caveat-cli 0.14.9 → 0.15.0

package/dist/index.js

@@ -2,9 +2,11 @@
 import { createRequire as __caveat_createRequire } from 'node:module';
 const require = __caveat_createRequire(import.meta.url);
 import {
+  KNOWLEDGE_GITIGNORE,
   __commonJS,
   __export,
   __toESM,
+  acquireReindexLock,
   appendPendingReminder,
   buildCodexSidecarDiagnosticsCommand,
   buildCodexSidecarReadOnlySmokeCommand,
@@ -15,6 +17,7 @@ import {
   communityList,
   communityPull,
   communityRemove,
+  computeEntriesDigest,
   decideCodexSidecarExecution,
   defaultSelfIdentityTokens,
   drainPendingReminders,
@@ -23,26 +26,34 @@ import {
   findCaveatsForPrompt,
   get,
   hasAnyStruggleSignal,
+  initOwnSync,
   listRecent,
   listStale,
   loadConfig,
   markHit,
   maybeSweepPendingDirs,
   openDb,
+  publishOwn,
   readCodexSessionSignals,
+  readDigestMarker,
   readSessionSignals,
   rebuildAll,
   recordEntry,
+  reindexAllSources,
+  releaseReindexLock,
   resolvePaths,
   scanSource,
   search,
   stderrLogger,
   stopReminderText,
   struggleSearchText,
+  syncOwn,
   toolErrorReminderText,
   updateEntry,
-  userPromptSubmitReminderText
-} from "./chunk-ECC5LJZF.js";
+  userPromptSubmitReminderText,
+  writeDigestMarker,
+  writeUserConfigPatch
+} from "./chunk-Z2XLYCR3.js";
 
 // ../../node_modules/.pnpm/ajv@8.18.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -7085,15 +7096,6 @@ function resolveHookNodePath({
 }
 
 // src/commands/init.ts
-var KNOWLEDGE_GITIGNORE = [
-  "# Never commit entries flagged private (visibility: private is enforced by the",
-  "# pre-commit gate, but this is a filename-level backup guard).",
-  "*.private.md",
-  "",
-  "# Obsidian per-user config: workspace layout, theme, plugin state, cache.",
-  ".obsidian/",
-  ""
-].join("\n");
 async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
   ensureUserConfig(ctx.userConfigPath);
   ctx.logger.info(`user config: ${ctx.userConfigPath}`);
@@ -7114,7 +7116,12 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
     const dbDir = dirname3(ctx.paths.dbPath);
     if (!existsSync3(dbDir)) mkdirSync2(dbDir, { recursive: true });
     const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
-    db.close();
+    try {
+      reindexAllSources({ db, paths: ctx.paths, logger: ctx.logger });
+      writeDigestMarker(ctx.caveatHome, computeEntriesDigest(ctx.paths));
+    } finally {
+      db.close();
+    }
     ctx.logger.info(`db initialized: ${ctx.paths.dbPath}`);
   } else {
     ctx.logger.info(`[dry-run] db path: ${ctx.paths.dbPath}`);
@@ -7227,8 +7234,8 @@ function reportInstallResult(ctx, result, dryRun) {
 }
 
 // src/commands/indexCmd.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
 function runIndex(ctx, opts) {
   const dbDir = dirname4(ctx.paths.dbPath);
   if (!existsSync4(dbDir)) mkdirSync3(dbDir, { recursive: true });
@@ -7238,22 +7245,15 @@ function runIndex(ctx, opts) {
       ctx.logger.info("full rebuild: DELETE FROM entries");
       rebuildAll(db);
     }
-    if (existsSync4(ctx.paths.entriesDir)) {
-      const result = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
-      ctx.logger.info(`own: +${result.added} ~${result.updated} -${result.deleted}`);
-    } else {
-      ctx.logger.warn(`entries dir not found: ${ctx.paths.entriesDir}`);
-    }
-    if (existsSync4(ctx.paths.communityDir)) {
-      for (const entry of readdirSync2(ctx.paths.communityDir, { withFileTypes: true })) {
-        if (!entry.isDirectory()) continue;
-        const source = `community/${entry.name}`;
-        const root = join6(ctx.paths.communityDir, entry.name, "entries");
-        if (!existsSync4(root)) continue;
-        const result = scanSource({ db, source, entriesRoot: root });
-        ctx.logger.info(`${source}: +${result.added} ~${result.updated} -${result.deleted}`);
+    const result = reindexAllSources({ db, paths: ctx.paths, logger: ctx.logger });
+    for (const [source, scan] of Object.entries(result.perSource)) {
+      if (source === "own") {
+        ctx.logger.info(`own: +${scan.added} ~${scan.updated} -${scan.deleted}`);
+      } else {
+        ctx.logger.info(`${source}: +${scan.added} ~${scan.updated} -${scan.deleted}`);
       }
     }
+    writeDigestMarker(ctx.caveatHome, computeEntriesDigest(ctx.paths));
   } finally {
     db.close();
   }
@@ -7405,7 +7405,7 @@ function runStats(ctx) {
 
 // src/commands/serve.ts
 async function runServe(opts) {
-  const { startServer } = await import("./server-YQ4DJ2H7.js");
+  const { startServer } = await import("./server-DCE3ODHI.js");
   const { port, host } = startServer({ port: opts.port });
   process.stdout.write(`[caveat] web portal: http://${host}:${port}/
 `);
@@ -31477,11 +31477,11 @@ var StdioServerTransport = class {
 
 // ../mcp/dist/context.js
 import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join6 } from "node:path";
 function buildMcpContext(overrides = {}) {
   const userHome = overrides.userHome ?? homedir2();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join7(userHome, ".caveatrc.json");
+  const userConfigPath = join6(userHome, ".caveatrc.json");
   const logger = overrides.logger ?? stderrLogger;
   const config2 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config2.knowledgeRepo, userHome);
@@ -31616,8 +31616,8 @@ function handleListRecent(ctx, args) {
 }
 
 // ../mcp/dist/tools/pull.js
-import { existsSync as existsSync5, readdirSync as readdirSync3 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
 var pullInputShape = {};
 async function handlePull(ctx, _args = {}) {
   const pulled = [];
@@ -31637,10 +31637,10 @@ async function handlePull(ctx, _args = {}) {
     indexed.push({ source: "own", ...own });
   }
   if (existsSync5(ctx.paths.communityDir)) {
-    for (const entry of readdirSync3(ctx.paths.communityDir, { withFileTypes: true })) {
+    for (const entry of readdirSync2(ctx.paths.communityDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const source = `community/${entry.name}`;
-      const root = join8(ctx.paths.communityDir, entry.name, "entries");
+      const root = join7(ctx.paths.communityDir, entry.name, "entries");
       if (!existsSync5(root)) continue;
       const scan = scanSource({ db: ctx.db, source, entriesRoot: root });
       indexed.push({ source, ...scan });
@@ -31754,9 +31754,9 @@ async function runMcpServer() {
 }
 
 // src/commands/hookCmd.ts
-import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync4,
   mkdtempSync,
   readFileSync as readFileSync3,
@@ -31767,6 +31767,31 @@ import {
 import { tmpdir } from "node:os";
 import { join as join9 } from "node:path";
 import { createHash, randomBytes } from "node:crypto";
+
+// src/autoReindexTrigger.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join8 } from "node:path";
+function maybeTriggerAutoReindex(ctx) {
+  if (process.env.CAVEAT_INDEX_AUTOSYNC === "off") return;
+  if (!existsSync6(ctx.paths.dbPath)) return;
+  if (existsSync6(join8(ctx.caveatHome, "index", ".reindex-lock"))) return;
+  const current = computeEntriesDigest(ctx.paths);
+  const marker = readDigestMarker(ctx.caveatHome);
+  if (marker?.digest === current.digest && marker.fileCount === current.fileCount) return;
+  const cliScript = process.argv[1];
+  if (!cliScript) throw new Error("current Caveat CLI script path is unavailable");
+  const child = spawn(
+    process.execPath,
+    // execArgv を継承して親と同じランタイム（例: テストハーネスの --import tsx）で
+    // worker を起動する。素の node だと TS ソース実行のテスト環境で worker が即死する。
+    [...process.execArgv, "--disable-warning=ExperimentalWarning", cliScript, "hook", "reindex"],
+    { detached: true, stdio: "ignore", windowsHide: true }
+  );
+  child.unref();
+}
+
+// src/commands/hookCmd.ts
 var silentLogger = {
   info: () => {
   },
@@ -31815,7 +31840,7 @@ function searchCaveatsFromTextSafely(text) {
   let db;
   try {
     const ctx = buildContextSafely();
-    if (!ctx || !existsSync6(ctx.paths.dbPath)) return [];
+    if (!ctx || !existsSync7(ctx.paths.dbPath)) return [];
     db = openDb({ path: ctx.paths.dbPath });
     const hits = findCaveatsForPrompt(db, text, {
       selfIdentity: defaultSelfIdentityTokens()
@@ -31977,7 +32002,7 @@ function spawnWorker(job) {
   const cliScript = process.argv[1];
   if (!cliScript) return;
   try {
-    const child = spawn(
+    const child = spawn2(
       process.execPath,
       ["--disable-warning=ExperimentalWarning", cliScript, "hook", "worker", workFile],
       { detached: true, stdio: "ignore", windowsHide: true }
@@ -32021,12 +32046,65 @@ async function runWorker(workFile) {
   }
   process.exit(0);
 }
+function writeLastReindex(caveatHome, value) {
+  try {
+    writeFileSync3(join9(caveatHome, "index", ".last-reindex.json"), JSON.stringify(value), "utf-8");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] reindex status write error: ${msg}
+`);
+  }
+}
+function runReindexWorker() {
+  if (process.env.CAVEAT_INDEX_AUTOSYNC === "off") {
+    process.stderr.write("[caveat:hook] auto reindex disabled by CAVEAT_INDEX_AUTOSYNC=off\n");
+    return;
+  }
+  const ctx = buildContextSafely();
+  if (!ctx || !existsSync7(ctx.paths.dbPath)) {
+    process.stderr.write("[caveat:hook] auto reindex skipped: index database does not exist\n");
+    return;
+  }
+  const lock = acquireReindexLock(ctx.caveatHome);
+  if (!lock) return;
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  let db;
+  try {
+    const digest = computeEntriesDigest(ctx.paths);
+    db = openDb({ path: ctx.paths.dbPath, logger: silentLogger });
+    const result = reindexAllSources({ db, paths: ctx.paths, logger: silentLogger });
+    writeDigestMarker(ctx.caveatHome, digest);
+    writeLastReindex(ctx.caveatHome, {
+      startedAt,
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      perSource: result.perSource
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] reindex error: ${msg}
+`);
+    writeLastReindex(ctx.caveatHome, {
+      startedAt,
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      error: msg
+    });
+  } finally {
+    db?.close();
+    try {
+      releaseReindexLock(lock);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[caveat:hook] reindex lock release error: ${msg}
+`);
+    }
+  }
+}
 function buildToolErrorReminder(job, hits) {
   const base = toolErrorReminderText(hits);
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync6(join9(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync7(join9(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: job.searchText,
@@ -32063,7 +32141,7 @@ function buildStopReminder(signals, related) {
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync6(join9(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync7(join9(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: struggleSearchText(signals),
@@ -32178,6 +32256,10 @@ function runCodexSidecarAdvisory(input) {
   }
 }
 async function runHook(name, arg) {
+  if (name === "reindex") {
+    runReindexWorker();
+    process.exit(0);
+  }
   if (name === "worker") {
     if (!arg) process.exit(0);
     await runWorker(arg);
@@ -32224,10 +32306,22 @@ async function runHook(name, arg) {
     process.exit(0);
   }
   if (name === "stop") {
-    try {
-      const ctx = buildContextSafely();
-      if (ctx) maybeSweepPendingDirs(ctx.caveatHome);
-    } catch {
+    const ctx = buildContextSafely();
+    if (ctx) {
+      try {
+        maybeSweepPendingDirs(ctx.caveatHome);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[caveat:hook] pending sweep error: ${msg}
+`);
+      }
+      try {
+        maybeTriggerAutoReindex(ctx);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[caveat:hook] auto reindex trigger error: ${msg}
+`);
+      }
     }
     if (payload.stop_hook_active === true) process.exit(0);
     const transcriptPath = typeof payload.transcript_path === "string" ? payload.transcript_path : "";
@@ -32243,14 +32337,14 @@ async function runHook(name, arg) {
 }
 
 // src/commands/codexHookCmd.ts
-import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
 import { join as join11 } from "node:path";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 
 // src/codexHookInstall.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname5, join as join10 } from "node:path";
 function quote2(p) {
   return p.includes(" ") ? `"${p}"` : p;
@@ -32274,14 +32368,14 @@ function hasCaveatHook(hooksJson, event, fragment) {
   ) ?? false;
 }
 function readHooks(path) {
-  if (!existsSync7(path)) return {};
+  if (!existsSync8(path)) return {};
   return JSON.parse(readFileSync4(path, "utf-8"));
 }
 function writeJsonWithBackup(path, value) {
   const dir = dirname5(path);
-  if (!existsSync7(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync8(dir)) mkdirSync5(dir, { recursive: true });
   let backupPath = "";
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     backupPath = `${path}.caveat-backup-${Date.now()}`;
     copyFileSync2(path, backupPath);
   }
@@ -32358,9 +32452,9 @@ codex_hooks = true
 }
 function writeConfigWithBackup(path, text) {
   const dir = dirname5(path);
-  if (!existsSync7(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync8(dir)) mkdirSync5(dir, { recursive: true });
   let backupPath = "";
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     backupPath = `${path}.caveat-backup-${Date.now()}`;
     copyFileSync2(path, backupPath);
   }
@@ -32389,7 +32483,7 @@ function installCodexHooks(opts) {
     hookCommand2(opts.nodePath, opts.cliScriptPath, "stop"),
     "stop"
   );
-  const rawConfig = existsSync7(configPath) ? readFileSync4(configPath, "utf-8") : "";
+  const rawConfig = existsSync8(configPath) ? readFileSync4(configPath, "utf-8") : "";
   const enabled = enableCodexHooksFeature(rawConfig);
   const anyHookAdded = userPromptSubmit === "added" || postToolUse === "added" || stop === "added";
   let backupPath;
@@ -32517,7 +32611,7 @@ function searchCaveatsFromTextSafely2(text) {
   let db;
   try {
     const ctx = buildContextSafely2();
-    if (!ctx || !existsSync8(ctx.paths.dbPath)) return [];
+    if (!ctx || !existsSync9(ctx.paths.dbPath)) return [];
     db = openDb({ path: ctx.paths.dbPath });
     const hits = findCaveatsForPrompt(db, text, {
       selfIdentity: defaultSelfIdentityTokens()
@@ -32586,7 +32680,7 @@ function processExitCodeFromText(text) {
   return m ? Number(m[1]) : null;
 }
 function transcriptToolOutput(transcriptPath, toolUseId) {
-  if (!transcriptPath || !toolUseId || !existsSync8(transcriptPath)) return null;
+  if (!transcriptPath || !toolUseId || !existsSync9(transcriptPath)) return null;
   let raw = "";
   try {
     raw = readFileSync5(transcriptPath, "utf-8");
@@ -32873,6 +32967,14 @@ async function runCodexHook(name, arg) {
     process.exit(0);
   }
   if (name === "stop") {
+    try {
+      const ctx = buildContextSafely2();
+      if (ctx) maybeTriggerAutoReindex(ctx);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[caveat:codex-hook] auto reindex trigger error: ${msg}
+`);
+    }
     if (payload.stop_hook_active === true) process.exit(0);
     const transcriptPath = typeof payload.transcript_path === "string" ? payload.transcript_path : "";
     const signals = transcriptPath ? loadSignalsSafely2(transcriptPath) : null;
@@ -32887,19 +32989,15 @@ async function runCodexHook(name, arg) {
 }
 
 // src/commands/pull.ts
-import { existsSync as existsSync9, readdirSync as readdirSync4 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
 async function runPull(ctx) {
-  if (!existsSync9(ctx.paths.communityDir)) {
+  const hasCommunityDir = existsSync10(ctx.paths.communityDir);
+  if (!hasCommunityDir) {
     ctx.logger.info(
       "no community repos yet \u2014 add one with `caveat community add <github-url>`."
     );
-    return;
   }
-  const pulls = await communityPull({
-    communityDir: ctx.paths.communityDir,
-    logger: ctx.logger
-  });
+  const pulls = hasCommunityDir ? await communityPull({ communityDir: ctx.paths.communityDir, logger: ctx.logger }) : [];
   for (const p of pulls) {
     if (p.status === "ok") {
       ctx.logger.info(`${p.handle}: pulled`);
@@ -32910,28 +33008,160 @@ async function runPull(ctx) {
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
   try {
     rebuildAll(db);
-    if (existsSync9(ctx.paths.entriesDir)) {
-      const own = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
-      ctx.logger.info(`own: +${own.added}`);
-    }
-    for (const entry of readdirSync4(ctx.paths.communityDir, { withFileTypes: true })) {
-      if (!entry.isDirectory()) continue;
-      const source = `community/${entry.name}`;
-      const root = join12(ctx.paths.communityDir, entry.name, "entries");
-      if (!existsSync9(root)) continue;
-      const scan = scanSource({ db, source, entriesRoot: root });
+    const result = reindexAllSources({ db, paths: ctx.paths, logger: ctx.logger });
+    for (const [source, scan] of Object.entries(result.perSource)) {
       ctx.logger.info(`${source}: +${scan.added}`);
     }
+    writeDigestMarker(ctx.caveatHome, computeEntriesDigest(ctx.paths));
   } finally {
     db.close();
   }
 }
 
-// src/commands/codexSidecar.ts
+// src/ghSetup.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
+import { readSync } from "node:fs";
+function runGh(args) {
+  const result = spawnSync4("gh", args, { encoding: "utf-8" });
+  return { status: result.status, stdout: typeof result.stdout === "string" ? result.stdout : "", stderr: typeof result.stderr === "string" ? result.stderr : "" };
+}
+function commandError(result, fallback) {
+  return new Error((result.stderr || result.stdout || fallback).trim());
+}
+function askOnce(question) {
+  process.stdout.write(`${question} `);
+  const buf = Buffer.alloc(256);
+  const bytes = readSync(0, buf, 0, buf.length, null);
+  return /^(?:y|yes)$/i.test(buf.toString("utf-8", 0, bytes).trim());
+}
+
+// src/commands/sync.ts
+async function defaultPrivateRepoUrl(opts, deps) {
+  const version2 = deps.ghRunner(["--version"]);
+  if (version2.status !== 0) {
+    throw new Error(
+      "gh is not available. create a private repository named Caveat-Private on GitHub, then run:\n  caveat sync --init <url>\n  # or install gh and run caveat sync --init"
+    );
+  }
+  const user = deps.ghRunner(["api", "user", "-q", ".login"]);
+  if (user.status !== 0 || !user.stdout.trim()) {
+    throw new Error("gh is not authenticated; run `gh auth login`, then retry `caveat sync --init`");
+  }
+  const login = user.stdout.trim();
+  const name = `${login}/Caveat-Private`;
+  const view = deps.ghRunner(["repo", "view", name]);
+  if (view.status !== 0) {
+    const question = `create private repo github.com/${name}? [y/N]`;
+    if (!opts.yes) {
+      if (!deps.isTty()) {
+        throw new Error(`${question}; rerun with --yes to approve non-interactively`);
+      }
+      if (!deps.confirm(question)) throw new Error("private repository creation cancelled");
+    }
+    const create = deps.ghRunner(["repo", "create", "Caveat-Private", "--private"]);
+    if (create.status !== 0) throw commandError(create, "gh repo create failed");
+  }
+  return `https://github.com/${name}.git`;
+}
+async function runSync(ctx, opts, dependencies = {}) {
+  try {
+    const ghRunner = dependencies.ghRunner ?? runGh;
+    const isTty = dependencies.isTty ?? (() => Boolean(process.stdin.isTTY));
+    const confirm = dependencies.confirm ?? askOnce;
+    const initValue = opts.init;
+    if (initValue !== void 0 && initValue !== false) {
+      const url2 = opts.repo ?? (typeof initValue === "string" ? initValue : await defaultPrivateRepoUrl(opts, { ghRunner, isTty, confirm }));
+      const result2 = await initOwnSync({
+        ownDir: ctx.paths.knowledgeRepo,
+        url: url2,
+        caveatHome: ctx.caveatHome,
+        paths: ctx.paths,
+        logger: ctx.logger,
+        trustRemotePrivate: opts.trustRemotePrivate
+      });
+      ctx.logger.info(
+        result2.remoteWasEmpty ? `initialized private sync remote: ${url2}` : `checked out existing private remote: ${url2} (branch ${result2.branch})`
+      );
+      return;
+    }
+    if (opts.repo) throw new Error("--repo requires --init");
+    const result = await syncOwn({
+      ownDir: ctx.paths.knowledgeRepo,
+      caveatHome: ctx.caveatHome,
+      paths: ctx.paths,
+      logger: ctx.logger,
+      trustRemotePrivate: opts.trustRemotePrivate,
+      dryRun: opts.dryRun
+    });
+    if (result.dryRun) {
+      ctx.logger.info(
+        `[dry-run] ${result.changedFiles} local change(s) pending; remote ${result.pushUrls.join(", ")} (${result.probe.kind})`
+      );
+    } else {
+      const rebased = result.pulled ? ", rebased onto remote" : "";
+      ctx.logger.info(`synced ${result.branch} \u2192 origin (${result.changedFiles} local change(s)${rebased})`);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    ctx.logger.error(message);
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/publish.ts
+var HTTPS_TARGET_RE = /^https:\/\/github\.com\/[^/]+\/[^/]+?(?:\.git)?\/?$/;
+var SCP_TARGET_RE = /^git@github\.com:[^/]+\/[^/]+?(?:\.git)?$/;
+function validatePublishTarget(url2) {
+  if (!HTTPS_TARGET_RE.test(url2) && !SCP_TARGET_RE.test(url2)) throw new Error("invalid publish target: use https://github.com/<org>/<repo>(.git) or git@github.com:<org>/<repo>(.git)");
+  return url2;
+}
+async function defaultPublicRepoUrl(opts, deps) {
+  const version2 = deps.ghRunner(["--version"]);
+  if (version2.status !== 0) throw new Error("gh is not available. create a public repository named Caveat-Public on GitHub, then run:\n  caveat publish --init <url>\n  # or install gh and run caveat publish");
+  const user = deps.ghRunner(["api", "user", "-q", ".login"]);
+  if (user.status !== 0 || !user.stdout.trim()) throw new Error("gh is not authenticated; run `gh auth login`, then retry `caveat publish`");
+  const login = user.stdout.trim();
+  const name = `${login}/Caveat-Public`;
+  const view = deps.ghRunner(["repo", "view", name]);
+  if (view.status !== 0) {
+    const question = `create public repo github.com/${name}? [y/N]`;
+    if (!opts.yes) {
+      if (!deps.isTty()) throw new Error(`${question}; rerun with --yes to approve non-interactively`);
+      if (!deps.confirm(question)) throw new Error("public repository creation cancelled");
+    }
+    const create = deps.ghRunner(["repo", "create", "Caveat-Public", "--public"]);
+    if (create.status !== 0) throw commandError(create, "gh repo create failed");
+  }
+  return `https://github.com/${name}.git`;
+}
+async function runPublish(ctx, opts, dependencies = {}) {
+  try {
+    const ghRunner = dependencies.ghRunner ?? runGh;
+    const isTty = dependencies.isTty ?? (() => Boolean(process.stdin.isTTY));
+    const confirm = dependencies.confirm ?? askOnce;
+    let target = ctx.config.publishTarget;
+    if (opts.init !== void 0) {
+      target = validatePublishTarget(opts.init);
+      writeUserConfigPatch(ctx.userConfigPath, { publishTarget: target });
+    }
+    if (!target) {
+      target = await defaultPublicRepoUrl(opts, { ghRunner, isTty, confirm });
+      writeUserConfigPatch(ctx.userConfigPath, { publishTarget: target });
+    }
+    const result = await publishOwn({ paths: ctx.paths, config: { ...ctx.config, publishTarget: target }, logger: ctx.logger, confirmImpl: confirm, isTty, dryRun: opts.dryRun, yes: opts.yes });
+    if (result.dryRun) ctx.logger.info(`[dry-run] ${result.fileCount} public entry(ies) ready to publish`);
+    else if (result.changed) ctx.logger.info(`published ${result.fileCount} public entry(ies)`);
+  } catch (err) {
+    ctx.logger.error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  }
+}
+
+// src/commands/codexSidecar.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname6, join as join13 } from "node:path";
+import { dirname as dirname6, join as join12 } from "node:path";
 import { cwd, exit } from "node:process";
 function runCodexSidecarDiagnostics(logger, opts) {
   const plan = buildCodexSidecarDiagnosticsCommand({
@@ -32963,8 +33193,8 @@ function runCodexSidecarWithCaveats(ctx, workflow, prompt, opts) {
     process.stdout.write(JSON.stringify({ status: "skipped", decision }, null, 2) + "\n");
     exit(0);
   }
-  const contextDir = mkdtempSync2(join13(tmpdir3(), "caveat-sidecar-context-"));
-  const contextFile = join13(contextDir, "context.json");
+  const contextDir = mkdtempSync2(join12(tmpdir3(), "caveat-sidecar-context-"));
+  const contextFile = join12(contextDir, "context.json");
   let status = 1;
   try {
     const blocks = collectCaveatContextBlocks(ctx, {
@@ -33028,7 +33258,7 @@ function defaultPreset(workflow) {
 }
 function executePlan(logger, command, args, options = {}) {
   logger.info(`[codex-sidecar] ${command} ${args.map(shellDisplayQuote).join(" ")}`);
-  const result = spawnSync4(command, args, { encoding: "utf-8", stdio: "pipe" });
+  const result = spawnSync5(command, args, { encoding: "utf-8", stdio: "pipe" });
   if (result.stdout) process.stdout.write(result.stdout);
   if (result.stderr) process.stderr.write(result.stderr);
   if (options.saveResult && result.stdout) {
@@ -33198,6 +33428,14 @@ program.command("pull").description(
   const ctx = buildContext(stdoutLogger);
   await runPull(ctx);
 });
+program.command("sync").description("Sync own Caveat entries to a private git remote").option("--init [url]", "initialize private remote sync (optionally with its URL)").option("--repo <url>", "private remote URL (requires --init)").option("--dry-run", "show pending own-repo changes without writing", false).option("--trust-remote-private", "continue when anonymous remote visibility cannot be determined", false).option("--yes", "approve creating the default GitHub private repository", false).action(async (opts) => {
+  const ctx = buildContext(stdoutLogger);
+  await runSync(ctx, opts);
+});
+program.command("publish").description("Mirror own public Caveat entries to a public git repository").option("--init <url>", "set the public mirror target").option("--dry-run", "show public mirror changes without committing or pushing", false).option("--yes", "approve creating a default repository or publishing changes", false).action(async (opts) => {
+  const ctx = buildContext(stdoutLogger);
+  await runPublish(ctx, opts);
+});
 program.command("serve").description("Start the read-only web share portal").option("--port <n>", "port number", (v) => Number(v), 4242).action(async (opts) => {
   await runServe({ port: opts.port });
 });
@@ -33205,7 +33443,7 @@ program.command("mcp-server").description("Run the MCP stdio server (registered
   await runMcpServer();
 });
 program.command("hook <name> [arg]").description(
-  "Run a Claude Code hook. name: user-prompt-submit | post-tool-use | stop | worker"
+  "Run a Claude Code hook. name: user-prompt-submit | post-tool-use | stop | worker | reindex"
 ).action(async (name, arg) => {
   await runHook(name, arg);
 });