caveat-cli 0.14.8 → 0.14.10

package/README.md

@@ -12,6 +12,11 @@ caveat init                          # Claude Code MCP + hooks
 caveat codex-hook install            # optional: native Codex hooks
 ```
 
+On macOS with Homebrew Node, Caveat installs hook commands through the stable
+`/opt/homebrew/bin/node` symlink when it points at the current Node binary. This
+keeps Claude Code and Codex hooks working after Homebrew moves Node between
+`/opt/homebrew/Cellar/node/<version>/...` directories.
+
 `caveat init` (idempotent, `--dry-run` supported) does the Claude Code setup:
 
 1. Scaffolds `~/.caveat/own/` (your personal knowledge repo) + `~/.caveat/index/caveat.db`
@@ -82,6 +87,16 @@ If you want `~/.caveat/own/` to live elsewhere (e.g. a git-tracked directory you
 - Claude Code installed if you want Claude MCP / hooks integration. Without it, `caveat init --skip-claude` still provisions local state.
 - Codex installed if you want native Codex hooks via `caveat codex-hook install`.
 
+Release install smoke:
+
+```sh
+npm uninstall -g caveat-cli
+npm install -g caveat-cli
+caveat --version
+caveat init
+caveat codex-hook install
+```
+
 ## License
 
 MIT

package/dist/index.js

@@ -6854,8 +6854,8 @@ var stdoutLogger = {
 };
 
 // src/commands/init.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, renameSync, rmdirSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, renameSync, rmdirSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 
 // src/claudeInstall.ts
 import { spawnSync } from "node:child_process";
@@ -6877,10 +6877,16 @@ function hookCommand(nodePath, cliScriptPath, event) {
 function upsertHook(settings, event, command) {
   settings.hooks ??= {};
   const list = settings.hooks[event] ??= [];
-  const alreadyPresent = list.some(
-    (entry) => entry.hooks?.some((h) => isSameHookCommand(h.command, command))
-  );
-  if (alreadyPresent) return "unchanged";
+  const subcommand = command.includes("hook user-prompt-submit") ? "user-prompt-submit" : command.includes("hook post-tool-use") ? "post-tool-use" : command.includes("hook stop") ? "stop" : null;
+  for (const entry of list) {
+    for (const hook of entry.hooks ?? []) {
+      if (isSameHookCommand(hook.command, command)) return "unchanged";
+      if (subcommand && isCaveatClaudeHookCommand(hook.command, subcommand)) {
+        hook.command = command;
+        return "added";
+      }
+    }
+  }
   list.push({ hooks: [{ type: "command", command }] });
   return "added";
 }
@@ -6907,6 +6913,13 @@ function findExistingHookCommand(settings, event, command) {
 function isSameHookCommand(actual, expected) {
   return actual === expected || actual.endsWith(` ${expected}`);
 }
+function isEnvPrefixedCommand(command) {
+  return /^[A-Z_][A-Z0-9_]*=/.test(command.trim());
+}
+function isCaveatClaudeHookCommand(actual, event) {
+  const lower = actual.toLowerCase();
+  return !isEnvPrefixedCommand(actual) && lower.includes("caveat") && actual.includes(`hook ${event}`);
+}
 function readSettings(path) {
   if (!existsSync(path)) return {};
   return JSON.parse(readFileSync2(path, "utf-8"));
@@ -7037,6 +7050,40 @@ function uninstallClaudeIntegration(opts) {
   };
 }
 
+// src/nodePath.ts
+import { existsSync as existsSync2, realpathSync } from "node:fs";
+import { delimiter, join as join4 } from "node:path";
+var defaultRealpath = (path) => realpathSync.native(path);
+function safeRealpath(path, realpath = defaultRealpath) {
+  try {
+    return realpath(path);
+  } catch {
+    return null;
+  }
+}
+function resolveHookNodePath({
+  env = process.env,
+  execPath = process.execPath,
+  platform = process.platform,
+  exists = existsSync2,
+  realpath = defaultRealpath
+} = {}) {
+  const execRealpath = safeRealpath(execPath, realpath);
+  const pathEnv = env.PATH ?? env.Path ?? "";
+  const names = platform === "win32" ? ["node.exe", "node.cmd", "node.bat", "node"] : ["node"];
+  for (const dir of pathEnv.split(delimiter).filter(Boolean)) {
+    for (const name of names) {
+      const candidate = join4(dir, name);
+      if (!exists(candidate)) continue;
+      const candidateRealpath = safeRealpath(candidate, realpath);
+      if (execRealpath && candidateRealpath && candidateRealpath === execRealpath) {
+        return candidate;
+      }
+    }
+  }
+  return execPath;
+}
+
 // src/commands/init.ts
 var KNOWLEDGE_GITIGNORE = [
   "# Never commit entries flagged private (visibility: private is enforced by the",
@@ -7050,7 +7097,7 @@ var KNOWLEDGE_GITIGNORE = [
 async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
   ensureUserConfig(ctx.userConfigPath);
   ctx.logger.info(`user config: ${ctx.userConfigPath}`);
-  if (!existsSync2(ctx.paths.knowledgeRepo)) {
+  if (!existsSync3(ctx.paths.knowledgeRepo)) {
     mkdirSync2(ctx.paths.knowledgeRepo, { recursive: true });
     mkdirSync2(ctx.paths.entriesDir, { recursive: true });
     ctx.logger.info(`knowledge repo scaffolded: ${ctx.paths.knowledgeRepo}`);
@@ -7058,14 +7105,14 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
     ctx.logger.info(`knowledge repo: ${ctx.paths.knowledgeRepo}`);
   }
   migrateLegacyCommunityDir(ctx);
-  const gitignorePath = join4(ctx.paths.knowledgeRepo, ".gitignore");
-  if (!existsSync2(gitignorePath)) {
+  const gitignorePath = join5(ctx.paths.knowledgeRepo, ".gitignore");
+  if (!existsSync3(gitignorePath)) {
     writeFileSync2(gitignorePath, KNOWLEDGE_GITIGNORE, "utf-8");
     ctx.logger.info(`.gitignore created: ${gitignorePath}`);
   }
   if (!opts.dryRun) {
     const dbDir = dirname3(ctx.paths.dbPath);
-    if (!existsSync2(dbDir)) mkdirSync2(dbDir, { recursive: true });
+    if (!existsSync3(dbDir)) mkdirSync2(dbDir, { recursive: true });
     const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
     db.close();
     ctx.logger.info(`db initialized: ${ctx.paths.dbPath}`);
@@ -7096,20 +7143,20 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
     return;
   }
   const result = installClaudeIntegration({
-    claudeDir: join4(ctx.userHome, ".claude"),
+    claudeDir: join5(ctx.userHome, ".claude"),
     cliScriptPath,
-    nodePath: process.execPath,
+    nodePath: resolveHookNodePath(),
     dryRun: opts.dryRun,
     logger: ctx.logger
   });
   reportInstallResult(ctx, result, opts.dryRun);
 }
 function migrateLegacyCommunityDir(ctx) {
-  const legacy = join4(ctx.paths.knowledgeRepo, "community");
+  const legacy = join5(ctx.paths.knowledgeRepo, "community");
   const current = ctx.paths.communityDir;
   if (legacy === current) return;
-  if (!existsSync2(legacy)) return;
-  if (existsSync2(current)) {
+  if (!existsSync3(legacy)) return;
+  if (existsSync3(current)) {
     ctx.logger.warn(
       `legacy community dir still exists at ${legacy} \u2014 remove manually (new location in use)`
     );
@@ -7118,7 +7165,7 @@ function migrateLegacyCommunityDir(ctx) {
   mkdirSync2(current, { recursive: true });
   for (const entry of readdirSync(legacy, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    renameSync(join4(legacy, entry.name), join4(current, entry.name));
+    renameSync(join5(legacy, entry.name), join5(current, entry.name));
   }
   try {
     rmdirSync(legacy);
@@ -7133,9 +7180,9 @@ function runUninstall(ctx, opts) {
     process.exit(1);
   }
   const result = uninstallClaudeIntegration({
-    claudeDir: join4(ctx.userHome, ".claude"),
+    claudeDir: join5(ctx.userHome, ".claude"),
     cliScriptPath,
-    nodePath: process.execPath,
+    nodePath: resolveHookNodePath(),
     dryRun: opts.dryRun,
     logger: ctx.logger
   });
@@ -7180,29 +7227,29 @@ function reportInstallResult(ctx, result, dryRun) {
 }
 
 // src/commands/indexCmd.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname4, join as join5 } from "node:path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname4, join as join6 } from "node:path";
 function runIndex(ctx, opts) {
   const dbDir = dirname4(ctx.paths.dbPath);
-  if (!existsSync3(dbDir)) mkdirSync3(dbDir, { recursive: true });
+  if (!existsSync4(dbDir)) mkdirSync3(dbDir, { recursive: true });
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
   try {
     if (opts.full) {
       ctx.logger.info("full rebuild: DELETE FROM entries");
       rebuildAll(db);
     }
-    if (existsSync3(ctx.paths.entriesDir)) {
+    if (existsSync4(ctx.paths.entriesDir)) {
       const result = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
       ctx.logger.info(`own: +${result.added} ~${result.updated} -${result.deleted}`);
     } else {
       ctx.logger.warn(`entries dir not found: ${ctx.paths.entriesDir}`);
     }
-    if (existsSync3(ctx.paths.communityDir)) {
+    if (existsSync4(ctx.paths.communityDir)) {
       for (const entry of readdirSync2(ctx.paths.communityDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         const source = `community/${entry.name}`;
-        const root = join5(ctx.paths.communityDir, entry.name, "entries");
-        if (!existsSync3(root)) continue;
+        const root = join6(ctx.paths.communityDir, entry.name, "entries");
+        if (!existsSync4(root)) continue;
         const result = scanSource({ db, source, entriesRoot: root });
         ctx.logger.info(`${source}: +${result.added} ~${result.updated} -${result.deleted}`);
       }
@@ -12612,8 +12659,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+var mac = (delimiter2) => {
+  const escapedDelim = escapeRegex(delimiter2 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -31430,11 +31477,11 @@ var StdioServerTransport = class {
 
 // ../mcp/dist/context.js
 import { homedir as homedir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function buildMcpContext(overrides = {}) {
   const userHome = overrides.userHome ?? homedir2();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join6(userHome, ".caveatrc.json");
+  const userConfigPath = join7(userHome, ".caveatrc.json");
   const logger = overrides.logger ?? stderrLogger;
   const config2 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config2.knowledgeRepo, userHome);
@@ -31569,13 +31616,13 @@ function handleListRecent(ctx, args) {
 }
 
 // ../mcp/dist/tools/pull.js
-import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync3 } from "node:fs";
+import { join as join8 } from "node:path";
 var pullInputShape = {};
 async function handlePull(ctx, _args = {}) {
   const pulled = [];
   const indexed = [];
-  if (existsSync4(ctx.paths.communityDir)) {
+  if (existsSync5(ctx.paths.communityDir)) {
     const results = await communityPull({
       communityDir: ctx.paths.communityDir,
       logger: ctx.logger
@@ -31585,16 +31632,16 @@ async function handlePull(ctx, _args = {}) {
     }
   }
   rebuildAll(ctx.db);
-  if (existsSync4(ctx.paths.entriesDir)) {
+  if (existsSync5(ctx.paths.entriesDir)) {
     const own = scanSource({ db: ctx.db, source: "own", entriesRoot: ctx.paths.entriesDir });
     indexed.push({ source: "own", ...own });
   }
-  if (existsSync4(ctx.paths.communityDir)) {
+  if (existsSync5(ctx.paths.communityDir)) {
     for (const entry of readdirSync3(ctx.paths.communityDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const source = `community/${entry.name}`;
-      const root = join7(ctx.paths.communityDir, entry.name, "entries");
-      if (!existsSync4(root)) continue;
+      const root = join8(ctx.paths.communityDir, entry.name, "entries");
+      if (!existsSync5(root)) continue;
       const scan = scanSource({ db: ctx.db, source, entriesRoot: root });
       indexed.push({ source, ...scan });
     }
@@ -31709,7 +31756,7 @@ async function runMcpServer() {
 // src/commands/hookCmd.ts
 import { spawn, spawnSync as spawnSync2 } from "node:child_process";
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync4,
   mkdtempSync,
   readFileSync as readFileSync3,
@@ -31718,7 +31765,7 @@ import {
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
 var silentLogger = {
   info: () => {
@@ -31768,7 +31815,7 @@ function searchCaveatsFromTextSafely(text) {
   let db;
   try {
     const ctx = buildContextSafely();
-    if (!ctx || !existsSync5(ctx.paths.dbPath)) return [];
+    if (!ctx || !existsSync6(ctx.paths.dbPath)) return [];
     db = openDb({ path: ctx.paths.dbPath });
     const hits = findCaveatsForPrompt(db, text, {
       selfIdentity: defaultSelfIdentityTokens()
@@ -31852,7 +31899,7 @@ function stopSignalKey(signals, related) {
   return createHash("sha256").update(body).digest("hex");
 }
 function stopStatePath(caveatHome, sessionId) {
-  return join8(caveatHome, CLAUDE_STOP_STATE_DIR, `${sanitizeClaudeStateId(sessionId)}.txt`);
+  return join9(caveatHome, CLAUDE_STOP_STATE_DIR, `${sanitizeClaudeStateId(sessionId)}.txt`);
 }
 function wasStopReminderQueued(caveatHome, sessionId, key) {
   const path = stopStatePath(caveatHome, sessionId);
@@ -31864,7 +31911,7 @@ function wasStopReminderQueued(caveatHome, sessionId, key) {
 }
 function markStopReminderQueued(caveatHome, sessionId, key) {
   const path = stopStatePath(caveatHome, sessionId);
-  mkdirSync4(join8(caveatHome, CLAUDE_STOP_STATE_DIR), { recursive: true });
+  mkdirSync4(join9(caveatHome, CLAUDE_STOP_STATE_DIR), { recursive: true });
   writeFileSync3(path, key, "utf-8");
 }
 function queueStopForSession(sessionId, signals, related) {
@@ -31915,7 +31962,7 @@ function isToolError(payload) {
   return false;
 }
 function spawnWorker(job) {
-  const workFile = join8(
+  const workFile = join9(
     tmpdir(),
     `caveat-worker-${Date.now()}-${randomBytes(4).toString("hex")}.json`
   );
@@ -31979,7 +32026,7 @@ function buildToolErrorReminder(job, hits) {
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync5(join8(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync6(join9(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: job.searchText,
@@ -32016,7 +32063,7 @@ function buildStopReminder(signals, related) {
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync5(join8(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync6(join9(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: struggleSearchText(signals),
@@ -32081,8 +32128,8 @@ function runCodexSidecarAdvisory(input) {
     "--availability",
     "operational"
   ];
-  const resultDir = mkdtempSync(join8(tmpdir(), "caveat-codex-advisory-"));
-  const resultFile = join8(resultDir, "result.json");
+  const resultDir = mkdtempSync(join9(tmpdir(), "caveat-codex-advisory-"));
+  const resultFile = join9(resultDir, "result.json");
   args.push("--save-result", resultFile);
   const nodeCli = process.env.CAVEAT_CODEX_SIDECAR_NODE_CLI;
   if (nodeCli) {
@@ -32197,14 +32244,14 @@ async function runHook(name, arg) {
 
 // src/commands/codexHookCmd.ts
 import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 
 // src/codexHookInstall.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
 function quote2(p) {
   return p.includes(" ") ? `"${p}"` : p;
 }
@@ -32217,20 +32264,24 @@ function eventCommandFragment(event) {
 function isSameHookCommand2(actual, expected) {
   return actual === expected || actual.endsWith(` ${expected}`);
 }
+function isCaveatCodexHookCommand(actual, event) {
+  const lower = actual.toLowerCase();
+  return lower.includes("caveat") && actual.includes(eventCommandFragment(event));
+}
 function hasCaveatHook(hooksJson, event, fragment) {
   return hooksJson.hooks?.[event]?.some(
     (entry) => entry.hooks?.some((h) => h.command.includes(fragment))
   ) ?? false;
 }
 function readHooks(path) {
-  if (!existsSync6(path)) return {};
+  if (!existsSync7(path)) return {};
   return JSON.parse(readFileSync4(path, "utf-8"));
 }
 function writeJsonWithBackup(path, value) {
   const dir = dirname5(path);
-  if (!existsSync6(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync5(dir, { recursive: true });
   let backupPath = "";
-  if (existsSync6(path)) {
+  if (existsSync7(path)) {
     backupPath = `${path}.caveat-backup-${Date.now()}`;
     copyFileSync2(path, backupPath);
   }
@@ -32238,13 +32289,21 @@ function writeJsonWithBackup(path, value) {
 `, "utf-8");
   return backupPath;
 }
-function upsertHook2(hooksJson, event, command) {
+function upsertHook2(hooksJson, event, command, subcommand) {
   hooksJson.hooks ??= {};
   const list = hooksJson.hooks[event] ??= [];
-  const alreadyPresent = list.some(
-    (entry) => entry.hooks?.some((h) => isSameHookCommand2(h.command, command))
-  );
-  if (alreadyPresent) return "unchanged";
+  for (const entry of list) {
+    for (const hook of entry.hooks ?? []) {
+      if (isSameHookCommand2(hook.command, command)) return "unchanged";
+      if (isCaveatCodexHookCommand(hook.command, subcommand)) {
+        hook.command = command;
+        hook.timeoutSec = 5;
+        hook.async = false;
+        hook.statusMessage = null;
+        return "added";
+      }
+    }
+  }
   list.push({
     hooks: [
       {
@@ -32258,12 +32317,14 @@ function upsertHook2(hooksJson, event, command) {
   });
   return "added";
 }
-function removeHook2(hooksJson, event, command) {
+function removeHook2(hooksJson, event, command, subcommand) {
   const list = hooksJson.hooks?.[event];
   if (!list) return false;
   const before = list.length;
   const filtered = list.filter(
-    (entry) => !entry.hooks?.some((h) => isSameHookCommand2(h.command, command))
+    (entry) => !entry.hooks?.some(
+      (h) => isSameHookCommand2(h.command, command) || isCaveatCodexHookCommand(h.command, subcommand)
+    )
   );
   if (filtered.length === before) return false;
   hooksJson.hooks[event] = filtered;
@@ -32297,9 +32358,9 @@ codex_hooks = true
 }
 function writeConfigWithBackup(path, text) {
   const dir = dirname5(path);
-  if (!existsSync6(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync5(dir, { recursive: true });
   let backupPath = "";
-  if (existsSync6(path)) {
+  if (existsSync7(path)) {
     backupPath = `${path}.caveat-backup-${Date.now()}`;
     copyFileSync2(path, backupPath);
   }
@@ -32307,25 +32368,28 @@ function writeConfigWithBackup(path, text) {
   return backupPath;
 }
 function installCodexHooks(opts) {
-  const hooksPath = join9(opts.codexHome, "hooks.json");
-  const configPath = join9(opts.codexHome, "config.toml");
+  const hooksPath = join10(opts.codexHome, "hooks.json");
+  const configPath = join10(opts.codexHome, "config.toml");
   const hooksJson = readHooks(hooksPath);
   const userPromptSubmit = upsertHook2(
     hooksJson,
     "UserPromptSubmit",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "user-prompt-submit")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "user-prompt-submit"),
+    "user-prompt-submit"
   );
   const postToolUse = upsertHook2(
     hooksJson,
     "PostToolUse",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "post-tool-use")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "post-tool-use"),
+    "post-tool-use"
   );
   const stop = upsertHook2(
     hooksJson,
     "Stop",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "stop")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "stop"),
+    "stop"
   );
-  const rawConfig = existsSync6(configPath) ? readFileSync4(configPath, "utf-8") : "";
+  const rawConfig = existsSync7(configPath) ? readFileSync4(configPath, "utf-8") : "";
   const enabled = enableCodexHooksFeature(rawConfig);
   const anyHookAdded = userPromptSubmit === "added" || postToolUse === "added" || stop === "added";
   let backupPath;
@@ -32351,22 +32415,25 @@ function installCodexHooks(opts) {
   };
 }
 function uninstallCodexHooks(opts) {
-  const hooksPath = join9(opts.codexHome, "hooks.json");
+  const hooksPath = join10(opts.codexHome, "hooks.json");
   const hooksJson = readHooks(hooksPath);
   const userPromptSubmitRemoved = removeHook2(
     hooksJson,
     "UserPromptSubmit",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "user-prompt-submit")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "user-prompt-submit"),
+    "user-prompt-submit"
   );
   const postToolUseRemoved = removeHook2(
     hooksJson,
     "PostToolUse",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "post-tool-use")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "post-tool-use"),
+    "post-tool-use"
   );
   const stopRemoved = removeHook2(
     hooksJson,
     "Stop",
-    hookCommand2(opts.nodePath, opts.cliScriptPath, "stop")
+    hookCommand2(opts.nodePath, opts.cliScriptPath, "stop"),
+    "stop"
   );
   let backupPath;
   if (opts.dryRun) {
@@ -32386,7 +32453,7 @@ function uninstallCodexHooks(opts) {
   };
 }
 function detectCodexHookInstallation(codexHome) {
-  const hooksPath = join9(codexHome, "hooks.json");
+  const hooksPath = join10(codexHome, "hooks.json");
   const hooksJson = readHooks(hooksPath);
   const hooks = {
     userPromptSubmit: hasCaveatHook(
@@ -32450,7 +32517,7 @@ function searchCaveatsFromTextSafely2(text) {
   let db;
   try {
     const ctx = buildContextSafely2();
-    if (!ctx || !existsSync7(ctx.paths.dbPath)) return [];
+    if (!ctx || !existsSync8(ctx.paths.dbPath)) return [];
     db = openDb({ path: ctx.paths.dbPath });
     const hits = findCaveatsForPrompt(db, text, {
       selfIdentity: defaultSelfIdentityTokens()
@@ -32519,7 +32586,7 @@ function processExitCodeFromText(text) {
   return m ? Number(m[1]) : null;
 }
 function transcriptToolOutput(transcriptPath, toolUseId) {
-  if (!transcriptPath || !toolUseId || !existsSync7(transcriptPath)) return null;
+  if (!transcriptPath || !toolUseId || !existsSync8(transcriptPath)) return null;
   let raw = "";
   try {
     raw = readFileSync5(transcriptPath, "utf-8");
@@ -32660,7 +32727,7 @@ function stopSignalKey2(signals, related) {
   return createHash2("sha256").update(body).digest("hex");
 }
 function stopStatePath2(caveatHome, sessionId) {
-  return join10(caveatHome, CODEX_STOP_STATE_DIR, `${sanitizeCodexStateId(sessionId)}.txt`);
+  return join11(caveatHome, CODEX_STOP_STATE_DIR, `${sanitizeCodexStateId(sessionId)}.txt`);
 }
 function wasStopReminderQueued2(caveatHome, sessionId, key) {
   const path = stopStatePath2(caveatHome, sessionId);
@@ -32672,7 +32739,7 @@ function wasStopReminderQueued2(caveatHome, sessionId, key) {
 }
 function markStopReminderQueued2(caveatHome, sessionId, key) {
   const path = stopStatePath2(caveatHome, sessionId);
-  mkdirSync6(join10(caveatHome, CODEX_STOP_STATE_DIR), { recursive: true });
+  mkdirSync6(join11(caveatHome, CODEX_STOP_STATE_DIR), { recursive: true });
   writeFileSync5(path, key, "utf-8");
 }
 function queueStopForSession2(sessionId, signals, related) {
@@ -32743,7 +32810,7 @@ async function runCodexWorker(workFile) {
   await processCodexWorkerJob(job);
   process.exit(0);
 }
-function runDiagnostics(codexHome = process.env.CODEX_HOME ?? join10(homedir3(), ".codex")) {
+function runDiagnostics(codexHome = process.env.CODEX_HOME ?? join11(homedir3(), ".codex")) {
   const features = spawnSync3("codex", ["features", "list"], {
     encoding: "utf-8",
     maxBuffer: 1024 * 1024
@@ -32820,10 +32887,10 @@ async function runCodexHook(name, arg) {
 }
 
 // src/commands/pull.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync4 } from "node:fs";
+import { join as join12 } from "node:path";
 async function runPull(ctx) {
-  if (!existsSync8(ctx.paths.communityDir)) {
+  if (!existsSync9(ctx.paths.communityDir)) {
     ctx.logger.info(
       "no community repos yet \u2014 add one with `caveat community add <github-url>`."
     );
@@ -32843,15 +32910,15 @@ async function runPull(ctx) {
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
   try {
     rebuildAll(db);
-    if (existsSync8(ctx.paths.entriesDir)) {
+    if (existsSync9(ctx.paths.entriesDir)) {
       const own = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
       ctx.logger.info(`own: +${own.added}`);
     }
     for (const entry of readdirSync4(ctx.paths.communityDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const source = `community/${entry.name}`;
-      const root = join11(ctx.paths.communityDir, entry.name, "entries");
-      if (!existsSync8(root)) continue;
+      const root = join12(ctx.paths.communityDir, entry.name, "entries");
+      if (!existsSync9(root)) continue;
       const scan = scanSource({ db, source, entriesRoot: root });
       ctx.logger.info(`${source}: +${scan.added}`);
     }
@@ -32864,7 +32931,7 @@ async function runPull(ctx) {
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname6, join as join12 } from "node:path";
+import { dirname as dirname6, join as join13 } from "node:path";
 import { cwd, exit } from "node:process";
 function runCodexSidecarDiagnostics(logger, opts) {
   const plan = buildCodexSidecarDiagnosticsCommand({
@@ -32896,8 +32963,8 @@ function runCodexSidecarWithCaveats(ctx, workflow, prompt, opts) {
     process.stdout.write(JSON.stringify({ status: "skipped", decision }, null, 2) + "\n");
     exit(0);
   }
-  const contextDir = mkdtempSync2(join12(tmpdir3(), "caveat-sidecar-context-"));
-  const contextFile = join12(contextDir, "context.json");
+  const contextDir = mkdtempSync2(join13(tmpdir3(), "caveat-sidecar-context-"));
+  const contextFile = join13(contextDir, "context.json");
   let status = 1;
   try {
     const blocks = collectCaveatContextBlocks(ctx, {
@@ -33152,7 +33219,7 @@ codexHook.command("install").description("Install Caveat hooks into ~/.codex/hoo
   const result = installCodexHooks({
     codexHome: opts.codexHome,
     cliScriptPath,
-    nodePath: process.execPath,
+    nodePath: resolveHookNodePath(),
     dryRun: opts.dryRun,
     logger: stdoutLogger
   });
@@ -33174,7 +33241,7 @@ codexHook.command("uninstall").description("Remove Caveat-owned Codex hooks from
   const result = uninstallCodexHooks({
     codexHome: opts.codexHome,
     cliScriptPath,
-    nodePath: process.execPath,
+    nodePath: resolveHookNodePath(),
     dryRun: opts.dryRun,
     logger: stdoutLogger
   });