInput, triggers, cwd) {
       id: trigger.id,
       enforce: trigger.enforce,
       text,
-      ...trigger.when !== void 0 && { when: trigger.when }
+      ...trigger.when !== void 0 && { when: trigger.when },
+      ...trigger.dedup !== void 0 && { dedup: trigger.dedup }
     });
   }
   return matches;
@@ -2506,10 +2652,10 @@ function patchPaths(toolInput) {
   return paths;
 }
 function vaultPathTouched(toolInput, vaultRoot2, cwd) {
-  const root = resolve2(vaultRoot2);
+  const root = resolve3(vaultRoot2);
   const candidates = [...pathCandidates(toolInput, cwd), ...patchPaths(toolInput)];
   return candidates.some((candidate) => {
-    const absolute = resolve2(cwd ?? ".", candidate);
+    const absolute = resolve3(cwd ?? ".", candidate);
     return absolute === root || absolute.startsWith(`${root}/`);
   });
 }
@@ -2532,6 +2678,27 @@ ${lines.join("\n")}`
   }
   return JSON.stringify({ findings, synced });
 }
+function parseStopEvent(raw) {
+  const fields = eventFields(raw);
+  if (fields === null) return null;
+  const { session_id, cwd, stop_hook_active } = fields;
+  if (typeof session_id !== "string") return null;
+  return {
+    session_id,
+    ...typeof cwd === "string" && { cwd },
+    ...typeof stop_hook_active === "boolean" && { stop_hook_active }
+  };
+}
+function renderStop(findings) {
+  const errors = findings.filter((finding) => finding.severity === "error");
+  if (errors.length === 0) return null;
+  const lines = errors.map((f) => `${f.severity}: ${f.path} [${f.rule}] ${f.message}`);
+  return JSON.stringify({
+    decision: "block",
+    reason: `kmd validate: ${errors.length} error(s) outstanding \u2014 the index sync is held. Fix them, let the posttool hook sync, then finish:
+${lines.join("\n")}`
+  });
+}
 function dedupePretoolMatches(stateDir, sessionId, matches) {
   const blocks = matches.filter((match) => match.enforce === "block");
   const rest = matches.filter((match) => match.enforce !== "block");
@@ -2541,15 +2708,26 @@ function dedupePretoolMatches(stateDir, sessionId, matches) {
 function hookStateDir() {
   return join10(kmdHome(), "state", "hook");
 }
-function dedupeMatches(stateDir, sessionId, matches) {
+function dedupeMatches(stateDir, sessionId, matches, now = Date.now()) {
   if (matches.length === 0) return [];
   const file = join10(stateDir, `${sessionId.replace(/[^A-Za-z0-9._-]/g, "_")}.json`);
   const fired = readFired(file);
-  const fresh = matches.filter((match) => !fired.has(match.id));
-  if (fresh.length > 0) {
+  const fresh = [];
+  const record = [];
+  for (const match of matches) {
+    if (match.dedup === "never") {
+      fresh.push(match);
+      continue;
+    }
+    const key = typeof match.dedup === "object" ? `${match.id}@${Math.floor(now / (match.dedup.minutes * 6e4))}` : match.id;
+    if (fired.has(key)) continue;
+    fresh.push(match);
+    record.push(key);
+  }
+  if (record.length > 0) {
     mkdirSync4(stateDir, { recursive: true });
-    for (const match of fresh) {
-      fired.add(match.id);
+    for (const key of record) {
+      fired.add(key);
     }
     writeFileSync(file, JSON.stringify([...fired]));
     pruneStale(stateDir, file);
@@ -2723,6 +2901,28 @@ async function runHookPosttool() {
     diag2(err instanceof Error ? err.message : String(err));
   }
 }
+async function runHookStop() {
+  try {
+    const invocation = hookInvocation();
+    if (invocation === null) return;
+    const event = parseStopEvent(await readStdin());
+    if (event === null) {
+      diag2("stdin is not a stop event ({session_id})");
+      return;
+    }
+    if (event.stop_hook_active === true) return;
+    const config = await loadVaultConfig(invocation.vaultRoot);
+    const scope = invocation.scope ?? resolveScope(config, event.cwd);
+    if (scope === void 0) return;
+    const rendered = renderStop(await validateVault(invocation.vaultRoot));
+    if (rendered === null) return;
+    const fired = dedupeMatches(hookStateDir(), event.session_id, [{ id: "stop-validate-gate" }]);
+    if (fired.length === 0) return;
+    console.log(rendered);
+  } catch (err) {
+    diag2(err instanceof Error ? err.message : String(err));
+  }
+}
 async function readStdin() {
   process.stdin.setEncoding("utf8");
   let input = "";
@@ -2739,7 +2939,7 @@ var init_hook = __esm({
   "../cli/src/hook.ts"() {
     "use strict";
     init_database();
-    init_config();
+    init_vault_config();
     init_frontmatter();
     init_sync();
     init_validate();
@@ -2762,14 +2962,16 @@ process.on("warning", (warning) => {
 var USAGE = `usage: kmd <command> [options]
 
 commands:
+  init [<dir>] [-y]        scaffold a fresh vault (no dir: current directory \u2014 TTY prompt, or -y)
   sync                     vault \u2192 index sync (runs validate first)
   validate [<path>]        deterministic vault checker (default: $WIKI_VAULT)
   mcp [<vault-root>]       start the stdio MCP server (default: $WIKI_VAULT)
   config [<vault-root>]    print vault + index resolution; with no vault, list known vaults
   db reset [<vault-root>]  delete the vault's index (default: $WIKI_VAULT)
-  hook <prompt|pretool|posttool> [<vault-root>] [--scope <s>] [--harness <claude|kiro-ide>] [--triggers <file>]
+  hook <prompt|pretool|posttool|stop> [<vault-root>] [--scope <s>] [--harness <claude|kiro-ide>] [--triggers <file>]
                            harness gate engine: JSON event on stdin, decision/context on stdout;
-                           posttool auto-runs validate + sync after a vault write
+                           posttool auto-runs validate + sync after a vault write;
+                           stop blocks the handoff once while validate errors hold the sync
 
 options:
   --version   print version
@@ -2780,7 +2982,8 @@ var { positionals, values } = parseArgs3({
   strict: false,
   options: {
     version: { type: "boolean", short: "v" },
-    help: { type: "boolean", short: "h" }
+    help: { type: "boolean", short: "h" },
+    yes: { type: "boolean", short: "y" }
   }
 });
 var command = values.version ? "--version" : values.help ? "--help" : positionals[0];
@@ -2792,6 +2995,11 @@ function applyVaultRoot(positionalIndex) {
 }
 async function run() {
   switch (command) {
+    case "init": {
+      const { runInit: runInit2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+      await runInit2(positionals[1], Boolean(values.yes));
+      break;
+    }
     case "sync": {
       const { runSyncCommand: runSyncCommand2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
       await runSyncCommand2();
@@ -2838,9 +3046,14 @@ async function run() {
       } else if (sub === "posttool") {
         const { runHookPosttool: runHookPosttool2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
         await runHookPosttool2();
+      } else if (sub === "stop") {
+        const { runHookStop: runHookStop2 } = await Promise.resolve().then(() => (init_hook(), hook_exports));
+        await runHookStop2();
+      } else if (sub) {
+        console.error(`kmd hook: unknown event: ${sub}`);
       } else {
         console.error(
-          sub ? `unknown hook event: ${sub}` : "usage: kmd hook <prompt|pretool|posttool> [<vault-root>] [--scope <scope>] [--harness <claude|kiro-ide>]"
+          "usage: kmd hook <prompt|pretool|posttool|stop> [<vault-root>] [--scope <scope>] [--harness <claude|kiro-ide>]"
         );
         process.exit(2);
       }
@@ -2864,6 +3077,11 @@ async function run() {
       break;
     }
     default: {
+      const tail = positionals[1];
+      if (tail === "prompt" || tail === "pretool" || tail === "posttool") {
+        console.error(`kmd: unknown command: ${command}`);
+        break;
+      }
       console.error(`unknown command: ${command}
 
 ${USAGE}`);