caveat-cli 0.16.1 → 0.16.3

package/dist/{chunk-HCLEIAGO.js → chunk-PD5E6TFL.js}

@@ -2721,7 +2721,7 @@ var require_dumper = __commonJS({
       var hasFoldableLine = false;
       var shouldTrackWidth = lineWidth !== -1;
       var previousLineBreak = -1;
-      var plain = isPlainSafeFirst2(string.charCodeAt(0)) && !isWhitespace2(string.charCodeAt(string.length - 1));
+      var plain2 = isPlainSafeFirst2(string.charCodeAt(0)) && !isWhitespace2(string.charCodeAt(string.length - 1));
       if (singleLineOnly) {
         for (i2 = 0; i2 < string.length; i2++) {
           char = string.charCodeAt(i2);
@@ -2729,7 +2729,7 @@ var require_dumper = __commonJS({
             return STYLE_DOUBLE2;
           }
           prev_char = i2 > 0 ? string.charCodeAt(i2 - 1) : null;
-          plain = plain && isPlainSafe2(char, prev_char);
+          plain2 = plain2 && isPlainSafe2(char, prev_char);
         }
       } else {
         for (i2 = 0; i2 < string.length; i2++) {
@@ -2745,12 +2745,12 @@ var require_dumper = __commonJS({
             return STYLE_DOUBLE2;
           }
           prev_char = i2 > 0 ? string.charCodeAt(i2 - 1) : null;
-          plain = plain && isPlainSafe2(char, prev_char);
+          plain2 = plain2 && isPlainSafe2(char, prev_char);
         }
         hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
       }
       if (!hasLineBreak && !hasFoldableLine) {
-        return plain && !testAmbiguousType(string) ? STYLE_PLAIN2 : STYLE_SINGLE2;
+        return plain2 && !testAmbiguousType(string) ? STYLE_PLAIN2 : STYLE_SINGLE2;
       }
       if (indentPerLevel > 9 && needIndentIndicator2(string)) {
         return STYLE_DOUBLE2;
@@ -6112,7 +6112,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/index.js"(exports2, module2) {
     "use strict";
     var internalRe = require_re();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse2 = require_parse2();
@@ -6194,8 +6194,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants2.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -8367,14 +8367,14 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
   var hasFoldableLine = false;
   var shouldTrackWidth = lineWidth !== -1;
   var previousLineBreak = -1;
-  var plain = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
+  var plain2 = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
   if (singleLineOnly || forceQuotes) {
     for (i2 = 0; i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
       char = codePointAt(string, i2);
       if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
-      plain = plain && isPlainSafe(char, prevChar, inblock);
+      plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
   } else {
@@ -8390,13 +8390,13 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       } else if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
-      plain = plain && isPlainSafe(char, prevChar, inblock);
+      plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
     hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
   }
   if (!hasLineBreak && !hasFoldableLine) {
-    if (plain && !forceQuotes && !testAmbiguousType(string)) {
+    if (plain2 && !forceQuotes && !testAmbiguousType(string)) {
       return STYLE_PLAIN;
     }
     return quotingType === QUOTING_TYPE_DOUBLE ? STYLE_DOUBLE : STYLE_SINGLE;
@@ -8963,7 +8963,7 @@ import { readFileSync as readFileSync2, readdirSync as readdirSync2, statSync, e
 import { join as join2, relative } from "node:path";
 function scanSource(opts) {
   const { db, source, entriesRoot } = opts;
-  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const now2 = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   db.exec("DROP TABLE IF EXISTS temp.touched");
   db.exec("CREATE TEMP TABLE touched(rowid INTEGER PRIMARY KEY)");
   const insertTouched = db.prepare("INSERT INTO touched (rowid) VALUES (?)");
@@ -8981,7 +8981,7 @@ function scanSource(opts) {
           path: rel,
           content: src,
           file_mtime: mtime,
-          indexed_at: now()
+          indexed_at: now2()
         });
         const existing = db.prepare("SELECT rowid, file_mtime, path FROM entries WHERE source = ? AND id = ?").get(source, row.id);
         if (existing && existing.file_mtime === mtime && existing.path === rel) {
@@ -9351,7 +9351,7 @@ async function prewarmSealedKeys(opts) {
   return failures;
 }
 function scanSealedSource(opts) {
-  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const now2 = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const bundle = readFileSync3(opts.bundlePath);
   const { header } = readSealedHeader(bundle);
   const contentKey = opts.keyProvider.resolveContentKey(header.keyId, header.keyserverUrl);
@@ -9370,7 +9370,7 @@ function scanSealedSource(opts) {
         path: file.relPath,
         content: file.content.toString("utf-8"),
         file_mtime: bundleMtime,
-        indexed_at: now()
+        indexed_at: now2()
       });
       const existing = opts.db.prepare("SELECT rowid FROM entries WHERE source = ? AND id = ?").get(opts.source, row.id);
       const rowid = upsertEntry(opts.db, row);
@@ -9496,9 +9496,9 @@ function acquireFileLock(lockFilePath) {
   }
   return tryCreateLock(lockFilePath) ? { path: lockFilePath } : null;
 }
-function releaseFileLock(lock) {
+function releaseFileLock(lock2) {
   try {
-    unlinkSync(lock.path);
+    unlinkSync(lock2.path);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -9506,8 +9506,8 @@ function releaseFileLock(lock) {
 function acquireReindexLock(caveatHome) {
   return acquireFileLock(lockPath(caveatHome));
 }
-function releaseReindexLock(lock) {
-  releaseFileLock(lock);
+function releaseReindexLock(lock2) {
+  releaseFileLock(lock2);
 }
 function reindexAllSources(opts) {
   const { db, paths, logger, keyProvider } = opts;
@@ -14699,6 +14699,10 @@ import {
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync6,
   readFileSync as readFileSync5,
+  linkSync,
+  openSync,
+  closeSync,
+  chmodSync,
   rmSync as rmSync2,
   statSync as statSync5,
   unlinkSync as unlinkSync2,
@@ -14706,21 +14710,182 @@ import {
 } from "node:fs";
 import { join as join6 } from "node:path";
 import { randomBytes } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 function sanitizeSessionId(raw) {
   const clean = raw.replace(/[^A-Za-z0-9_-]/g, "");
   return clean.length > 0 ? clean : "_unknown";
 }
 var GLOBAL_PENDING_SESSION = "_global";
+var PENDING_LOCK_BUSY_TIMEOUT_MS = 1e3;
+function withPendingQueueLock(caveatHome, operation) {
+  const root = join6(caveatHome, "pending");
+  mkdirSync3(root, { recursive: true, mode: 448 });
+  const lockPath2 = join6(root, ".queue-lock.sqlite");
+  const db = new DatabaseSync2(lockPath2);
+  let transactionOpen = false;
+  try {
+    chmodSync(lockPath2, 384);
+    db.exec(`PRAGMA busy_timeout = ${PENDING_LOCK_BUSY_TIMEOUT_MS}`);
+    db.exec("BEGIN IMMEDIATE");
+    transactionOpen = true;
+    const result = operation();
+    db.exec("COMMIT");
+    transactionOpen = false;
+    return result;
+  } catch (error) {
+    if (transactionOpen) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {
+      }
+    }
+    throw error;
+  } finally {
+    db.close();
+  }
+}
 function pendingDirFor(caveatHome, sessionId) {
   return join6(caveatHome, "pending", sanitizeSessionId(sessionId));
 }
 function appendPendingReminder(caveatHome, sessionId, text) {
-  const dir = pendingDirFor(caveatHome, sessionId);
-  mkdirSync3(dir, { recursive: true });
-  const name = `${Date.now()}-${randomBytes(4).toString("hex")}.txt`;
-  const path = join6(dir, name);
-  writeFileSync2(path, text, "utf-8");
-  return path;
+  return withPendingQueueLock(caveatHome, () => {
+    const dir = pendingDirFor(caveatHome, sessionId);
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    const name = `${Date.now()}-${randomBytes(4).toString("hex")}.txt`;
+    const path = join6(dir, name);
+    writeFileSync2(path, text, { encoding: "utf-8", mode: 384, flag: "wx" });
+    return path;
+  });
+}
+function buildPendingSemanticKey(input) {
+  const refs = [...input.refs].map(({ source, id }) => ({ source, id })).sort((a, b2) => a.source.localeCompare(b2.source) || a.id.localeCompare(b2.id)).filter((ref, index, all) => index === 0 || ref.source !== all[index - 1].source || ref.id !== all[index - 1].id).map(({ source, id }) => [source, id]);
+  return createHash2("sha256").update(JSON.stringify({
+    agent: input.agent,
+    surface: input.surface,
+    refs,
+    stopSignalDigest: input.stopSignalDigest ?? null
+  })).digest("hex");
+}
+var CLAIM_TTL_MS = 5 * 60 * 1e3;
+function hasNonExpiredPendingClaim(sessionDir, nowMs) {
+  const claimsDir = join6(sessionDir, ".claims");
+  let claims;
+  try {
+    claims = readdirSync6(claimsDir).filter((entry) => entry.endsWith(".claim"));
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "ENOENT") return false;
+    return true;
+  }
+  for (const claim of claims) {
+    const path = join6(claimsDir, claim);
+    try {
+      let createdAt = statSync5(path).mtimeMs;
+      try {
+        const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+        if (typeof parsed.createdAt === "number") createdAt = parsed.createdAt;
+      } catch {
+      }
+      if (nowMs - createdAt <= CLAIM_TTL_MS) return true;
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
+function acquirePendingClaim(caveatHome, sessionId, key, options2 = {}) {
+  return withPendingQueueLock(caveatHome, () => {
+    if (!/^[a-f0-9]{64}$/.test(key)) throw new Error("pending semantic key is invalid");
+    if (existsSync6(join6(pendingDirFor(caveatHome, sessionId), `${key}.ready`))) return null;
+    const dir = join6(pendingDirFor(caveatHome, sessionId), ".claims");
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    const path = join6(dir, `${key}.claim`);
+    const now2 = options2.now ?? Date.now();
+    const ttlMs = options2.ttlMs ?? CLAIM_TTL_MS;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const ownerToken = randomBytes(16).toString("hex");
+      try {
+        const fd = openSync(path, "wx", 384);
+        try {
+          writeFileSync2(fd, JSON.stringify({ ownerToken, createdAt: now2 }), "utf-8");
+        } finally {
+          closeSync(fd);
+        }
+        if (existsSync6(join6(pendingDirFor(caveatHome, sessionId), `${key}.ready`))) {
+          unlinkSync2(path);
+          return null;
+        }
+        return { caveatHome, key, ownerToken, path };
+      } catch (error) {
+        if (!(error && typeof error === "object" && error.code === "EEXIST")) throw error;
+        try {
+          let createdAt = statSync5(path).mtimeMs;
+          try {
+            const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+            if (typeof parsed.createdAt === "number") createdAt = parsed.createdAt;
+          } catch {
+          }
+          if (now2 - createdAt <= ttlMs) return null;
+          unlinkSync2(path);
+        } catch (retryError) {
+          if (retryError && typeof retryError === "object" && retryError.code === "ENOENT") continue;
+          return null;
+        }
+      }
+    }
+    return null;
+  });
+}
+function releasePendingClaim(claim) {
+  withPendingQueueLock(claim.caveatHome, () => {
+    try {
+      const parsed = JSON.parse(readFileSync5(claim.path, "utf-8"));
+      if (parsed.ownerToken !== claim.ownerToken) return;
+      unlinkSync2(claim.path);
+    } catch (error) {
+      if (error && typeof error === "object" && error.code === "ENOENT") return;
+      throw error;
+    }
+  });
+}
+function publishPendingReminder(caveatHome, sessionId, semanticKey, text) {
+  if (!/^[a-f0-9]{64}$/.test(semanticKey)) throw new Error("pending semantic key is invalid");
+  const ready = join6(pendingDirFor(caveatHome, sessionId), `${semanticKey}.ready`);
+  if (existsSync6(ready)) return { path: ready, published: false };
+  try {
+    return withPendingQueueLock(caveatHome, () => {
+      const dir = pendingDirFor(caveatHome, sessionId);
+      mkdirSync3(dir, { recursive: true, mode: 448 });
+      const temp = join6(dir, `.${semanticKey}.${randomBytes(12).toString("hex")}.tmp`);
+      writeFileSync2(temp, text, { encoding: "utf-8", mode: 384, flag: "wx" });
+      try {
+        linkSync(temp, ready);
+        return { path: ready, published: true };
+      } catch (error) {
+        if (error && typeof error === "object" && error.code === "EEXIST") return { path: ready, published: false };
+        throw error;
+      } finally {
+        try {
+          unlinkSync2(temp);
+        } catch (error) {
+          if (!(error && typeof error === "object" && error.code === "ENOENT")) throw error;
+        }
+      }
+    });
+  } catch (error) {
+    if (existsSync6(ready)) return { path: ready, published: false };
+    throw error;
+  }
+}
+function buildAndPublishPendingReminder(caveatHome, sessionId, semanticKey, build) {
+  const claim = acquirePendingClaim(caveatHome, sessionId, semanticKey);
+  if (!claim) return { ran: false, published: false };
+  try {
+    const result = publishPendingReminder(caveatHome, sessionId, claim.key, build());
+    return { ran: true, published: result.published };
+  } finally {
+    releasePendingClaim(claim);
+  }
 }
 function appendGlobalPendingReminder(caveatHome, text) {
   return appendPendingReminder(caveatHome, GLOBAL_PENDING_SESSION, text);
@@ -14730,55 +14895,61 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
   if (staleDays < 0) {
     throw new Error(`cleanupStalePendingDirs: staleDays must be >= 0 (got ${staleDays})`);
   }
-  const now = options2.now ?? /* @__PURE__ */ new Date();
-  const cutoffMs = now.getTime() - staleDays * 24 * 60 * 60 * 1e3;
+  const now2 = options2.now ?? /* @__PURE__ */ new Date();
+  const cutoffMs = now2.getTime() - staleDays * 24 * 60 * 60 * 1e3;
   const root = join6(caveatHome, "pending");
   if (!existsSync6(root)) return { removed: [], kept: 0 };
-  let entries;
-  try {
-    entries = readdirSync6(root);
-  } catch {
-    return { removed: [], kept: 0 };
-  }
-  const removed = [];
-  let kept = 0;
-  for (const entry of entries) {
-    const sub = join6(root, entry);
-    let subStat;
+  return withPendingQueueLock(caveatHome, () => {
+    let entries;
     try {
-      subStat = statSync5(sub);
+      entries = readdirSync6(root);
     } catch {
-      continue;
+      return { removed: [], kept: 0 };
     }
-    if (!subStat.isDirectory()) continue;
-    let newest = subStat.mtimeMs;
-    let scanFailed = false;
-    try {
-      for (const f of readdirSync6(sub)) {
-        const fp = join6(sub, f);
-        try {
-          const fs = statSync5(fp);
-          if (fs.mtimeMs > newest) newest = fs.mtimeMs;
-        } catch {
-          scanFailed = true;
-          break;
+    const removed = [];
+    let kept = 0;
+    for (const entry of entries) {
+      const sub = join6(root, entry);
+      let subStat;
+      try {
+        subStat = statSync5(sub);
+      } catch {
+        continue;
+      }
+      if (!subStat.isDirectory()) continue;
+      if (hasNonExpiredPendingClaim(sub, now2.getTime())) {
+        kept++;
+        continue;
+      }
+      let newest = subStat.mtimeMs;
+      let scanFailed = false;
+      try {
+        for (const f of readdirSync6(sub)) {
+          const fp = join6(sub, f);
+          try {
+            const fileStat = statSync5(fp);
+            if (fileStat.mtimeMs > newest) newest = fileStat.mtimeMs;
+          } catch {
+            scanFailed = true;
+            break;
+          }
         }
+      } catch {
+        scanFailed = true;
+      }
+      if (scanFailed || newest >= cutoffMs) {
+        kept++;
+        continue;
+      }
+      try {
+        rmSync2(sub, { recursive: true, force: true });
+        removed.push(sub);
+      } catch {
+        kept++;
       }
-    } catch {
-      scanFailed = true;
-    }
-    if (scanFailed || newest >= cutoffMs) {
-      kept++;
-      continue;
-    }
-    try {
-      rmSync2(sub, { recursive: true, force: true });
-      removed.push(sub);
-    } catch {
-      kept++;
     }
-  }
-  return { removed, kept };
+    return { removed, kept };
+  });
 }
 function maybeSweepPendingDirs(caveatHome, options2 = {}) {
   if (process.env.CAVEAT_PENDING_SWEEP === "off") {
@@ -14791,55 +14962,70 @@ function maybeSweepPendingDirs(caveatHome, options2 = {}) {
       `maybeSweepPendingDirs: debounceDays must be >= 0 (got ${debounceDays})`
     );
   }
-  const now = options2.now ?? /* @__PURE__ */ new Date();
+  const now2 = options2.now ?? /* @__PURE__ */ new Date();
   const pendingRoot = join6(caveatHome, "pending");
   if (!existsSync6(pendingRoot)) return { skipped: "no_pending_dir" };
   const marker = join6(pendingRoot, ".last-sweep");
   try {
     const m = statSync5(marker);
-    const ageMs = now.getTime() - m.mtimeMs;
+    const ageMs = now2.getTime() - m.mtimeMs;
     if (ageMs < debounceDays * 24 * 60 * 60 * 1e3) {
       return { skipped: "debounced" };
     }
   } catch {
   }
-  const result = cleanupStalePendingDirs(caveatHome, { staleDays, now });
+  const result = cleanupStalePendingDirs(caveatHome, { staleDays, now: now2 });
   try {
     writeFileSync2(marker, "", "utf-8");
   } catch {
   }
   return { swept: result };
 }
-function drainPendingReminders(caveatHome, sessionId) {
+function drainPendingRemindersDetailed(caveatHome, sessionId, fs = {}) {
   const dir = pendingDirFor(caveatHome, sessionId);
-  if (!existsSync6(dir)) return [];
-  let entries;
+  if (!existsSync6(dir)) return { reminders: [], cleanupFailures: [] };
   try {
-    entries = readdirSync6(dir).filter((f) => f.endsWith(".txt")).sort();
+    return withPendingQueueLock(caveatHome, () => {
+      let entries;
+      try {
+        entries = readdirSync6(dir).filter((f) => f.endsWith(".txt") || f.endsWith(".ready"));
+      } catch {
+        return { reminders: [], cleanupFailures: ["pending directory read failed"] };
+      }
+      const cleanupFailures = [];
+      entries.sort((a, b2) => {
+        try {
+          const diff = statSync5(join6(dir, a)).mtimeMs - statSync5(join6(dir, b2)).mtimeMs;
+          return diff || a.localeCompare(b2);
+        } catch {
+          return a.localeCompare(b2);
+        }
+      });
+      const reminders = [];
+      for (const entry of entries) {
+        const path = join6(dir, entry);
+        try {
+          reminders.push(fs.read ? fs.read(path) : readFileSync5(path, "utf-8"));
+        } catch {
+          cleanupFailures.push(entry);
+          continue;
+        }
+        try {
+          if (fs.unlink) fs.unlink(path);
+          else unlinkSync2(path);
+        } catch {
+          cleanupFailures.push(entry);
+        }
+      }
+      return { reminders, cleanupFailures };
+    });
   } catch {
-    return [];
+    return { reminders: [], cleanupFailures: ["pending queue lock unavailable"] };
   }
-  const out = [];
-  for (const entry of entries) {
-    const path = join6(dir, entry);
-    try {
-      out.push(readFileSync5(path, "utf-8"));
-    } catch {
-      continue;
-    }
-    try {
-      unlinkSync2(path);
-    } catch {
-    }
-  }
-  return out;
-}
-function drainGlobalPendingReminders(caveatHome) {
-  return drainPendingReminders(caveatHome, GLOBAL_PENDING_SESSION);
 }
 
 // ../../packages/core/dist/sealedKeys.js
-import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync4,
@@ -14891,7 +15077,7 @@ function memoryKey(keyserverUrl, keyId) {
 ${keyId}`;
 }
 function cacheFilePath(caveatHome, keyserverUrl, keyId) {
-  const digest = createHash2("sha256").update(`${keyserverUrl}
+  const digest = createHash3("sha256").update(`${keyserverUrl}
 ${keyId}`).digest("hex").slice(0, 32);
   return join7(caveatHome, "keys", `${digest}.json`);
 }
@@ -15248,7 +15434,7 @@ function errorMessage2(err) {
 }
 
 // ../../packages/core/dist/autoSync.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
 var AUTO_SYNC_DEBOUNCE_MS = 24 * 60 * 60 * 1e3;
@@ -15346,8 +15532,8 @@ function autoSyncNotification(outcome) {
 }
 async function runAutoSync(opts) {
   if (process.env[CAVEAT_AUTO_SYNC_ENV] === "off") return { ran: false };
-  const lock = acquireFileLock(autoSyncLockPath(opts.caveatHome));
-  if (!lock) return { ran: false };
+  const lock2 = acquireFileLock(autoSyncLockPath(opts.caveatHome));
+  if (!lock2) return { ran: false };
   let reindexLock = null;
   try {
     reindexLock = acquireReindexLock(opts.caveatHome);
@@ -15428,7 +15614,7 @@ async function runAutoSync(opts) {
       }
     }
     try {
-      releaseFileLock(lock);
+      releaseFileLock(lock2);
     } catch (err) {
       opts.logger.warn(`autosync lock release failed: ${errorMessage3(err)}`);
     }
@@ -15450,7 +15636,7 @@ async function reindexAndMark2(opts) {
   }
 }
 function sha256(input) {
-  return createHash3("sha256").update(input).digest("hex");
+  return createHash4("sha256").update(input).digest("hex");
 }
 function errorMessage3(err) {
   return err instanceof Error ? err.message : String(err);
@@ -15707,7 +15893,40 @@ function toSearchResult2(row) {
     environment: fm.environment ?? {}
   };
 }
-function findCaveatsForPrompt(db, prompt, opts = {}) {
+function findCaveatsForHook(db, input, opts = {}) {
+  if (input.surface === "user_prompt") {
+    const prompt = input.topicText || input.failureText;
+    return findCaveatsForText(db, prompt, opts);
+  }
+  if (input.surface === "stop") {
+    return findCaveatsForText(db, input.failureText, opts);
+  }
+  const failureTokens = new Set(
+    buildPromptCandidates(input.failureText).map((candidate) => candidate.token.toLowerCase())
+  );
+  return findCaveatsForText(
+    db,
+    [input.topicText, input.failureText].filter(Boolean).join("\n"),
+    opts,
+    failureTokens
+  );
+}
+function findCaveatsForHookSegments(db, inputs, opts = {}) {
+  const limit = opts.limit ?? DEFAULT_REMINDER_HIT_LIMIT;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const input of inputs) {
+    for (const hit of findCaveatsForHook(db, input, { ...opts, limit })) {
+      const key = `${hit.source}\0${hit.id}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(hit);
+      if (out.length >= limit) return out;
+    }
+  }
+  return out;
+}
+function findCaveatsForText(db, prompt, opts = {}, symptomEvidenceTokens) {
   if (typeof prompt !== "string" || prompt.length === 0) return [];
   const candidates = buildPromptCandidates(prompt);
   if (candidates.length === 0) return [];
@@ -15746,7 +15965,7 @@ function findCaveatsForPrompt(db, prompt, opts = {}) {
         perEntry.set(row.rowid, entry);
       }
       entry.groups.add(cand.group);
-      if (entry.symptomLower !== null && tokenAppearsIn(tokLower, entry.symptomLower)) {
+      if (entry.symptomLower !== null && (symptomEvidenceTokens === void 0 || symptomEvidenceTokens.has(tokLower)) && tokenAppearsIn(tokLower, entry.symptomLower)) {
         entry.symptomTokens.add(tokLower);
       }
       if (entry.topicalLower !== null && tokenAppearsIn(tokLower, entry.topicalLower)) {
@@ -16152,9 +16371,9 @@ function readCodexSessionSignals(transcriptPath) {
 }
 
 // ../../packages/core/dist/markHit.js
-function markHit(db, keys, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+function markHit(db, keys, now2 = () => (/* @__PURE__ */ new Date()).toISOString()) {
   if (keys.length === 0) return;
-  const ts = now();
+  const ts = now2();
   const stmt = db.prepare(
     "UPDATE entries SET last_hit_at = ? WHERE source = ? AND id = ?"
   );
@@ -16164,14 +16383,14 @@ function markHit(db, keys, now = () => (/* @__PURE__ */ new Date()).toISOString(
 }
 
 // ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync6, unlinkSync as unlinkSync3 } from "node:fs";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync6, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join11, resolve as resolve3 } from "node:path";
 var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
 var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
 var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
 var fsDependencies = {
   appendFileSync,
-  chmodSync,
+  chmodSync: chmodSync2,
   mkdirSync: mkdirSync7,
   renameSync: renameSync4,
   statSync: statSync6,
@@ -16234,8 +16453,8 @@ function logHookQueryMiss(miss, dependencies = fsDependencies) {
 function listStale(db, opts = {}) {
   const days = opts.days ?? 90;
   const limit = opts.limit ?? 50;
-  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  const cutoff = new Date(now.getTime() - days * 24 * 60 * 60 * 1e3).toISOString();
+  const now2 = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  const cutoff = new Date(now2.getTime() - days * 24 * 60 * 60 * 1e3).toISOString();
   const conditions = ["(last_hit_at IS NULL OR last_hit_at < ?)"];
   const params = [cutoff];
   if (opts.visibility === "public" || opts.visibility === "private") {
@@ -16261,7 +16480,7 @@ function listStale(db, opts = {}) {
 }
 
 // ../../packages/core/dist/publishScan.js
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join12, basename as basename2 } from "node:path";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
@@ -16292,7 +16511,7 @@ var WIN_UNC_PATH_RE = /\\\\[^\\\s"'`<>()|]+\\[^\\\s"'`<>()|]+(?:\\[^\\\s"'`<>()|
 var PRIVATE_IP_RE = /\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g;
 var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
 function sha2562(raw) {
-  return createHash4("sha256").update(raw).digest("hex");
+  return createHash5("sha256").update(raw).digest("hex");
 }
 function findingDigest(opts) {
   const pemContext = opts.rule === "pem-private-key" ? `\0${opts.fileDigest}\0${opts.lineNumber}\0${opts.index}` : "";
@@ -16522,7 +16741,7 @@ var PublishScanError = class extends Error {
 };
 
 // ../../packages/core/dist/publish.js
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname7, join as join13, relative as relative3 } from "node:path";
 
@@ -16661,7 +16880,7 @@ ${bad.join("\n")}`);
   return { fileCount: unsealed.files.length };
 }
 function sha2563(content) {
-  return createHash5("sha256").update(content).digest("hex");
+  return createHash6("sha256").update(content).digest("hex");
 }
 function diffFiles(previous, next) {
   const before = new Map(previous.map((file) => [file.relPath, sha2563(file.content)]));
@@ -17022,9 +17241,321 @@ function boundedCount(value) {
   return Math.min(1e4, Math.max(0, Math.floor(value)));
 }
 
+// ../../packages/core/dist/runtimeErrors.js
+import { spawnSync } from "node:child_process";
+import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
+import { closeSync as closeSync2, constants, existsSync as existsSync15, fstatSync, lstatSync, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { arch as hostArch, homedir as homedir3, platform as hostPlatform } from "node:os";
+import { dirname as dirname8, join as join14 } from "node:path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+var RUNTIME_ERRORS_SCHEMA = "caveat.runtime_errors.v1";
+var STATE_VERSION = "1.0";
+var MAX_RECORDS = 256;
+var RETENTION_MS = 30 * 864e5;
+var MAX_CONFIG_BYTES = 64 * 1024;
+var definitions = {
+  "CAVEAT.DATABASE_OPEN_FAILED": { component: "database", severity: "high", template: "Caveat database open failed" },
+  "CAVEAT.INDEX_FAILED": { component: "index", severity: "high", template: "Caveat index operation failed" },
+  "CAVEAT.SYNC_FAILED": { component: "sync", severity: "high", template: "Caveat own sync failed" },
+  "CAVEAT.MCP_SERVER_FAILED": { component: "mcp", severity: "high", template: "Caveat MCP server failed" },
+  "CAVEAT.MCP_TOOL_FAILED": { component: "mcp_tool", severity: "high", template: "Caveat MCP tool handler failed" },
+  "CAVEAT.CLAUDE_HOOK_FAILED": { component: "claude_hook", severity: "high", template: "Caveat Claude hook failed" },
+  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", severity: "high", template: "Caveat Codex hook failed" }
+};
+function normalizeOptions(options2 = {}) {
+  return "env" in options2 || "configPath" in options2 || "storePath" in options2 || "version" in options2 || "isWindows" in options2 ? options2 : { env: options2 };
+}
+var plain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var exact = (v, keys) => Object.keys(v).length === keys.length && keys.every((key) => Object.hasOwn(v, key));
+var validTime = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+var validVersion = (v) => typeof v === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
+var validOs = (v) => typeof v === "string" && ["darwin", "linux", "windows"].includes(v);
+var validArch = (v) => typeof v === "string" && ["x64", "arm64", "arm", "ia32"].includes(v);
+var windows = (env) => env.OS === "Windows_NT" || hostPlatform() === "win32";
+function defaultFactoryReporterConfigPath(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir3();
+  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "dotagents", "factory-reporter", "config.json") : join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "dotagents", "factory-reporter.json");
+}
+function runtimeErrorsStatePath(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir3();
+  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "caveat", "runtime-errors.json") : join14(env.XDG_STATE_HOME || join14(home, ".local", "state"), "caveat", "runtime-errors.json");
+}
+function collectionEnabled(options2 = {}) {
+  const env = options2.env ?? process.env;
+  try {
+    const path = options2.configPath ?? defaultFactoryReporterConfigPath(env);
+    const isWin = (options2.isWindows ?? windows)(env);
+    const before = lstatSync(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_CONFIG_BYTES) return false;
+    if (isWin) secureWindowsAcl(path, options2.aclRunner);
+    else assertPosix(before, 384);
+    const fd = openSync2(path, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+    let text;
+    try {
+      const after = fstatSync(fd);
+      if (before.dev !== after.dev || before.ino !== after.ino || after.size > MAX_CONFIG_BYTES) return false;
+      if (!isWin) assertPosix(after, 384);
+      text = readFileSync13(fd, "utf8");
+    } finally {
+      closeSync2(fd);
+    }
+    const config = JSON.parse(text);
+    return plain(config) && exact(config, ["schema_version", "host", "collection", "reporting"]) && config.schema_version === "1.0" && plain(config.host) && exact(config.host, ["id", "profile"]) && typeof config.host.id === "string" && /^[a-z0-9][a-z0-9._-]{0,63}$/.test(config.host.id) && ["server", "mac", "wsl", "windows-native"].includes(config.host.profile) && plain(config.collection) && exact(config.collection, ["enabled"]) && config.collection.enabled === true && canonicalReporting(config.reporting);
+  } catch {
+    return false;
+  }
+}
+var empty = () => ({ schema: RUNTIME_ERRORS_SCHEMA, next_sequence: 1, acknowledged_through: 0, records: [] });
+function fingerprint(code) {
+  const d = definitions[code];
+  return createHash7("sha256").update(`caveat\0${d.component}\0${code}\0${d.template}`).digest("hex");
+}
+function ensureSafeDir(dir, isWin, options2 = {}) {
+  const existed = existsSync15(dir);
+  mkdirSync9(dir, { recursive: true, mode: 448 });
+  const s = lstatSync(dir);
+  if (!s.isDirectory() || s.isSymbolicLink()) throw Error("store_unsafe");
+  if (isWin) secureWindowsAcl(dir, options2.aclRunner, true, !existed);
+  else assertPosix(s, 448);
+}
+function canonicalReporting(value) {
+  if (!plain(value) || !Object.keys(value).every((key) => ["enabled", "endpoint", "credential_file"].includes(key)) || typeof value.enabled !== "boolean") return false;
+  if (value.endpoint !== void 0) {
+    if (typeof value.endpoint !== "string" || value.endpoint.length > 2048) return false;
+    try {
+      if (!["http:", "https:"].includes(new URL(value.endpoint).protocol)) return false;
+    } catch {
+      return false;
+    }
+  }
+  if (value.credential_file !== void 0 && (typeof value.credential_file !== "string" || value.credential_file.length < 1 || value.credential_file.length > 4096)) return false;
+  return !value.enabled || value.endpoint !== void 0 && value.credential_file !== void 0;
+}
+var WINDOWS_ACL_VERIFY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)};$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
+var WINDOWS_ACL_APPLY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)};` + WINDOWS_ACL_VERIFY;
+function runWindowsAcl(path, directory, apply) {
+  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, stdio: "ignore", timeout: 3e3, windowsHide: true });
+  if (result.status !== 0) throw Error("store_unsafe");
+}
+function secureWindowsAcl(path, runner, directory = false, apply = false) {
+  try {
+    (runner ?? runWindowsAcl)(path, directory, apply);
+  } catch {
+    throw Error("store_unsafe");
+  }
+}
+function assertPosix(info, mode) {
+  if ((info.mode & 511) !== mode || typeof process.getuid === "function" && info.uid !== process.getuid()) throw Error("store_unsafe");
+}
+function ensureSafeFile(path, isWin, options2 = {}) {
+  const s = lstatSync(path);
+  if (!s.isFile() || s.isSymbolicLink()) throw Error("store_unsafe");
+  if (isWin) secureWindowsAcl(path, options2.aclRunner);
+  else assertPosix(statSync7(path), 384);
+}
+function validate(store) {
+  if (!plain(store) || !exact(store, ["schema", "next_sequence", "acknowledged_through", "records"])) throw Error("state_invalid");
+  const checked = store;
+  if (checked.schema !== RUNTIME_ERRORS_SCHEMA || !Number.isSafeInteger(checked.next_sequence) || checked.next_sequence < 1 || !Number.isSafeInteger(checked.acknowledged_through) || checked.acknowledged_through < 0 || checked.acknowledged_through >= checked.next_sequence || !Array.isArray(checked.records) || checked.records.length > MAX_RECORDS) throw Error("state_invalid");
+  const seen = /* @__PURE__ */ new Set();
+  let previous = 0;
+  for (const record of checked.records) {
+    if (!plain(record) || !exact(record, ["product", "product_version", "component", "error_code", "message_template", "severity", "fingerprint", "count", "first_seen", "last_seen", "state_schema_version", "os", "arch", "status", "resolved_at", "reason_code", "sequence"])) throw Error("state_invalid");
+    const code = typeof record.error_code === "string" ? record.error_code : void 0;
+    const d = code && definitions[code];
+    if (!d || record.product !== "caveat" || !validVersion(record.product_version) || record.component !== d.component || record.message_template !== d.template || record.severity !== d.severity || record.fingerprint !== fingerprint(code) || seen.has(record.fingerprint) || !Number.isSafeInteger(record.count) || record.count < 1 || !validTime(record.first_seen) || !validTime(record.last_seen) || Date.parse(record.first_seen) > Date.parse(record.last_seen) || record.state_schema_version !== STATE_VERSION || !validOs(record.os) || !validArch(record.arch) || !Number.isSafeInteger(record.sequence) || record.sequence <= previous || record.sequence >= checked.next_sequence || !["open", "resolved"].includes(record.status) || record.status === "open" && (record.resolved_at !== null || record.reason_code !== null) || record.status === "resolved" && (typeof record.resolved_at !== "string" || !validTime(record.resolved_at) || Date.parse(record.resolved_at) < Date.parse(record.last_seen) || record.reason_code !== "operator_resolved")) throw Error("state_invalid");
+    seen.add(record.fingerprint);
+    previous = record.sequence;
+  }
+}
+function readStore(path, isWin, options2 = {}) {
+  if (!existsSync15(path)) return empty();
+  ensureSafeFile(path, isWin, options2);
+  const value = JSON.parse(readFileSync13(path, "utf8"));
+  validate(value);
+  return value;
+}
+function lock(path, isWin, fn, options2 = {}) {
+  ensureSafeDir(dirname8(path), isWin, options2);
+  const lockPath2 = `${path}.lock.sqlite`;
+  let created = false;
+  try {
+    writeFileSync9(lockPath2, "", { mode: 384, flag: "wx" });
+    created = true;
+  } catch (error) {
+    if (!plain(error) || error.code !== "EEXIST") throw error;
+  }
+  if (created) {
+    if (isWin) secureWindowsAcl(lockPath2, options2.aclRunner, false, true);
+    else assertPosix(statSync7(lockPath2), 384);
+  } else ensureSafeFile(lockPath2, isWin, options2);
+  const db = new DatabaseSync3(lockPath2);
+  let begun = false;
+  try {
+    ensureSafeFile(lockPath2, isWin, options2);
+    db.exec("PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL; BEGIN IMMEDIATE");
+    begun = true;
+    const result = fn();
+    db.exec("COMMIT");
+    begun = false;
+    return result;
+  } finally {
+    if (begun) try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    db.close();
+  }
+}
+function writeStore(path, store, isWin, options2 = {}) {
+  validate(store);
+  ensureSafeDir(dirname8(path), isWin, options2);
+  const temporary = join14(dirname8(path), `.runtime-errors-${process.pid}-${randomBytes3(6).toString("hex")}`);
+  try {
+    writeFileSync9(temporary, `${JSON.stringify(store)}
+`, { mode: 384, flag: "wx" });
+    if (isWin) secureWindowsAcl(temporary, options2.aclRunner, false, true);
+    else assertPosix(statSync7(temporary), 384);
+    renameSync5(temporary, path);
+    ensureSafeFile(path, isWin, options2);
+  } finally {
+    rmSync6(temporary, { force: true });
+  }
+}
+function now(options2) {
+  const value = options2.now ? new Date(options2.now) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(value.valueOf())) throw Error("invalid_time");
+  return value.toISOString();
+}
+function normalizeOs(value) {
+  return value === "win32" ? "windows" : value;
+}
+function optionsFor(options2) {
+  const env = options2.env ?? process.env;
+  const isWin = (options2.isWindows ?? windows)(env);
+  return { env, isWin, path: options2.storePath ?? runtimeErrorsStatePath(env) };
+}
+function requireCursor(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw Error("invalid_cursor");
+}
+function requireLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_RECORDS) throw Error("invalid_limit");
+}
+function snapshot(options2 = {}) {
+  const afterCursor = options2.afterCursor ?? 0, limit = options2.limit ?? MAX_RECORDS;
+  requireCursor(afterCursor);
+  requireLimit(limit);
+  const enabled = collectionEnabled(options2);
+  const { path, isWin } = optionsFor(options2);
+  const store = enabled ? readStore(path, isWin, options2) : empty();
+  if (afterCursor > store.next_sequence - 1) throw Error("invalid_cursor");
+  const all = store.records.filter((r2) => r2.sequence > afterCursor);
+  const rows = all.slice(0, limit);
+  return { schema: RUNTIME_ERRORS_SCHEMA, product: "caveat", version: options2.version ?? "unknown", state_schema_version: STATE_VERSION, cursor: { high_watermark: store.next_sequence - 1, acknowledged_through: store.acknowledged_through, next: rows.at(-1)?.sequence ?? afterCursor }, runtime_errors: rows.filter((r2) => r2.status === "open").map(({ error_code, component, status, severity, fingerprint: fingerprint22, message_template, count, first_seen, last_seen, state_schema_version }) => ({ error_code, component, status, severity, fingerprint: fingerprint22, message_template, occurrence_count: count, first_seen, last_seen, state_schema_version })), resolutions: rows.filter((r2) => r2.status === "resolved").map(({ fingerprint: fingerprint22, resolved_at, reason_code }) => ({ fingerprint: fingerprint22, resolved_at, reason_code })), diagnostics: { collection: enabled ? "enabled" : "disabled", status: enabled ? "ready" : "not_applicable", total_count: store.records.length, pending_count: store.records.filter((r2) => r2.sequence > store.acknowledged_through).length, truncated: all.length > rows.length } };
+}
+function runtimeErrorsDiagnostics(options2 = {}) {
+  if (!collectionEnabled(options2)) return { schema: "caveat.runtime_error_diagnostics.v1", collection: "disabled", status: "not_applicable", total_count: 0, open_count: 0, pending_count: 0, high_watermark: 0, acknowledged_through: 0 };
+  try {
+    const { path, isWin } = optionsFor(options2);
+    const store = readStore(path, isWin, options2);
+    return { schema: "caveat.runtime_error_diagnostics.v1", collection: "enabled", status: "ready", total_count: store.records.length, open_count: store.records.filter((record) => record.status === "open").length, pending_count: store.records.filter((record) => record.sequence > store.acknowledged_through).length, high_watermark: store.next_sequence - 1, acknowledged_through: store.acknowledged_through };
+  } catch {
+    return { schema: "caveat.runtime_error_diagnostics.v1", collection: "enabled", status: "unavailable", total_count: 0, open_count: 0, pending_count: 0, high_watermark: 0, acknowledged_through: 0 };
+  }
+}
+function recordRuntimeError(code, options2 = {}) {
+  if (!collectionEnabled(options2)) return { status: "disabled" };
+  const { path, isWin } = optionsFor(options2);
+  return lock(path, isWin, () => {
+    const store = readStore(path, isWin, options2);
+    const definition = definitions[code];
+    if (!definition) throw Error("unknown_runtime_code");
+    const key = fingerprint(code);
+    const sequence = store.next_sequence++;
+    const time = now(options2);
+    const existing = store.records.find((r2) => r2.fingerprint === key);
+    const version = options2.version ?? "0.0.0";
+    const os = normalizeOs(options2.os ?? hostPlatform());
+    const arch = options2.arch ?? hostArch();
+    if (!validVersion(version) || !validOs(os) || !validArch(arch)) throw Error("invalid_runtime_metadata");
+    if (existing) {
+      existing.product_version = version;
+      existing.os = os;
+      existing.arch = arch;
+      existing.count += 1;
+      existing.last_seen = time;
+      existing.sequence = sequence;
+      existing.status = "open";
+      existing.resolved_at = null;
+      existing.reason_code = null;
+    } else {
+      if (store.records.length >= MAX_RECORDS) throw Error("store_overflow");
+      store.records.push({ product: "caveat", product_version: version, component: definition.component, error_code: code, message_template: definition.template, severity: definition.severity, fingerprint: key, count: 1, first_seen: time, last_seen: time, state_schema_version: STATE_VERSION, os, arch, status: "open", resolved_at: null, reason_code: null, sequence });
+    }
+    store.records.sort((a, b2) => a.sequence - b2.sequence);
+    writeStore(path, store, isWin, options2);
+    return { status: "recorded", fingerprint: key, sequence };
+  }, options2);
+}
+function observeRuntimeError(code, options2 = {}) {
+  try {
+    recordRuntimeError(code, options2);
+  } catch {
+    try {
+      process.stderr.write("[caveat:runtime-errors] store_unavailable\n");
+    } catch {
+    }
+  }
+}
+var runtimeErrorsSnapshot = (afterCursor = 0, limit = MAX_RECORDS, options2 = {}) => snapshot({ ...normalizeOptions(options2), afterCursor, limit });
+function acknowledgeRuntimeErrors(cursor, options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  requireCursor(cursor);
+  if (!collectionEnabled(normalized)) return snapshot({ ...normalized, afterCursor: cursor });
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    if (cursor >= store.next_sequence) throw Error("invalid_cursor");
+    store.acknowledged_through = Math.max(store.acknowledged_through, cursor);
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+function setRuntimeErrorStatus(fingerprintValue, status, options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  if (!/^[0-9a-f]{64}$/.test(fingerprintValue)) throw Error("invalid_fingerprint");
+  if (!collectionEnabled(normalized)) return snapshot(normalized);
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    const record = store.records.find((r2) => r2.fingerprint === fingerprintValue);
+    if (!record) throw Error("fingerprint_not_found");
+    if (record.status === status) return;
+    record.status = status;
+    record.resolved_at = status === "resolved" ? now(normalized) : null;
+    record.reason_code = status === "resolved" ? "operator_resolved" : null;
+    record.sequence = store.next_sequence++;
+    store.records.sort((a, b2) => a.sequence - b2.sequence);
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+function compactRuntimeErrors(options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  if (!collectionEnabled(normalized)) return snapshot(normalized);
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    const cutoff = Date.parse(now(normalized)) - RETENTION_MS;
+    store.records = store.records.filter((record) => !(record.status === "resolved" && record.sequence <= store.acknowledged_through && record.resolved_at !== null && Date.parse(record.resolved_at) <= cutoff));
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+
 // ../../packages/core/dist/env.js
 var import_semver = __toESM(require_semver2(), 1);
-function fingerprint() {
+function fingerprint2() {
   return {
     os: process.platform,
     arch: process.arch,
@@ -17033,16 +17564,16 @@ function fingerprint() {
 }
 
 // ../../packages/core/dist/id.js
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 function randomHex(hexChars) {
   const bytes = Math.ceil(hexChars / 2);
-  return randomBytes3(bytes).toString("hex").slice(0, hexChars);
+  return randomBytes4(bytes).toString("hex").slice(0, hexChars);
 }
-function slugify(title, now = () => /* @__PURE__ */ new Date()) {
+function slugify(title, now2 = () => /* @__PURE__ */ new Date()) {
   const lowered = title.toLowerCase();
   const sluggy = lowered.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   if (!sluggy || !/^[a-z0-9]/.test(sluggy)) {
-    const d = now();
+    const d = now2();
     const yyyy = d.getUTCFullYear().toString().padStart(4, "0");
     const mm = (d.getUTCMonth() + 1).toString().padStart(2, "0");
     const dd = d.getUTCDate().toString().padStart(2, "0");
@@ -17056,13 +17587,13 @@ function resolveCollision(baseId, exists2) {
   while (exists2(`${baseId}-${n}`)) n++;
   return `${baseId}-${n}`;
 }
-function generateSourceSession(now = () => /* @__PURE__ */ new Date()) {
-  return `${now().toISOString()}/${randomHex(12)}`;
+function generateSourceSession(now2 = () => /* @__PURE__ */ new Date()) {
+  return `${now2().toISOString()}/${randomHex(12)}`;
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname9 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
   for (const [heading, content2] of Object.entries(sections)) {
@@ -17080,24 +17611,24 @@ ${body}${body ? "\n" : ""}`;
   return { content, body };
 }
 function writeEntryFile(filePath, content) {
-  const dir = dirname8(filePath);
-  if (!existsSync15(dir)) mkdirSync9(dir, { recursive: true });
-  writeFileSync9(filePath, content, "utf-8");
+  const dir = dirname9(filePath);
+  if (!existsSync16(dir)) mkdirSync10(dir, { recursive: true });
+  writeFileSync10(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
-import { statSync as statSync7 } from "node:fs";
-import { join as join14 } from "node:path";
+import { statSync as statSync8 } from "node:fs";
+import { join as join15 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
   const source = opts.source ?? "own";
-  const nowDate = now();
+  const nowDate = now2();
   const ymd = formatYmd(nowDate);
-  const baseId = input.id ?? slugify(input.title, now);
+  const baseId = input.id ?? slugify(input.title, now2);
   const id = resolveCollision(baseId, (candidate) => entryExists(opts.db, source, candidate));
   const mergedEnv = {
-    ...fingerprint(),
+    ...fingerprint2(),
     ...input.environment ?? {}
   };
   const frontmatter = {
@@ -17109,7 +17640,7 @@ function recordEntry(input, opts) {
     tags: input.tags ?? [],
     environment: mergedEnv,
     source_project: null,
-    source_session: generateSourceSession(now),
+    source_session: generateSourceSession(now2),
     created_at: ymd,
     updated_at: ymd,
     last_verified: ymd
@@ -17123,9 +17654,9 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join14(opts.entriesRoot, relPath);
+  const filePath = join15(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
-  const stat = statSync7(filePath);
+  const stat = statSync8(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17153,8 +17684,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync13, statSync as statSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readFileSync as readFileSync14, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -17166,15 +17697,15 @@ function updateEntry(id, patch, opts) {
   if (source !== "own") {
     throw new Error("community \u30A8\u30F3\u30C8\u30EA\u306F\u8CFC\u8AAD\u7269\u3067\u3059; \u7DE8\u96C6\u306F\u4E0A\u6D41\u3067\u884C\u3063\u3066\u304F\u3060\u3055\u3044");
   }
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
-  const nowDate = now();
+  const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const nowDate = now2();
   const row = opts.db.prepare("SELECT path FROM entries WHERE source = ? AND id = ?").get(source, id);
   if (!row) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join15(opts.entriesRoot, relPath);
-  const raw = readFileSync13(filePath, "utf-8");
+  const filePath = join16(opts.entriesRoot, relPath);
+  const raw = readFileSync14(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -17215,8 +17746,8 @@ function updateEntry(id, patch, opts) {
     }
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
-  writeFileSync10(filePath, built.content, "utf-8");
-  const stat = statSync8(filePath);
+  writeFileSync11(filePath, built.content, "utf-8");
+  const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17240,15 +17771,15 @@ function formatYmd2(d) {
 }
 
 // ../../packages/core/dist/proposalEval.js
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // ../../packages/core/dist/proposalExecution.js
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { basename as basename3, isAbsolute as isAbsolute3 } from "node:path";
 
 // ../../packages/core/dist/proposalExecutionCompiler.js
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 
 export {
   __commonJS,
@@ -17268,11 +17799,11 @@ export {
   communityPull,
   communityList,
   communityRemove,
-  appendPendingReminder,
+  buildPendingSemanticKey,
+  buildAndPublishPendingReminder,
   cleanupStalePendingDirs,
   maybeSweepPendingDirs,
-  drainPendingReminders,
-  drainGlobalPendingReminders,
+  drainPendingRemindersDetailed,
   createKeyserverKeyProvider,
   SyncError,
   syncOwn,
@@ -17293,7 +17824,8 @@ export {
   ensureUserConfig,
   writeUserConfigPatch,
   defaultSelfIdentityTokens,
-  findCaveatsForPrompt,
+  findCaveatsForHook,
+  findCaveatsForHookSegments,
   toolErrorReminderText,
   userPromptSubmitReminderText,
   stopReminderText,
@@ -17311,7 +17843,13 @@ export {
   decideCodexSidecarExecution,
   buildCodexSidecarDiagnosticsCommand,
   buildCodexSidecarReadOnlySmokeCommand,
-  buildCodexSidecarRunCommand
+  buildCodexSidecarRunCommand,
+  runtimeErrorsDiagnostics,
+  observeRuntimeError,
+  runtimeErrorsSnapshot,
+  acknowledgeRuntimeErrors,
+  setRuntimeErrorStatus,
+  compactRuntimeErrors
 };
 /*! Bundled license information:
 
@@ -17334,4 +17872,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-HCLEIAGO.js.map
+//# sourceMappingURL=chunk-PD5E6TFL.js.map