caveat-cli 0.16.0 → 0.16.2

package/dist/{chunk-ZNAFNCPW.js → chunk-3MLJQLWY.js}

@@ -14547,23 +14547,35 @@ var simpleGit = gitInstanceFactory;
 
 // ../../packages/core/dist/gitRuntime.js
 var FOREGROUND_GIT_TIMEOUT_MS = 3e5;
+var BACKGROUND_GIT_TIMEOUT_MS = 3e4;
+var HTTP_HELPER_PREEMPT_MARGIN_MS = 5e3;
+var MIN_GIT_TIMEOUT_MS = HTTP_HELPER_PREEMPT_MARGIN_MS + 1e3;
 function createGit(baseDir, opts) {
   const timeoutMs = opts?.timeoutMs ?? FOREGROUND_GIT_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < MIN_GIT_TIMEOUT_MS) {
+    throw new Error(`git timeoutMs must be at least ${MIN_GIT_TIMEOUT_MS}`);
+  }
+  const lowSpeedTimeSeconds = Math.floor((timeoutMs - HTTP_HELPER_PREEMPT_MARGIN_MS) / 1e3);
   const env = {
     ...process.env,
     GIT_TERMINAL_PROMPT: "0",
-    GCM_INTERACTIVE: "Never"
+    GCM_INTERACTIVE: "Never",
+    // Git's GIT_HTTP_LOW_SPEED_* environment variables override the matching
+    // config keys. Set both after inherited env so a caller cannot silently
+    // disable the helper-side no-response bound.
+    GIT_HTTP_LOW_SPEED_LIMIT: "1",
+    GIT_HTTP_LOW_SPEED_TIME: String(lowSpeedTimeSeconds)
   };
   const options2 = {
     maxConcurrentProcesses: 1,
     timeout: { block: timeoutMs },
     // On Windows, killing the direct `git` child does not necessarily kill its
-    // `git-remote-http` descendant. Give the HTTP helper the same bounded
-    // inactivity policy so it terminates itself instead of retaining handles
-    // indefinitely after simple-git has already rejected the task.
+    // `git-remote-http` descendant. This earlier HTTP transfer-rate bound lets
+    // Git unwind its own helper first; it is not a general process-tree or
+    // total elapsed-time guarantee.
     config: [
       "http.lowSpeedLimit=1",
-      `http.lowSpeedTime=${Math.max(1, Math.ceil(timeoutMs / 1e3))}`
+      `http.lowSpeedTime=${lowSpeedTimeSeconds}`
     ],
     unsafe: unsafeAllowancesForInheritedEnv(env)
   };
@@ -14625,8 +14637,8 @@ async function communityPull(opts) {
   for (const entry of readdirSync5(opts.communityDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const path = join5(opts.communityDir, entry.name);
-    const git = createGit(path);
     try {
+      const git = createGit(path, { timeoutMs: opts.gitTimeoutMs });
       await git.raw(["fetch", "origin", "--force", "--depth", "1"]);
       await git.raw(["reset", "--hard", "FETCH_HEAD"]);
       await git.raw(["clean", "-ffdx"]);
@@ -14687,6 +14699,10 @@ import {
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync6,
   readFileSync as readFileSync5,
+  linkSync,
+  openSync,
+  closeSync,
+  chmodSync,
   rmSync as rmSync2,
   statSync as statSync5,
   unlinkSync as unlinkSync2,
@@ -14694,21 +14710,182 @@ import {
 } from "node:fs";
 import { join as join6 } from "node:path";
 import { randomBytes } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 function sanitizeSessionId(raw) {
   const clean = raw.replace(/[^A-Za-z0-9_-]/g, "");
   return clean.length > 0 ? clean : "_unknown";
 }
 var GLOBAL_PENDING_SESSION = "_global";
+var PENDING_LOCK_BUSY_TIMEOUT_MS = 1e3;
+function withPendingQueueLock(caveatHome, operation) {
+  const root = join6(caveatHome, "pending");
+  mkdirSync3(root, { recursive: true, mode: 448 });
+  const lockPath2 = join6(root, ".queue-lock.sqlite");
+  const db = new DatabaseSync2(lockPath2);
+  let transactionOpen = false;
+  try {
+    chmodSync(lockPath2, 384);
+    db.exec(`PRAGMA busy_timeout = ${PENDING_LOCK_BUSY_TIMEOUT_MS}`);
+    db.exec("BEGIN IMMEDIATE");
+    transactionOpen = true;
+    const result = operation();
+    db.exec("COMMIT");
+    transactionOpen = false;
+    return result;
+  } catch (error) {
+    if (transactionOpen) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    db.close();
+  }
+}
 function pendingDirFor(caveatHome, sessionId) {
   return join6(caveatHome, "pending", sanitizeSessionId(sessionId));
 }
 function appendPendingReminder(caveatHome, sessionId, text) {
-  const dir = pendingDirFor(caveatHome, sessionId);
-  mkdirSync3(dir, { recursive: true });
-  const name = `${Date.now()}-${randomBytes(4).toString("hex")}.txt`;
-  const path = join6(dir, name);
-  writeFileSync2(path, text, "utf-8");
-  return path;
+  return withPendingQueueLock(caveatHome, () => {
+    const dir = pendingDirFor(caveatHome, sessionId);
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    const name = `${Date.now()}-${randomBytes(4).toString("hex")}.txt`;
+    const path = join6(dir, name);
+    writeFileSync2(path, text, { encoding: "utf-8", mode: 384, flag: "wx" });
+    return path;
+  });
+}
+function buildPendingSemanticKey(input) {
+  const refs = [...input.refs].map(({ source, id }) => ({ source, id })).sort((a, b2) => a.source.localeCompare(b2.source) || a.id.localeCompare(b2.id)).filter((ref, index, all) => index === 0 || ref.source !== all[index - 1].source || ref.id !== all[index - 1].id).map(({ source, id }) => [source, id]);
+  return createHash2("sha256").update(JSON.stringify({
+    agent: input.agent,
+    surface: input.surface,
+    refs,
+    stopSignalDigest: input.stopSignalDigest ?? null
+  })).digest("hex");
+}
+var CLAIM_TTL_MS = 5 * 60 * 1e3;
+function hasNonExpiredPendingClaim(sessionDir, nowMs) {
+  const claimsDir = join6(sessionDir, ".claims");
+  let claims;
+  try {
+    claims = readdirSync6(claimsDir).filter((entry) => entry.endsWith(".claim"));
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") return false;
+    return true;
+  }
+  for (const claim of claims) {
+    const path = join6(claimsDir, claim);
+    try {
+      let createdAt = statSync5(path).mtimeMs;
+      try {
+        const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+        if (typeof parsed.createdAt === "number") createdAt = parsed.createdAt;
+      } catch {
+      }
+      if (nowMs - createdAt <= CLAIM_TTL_MS) return true;
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+function acquirePendingClaim(caveatHome, sessionId, key, options2 = {}) {
+  return withPendingQueueLock(caveatHome, () => {
+    if (!/^[a-f0-9]{64}$/.test(key)) throw new Error("pending semantic key is invalid");
+    if (existsSync6(join6(pendingDirFor(caveatHome, sessionId), `${key}.ready`))) return null;
+    const dir = join6(pendingDirFor(caveatHome, sessionId), ".claims");
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    const path = join6(dir, `${key}.claim`);
+    const now = options2.now ?? Date.now();
+    const ttlMs = options2.ttlMs ?? CLAIM_TTL_MS;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const ownerToken = randomBytes(16).toString("hex");
+      try {
+        const fd = openSync(path, "wx", 384);
+        try {
+          writeFileSync2(fd, JSON.stringify({ ownerToken, createdAt: now }), "utf-8");
+        } finally {
+          closeSync(fd);
+        }
+        if (existsSync6(join6(pendingDirFor(caveatHome, sessionId), `${key}.ready`))) {
+          unlinkSync2(path);
+          return null;
+        }
+        return { caveatHome, key, ownerToken, path };
+      } catch (error) {
+        if (!(error && typeof error === "object" && error.code === "EEXIST")) throw error;
+        try {
+          let createdAt = statSync5(path).mtimeMs;
+          try {
+            const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+            if (typeof parsed.createdAt === "number") createdAt = parsed.createdAt;
+          } catch {
+          }
+          if (now - createdAt <= ttlMs) return null;
+          unlinkSync2(path);
+        } catch (retryError) {
+          if (retryError && typeof retryError === "object" && retryError.code === "ENOENT") continue;
+          return null;
+        }
+      }
+    }
+    return null;
+  });
+}
+function releasePendingClaim(claim) {
+  withPendingQueueLock(claim.caveatHome, () => {
+    try {
+      const parsed = JSON.parse(readFileSync5(claim.path, "utf-8"));
+      if (parsed.ownerToken !== claim.ownerToken) return;
+      unlinkSync2(claim.path);
+    } catch (error) {
+      if (error && typeof error === "object" && error.code === "ENOENT") return;
+      throw error;
+    }
+  });
+}
+function publishPendingReminder(caveatHome, sessionId, semanticKey, text) {
+  if (!/^[a-f0-9]{64}$/.test(semanticKey)) throw new Error("pending semantic key is invalid");
+  const ready = join6(pendingDirFor(caveatHome, sessionId), `${semanticKey}.ready`);
+  if (existsSync6(ready)) return { path: ready, published: false };
+  try {
+    return withPendingQueueLock(caveatHome, () => {
+      const dir = pendingDirFor(caveatHome, sessionId);
+      mkdirSync3(dir, { recursive: true, mode: 448 });
+      const temp = join6(dir, `.${semanticKey}.${randomBytes(12).toString("hex")}.tmp`);
+      writeFileSync2(temp, text, { encoding: "utf-8", mode: 384, flag: "wx" });
+      try {
+        linkSync(temp, ready);
+        return { path: ready, published: true };
+      } catch (error) {
+        if (error && typeof error === "object" && error.code === "EEXIST") return { path: ready, published: false };
+        throw error;
+      } finally {
+        try {
+          unlinkSync2(temp);
+        } catch (error) {
+          if (!(error && typeof error === "object" && error.code === "ENOENT")) throw error;
+        }
+      }
+    });
+  } catch (error) {
+    if (existsSync6(ready)) return { path: ready, published: false };
+    throw error;
+  }
+}
+function buildAndPublishPendingReminder(caveatHome, sessionId, semanticKey, build) {
+  const claim = acquirePendingClaim(caveatHome, sessionId, semanticKey);
+  if (!claim) return { ran: false, published: false };
+  try {
+    const result = publishPendingReminder(caveatHome, sessionId, claim.key, build());
+    return { ran: true, published: result.published };
+  } finally {
+    releasePendingClaim(claim);
+  }
 }
 function appendGlobalPendingReminder(caveatHome, text) {
   return appendPendingReminder(caveatHome, GLOBAL_PENDING_SESSION, text);
@@ -14722,51 +14899,57 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
   const cutoffMs = now.getTime() - staleDays * 24 * 60 * 60 * 1e3;
   const root = join6(caveatHome, "pending");
   if (!existsSync6(root)) return { removed: [], kept: 0 };
-  let entries;
-  try {
-    entries = readdirSync6(root);
-  } catch {
-    return { removed: [], kept: 0 };
-  }
-  const removed = [];
-  let kept = 0;
-  for (const entry of entries) {
-    const sub = join6(root, entry);
-    let subStat;
+  return withPendingQueueLock(caveatHome, () => {
+    let entries;
     try {
-      subStat = statSync5(sub);
+      entries = readdirSync6(root);
     } catch {
-      continue;
+      return { removed: [], kept: 0 };
     }
-    if (!subStat.isDirectory()) continue;
-    let newest = subStat.mtimeMs;
-    let scanFailed = false;
-    try {
-      for (const f of readdirSync6(sub)) {
-        const fp = join6(sub, f);
-        try {
-          const fs = statSync5(fp);
-          if (fs.mtimeMs > newest) newest = fs.mtimeMs;
-        } catch {
-          scanFailed = true;
-          break;
+    const removed = [];
+    let kept = 0;
+    for (const entry of entries) {
+      const sub = join6(root, entry);
+      let subStat;
+      try {
+        subStat = statSync5(sub);
+      } catch {
+        continue;
+      }
+      if (!subStat.isDirectory()) continue;
+      if (hasNonExpiredPendingClaim(sub, now.getTime())) {
+        kept++;
+        continue;
+      }
+      let newest = subStat.mtimeMs;
+      let scanFailed = false;
+      try {
+        for (const f of readdirSync6(sub)) {
+          const fp = join6(sub, f);
+          try {
+            const fileStat = statSync5(fp);
+            if (fileStat.mtimeMs > newest) newest = fileStat.mtimeMs;
+          } catch {
+            scanFailed = true;
+            break;
+          }
         }
+      } catch {
+        scanFailed = true;
+      }
+      if (scanFailed || newest >= cutoffMs) {
+        kept++;
+        continue;
+      }
+      try {
+        rmSync2(sub, { recursive: true, force: true });
+        removed.push(sub);
+      } catch {
+        kept++;
       }
-    } catch {
-      scanFailed = true;
-    }
-    if (scanFailed || newest >= cutoffMs) {
-      kept++;
-      continue;
-    }
-    try {
-      rmSync2(sub, { recursive: true, force: true });
-      removed.push(sub);
-    } catch {
-      kept++;
     }
-  }
-  return { removed, kept };
+    return { removed, kept };
+  });
 }
 function maybeSweepPendingDirs(caveatHome, options2 = {}) {
   if (process.env.CAVEAT_PENDING_SWEEP === "off") {
@@ -14798,36 +14981,51 @@ function maybeSweepPendingDirs(caveatHome, options2 = {}) {
   }
   return { swept: result };
 }
-function drainPendingReminders(caveatHome, sessionId) {
+function drainPendingRemindersDetailed(caveatHome, sessionId, fs = {}) {
   const dir = pendingDirFor(caveatHome, sessionId);
-  if (!existsSync6(dir)) return [];
-  let entries;
+  if (!existsSync6(dir)) return { reminders: [], cleanupFailures: [] };
   try {
-    entries = readdirSync6(dir).filter((f) => f.endsWith(".txt")).sort();
+    return withPendingQueueLock(caveatHome, () => {
+      let entries;
+      try {
+        entries = readdirSync6(dir).filter((f) => f.endsWith(".txt") || f.endsWith(".ready"));
+      } catch {
+        return { reminders: [], cleanupFailures: ["pending directory read failed"] };
+      }
+      const cleanupFailures = [];
+      entries.sort((a, b2) => {
+        try {
+          const diff = statSync5(join6(dir, a)).mtimeMs - statSync5(join6(dir, b2)).mtimeMs;
+          return diff || a.localeCompare(b2);
+        } catch {
+          return a.localeCompare(b2);
+        }
+      });
+      const reminders = [];
+      for (const entry of entries) {
+        const path = join6(dir, entry);
+        try {
+          reminders.push(fs.read ? fs.read(path) : readFileSync5(path, "utf-8"));
+        } catch {
+          cleanupFailures.push(entry);
+          continue;
+        }
+        try {
+          if (fs.unlink) fs.unlink(path);
+          else unlinkSync2(path);
+        } catch {
+          cleanupFailures.push(entry);
+        }
+      }
+      return { reminders, cleanupFailures };
+    });
   } catch {
-    return [];
-  }
-  const out = [];
-  for (const entry of entries) {
-    const path = join6(dir, entry);
-    try {
-      out.push(readFileSync5(path, "utf-8"));
-    } catch {
-      continue;
-    }
-    try {
-      unlinkSync2(path);
-    } catch {
-    }
+    return { reminders: [], cleanupFailures: ["pending queue lock unavailable"] };
   }
-  return out;
-}
-function drainGlobalPendingReminders(caveatHome) {
-  return drainPendingReminders(caveatHome, GLOBAL_PENDING_SESSION);
 }
 
 // ../../packages/core/dist/sealedKeys.js
-import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync4,
@@ -14879,7 +15077,7 @@ function memoryKey(keyserverUrl, keyId) {
 ${keyId}`;
 }
 function cacheFilePath(caveatHome, keyserverUrl, keyId) {
-  const digest = createHash2("sha256").update(`${keyserverUrl}
+  const digest = createHash3("sha256").update(`${keyserverUrl}
 ${keyId}`).digest("hex").slice(0, 32);
   return join7(caveatHome, "keys", `${digest}.json`);
 }
@@ -15067,7 +15265,7 @@ async function assertPrivateRemotes(remoteUrls, opts) {
   return worst;
 }
 async function preflightSync(ownDir, opts = {}) {
-  const git = createGit(ownDir);
+  const git = createGit(ownDir, { timeoutMs: opts.gitTimeoutMs });
   if (!await git.checkIsRepo()) {
     throw new SyncError("NOT_A_REPO", "own knowledge directory is not a git repository; run `caveat sync --init` first");
   }
@@ -15103,7 +15301,7 @@ async function reindexAndMark(opts) {
 }
 async function syncOwn(opts) {
   const preflight = await preflightSync(opts.ownDir, opts);
-  const git = createGit(preflight.ownDir);
+  const git = createGit(preflight.ownDir, { timeoutMs: opts.gitTimeoutMs });
   const status = await git.status();
   if (opts.dryRun) {
     return {
@@ -15236,7 +15434,7 @@ function errorMessage2(err) {
 }
 
 // ../../packages/core/dist/autoSync.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
 var AUTO_SYNC_DEBOUNCE_MS = 24 * 60 * 60 * 1e3;
@@ -15347,7 +15545,8 @@ async function runAutoSync(opts) {
     };
     const community = await communityPull({
       communityDir: opts.paths.communityDir,
-      logger: opts.logger
+      logger: opts.logger,
+      gitTimeoutMs: opts.gitTimeoutMs ?? BACKGROUND_GIT_TIMEOUT_MS
     });
     let own;
     if (ownSyncState.consecutiveFailureCount >= 3) {
@@ -15361,6 +15560,7 @@ async function runAutoSync(opts) {
           paths: opts.paths,
           logger: opts.logger,
           trustRemotePrivate: false,
+          gitTimeoutMs: opts.gitTimeoutMs ?? BACKGROUND_GIT_TIMEOUT_MS,
           probeImpl: async (url) => {
             const probe = await probeAnonymousRead(url);
             lastProbe = probe;
@@ -15436,7 +15636,7 @@ async function reindexAndMark2(opts) {
   }
 }
 function sha256(input) {
-  return createHash3("sha256").update(input).digest("hex");
+  return createHash4("sha256").update(input).digest("hex");
 }
 function errorMessage3(err) {
   return err instanceof Error ? err.message : String(err);
@@ -15693,7 +15893,40 @@ function toSearchResult2(row) {
     environment: fm.environment ?? {}
   };
 }
-function findCaveatsForPrompt(db, prompt, opts = {}) {
+function findCaveatsForHook(db, input, opts = {}) {
+  if (input.surface === "user_prompt") {
+    const prompt = input.topicText || input.failureText;
+    return findCaveatsForText(db, prompt, opts);
+  }
+  if (input.surface === "stop") {
+    return findCaveatsForText(db, input.failureText, opts);
+  }
+  const failureTokens = new Set(
+    buildPromptCandidates(input.failureText).map((candidate) => candidate.token.toLowerCase())
+  );
+  return findCaveatsForText(
+    db,
+    [input.topicText, input.failureText].filter(Boolean).join("\n"),
+    opts,
+    failureTokens
+  );
+}
+function findCaveatsForHookSegments(db, inputs, opts = {}) {
+  const limit = opts.limit ?? DEFAULT_REMINDER_HIT_LIMIT;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const input of inputs) {
+    for (const hit of findCaveatsForHook(db, input, { ...opts, limit })) {
+      const key = `${hit.source}\0${hit.id}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(hit);
+      if (out.length >= limit) return out;
+    }
+  }
+  return out;
+}
+function findCaveatsForText(db, prompt, opts = {}, symptomEvidenceTokens) {
   if (typeof prompt !== "string" || prompt.length === 0) return [];
   const candidates = buildPromptCandidates(prompt);
   if (candidates.length === 0) return [];
@@ -15732,7 +15965,7 @@ function findCaveatsForPrompt(db, prompt, opts = {}) {
         perEntry.set(row.rowid, entry);
       }
       entry.groups.add(cand.group);
-      if (entry.symptomLower !== null && tokenAppearsIn(tokLower, entry.symptomLower)) {
+      if (entry.symptomLower !== null && (symptomEvidenceTokens === void 0 || symptomEvidenceTokens.has(tokLower)) && tokenAppearsIn(tokLower, entry.symptomLower)) {
         entry.symptomTokens.add(tokLower);
       }
       if (entry.topicalLower !== null && tokenAppearsIn(tokLower, entry.topicalLower)) {
@@ -16150,14 +16383,14 @@ function markHit(db, keys, now = () => (/* @__PURE__ */ new Date()).toISOString(
 }
 
 // ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync6, unlinkSync as unlinkSync3 } from "node:fs";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync6, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join11, resolve as resolve3 } from "node:path";
 var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
 var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
 var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
 var fsDependencies = {
   appendFileSync,
-  chmodSync,
+  chmodSync: chmodSync2,
   mkdirSync: mkdirSync7,
   renameSync: renameSync4,
   statSync: statSync6,
@@ -16247,7 +16480,7 @@ function listStale(db, opts = {}) {
 }
 
 // ../../packages/core/dist/publishScan.js
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join12, basename as basename2 } from "node:path";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
@@ -16278,7 +16511,7 @@ var WIN_UNC_PATH_RE = /\\\\[^\\\s"'`<>()|]+\\[^\\\s"'`<>()|]+(?:\\[^\\\s"'`<>()|
 var PRIVATE_IP_RE = /\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g;
 var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
 function sha2562(raw) {
-  return createHash4("sha256").update(raw).digest("hex");
+  return createHash5("sha256").update(raw).digest("hex");
 }
 function findingDigest(opts) {
   const pemContext = opts.rule === "pem-private-key" ? `\0${opts.fileDigest}\0${opts.lineNumber}\0${opts.index}` : "";
@@ -16508,7 +16741,7 @@ var PublishScanError = class extends Error {
 };
 
 // ../../packages/core/dist/publish.js
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname7, join as join13, relative as relative3 } from "node:path";
 
@@ -16647,7 +16880,7 @@ ${bad.join("\n")}`);
   return { fileCount: unsealed.files.length };
 }
 function sha2563(content) {
-  return createHash5("sha256").update(content).digest("hex");
+  return createHash6("sha256").update(content).digest("hex");
 }
 function diffFiles(previous, next) {
   const before = new Map(previous.map((file) => [file.relPath, sha2563(file.content)]));
@@ -17226,15 +17459,15 @@ function formatYmd2(d) {
 }
 
 // ../../packages/core/dist/proposalEval.js
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // ../../packages/core/dist/proposalExecution.js
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { basename as basename3, isAbsolute as isAbsolute3 } from "node:path";
 
 // ../../packages/core/dist/proposalExecutionCompiler.js
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 
 export {
   __commonJS,
@@ -17254,11 +17487,11 @@ export {
   communityPull,
   communityList,
   communityRemove,
-  appendPendingReminder,
+  buildPendingSemanticKey,
+  buildAndPublishPendingReminder,
   cleanupStalePendingDirs,
   maybeSweepPendingDirs,
-  drainPendingReminders,
-  drainGlobalPendingReminders,
+  drainPendingRemindersDetailed,
   createKeyserverKeyProvider,
   SyncError,
   syncOwn,
@@ -17279,7 +17512,8 @@ export {
   ensureUserConfig,
   writeUserConfigPatch,
   defaultSelfIdentityTokens,
-  findCaveatsForPrompt,
+  findCaveatsForHook,
+  findCaveatsForHookSegments,
   toolErrorReminderText,
   userPromptSubmitReminderText,
   stopReminderText,
@@ -17320,4 +17554,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-ZNAFNCPW.js.map
+//# sourceMappingURL=chunk-3MLJQLWY.js.map