caveat-cli 0.14.10 → 0.15.0

package/dist/{chunk-ECC5LJZF.js → chunk-Z2XLYCR3.js}

@@ -9071,6 +9071,141 @@ function* walkMarkdown(root) {
   }
 }
 
+// ../../packages/core/dist/autoReindex.js
+import { createHash } from "node:crypto";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync3,
+  renameSync,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { join as join3, relative as relative2 } from "node:path";
+function sourceRoots(paths) {
+  const roots = [];
+  if (existsSync3(paths.entriesDir)) roots.push({ source: "own", root: paths.entriesDir });
+  if (!existsSync3(paths.communityDir)) return roots;
+  for (const entry of requireDirectories(paths.communityDir)) {
+    const root = join3(paths.communityDir, entry, "entries");
+    if (existsSync3(root)) roots.push({ source: `community/${entry}`, root });
+  }
+  return roots;
+}
+function requireDirectories(root) {
+  return readdirSync3(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+}
+function computeEntriesDigest(paths) {
+  const lines = [];
+  for (const { source, root } of sourceRoots(paths)) {
+    for (const filePath of walkMarkdown(root)) {
+      const stat = statSync2(filePath);
+      const rel = relative2(root, filePath).replace(/\\/g, "/");
+      lines.push(`${source}	${rel}	${stat.mtimeMs}	${stat.size}`);
+    }
+  }
+  lines.sort();
+  return {
+    digest: createHash("sha256").update(lines.join("\n")).digest("hex"),
+    fileCount: lines.length
+  };
+}
+function indexDir(caveatHome) {
+  return join3(caveatHome, "index");
+}
+function digestMarkerPath(caveatHome) {
+  return join3(indexDir(caveatHome), ".entries-digest");
+}
+function readDigestMarker(caveatHome) {
+  try {
+    const value = JSON.parse(readFileSync3(digestMarkerPath(caveatHome), "utf-8"));
+    if (value !== null && typeof value === "object" && typeof value.digest === "string" && typeof value.fileCount === "number" && typeof value.generatedAt === "string") return value;
+  } catch {
+  }
+  return null;
+}
+function writeDigestMarker(caveatHome, value) {
+  const dir = indexDir(caveatHome);
+  mkdirSync2(dir, { recursive: true });
+  const path = digestMarkerPath(caveatHome);
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, JSON.stringify({ ...value, generatedAt: (/* @__PURE__ */ new Date()).toISOString() }), "utf-8");
+  renameSync(temporary, path);
+}
+function lockPath(caveatHome) {
+  return join3(indexDir(caveatHome), ".reindex-lock");
+}
+function tryCreateLock(path) {
+  try {
+    writeFileSync(path, String(process.pid), { flag: "wx" });
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+function acquireReindexLock(caveatHome) {
+  const dir = indexDir(caveatHome);
+  mkdirSync2(dir, { recursive: true });
+  const path = lockPath(caveatHome);
+  if (tryCreateLock(path)) return { path };
+  let pid;
+  try {
+    pid = Number.parseInt(readFileSync3(path, "utf-8").trim(), 10);
+    if (!Number.isInteger(pid) || pid <= 0) return null;
+  } catch (err) {
+    if (err.code === "ENOENT") return tryCreateLock(path) ? { path } : null;
+    return null;
+  }
+  try {
+    process.kill(pid, 0);
+    return null;
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ESRCH") return null;
+  }
+  try {
+    unlinkSync(path);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  return tryCreateLock(path) ? { path } : null;
+}
+function releaseReindexLock(lock) {
+  try {
+    unlinkSync(lock.path);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+function reindexAllSources(opts) {
+  const { db, paths, logger } = opts;
+  const perSource = {};
+  if (existsSync3(paths.entriesDir)) {
+    perSource.own = scanSource({ db, source: "own", entriesRoot: paths.entriesDir });
+  } else {
+    logger.warn(`entries dir not found; preserving own index rows: ${paths.entriesDir}`);
+  }
+  const presentCommunitySources = /* @__PURE__ */ new Set();
+  if (existsSync3(paths.communityDir)) {
+    for (const handle of requireDirectories(paths.communityDir)) {
+      const source = `community/${handle}`;
+      const root = join3(paths.communityDir, handle, "entries");
+      presentCommunitySources.add(source);
+      if (!existsSync3(root)) continue;
+      perSource[source] = scanSource({ db, source, entriesRoot: root });
+    }
+  }
+  const rows = db.prepare("SELECT DISTINCT source FROM entries WHERE source LIKE 'community/%'").all();
+  for (const { source } of rows) {
+    if (presentCommunitySources.has(source)) continue;
+    db.prepare("DELETE FROM entries WHERE source = ?").run(source);
+  }
+  return { perSource, fileCount: computeEntriesDigest(paths).fileCount };
+}
+
 // ../../packages/core/dist/repository.js
 var SYMPTOM_EXCERPT_LENGTH = 200;
 function sanitizeFtsQuery(raw) {
@@ -9154,25 +9289,25 @@ function toSearchResult(row) {
     title: row.title,
     symptomExcerpt: symptom.slice(0, SYMPTOM_EXCERPT_LENGTH),
     confidence: row.confidence,
-    visibility: row.visibility ?? "public",
+    visibility: row.visibility ?? "private",
     environment: fm.environment ?? {}
   };
 }
 
 // ../../packages/core/dist/paths.js
-import { existsSync as existsSync3 } from "node:fs";
-import { dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
+import { existsSync as existsSync4 } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join4, resolve } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function expandHome(p2, userHome) {
   if (p2 === "~" || p2.startsWith("~/") || p2.startsWith("~\\")) {
-    return join3(userHome, p2.slice(1));
+    return join4(userHome, p2.slice(1));
   }
   return p2;
 }
 function findCaveatHome(userHome) {
   const fromEnv = process.env.CAVEAT_HOME;
   if (fromEnv && fromEnv.length > 0) return fromEnv;
-  return join3(userHome, ".caveat");
+  return join4(userHome, ".caveat");
 }
 function resolvePaths(caveatHome, knowledgeRepo, userHome) {
   const expanded = expandHome(knowledgeRepo, userHome);
@@ -9180,32 +9315,39 @@ function resolvePaths(caveatHome, knowledgeRepo, userHome) {
   return {
     caveatHome,
     knowledgeRepo: resolved,
-    dbPath: join3(caveatHome, "index", "caveat.db"),
-    entriesDir: join3(resolved, "entries"),
+    dbPath: join4(caveatHome, "index", "caveat.db"),
+    entriesDir: join4(resolved, "entries"),
     // community/ lives at caveatHome level, NOT inside knowledgeRepo. Community
     // clones are external knowledge caches — not semantically "owned" by the
     // user — and they embed their own .git dirs which would otherwise nest
     // inside the user's git-tracked knowledge repo.
-    communityDir: join3(caveatHome, "community")
+    communityDir: join4(caveatHome, "community"),
+    publishMirrorDir: join4(caveatHome, "publish", "mirror")
   };
 }
 
 // ../../packages/core/dist/config.js
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 var DEFAULT_CONFIG = {
   knowledgeRepo: "own",
   semverKeys: ["driver", "cuda", "node"],
-  communitySources: []
+  communitySources: [],
+  publishTarget: null
 };
 function loadConfig(userConfigPath) {
-  const userCfg = existsSync4(userConfigPath) ? JSON.parse(readFileSync3(userConfigPath, "utf-8")) : {};
+  const userCfg = existsSync5(userConfigPath) ? JSON.parse(readFileSync4(userConfigPath, "utf-8")) : {};
   return deepMerge(DEFAULT_CONFIG, userCfg);
 }
 function ensureUserConfig(userConfigPath) {
-  if (!existsSync4(userConfigPath)) {
-    writeFileSync(userConfigPath, "{}\n", "utf-8");
+  if (!existsSync5(userConfigPath)) {
+    writeFileSync2(userConfigPath, "{}\n", "utf-8");
   }
 }
+function writeUserConfigPatch(userConfigPath, patch) {
+  const existing = existsSync5(userConfigPath) ? JSON.parse(readFileSync4(userConfigPath, "utf-8")) : {};
+  writeFileSync2(userConfigPath, `${JSON.stringify({ ...existing, ...patch }, null, 2)}
+`, "utf-8");
+}
 function deepMerge(base, overlay) {
   if (overlay === null || overlay === void 0) return base;
   if (Array.isArray(overlay)) return overlay;
@@ -9219,8 +9361,8 @@ function deepMerge(base, overlay) {
 }
 
 // ../../packages/core/dist/community.js
-import { existsSync as existsSync5, readdirSync as readdirSync3, rmSync, statSync as statSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync6, readdirSync as readdirSync4, rmSync, statSync as statSync3 } from "node:fs";
+import { join as join5 } from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -14185,6 +14327,7 @@ var simpleGit = gitInstanceFactory;
 
 // ../../packages/core/dist/community.js
 var GITHUB_URL_RE = /^https:\/\/github\.com\/[^/]+\/([^/]+?)(\.git)?\/?$/;
+var GITHUB_HANDLE_RE = /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$/;
 function validateCommunityUrl(url) {
   const trimmed2 = (url ?? "").trim();
   const m = GITHUB_URL_RE.exec(trimmed2);
@@ -14207,26 +14350,28 @@ function resolveHandleCollision(baseHandle, exists2) {
   return `${baseHandle}-${n}`;
 }
 async function communityAdd(opts) {
-  const validation = validateCommunityUrl(opts.url);
+  const supplied = opts.url ?? "";
+  const url = /^https?:\/\//.test(supplied.trim()) ? supplied : GITHUB_HANDLE_RE.test(supplied) ? `https://github.com/${supplied}/Caveat-Public` : supplied;
+  const validation = validateCommunityUrl(url);
   if (!validation.valid) {
     throw new Error(`invalid community URL: ${validation.reason}`);
   }
   const handle = resolveHandleCollision(
     validation.handle,
-    (h2) => existsSync5(join4(opts.communityDir, h2))
+    (h2) => existsSync6(join5(opts.communityDir, h2))
   );
-  const target = join4(opts.communityDir, handle);
+  const target = join5(opts.communityDir, handle);
   const depth = opts.depth ?? 1;
   const git = simpleGit();
-  await git.clone(opts.url, target, ["--depth", String(depth)]);
+  await git.clone(url, target, ["--depth", String(depth)]);
   return { handle, path: target };
 }
 async function communityPull(opts) {
-  if (!existsSync5(opts.communityDir)) return [];
+  if (!existsSync6(opts.communityDir)) return [];
   const results = [];
-  for (const entry of readdirSync3(opts.communityDir, { withFileTypes: true })) {
+  for (const entry of readdirSync4(opts.communityDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const path = join4(opts.communityDir, entry.name);
+    const path = join5(opts.communityDir, entry.name);
     const git = simpleGit(path);
     try {
       await git.pull();
@@ -14239,11 +14384,11 @@ async function communityPull(opts) {
   return results;
 }
 function communityList(opts) {
-  if (!existsSync5(opts.communityDir)) return [];
+  if (!existsSync6(opts.communityDir)) return [];
   const out = [];
-  for (const entry of readdirSync3(opts.communityDir, { withFileTypes: true })) {
+  for (const entry of readdirSync4(opts.communityDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const path = join4(opts.communityDir, entry.name);
+    const path = join5(opts.communityDir, entry.name);
     const row = opts.db.prepare("SELECT COUNT(*) AS n FROM entries WHERE source = ?").get(`community/${entry.name}`);
     out.push({ handle: entry.name, path, entryCount: row?.n ?? 0 });
   }
@@ -14257,8 +14402,8 @@ function communityRemove(opts) {
   if (handle === "." || handle === ".." || /[\\/]/.test(handle)) {
     throw new Error(`invalid handle (no path separators or relative segments): ${opts.handle}`);
   }
-  const target = join4(opts.communityDir, handle);
-  const dirExisted = existsSync5(target) && statSync2(target).isDirectory();
+  const target = join5(opts.communityDir, handle);
+  const dirExisted = existsSync6(target) && statSync3(target).isDirectory();
   const source = `community/${handle}`;
   const row = opts.db.prepare("SELECT COUNT(*) AS n FROM entries WHERE source = ?").get(source);
   const rowCount = row?.n ?? 0;
@@ -14369,7 +14514,7 @@ function toSearchResult2(row) {
     title: row.title,
     symptomExcerpt: symptom.slice(0, SYMPTOM_EXCERPT_LENGTH2),
     confidence: row.confidence,
-    visibility: row.visibility ?? "public",
+    visibility: row.visibility ?? "private",
     environment: fm.environment ?? {}
   };
 }
@@ -14523,7 +14668,7 @@ function stopReminderText(signals, related) {
 }
 
 // ../../packages/core/dist/transcriptSignals.js
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
 var MAX_ERROR_SNIPPETS = 10;
 var MAX_ERROR_SNIPPET_LENGTH = 300;
 var MAX_SEARCH_QUERIES = 10;
@@ -14549,10 +14694,10 @@ function parseTimestamp(raw) {
   return Number.isNaN(ms) ? void 0 : ms;
 }
 function readSessionSignals(transcriptPath) {
-  if (!transcriptPath || !existsSync6(transcriptPath)) return null;
+  if (!transcriptPath || !existsSync7(transcriptPath)) return null;
   let raw;
   try {
-    raw = readFileSync4(transcriptPath, "utf-8");
+    raw = readFileSync5(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -14633,7 +14778,7 @@ function struggleSearchText(s) {
 }
 
 // ../../packages/core/dist/codexTranscriptSignals.js
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 var MAX_ERROR_SNIPPETS2 = 10;
 var MAX_ERROR_SNIPPET_LENGTH2 = 300;
 var MAX_SEARCH_QUERIES2 = 10;
@@ -14698,10 +14843,10 @@ function addQuery(searchQueries, query) {
   searchQueries.push(query.slice(0, MAX_SEARCH_QUERY_LENGTH2));
 }
 function readCodexSessionSignals(transcriptPath) {
-  if (!transcriptPath || !existsSync7(transcriptPath)) return null;
+  if (!transcriptPath || !existsSync8(transcriptPath)) return null;
   let raw;
   try {
-    raw = readFileSync5(transcriptPath, "utf-8");
+    raw = readFileSync6(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -14805,30 +14950,30 @@ function readCodexSessionSignals(transcriptPath) {
 
 // ../../packages/core/dist/pendingReminders.js
 import {
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync2,
-  readdirSync as readdirSync4,
-  readFileSync as readFileSync6,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync7,
   rmSync as rmSync2,
-  statSync as statSync3,
-  unlinkSync,
-  writeFileSync as writeFileSync2
+  statSync as statSync4,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { randomBytes } from "node:crypto";
 function sanitizeSessionId(raw) {
   const clean = raw.replace(/[^A-Za-z0-9_-]/g, "");
   return clean.length > 0 ? clean : "_unknown";
 }
 function pendingDirFor(caveatHome, sessionId) {
-  return join5(caveatHome, "pending", sanitizeSessionId(sessionId));
+  return join6(caveatHome, "pending", sanitizeSessionId(sessionId));
 }
 function appendPendingReminder(caveatHome, sessionId, text) {
   const dir = pendingDirFor(caveatHome, sessionId);
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   const name = `${Date.now()}-${randomBytes(4).toString("hex")}.txt`;
-  const path = join5(dir, name);
-  writeFileSync2(path, text, "utf-8");
+  const path = join6(dir, name);
+  writeFileSync3(path, text, "utf-8");
   return path;
 }
 function cleanupStalePendingDirs(caveatHome, options2 = {}) {
@@ -14838,21 +14983,21 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
   }
   const now = options2.now ?? /* @__PURE__ */ new Date();
   const cutoffMs = now.getTime() - staleDays * 24 * 60 * 60 * 1e3;
-  const root = join5(caveatHome, "pending");
-  if (!existsSync8(root)) return { removed: [], kept: 0 };
+  const root = join6(caveatHome, "pending");
+  if (!existsSync9(root)) return { removed: [], kept: 0 };
   let entries;
   try {
-    entries = readdirSync4(root);
+    entries = readdirSync5(root);
   } catch {
     return { removed: [], kept: 0 };
   }
   const removed = [];
   let kept = 0;
   for (const entry of entries) {
-    const sub = join5(root, entry);
+    const sub = join6(root, entry);
     let subStat;
     try {
-      subStat = statSync3(sub);
+      subStat = statSync4(sub);
     } catch {
       continue;
     }
@@ -14860,10 +15005,10 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
     let newest = subStat.mtimeMs;
     let scanFailed = false;
     try {
-      for (const f of readdirSync4(sub)) {
-        const fp = join5(sub, f);
+      for (const f of readdirSync5(sub)) {
+        const fp = join6(sub, f);
         try {
-          const fs = statSync3(fp);
+          const fs = statSync4(fp);
           if (fs.mtimeMs > newest) newest = fs.mtimeMs;
         } catch {
           scanFailed = true;
@@ -14898,11 +15043,11 @@ function maybeSweepPendingDirs(caveatHome, options2 = {}) {
     );
   }
   const now = options2.now ?? /* @__PURE__ */ new Date();
-  const pendingRoot = join5(caveatHome, "pending");
-  if (!existsSync8(pendingRoot)) return { skipped: "no_pending_dir" };
-  const marker = join5(pendingRoot, ".last-sweep");
+  const pendingRoot = join6(caveatHome, "pending");
+  if (!existsSync9(pendingRoot)) return { skipped: "no_pending_dir" };
+  const marker = join6(pendingRoot, ".last-sweep");
   try {
-    const m = statSync3(marker);
+    const m = statSync4(marker);
     const ageMs = now.getTime() - m.mtimeMs;
     if (ageMs < debounceDays * 24 * 60 * 60 * 1e3) {
       return { skipped: "debounced" };
@@ -14911,30 +15056,30 @@ function maybeSweepPendingDirs(caveatHome, options2 = {}) {
   }
   const result = cleanupStalePendingDirs(caveatHome, { staleDays, now });
   try {
-    writeFileSync2(marker, "", "utf-8");
+    writeFileSync3(marker, "", "utf-8");
   } catch {
   }
   return { swept: result };
 }
 function drainPendingReminders(caveatHome, sessionId) {
   const dir = pendingDirFor(caveatHome, sessionId);
-  if (!existsSync8(dir)) return [];
+  if (!existsSync9(dir)) return [];
   let entries;
   try {
-    entries = readdirSync4(dir).filter((f) => f.endsWith(".txt")).sort();
+    entries = readdirSync5(dir).filter((f) => f.endsWith(".txt")).sort();
   } catch {
     return [];
   }
   const out = [];
   for (const entry of entries) {
-    const path = join5(dir, entry);
+    const path = join6(dir, entry);
     try {
-      out.push(readFileSync6(path, "utf-8"));
+      out.push(readFileSync7(path, "utf-8"));
     } catch {
       continue;
     }
     try {
-      unlinkSync(path);
+      unlinkSync2(path);
     } catch {
     }
   }
@@ -14978,11 +15123,414 @@ function listStale(db, opts = {}) {
     id: r2.id,
     source: r2.source,
     title: r2.title,
-    visibility: r2.visibility ?? "public",
+    visibility: r2.visibility ?? "private",
     last_hit_at: r2.last_hit_at
   }));
 }
 
+// ../../packages/core/dist/sync.js
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readdirSync as readdirSync6, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join7, resolve as resolve2 } from "node:path";
+
+// ../../packages/core/dist/remoteVisibility.js
+var PROBE_TIMEOUT_MS = 1e4;
+function deriveAnonymousProbeUrl(remoteUrl) {
+  let url;
+  try {
+    url = new URL(remoteUrl);
+  } catch {
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/.exec(remoteUrl);
+    if (!scp) return void 0;
+    try {
+      return new URL(`https://${scp[1]}/${scp[2]}`).toString();
+    } catch {
+      return void 0;
+    }
+  }
+  if (url.protocol !== "https:" && url.protocol !== "ssh:") return void 0;
+  return `https://${url.host}${url.pathname}${url.search}${url.hash}`;
+}
+async function probeAnonymousRead(probeUrl, options2 = {}) {
+  if (!probeUrl) return { kind: "indeterminate", reason: "remote URL cannot be probed anonymously" };
+  const endpoint = new URL("info/refs?service=git-upload-pack", ensureTrailingSlash(probeUrl));
+  try {
+    const response = await (options2.fetchImpl ?? globalThis.fetch)(endpoint, {
+      method: "GET",
+      redirect: "follow",
+      signal: AbortSignal.timeout(options2.timeoutMs ?? PROBE_TIMEOUT_MS)
+    });
+    if (response.status === 401 || response.status === 404) {
+      return { kind: "denied", status: response.status };
+    }
+    if (!response.ok) return { kind: "indeterminate", reason: `unexpected HTTP status ${response.status}` };
+    const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/x-git-upload-pack-advertisement") {
+      return { kind: "indeterminate", reason: "missing Git smart-HTTP advertisement content type" };
+    }
+    return { kind: "anonymous-readable" };
+  } catch {
+    return { kind: "indeterminate", reason: "anonymous read probe request failed" };
+  }
+}
+function ensureTrailingSlash(url) {
+  return url.endsWith("/") ? url : `${url}/`;
+}
+
+// ../../packages/core/dist/sync.js
+var SyncError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SyncError";
+  }
+  code;
+};
+function normalizePath(path) {
+  const normalized = resolve2(path).replace(/\\/g, "/");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+async function effectivePushUrls(git) {
+  let raw;
+  try {
+    raw = await git.raw(["remote", "get-url", "--push", "--all", "origin"]);
+  } catch {
+    const remotes = (await git.raw(["remote"])).trim();
+    const available = remotes ? remotes.split(/\r?\n/).join(", ") : "(none)";
+    throw new SyncError("NO_REMOTE", `NO_REMOTE: origin is required (configured remotes: ${available})`);
+  }
+  const urls = raw.split(/\r?\n/).map((u) => u.trim()).filter(Boolean);
+  if (urls.length === 0) throw new SyncError("NO_REMOTE", "NO_REMOTE: origin has no push URL");
+  return urls;
+}
+async function assertPrivateRemotes(remoteUrls, opts) {
+  const probe = opts.probeImpl ?? probeAnonymousRead;
+  let worst = { kind: "denied", status: 0 };
+  for (const remoteUrl of remoteUrls) {
+    const result = await probe(deriveAnonymousProbeUrl(remoteUrl));
+    if (result.kind === "anonymous-readable") {
+      throw new SyncError("REMOTE_PUBLIC", `remote is anonymously readable: ${remoteUrl}`);
+    }
+    if (result.kind === "indeterminate") {
+      if (!opts.trustRemotePrivate) {
+        throw new SyncError(
+          "REMOTE_VISIBILITY_INDETERMINATE",
+          `could not verify remote privacy: ${remoteUrl}; rerun with --trust-remote-private to accept this risk`
+        );
+      }
+      worst = result;
+    }
+  }
+  return worst;
+}
+async function preflightSync(ownDir, opts = {}) {
+  const git = simpleGit(ownDir);
+  if (!await git.checkIsRepo()) {
+    throw new SyncError("NOT_A_REPO", "own knowledge directory is not a git repository; run `caveat sync --init` first");
+  }
+  const root = realpathSync.native((await git.revparse(["--show-toplevel"])).trim());
+  const requested = realpathSync.native(ownDir);
+  if (normalizePath(root) !== normalizePath(requested)) {
+    throw new SyncError("EXTERNAL_TOPLEVEL", `EXTERNAL_TOPLEVEL: own directory must be the repository root: ${requested} (root: ${root})`);
+  }
+  let branch;
+  try {
+    branch = (await git.raw(["symbolic-ref", "--short", "HEAD"])).trim();
+  } catch {
+    throw new SyncError("DETACHED_HEAD", "cannot sync from a detached HEAD");
+  }
+  const pushUrls = await effectivePushUrls(git);
+  const probe = await assertPrivateRemotes(pushUrls, opts);
+  return { ownDir: requested, branch, pushUrls, probe };
+}
+function reindexAndMark(opts) {
+  mkdirSync4(dirname3(opts.paths.dbPath), { recursive: true });
+  const db = openDb({ path: opts.paths.dbPath, logger: opts.logger });
+  try {
+    reindexAllSources({ db, paths: opts.paths, logger: opts.logger });
+    writeDigestMarker(opts.caveatHome, computeEntriesDigest(opts.paths));
+  } finally {
+    db.close();
+  }
+}
+async function syncOwn(opts) {
+  const preflight = await preflightSync(opts.ownDir, opts);
+  const git = simpleGit(preflight.ownDir);
+  const status = await git.status();
+  if (opts.dryRun) {
+    return {
+      ...preflight,
+      committed: false,
+      pulled: false,
+      pushed: false,
+      dryRun: true,
+      changedFiles: status.files.length
+    };
+  }
+  let committed = false;
+  if (!status.isClean()) {
+    await git.add("-A");
+    const changed = status.files.length;
+    await git.commit(`caveat sync: ${changed} changed file${changed === 1 ? "" : "s"}`);
+    committed = true;
+  }
+  const remoteBranch = (await git.raw(["ls-remote", "--heads", "origin", preflight.branch])).trim();
+  let pulled = false;
+  if (remoteBranch) {
+    try {
+      await git.pull("origin", preflight.branch, ["--rebase"]);
+      pulled = true;
+    } catch (err) {
+      try {
+        await git.raw(["rebase", "--abort"]);
+      } catch {
+      }
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new SyncError("SYNC_CONFLICT", `sync rebase failed and was aborted: ${detail}`);
+    }
+  }
+  reindexAndMark(opts);
+  await git.push("origin", preflight.branch, ["-u"]);
+  return {
+    ...preflight,
+    committed,
+    pulled,
+    pushed: true,
+    dryRun: false,
+    changedFiles: status.files.length
+  };
+}
+var KNOWLEDGE_GITIGNORE = [
+  "# Private entries DO sync to your private remote (Caveat-Private) \u2014 that is the",
+  "# intended sharing boundary. The public boundary is enforced by `caveat publish`.",
+  "",
+  "# Obsidian per-user config: workspace layout, theme, plugin state, cache.",
+  ".obsidian/",
+  ""
+].join("\n");
+function countMarkdownEntries(ownDir) {
+  const entries = join7(ownDir, "entries");
+  if (!existsSync10(entries)) return 0;
+  let count = 0;
+  const stack = [entries];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+      const path = join7(dir, entry.name);
+      if (entry.isDirectory()) stack.push(path);
+      else if (entry.isFile() && entry.name.endsWith(".md")) count++;
+    }
+  }
+  return count;
+}
+function scaffold(ownDir) {
+  mkdirSync4(join7(ownDir, "entries"), { recursive: true });
+  const gitignore = join7(ownDir, ".gitignore");
+  if (!existsSync10(gitignore)) writeFileSync4(gitignore, KNOWLEDGE_GITIGNORE, "utf-8");
+}
+async function defaultRemoteBranch(git, url) {
+  const symref = await git.raw(["ls-remote", "--symref", url, "HEAD"]);
+  const match = /^ref: refs\/heads\/([^\s]+)\s+HEAD$/m.exec(symref);
+  if (match) return match[1];
+  const heads = await git.raw(["ls-remote", "--heads", url]);
+  const first2 = /refs\/heads\/([^\s]+)\s*$/m.exec(heads);
+  if (!first2) throw new Error(`remote has refs but no branch heads: ${url}`);
+  return first2[1];
+}
+async function initOwnSync(opts) {
+  const ownDir = resolve2(opts.ownDir);
+  mkdirSync4(ownDir, { recursive: true });
+  const existing = simpleGit(ownDir);
+  if (await existing.checkIsRepo()) {
+    throw new SyncError("OWN_REPO_EXISTS", `own knowledge directory is already a git repository: ${ownDir}`);
+  }
+  const inspector = simpleGit(ownDir);
+  const refs = (await inspector.raw(["ls-remote", "--heads", opts.url])).trim();
+  const entryCount = countMarkdownEntries(ownDir);
+  if (refs && entryCount > 0) {
+    throw new SyncError("BOTH_HAVE_ENTRIES", "local and remote both contain entries; resolve the ownership conflict before initializing sync");
+  }
+  const git = simpleGit(ownDir);
+  const createdGitDir = join7(ownDir, ".git");
+  await git.init();
+  try {
+    await git.addRemote("origin", opts.url);
+    await assertPrivateRemotes(await effectivePushUrls(git), opts);
+    if (!refs) {
+      scaffold(ownDir);
+      await git.add("-A");
+      await git.commit(`caveat sync: initial import (${entryCount} entries)`);
+      const branch2 = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
+      await git.push("origin", branch2, ["-u"]);
+      reindexAndMark(opts);
+      return { ownDir, branch: branch2, remoteWasEmpty: true };
+    }
+    const branch = await defaultRemoteBranch(git, opts.url);
+    await git.fetch("origin", branch);
+    await git.checkout(["--track", "-B", branch, `origin/${branch}`]);
+    reindexAndMark(opts);
+    return { ownDir, branch, remoteWasEmpty: false };
+  } catch (err) {
+    try {
+      rmSync3(createdGitDir, { recursive: true, force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// ../../packages/core/dist/publish.js
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync7, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, join as join8, relative as relative3 } from "node:path";
+
+// ../../packages/core/dist/visibility.js
+function classifyVisibility(value) {
+  if (value === "public") return "public";
+  if (value === "private") return "private";
+  return "invalid";
+}
+
+// ../../packages/core/dist/publish.js
+function collectPublishSet(entriesDir) {
+  const files = [];
+  const invalid = [];
+  if (!existsSync11(entriesDir)) return { files, invalid };
+  for (const path of walkMarkdown(entriesDir)) {
+    const relPath = relative3(entriesDir, path).replace(/\\/g, "/");
+    const content = readFileSync8(path);
+    try {
+      const visibility = classifyVisibility(parseMarkdown(content.toString("utf-8")).frontmatter.visibility);
+      if (visibility === "public") files.push({ relPath, content });
+      else if (visibility === "invalid") invalid.push({ relPath, reason: "visibility must be exactly public or private" });
+    } catch (err) {
+      invalid.push({ relPath, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return { files, invalid };
+}
+async function preparePublishMirror(opts) {
+  const git = opts.git ?? simpleGit();
+  if (!existsSync11(opts.mirrorDir)) {
+    mkdirSync5(dirname4(opts.mirrorDir), { recursive: true });
+    await git.clone(opts.target, opts.mirrorDir);
+  } else {
+    const mirrorGit2 = simpleGit(opts.mirrorDir);
+    const old = (await mirrorGit2.raw(["remote", "get-url", "origin"])).trim();
+    if (old !== opts.target) {
+      throw new Error(`publish mirror points at ${old} but publishTarget is ${opts.target} \u2014 remove ${opts.mirrorDir} and re-run`);
+    }
+  }
+  const mirrorGit = simpleGit(opts.mirrorDir);
+  await mirrorGit.fetch("origin");
+  const head = (await mirrorGit.raw(["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"]).catch(() => "")).trim();
+  if (head) await mirrorGit.reset(["--hard", head]);
+  await mirrorGit.raw(["clean", "-ffdx"]);
+}
+function publishReadme(fileCount, files) {
+  const categories = [...new Set(files.map((f) => f.relPath.split("/")[0]).filter(Boolean))].sort();
+  return [
+    "# Caveat-Public",
+    "",
+    "This repository is generated by `caveat publish`. Do not edit it by hand.",
+    "",
+    "Subscribe with `caveat community add <https URL or username>`.",
+    "",
+    `Public entries: ${fileCount}`,
+    `Categories: ${categories.length ? categories.join(", ") : "(none)"}`,
+    "",
+    "Caveat: https://github.com/kitepon-rgb/Caveat",
+    ""
+  ].join("\n");
+}
+function writeMirror(opts) {
+  for (const item of readdirSync7(opts.mirrorDir, { withFileTypes: true })) {
+    if (item.name === ".git") continue;
+    rmSync4(join8(opts.mirrorDir, item.name), { recursive: true, force: true });
+  }
+  const entries = join8(opts.mirrorDir, "entries");
+  for (const file of opts.files) {
+    const target = join8(entries, file.relPath);
+    mkdirSync5(dirname4(target), { recursive: true });
+    writeFileSync5(target, file.content);
+  }
+  writeFileSync5(join8(opts.mirrorDir, "README.md"), opts.readme, "utf-8");
+}
+function* walkAllFiles(root) {
+  for (const item of readdirSync7(root, { withFileTypes: true })) {
+    if (item.name === ".git") continue;
+    const full = join8(root, item.name);
+    if (item.isDirectory()) yield* walkAllFiles(full);
+    else yield full;
+  }
+}
+function verifyMirror(mirrorDir) {
+  const entriesRoot = join8(mirrorDir, "entries");
+  const bad = [];
+  let fileCount = 0;
+  for (const path of walkAllFiles(mirrorDir)) {
+    const relToMirror = relative3(mirrorDir, path).replace(/\\/g, "/");
+    if (relToMirror === "README.md") continue;
+    if (!relToMirror.startsWith("entries/")) {
+      bad.push(`${relToMirror}: unexpected file outside entries/`);
+      continue;
+    }
+    if (!relToMirror.endsWith(".md")) {
+      bad.push(`${relToMirror}: unexpected non-markdown file`);
+      continue;
+    }
+    fileCount++;
+    const relPath = relative3(entriesRoot, path).replace(/\\/g, "/");
+    try {
+      const visibility = classifyVisibility(parseMarkdown(readFileSync8(path, "utf-8")).frontmatter.visibility);
+      if (visibility !== "public") bad.push(`${relPath}: visibility is ${visibility}`);
+    } catch (err) {
+      bad.push(`${relPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  if (bad.length) throw new Error(`publish mirror verification failed:
+${bad.join("\n")}`);
+  return { fileCount };
+}
+function stagedChanges(raw) {
+  const lines = raw.trim() ? raw.trim().split(/\r?\n/) : [];
+  let added = 0;
+  let modified = 0;
+  let deleted = 0;
+  for (const line of lines) {
+    if (line.startsWith("A")) added++;
+    else if (line.startsWith("D")) deleted++;
+    else modified++;
+  }
+  return { lines, added, modified, deleted };
+}
+async function publishOwn(opts) {
+  if (!opts.config.publishTarget) throw new Error("publishTarget is not configured");
+  const collected = collectPublishSet(opts.paths.entriesDir);
+  if (collected.invalid.length) throw new Error(`cannot publish invalid entries:
+${collected.invalid.map((x2) => `${x2.relPath}: ${x2.reason}`).join("\n")}`);
+  await preparePublishMirror({ mirrorDir: opts.paths.publishMirrorDir, target: opts.config.publishTarget });
+  writeMirror({ mirrorDir: opts.paths.publishMirrorDir, files: collected.files, readme: publishReadme(collected.files.length, collected.files) });
+  const verified = verifyMirror(opts.paths.publishMirrorDir);
+  if (verified.fileCount !== collected.files.length) throw new Error(`publish mirror file count mismatch: expected ${collected.files.length}, got ${verified.fileCount}`);
+  const git = simpleGit(opts.paths.publishMirrorDir);
+  await git.add("-A");
+  const changes = stagedChanges(await git.raw(["diff", "--cached", "--name-status"]));
+  if (!changes.lines.length) {
+    opts.logger.info("no changes to publish");
+    return { fileCount: verified.fileCount, changed: false, dryRun: Boolean(opts.dryRun) };
+  }
+  for (const line of changes.lines) opts.logger.info(line);
+  if (opts.dryRun) return { fileCount: verified.fileCount, changed: true, dryRun: true };
+  const question = `publish ${changes.lines.length} file change(s)? [y/N]`;
+  if (!opts.yes) {
+    if (!(opts.isTty ?? (() => Boolean(process.stdin.isTTY)))()) throw new Error(`${question}; rerun with --yes to approve non-interactively`);
+    if (!opts.confirmImpl(question)) throw new Error("publish cancelled");
+  }
+  await git.commit(`caveat publish: ${verified.fileCount} public entries (+${changes.added} ~${changes.modified} -${changes.deleted})`);
+  const branch = (await git.raw(["symbolic-ref", "--short", "HEAD"])).trim();
+  await git.push("origin", branch, ["-u"]);
+  return { fileCount: verified.fileCount, changed: true, dryRun: false };
+}
+
 // ../../packages/core/dist/codexSidecar.js
 function caveatEntryToSidecarContextBlock(entry) {
   const fm = entry.frontmatter;
@@ -15176,8 +15724,8 @@ function generateSourceSession(now = () => /* @__PURE__ */ new Date()) {
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
   for (const [heading, content2] of Object.entries(sections)) {
@@ -15195,14 +15743,14 @@ ${body}${body ? "\n" : ""}`;
   return { content, body };
 }
 function writeEntryFile(filePath, content) {
-  const dir = dirname3(filePath);
-  if (!existsSync9(dir)) mkdirSync3(dir, { recursive: true });
-  writeFileSync3(filePath, content, "utf-8");
+  const dir = dirname5(filePath);
+  if (!existsSync12(dir)) mkdirSync6(dir, { recursive: true });
+  writeFileSync6(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
-import { statSync as statSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { statSync as statSync5 } from "node:fs";
+import { join as join9 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -15218,7 +15766,7 @@ function recordEntry(input, opts) {
   const frontmatter = {
     id,
     title: input.title,
-    visibility: input.visibility ?? "public",
+    visibility: input.visibility ?? "private",
     confidence: input.confidence ?? "tentative",
     outcome: input.outcome ?? "resolved",
     tags: input.tags ?? [],
@@ -15238,9 +15786,9 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join6(opts.entriesRoot, relPath);
+  const filePath = join9(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
-  const stat = statSync4(filePath);
+  const stat = statSync5(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -15268,8 +15816,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync7, statSync as statSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { readFileSync as readFileSync9, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join10 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -15285,8 +15833,8 @@ function updateEntry(id, patch, opts) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join7(opts.entriesRoot, relPath);
-  const raw = readFileSync7(filePath, "utf-8");
+  const filePath = join10(opts.entriesRoot, relPath);
+  const raw = readFileSync9(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -15327,8 +15875,8 @@ function updateEntry(id, patch, opts) {
     }
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
-  writeFileSync4(filePath, built.content, "utf-8");
-  const stat = statSync5(filePath);
+  writeFileSync7(filePath, built.content, "utf-8");
+  const stat = statSync6(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -15359,6 +15907,12 @@ export {
   openDb,
   scanSource,
   rebuildAll,
+  computeEntriesDigest,
+  readDigestMarker,
+  writeDigestMarker,
+  acquireReindexLock,
+  releaseReindexLock,
+  reindexAllSources,
   search,
   get,
   listRecent,
@@ -15368,6 +15922,7 @@ export {
   resolvePaths,
   loadConfig,
   ensureUserConfig,
+  writeUserConfigPatch,
   communityAdd,
   communityPull,
   communityList,
@@ -15387,6 +15942,10 @@ export {
   drainPendingReminders,
   markHit,
   listStale,
+  syncOwn,
+  KNOWLEDGE_GITIGNORE,
+  initOwnSync,
+  publishOwn,
   caveatEntriesToSidecarContextBlocks,
   decideCodexSidecarExecution,
   buildCodexSidecarDiagnosticsCommand,
@@ -15414,4 +15973,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-ECC5LJZF.js.map
+//# sourceMappingURL=chunk-Z2XLYCR3.js.map