caveat-cli 0.16.2 → 0.16.3

package/dist/{chunk-3MLJQLWY.js → chunk-PD5E6TFL.js}

@@ -2721,7 +2721,7 @@ var require_dumper = __commonJS({
       var hasFoldableLine = false;
       var shouldTrackWidth = lineWidth !== -1;
       var previousLineBreak = -1;
-      var plain = isPlainSafeFirst2(string.charCodeAt(0)) && !isWhitespace2(string.charCodeAt(string.length - 1));
+      var plain2 = isPlainSafeFirst2(string.charCodeAt(0)) && !isWhitespace2(string.charCodeAt(string.length - 1));
       if (singleLineOnly) {
         for (i2 = 0; i2 < string.length; i2++) {
           char = string.charCodeAt(i2);
@@ -2729,7 +2729,7 @@ var require_dumper = __commonJS({
             return STYLE_DOUBLE2;
           }
           prev_char = i2 > 0 ? string.charCodeAt(i2 - 1) : null;
-          plain = plain && isPlainSafe2(char, prev_char);
+          plain2 = plain2 && isPlainSafe2(char, prev_char);
         }
       } else {
         for (i2 = 0; i2 < string.length; i2++) {
@@ -2745,12 +2745,12 @@ var require_dumper = __commonJS({
             return STYLE_DOUBLE2;
           }
           prev_char = i2 > 0 ? string.charCodeAt(i2 - 1) : null;
-          plain = plain && isPlainSafe2(char, prev_char);
+          plain2 = plain2 && isPlainSafe2(char, prev_char);
         }
         hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
       }
       if (!hasLineBreak && !hasFoldableLine) {
-        return plain && !testAmbiguousType(string) ? STYLE_PLAIN2 : STYLE_SINGLE2;
+        return plain2 && !testAmbiguousType(string) ? STYLE_PLAIN2 : STYLE_SINGLE2;
       }
       if (indentPerLevel > 9 && needIndentIndicator2(string)) {
         return STYLE_DOUBLE2;
@@ -6112,7 +6112,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/index.js"(exports2, module2) {
     "use strict";
     var internalRe = require_re();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse2 = require_parse2();
@@ -6194,8 +6194,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants2.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -8367,14 +8367,14 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
   var hasFoldableLine = false;
   var shouldTrackWidth = lineWidth !== -1;
   var previousLineBreak = -1;
-  var plain = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
+  var plain2 = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
   if (singleLineOnly || forceQuotes) {
     for (i2 = 0; i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
       char = codePointAt(string, i2);
       if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
-      plain = plain && isPlainSafe(char, prevChar, inblock);
+      plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
   } else {
@@ -8390,13 +8390,13 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       } else if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
-      plain = plain && isPlainSafe(char, prevChar, inblock);
+      plain2 = plain2 && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
     hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
   }
   if (!hasLineBreak && !hasFoldableLine) {
-    if (plain && !forceQuotes && !testAmbiguousType(string)) {
+    if (plain2 && !forceQuotes && !testAmbiguousType(string)) {
       return STYLE_PLAIN;
     }
     return quotingType === QUOTING_TYPE_DOUBLE ? STYLE_DOUBLE : STYLE_SINGLE;
@@ -8963,7 +8963,7 @@ import { readFileSync as readFileSync2, readdirSync as readdirSync2, statSync, e
 import { join as join2, relative } from "node:path";
 function scanSource(opts) {
   const { db, source, entriesRoot } = opts;
-  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const now2 = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   db.exec("DROP TABLE IF EXISTS temp.touched");
   db.exec("CREATE TEMP TABLE touched(rowid INTEGER PRIMARY KEY)");
   const insertTouched = db.prepare("INSERT INTO touched (rowid) VALUES (?)");
@@ -8981,7 +8981,7 @@ function scanSource(opts) {
           path: rel,
           content: src,
           file_mtime: mtime,
-          indexed_at: now()
+          indexed_at: now2()
         });
         const existing = db.prepare("SELECT rowid, file_mtime, path FROM entries WHERE source = ? AND id = ?").get(source, row.id);
         if (existing && existing.file_mtime === mtime && existing.path === rel) {
@@ -9351,7 +9351,7 @@ async function prewarmSealedKeys(opts) {
   return failures;
 }
 function scanSealedSource(opts) {
-  const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const now2 = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
   const bundle = readFileSync3(opts.bundlePath);
   const { header } = readSealedHeader(bundle);
   const contentKey = opts.keyProvider.resolveContentKey(header.keyId, header.keyserverUrl);
@@ -9370,7 +9370,7 @@ function scanSealedSource(opts) {
         path: file.relPath,
         content: file.content.toString("utf-8"),
         file_mtime: bundleMtime,
-        indexed_at: now()
+        indexed_at: now2()
       });
       const existing = opts.db.prepare("SELECT rowid FROM entries WHERE source = ? AND id = ?").get(opts.source, row.id);
       const rowid = upsertEntry(opts.db, row);
@@ -9496,9 +9496,9 @@ function acquireFileLock(lockFilePath) {
   }
   return tryCreateLock(lockFilePath) ? { path: lockFilePath } : null;
 }
-function releaseFileLock(lock) {
+function releaseFileLock(lock2) {
   try {
-    unlinkSync(lock.path);
+    unlinkSync(lock2.path);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -9506,8 +9506,8 @@ function releaseFileLock(lock) {
 function acquireReindexLock(caveatHome) {
   return acquireFileLock(lockPath(caveatHome));
 }
-function releaseReindexLock(lock) {
-  releaseFileLock(lock);
+function releaseReindexLock(lock2) {
+  releaseFileLock(lock2);
 }
 function reindexAllSources(opts) {
   const { db, paths, logger, keyProvider } = opts;
@@ -14800,14 +14800,14 @@ function acquirePendingClaim(caveatHome, sessionId, key, options2 = {}) {
     const dir = join6(pendingDirFor(caveatHome, sessionId), ".claims");
     mkdirSync3(dir, { recursive: true, mode: 448 });
     const path = join6(dir, `${key}.claim`);
-    const now = options2.now ?? Date.now();
+    const now2 = options2.now ?? Date.now();
     const ttlMs = options2.ttlMs ?? CLAIM_TTL_MS;
     for (let attempt = 0; attempt < 2; attempt++) {
       const ownerToken = randomBytes(16).toString("hex");
       try {
         const fd = openSync(path, "wx", 384);
         try {
-          writeFileSync2(fd, JSON.stringify({ ownerToken, createdAt: now }), "utf-8");
+          writeFileSync2(fd, JSON.stringify({ ownerToken, createdAt: now2 }), "utf-8");
         } finally {
           closeSync(fd);
         }
@@ -14825,7 +14825,7 @@ function acquirePendingClaim(caveatHome, sessionId, key, options2 = {}) {
             if (typeof parsed.createdAt === "number") createdAt = parsed.createdAt;
           } catch {
           }
-          if (now - createdAt <= ttlMs) return null;
+          if (now2 - createdAt <= ttlMs) return null;
           unlinkSync2(path);
         } catch (retryError) {
           if (retryError && typeof retryError === "object" && retryError.code === "ENOENT") continue;
@@ -14895,8 +14895,8 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
   if (staleDays < 0) {
     throw new Error(`cleanupStalePendingDirs: staleDays must be >= 0 (got ${staleDays})`);
   }
-  const now = options2.now ?? /* @__PURE__ */ new Date();
-  const cutoffMs = now.getTime() - staleDays * 24 * 60 * 60 * 1e3;
+  const now2 = options2.now ?? /* @__PURE__ */ new Date();
+  const cutoffMs = now2.getTime() - staleDays * 24 * 60 * 60 * 1e3;
   const root = join6(caveatHome, "pending");
   if (!existsSync6(root)) return { removed: [], kept: 0 };
   return withPendingQueueLock(caveatHome, () => {
@@ -14917,7 +14917,7 @@ function cleanupStalePendingDirs(caveatHome, options2 = {}) {
         continue;
       }
       if (!subStat.isDirectory()) continue;
-      if (hasNonExpiredPendingClaim(sub, now.getTime())) {
+      if (hasNonExpiredPendingClaim(sub, now2.getTime())) {
         kept++;
         continue;
       }
@@ -14962,19 +14962,19 @@ function maybeSweepPendingDirs(caveatHome, options2 = {}) {
       `maybeSweepPendingDirs: debounceDays must be >= 0 (got ${debounceDays})`
     );
   }
-  const now = options2.now ?? /* @__PURE__ */ new Date();
+  const now2 = options2.now ?? /* @__PURE__ */ new Date();
   const pendingRoot = join6(caveatHome, "pending");
   if (!existsSync6(pendingRoot)) return { skipped: "no_pending_dir" };
   const marker = join6(pendingRoot, ".last-sweep");
   try {
     const m = statSync5(marker);
-    const ageMs = now.getTime() - m.mtimeMs;
+    const ageMs = now2.getTime() - m.mtimeMs;
     if (ageMs < debounceDays * 24 * 60 * 60 * 1e3) {
       return { skipped: "debounced" };
     }
   } catch {
   }
-  const result = cleanupStalePendingDirs(caveatHome, { staleDays, now });
+  const result = cleanupStalePendingDirs(caveatHome, { staleDays, now: now2 });
   try {
     writeFileSync2(marker, "", "utf-8");
   } catch {
@@ -15532,8 +15532,8 @@ function autoSyncNotification(outcome) {
 }
 async function runAutoSync(opts) {
   if (process.env[CAVEAT_AUTO_SYNC_ENV] === "off") return { ran: false };
-  const lock = acquireFileLock(autoSyncLockPath(opts.caveatHome));
-  if (!lock) return { ran: false };
+  const lock2 = acquireFileLock(autoSyncLockPath(opts.caveatHome));
+  if (!lock2) return { ran: false };
   let reindexLock = null;
   try {
     reindexLock = acquireReindexLock(opts.caveatHome);
@@ -15614,7 +15614,7 @@ async function runAutoSync(opts) {
       }
     }
     try {
-      releaseFileLock(lock);
+      releaseFileLock(lock2);
     } catch (err) {
       opts.logger.warn(`autosync lock release failed: ${errorMessage3(err)}`);
     }
@@ -16371,9 +16371,9 @@ function readCodexSessionSignals(transcriptPath) {
 }
 
 // ../../packages/core/dist/markHit.js
-function markHit(db, keys, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+function markHit(db, keys, now2 = () => (/* @__PURE__ */ new Date()).toISOString()) {
   if (keys.length === 0) return;
-  const ts = now();
+  const ts = now2();
   const stmt = db.prepare(
     "UPDATE entries SET last_hit_at = ? WHERE source = ? AND id = ?"
   );
@@ -16453,8 +16453,8 @@ function logHookQueryMiss(miss, dependencies = fsDependencies) {
 function listStale(db, opts = {}) {
   const days = opts.days ?? 90;
   const limit = opts.limit ?? 50;
-  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  const cutoff = new Date(now.getTime() - days * 24 * 60 * 60 * 1e3).toISOString();
+  const now2 = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  const cutoff = new Date(now2.getTime() - days * 24 * 60 * 60 * 1e3).toISOString();
   const conditions = ["(last_hit_at IS NULL OR last_hit_at < ?)"];
   const params = [cutoff];
   if (opts.visibility === "public" || opts.visibility === "private") {
@@ -17241,9 +17241,321 @@ function boundedCount(value) {
   return Math.min(1e4, Math.max(0, Math.floor(value)));
 }
 
+// ../../packages/core/dist/runtimeErrors.js
+import { spawnSync } from "node:child_process";
+import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
+import { closeSync as closeSync2, constants, existsSync as existsSync15, fstatSync, lstatSync, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { arch as hostArch, homedir as homedir3, platform as hostPlatform } from "node:os";
+import { dirname as dirname8, join as join14 } from "node:path";
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+var RUNTIME_ERRORS_SCHEMA = "caveat.runtime_errors.v1";
+var STATE_VERSION = "1.0";
+var MAX_RECORDS = 256;
+var RETENTION_MS = 30 * 864e5;
+var MAX_CONFIG_BYTES = 64 * 1024;
+var definitions = {
+  "CAVEAT.DATABASE_OPEN_FAILED": { component: "database", severity: "high", template: "Caveat database open failed" },
+  "CAVEAT.INDEX_FAILED": { component: "index", severity: "high", template: "Caveat index operation failed" },
+  "CAVEAT.SYNC_FAILED": { component: "sync", severity: "high", template: "Caveat own sync failed" },
+  "CAVEAT.MCP_SERVER_FAILED": { component: "mcp", severity: "high", template: "Caveat MCP server failed" },
+  "CAVEAT.MCP_TOOL_FAILED": { component: "mcp_tool", severity: "high", template: "Caveat MCP tool handler failed" },
+  "CAVEAT.CLAUDE_HOOK_FAILED": { component: "claude_hook", severity: "high", template: "Caveat Claude hook failed" },
+  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", severity: "high", template: "Caveat Codex hook failed" }
+};
+function normalizeOptions(options2 = {}) {
+  return "env" in options2 || "configPath" in options2 || "storePath" in options2 || "version" in options2 || "isWindows" in options2 ? options2 : { env: options2 };
+}
+var plain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var exact = (v, keys) => Object.keys(v).length === keys.length && keys.every((key) => Object.hasOwn(v, key));
+var validTime = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+var validVersion = (v) => typeof v === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
+var validOs = (v) => typeof v === "string" && ["darwin", "linux", "windows"].includes(v);
+var validArch = (v) => typeof v === "string" && ["x64", "arm64", "arm", "ia32"].includes(v);
+var windows = (env) => env.OS === "Windows_NT" || hostPlatform() === "win32";
+function defaultFactoryReporterConfigPath(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir3();
+  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "dotagents", "factory-reporter", "config.json") : join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "dotagents", "factory-reporter.json");
+}
+function runtimeErrorsStatePath(env = process.env) {
+  const home = env.HOME || env.USERPROFILE || homedir3();
+  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "caveat", "runtime-errors.json") : join14(env.XDG_STATE_HOME || join14(home, ".local", "state"), "caveat", "runtime-errors.json");
+}
+function collectionEnabled(options2 = {}) {
+  const env = options2.env ?? process.env;
+  try {
+    const path = options2.configPath ?? defaultFactoryReporterConfigPath(env);
+    const isWin = (options2.isWindows ?? windows)(env);
+    const before = lstatSync(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_CONFIG_BYTES) return false;
+    if (isWin) secureWindowsAcl(path, options2.aclRunner);
+    else assertPosix(before, 384);
+    const fd = openSync2(path, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+    let text;
+    try {
+      const after = fstatSync(fd);
+      if (before.dev !== after.dev || before.ino !== after.ino || after.size > MAX_CONFIG_BYTES) return false;
+      if (!isWin) assertPosix(after, 384);
+      text = readFileSync13(fd, "utf8");
+    } finally {
+      closeSync2(fd);
+    }
+    const config = JSON.parse(text);
+    return plain(config) && exact(config, ["schema_version", "host", "collection", "reporting"]) && config.schema_version === "1.0" && plain(config.host) && exact(config.host, ["id", "profile"]) && typeof config.host.id === "string" && /^[a-z0-9][a-z0-9._-]{0,63}$/.test(config.host.id) && ["server", "mac", "wsl", "windows-native"].includes(config.host.profile) && plain(config.collection) && exact(config.collection, ["enabled"]) && config.collection.enabled === true && canonicalReporting(config.reporting);
+  } catch {
+    return false;
+  }
+}
+var empty = () => ({ schema: RUNTIME_ERRORS_SCHEMA, next_sequence: 1, acknowledged_through: 0, records: [] });
+function fingerprint(code) {
+  const d = definitions[code];
+  return createHash7("sha256").update(`caveat\0${d.component}\0${code}\0${d.template}`).digest("hex");
+}
+function ensureSafeDir(dir, isWin, options2 = {}) {
+  const existed = existsSync15(dir);
+  mkdirSync9(dir, { recursive: true, mode: 448 });
+  const s = lstatSync(dir);
+  if (!s.isDirectory() || s.isSymbolicLink()) throw Error("store_unsafe");
+  if (isWin) secureWindowsAcl(dir, options2.aclRunner, true, !existed);
+  else assertPosix(s, 448);
+}
+function canonicalReporting(value) {
+  if (!plain(value) || !Object.keys(value).every((key) => ["enabled", "endpoint", "credential_file"].includes(key)) || typeof value.enabled !== "boolean") return false;
+  if (value.endpoint !== void 0) {
+    if (typeof value.endpoint !== "string" || value.endpoint.length > 2048) return false;
+    try {
+      if (!["http:", "https:"].includes(new URL(value.endpoint).protocol)) return false;
+    } catch {
+      return false;
+    }
+  }
+  if (value.credential_file !== void 0 && (typeof value.credential_file !== "string" || value.credential_file.length < 1 || value.credential_file.length > 4096)) return false;
+  return !value.enabled || value.endpoint !== void 0 && value.credential_file !== void 0;
+}
+var WINDOWS_ACL_VERIFY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)};$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
+var WINDOWS_ACL_APPLY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)};` + WINDOWS_ACL_VERIFY;
+function runWindowsAcl(path, directory, apply) {
+  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, stdio: "ignore", timeout: 3e3, windowsHide: true });
+  if (result.status !== 0) throw Error("store_unsafe");
+}
+function secureWindowsAcl(path, runner, directory = false, apply = false) {
+  try {
+    (runner ?? runWindowsAcl)(path, directory, apply);
+  } catch {
+    throw Error("store_unsafe");
+  }
+}
+function assertPosix(info, mode) {
+  if ((info.mode & 511) !== mode || typeof process.getuid === "function" && info.uid !== process.getuid()) throw Error("store_unsafe");
+}
+function ensureSafeFile(path, isWin, options2 = {}) {
+  const s = lstatSync(path);
+  if (!s.isFile() || s.isSymbolicLink()) throw Error("store_unsafe");
+  if (isWin) secureWindowsAcl(path, options2.aclRunner);
+  else assertPosix(statSync7(path), 384);
+}
+function validate(store) {
+  if (!plain(store) || !exact(store, ["schema", "next_sequence", "acknowledged_through", "records"])) throw Error("state_invalid");
+  const checked = store;
+  if (checked.schema !== RUNTIME_ERRORS_SCHEMA || !Number.isSafeInteger(checked.next_sequence) || checked.next_sequence < 1 || !Number.isSafeInteger(checked.acknowledged_through) || checked.acknowledged_through < 0 || checked.acknowledged_through >= checked.next_sequence || !Array.isArray(checked.records) || checked.records.length > MAX_RECORDS) throw Error("state_invalid");
+  const seen = /* @__PURE__ */ new Set();
+  let previous = 0;
+  for (const record of checked.records) {
+    if (!plain(record) || !exact(record, ["product", "product_version", "component", "error_code", "message_template", "severity", "fingerprint", "count", "first_seen", "last_seen", "state_schema_version", "os", "arch", "status", "resolved_at", "reason_code", "sequence"])) throw Error("state_invalid");
+    const code = typeof record.error_code === "string" ? record.error_code : void 0;
+    const d = code && definitions[code];
+    if (!d || record.product !== "caveat" || !validVersion(record.product_version) || record.component !== d.component || record.message_template !== d.template || record.severity !== d.severity || record.fingerprint !== fingerprint(code) || seen.has(record.fingerprint) || !Number.isSafeInteger(record.count) || record.count < 1 || !validTime(record.first_seen) || !validTime(record.last_seen) || Date.parse(record.first_seen) > Date.parse(record.last_seen) || record.state_schema_version !== STATE_VERSION || !validOs(record.os) || !validArch(record.arch) || !Number.isSafeInteger(record.sequence) || record.sequence <= previous || record.sequence >= checked.next_sequence || !["open", "resolved"].includes(record.status) || record.status === "open" && (record.resolved_at !== null || record.reason_code !== null) || record.status === "resolved" && (typeof record.resolved_at !== "string" || !validTime(record.resolved_at) || Date.parse(record.resolved_at) < Date.parse(record.last_seen) || record.reason_code !== "operator_resolved")) throw Error("state_invalid");
+    seen.add(record.fingerprint);
+    previous = record.sequence;
+  }
+}
+function readStore(path, isWin, options2 = {}) {
+  if (!existsSync15(path)) return empty();
+  ensureSafeFile(path, isWin, options2);
+  const value = JSON.parse(readFileSync13(path, "utf8"));
+  validate(value);
+  return value;
+}
+function lock(path, isWin, fn, options2 = {}) {
+  ensureSafeDir(dirname8(path), isWin, options2);
+  const lockPath2 = `${path}.lock.sqlite`;
+  let created = false;
+  try {
+    writeFileSync9(lockPath2, "", { mode: 384, flag: "wx" });
+    created = true;
+  } catch (error) {
+    if (!plain(error) || error.code !== "EEXIST") throw error;
+  }
+  if (created) {
+    if (isWin) secureWindowsAcl(lockPath2, options2.aclRunner, false, true);
+    else assertPosix(statSync7(lockPath2), 384);
+  } else ensureSafeFile(lockPath2, isWin, options2);
+  const db = new DatabaseSync3(lockPath2);
+  let begun = false;
+  try {
+    ensureSafeFile(lockPath2, isWin, options2);
+    db.exec("PRAGMA busy_timeout=5000; PRAGMA synchronous=FULL; BEGIN IMMEDIATE");
+    begun = true;
+    const result = fn();
+    db.exec("COMMIT");
+    begun = false;
+    return result;
+  } finally {
+    if (begun) try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    db.close();
+  }
+}
+function writeStore(path, store, isWin, options2 = {}) {
+  validate(store);
+  ensureSafeDir(dirname8(path), isWin, options2);
+  const temporary = join14(dirname8(path), `.runtime-errors-${process.pid}-${randomBytes3(6).toString("hex")}`);
+  try {
+    writeFileSync9(temporary, `${JSON.stringify(store)}
+`, { mode: 384, flag: "wx" });
+    if (isWin) secureWindowsAcl(temporary, options2.aclRunner, false, true);
+    else assertPosix(statSync7(temporary), 384);
+    renameSync5(temporary, path);
+    ensureSafeFile(path, isWin, options2);
+  } finally {
+    rmSync6(temporary, { force: true });
+  }
+}
+function now(options2) {
+  const value = options2.now ? new Date(options2.now) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(value.valueOf())) throw Error("invalid_time");
+  return value.toISOString();
+}
+function normalizeOs(value) {
+  return value === "win32" ? "windows" : value;
+}
+function optionsFor(options2) {
+  const env = options2.env ?? process.env;
+  const isWin = (options2.isWindows ?? windows)(env);
+  return { env, isWin, path: options2.storePath ?? runtimeErrorsStatePath(env) };
+}
+function requireCursor(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw Error("invalid_cursor");
+}
+function requireLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_RECORDS) throw Error("invalid_limit");
+}
+function snapshot(options2 = {}) {
+  const afterCursor = options2.afterCursor ?? 0, limit = options2.limit ?? MAX_RECORDS;
+  requireCursor(afterCursor);
+  requireLimit(limit);
+  const enabled = collectionEnabled(options2);
+  const { path, isWin } = optionsFor(options2);
+  const store = enabled ? readStore(path, isWin, options2) : empty();
+  if (afterCursor > store.next_sequence - 1) throw Error("invalid_cursor");
+  const all = store.records.filter((r2) => r2.sequence > afterCursor);
+  const rows = all.slice(0, limit);
+  return { schema: RUNTIME_ERRORS_SCHEMA, product: "caveat", version: options2.version ?? "unknown", state_schema_version: STATE_VERSION, cursor: { high_watermark: store.next_sequence - 1, acknowledged_through: store.acknowledged_through, next: rows.at(-1)?.sequence ?? afterCursor }, runtime_errors: rows.filter((r2) => r2.status === "open").map(({ error_code, component, status, severity, fingerprint: fingerprint22, message_template, count, first_seen, last_seen, state_schema_version }) => ({ error_code, component, status, severity, fingerprint: fingerprint22, message_template, occurrence_count: count, first_seen, last_seen, state_schema_version })), resolutions: rows.filter((r2) => r2.status === "resolved").map(({ fingerprint: fingerprint22, resolved_at, reason_code }) => ({ fingerprint: fingerprint22, resolved_at, reason_code })), diagnostics: { collection: enabled ? "enabled" : "disabled", status: enabled ? "ready" : "not_applicable", total_count: store.records.length, pending_count: store.records.filter((r2) => r2.sequence > store.acknowledged_through).length, truncated: all.length > rows.length } };
+}
+function runtimeErrorsDiagnostics(options2 = {}) {
+  if (!collectionEnabled(options2)) return { schema: "caveat.runtime_error_diagnostics.v1", collection: "disabled", status: "not_applicable", total_count: 0, open_count: 0, pending_count: 0, high_watermark: 0, acknowledged_through: 0 };
+  try {
+    const { path, isWin } = optionsFor(options2);
+    const store = readStore(path, isWin, options2);
+    return { schema: "caveat.runtime_error_diagnostics.v1", collection: "enabled", status: "ready", total_count: store.records.length, open_count: store.records.filter((record) => record.status === "open").length, pending_count: store.records.filter((record) => record.sequence > store.acknowledged_through).length, high_watermark: store.next_sequence - 1, acknowledged_through: store.acknowledged_through };
+  } catch {
+    return { schema: "caveat.runtime_error_diagnostics.v1", collection: "enabled", status: "unavailable", total_count: 0, open_count: 0, pending_count: 0, high_watermark: 0, acknowledged_through: 0 };
+  }
+}
+function recordRuntimeError(code, options2 = {}) {
+  if (!collectionEnabled(options2)) return { status: "disabled" };
+  const { path, isWin } = optionsFor(options2);
+  return lock(path, isWin, () => {
+    const store = readStore(path, isWin, options2);
+    const definition = definitions[code];
+    if (!definition) throw Error("unknown_runtime_code");
+    const key = fingerprint(code);
+    const sequence = store.next_sequence++;
+    const time = now(options2);
+    const existing = store.records.find((r2) => r2.fingerprint === key);
+    const version = options2.version ?? "0.0.0";
+    const os = normalizeOs(options2.os ?? hostPlatform());
+    const arch = options2.arch ?? hostArch();
+    if (!validVersion(version) || !validOs(os) || !validArch(arch)) throw Error("invalid_runtime_metadata");
+    if (existing) {
+      existing.product_version = version;
+      existing.os = os;
+      existing.arch = arch;
+      existing.count += 1;
+      existing.last_seen = time;
+      existing.sequence = sequence;
+      existing.status = "open";
+      existing.resolved_at = null;
+      existing.reason_code = null;
+    } else {
+      if (store.records.length >= MAX_RECORDS) throw Error("store_overflow");
+      store.records.push({ product: "caveat", product_version: version, component: definition.component, error_code: code, message_template: definition.template, severity: definition.severity, fingerprint: key, count: 1, first_seen: time, last_seen: time, state_schema_version: STATE_VERSION, os, arch, status: "open", resolved_at: null, reason_code: null, sequence });
+    }
+    store.records.sort((a, b2) => a.sequence - b2.sequence);
+    writeStore(path, store, isWin, options2);
+    return { status: "recorded", fingerprint: key, sequence };
+  }, options2);
+}
+function observeRuntimeError(code, options2 = {}) {
+  try {
+    recordRuntimeError(code, options2);
+  } catch {
+    try {
+      process.stderr.write("[caveat:runtime-errors] store_unavailable\n");
+    } catch {
+    }
+  }
+}
+var runtimeErrorsSnapshot = (afterCursor = 0, limit = MAX_RECORDS, options2 = {}) => snapshot({ ...normalizeOptions(options2), afterCursor, limit });
+function acknowledgeRuntimeErrors(cursor, options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  requireCursor(cursor);
+  if (!collectionEnabled(normalized)) return snapshot({ ...normalized, afterCursor: cursor });
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    if (cursor >= store.next_sequence) throw Error("invalid_cursor");
+    store.acknowledged_through = Math.max(store.acknowledged_through, cursor);
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+function setRuntimeErrorStatus(fingerprintValue, status, options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  if (!/^[0-9a-f]{64}$/.test(fingerprintValue)) throw Error("invalid_fingerprint");
+  if (!collectionEnabled(normalized)) return snapshot(normalized);
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    const record = store.records.find((r2) => r2.fingerprint === fingerprintValue);
+    if (!record) throw Error("fingerprint_not_found");
+    if (record.status === status) return;
+    record.status = status;
+    record.resolved_at = status === "resolved" ? now(normalized) : null;
+    record.reason_code = status === "resolved" ? "operator_resolved" : null;
+    record.sequence = store.next_sequence++;
+    store.records.sort((a, b2) => a.sequence - b2.sequence);
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+function compactRuntimeErrors(options2 = {}) {
+  const normalized = normalizeOptions(options2);
+  if (!collectionEnabled(normalized)) return snapshot(normalized);
+  const { path, isWin } = optionsFor(normalized);
+  lock(path, isWin, () => {
+    const store = readStore(path, isWin, normalized);
+    const cutoff = Date.parse(now(normalized)) - RETENTION_MS;
+    store.records = store.records.filter((record) => !(record.status === "resolved" && record.sequence <= store.acknowledged_through && record.resolved_at !== null && Date.parse(record.resolved_at) <= cutoff));
+    writeStore(path, store, isWin, normalized);
+  }, normalized);
+  return snapshot(normalized);
+}
+
 // ../../packages/core/dist/env.js
 var import_semver = __toESM(require_semver2(), 1);
-function fingerprint() {
+function fingerprint2() {
   return {
     os: process.platform,
     arch: process.arch,
@@ -17252,16 +17564,16 @@ function fingerprint() {
 }
 
 // ../../packages/core/dist/id.js
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 function randomHex(hexChars) {
   const bytes = Math.ceil(hexChars / 2);
-  return randomBytes3(bytes).toString("hex").slice(0, hexChars);
+  return randomBytes4(bytes).toString("hex").slice(0, hexChars);
 }
-function slugify(title, now = () => /* @__PURE__ */ new Date()) {
+function slugify(title, now2 = () => /* @__PURE__ */ new Date()) {
   const lowered = title.toLowerCase();
   const sluggy = lowered.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   if (!sluggy || !/^[a-z0-9]/.test(sluggy)) {
-    const d = now();
+    const d = now2();
     const yyyy = d.getUTCFullYear().toString().padStart(4, "0");
     const mm = (d.getUTCMonth() + 1).toString().padStart(2, "0");
     const dd = d.getUTCDate().toString().padStart(2, "0");
@@ -17275,13 +17587,13 @@ function resolveCollision(baseId, exists2) {
   while (exists2(`${baseId}-${n}`)) n++;
   return `${baseId}-${n}`;
 }
-function generateSourceSession(now = () => /* @__PURE__ */ new Date()) {
-  return `${now().toISOString()}/${randomHex(12)}`;
+function generateSourceSession(now2 = () => /* @__PURE__ */ new Date()) {
+  return `${now2().toISOString()}/${randomHex(12)}`;
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname9 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
   for (const [heading, content2] of Object.entries(sections)) {
@@ -17299,24 +17611,24 @@ ${body}${body ? "\n" : ""}`;
   return { content, body };
 }
 function writeEntryFile(filePath, content) {
-  const dir = dirname8(filePath);
-  if (!existsSync15(dir)) mkdirSync9(dir, { recursive: true });
-  writeFileSync9(filePath, content, "utf-8");
+  const dir = dirname9(filePath);
+  if (!existsSync16(dir)) mkdirSync10(dir, { recursive: true });
+  writeFileSync10(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
-import { statSync as statSync7 } from "node:fs";
-import { join as join14 } from "node:path";
+import { statSync as statSync8 } from "node:fs";
+import { join as join15 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
   const source = opts.source ?? "own";
-  const nowDate = now();
+  const nowDate = now2();
   const ymd = formatYmd(nowDate);
-  const baseId = input.id ?? slugify(input.title, now);
+  const baseId = input.id ?? slugify(input.title, now2);
   const id = resolveCollision(baseId, (candidate) => entryExists(opts.db, source, candidate));
   const mergedEnv = {
-    ...fingerprint(),
+    ...fingerprint2(),
     ...input.environment ?? {}
   };
   const frontmatter = {
@@ -17328,7 +17640,7 @@ function recordEntry(input, opts) {
     tags: input.tags ?? [],
     environment: mergedEnv,
     source_project: null,
-    source_session: generateSourceSession(now),
+    source_session: generateSourceSession(now2),
     created_at: ymd,
     updated_at: ymd,
     last_verified: ymd
@@ -17342,9 +17654,9 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join14(opts.entriesRoot, relPath);
+  const filePath = join15(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
-  const stat = statSync7(filePath);
+  const stat = statSync8(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17372,8 +17684,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync13, statSync as statSync8, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readFileSync as readFileSync14, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -17385,15 +17697,15 @@ function updateEntry(id, patch, opts) {
   if (source !== "own") {
     throw new Error("community \u30A8\u30F3\u30C8\u30EA\u306F\u8CFC\u8AAD\u7269\u3067\u3059; \u7DE8\u96C6\u306F\u4E0A\u6D41\u3067\u884C\u3063\u3066\u304F\u3060\u3055\u3044");
   }
-  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
-  const nowDate = now();
+  const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const nowDate = now2();
   const row = opts.db.prepare("SELECT path FROM entries WHERE source = ? AND id = ?").get(source, id);
   if (!row) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join15(opts.entriesRoot, relPath);
-  const raw = readFileSync13(filePath, "utf-8");
+  const filePath = join16(opts.entriesRoot, relPath);
+  const raw = readFileSync14(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -17434,8 +17746,8 @@ function updateEntry(id, patch, opts) {
     }
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
-  writeFileSync10(filePath, built.content, "utf-8");
-  const stat = statSync8(filePath);
+  writeFileSync11(filePath, built.content, "utf-8");
+  const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17459,15 +17771,15 @@ function formatYmd2(d) {
 }
 
 // ../../packages/core/dist/proposalEval.js
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // ../../packages/core/dist/proposalExecution.js
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { basename as basename3, isAbsolute as isAbsolute3 } from "node:path";
 
 // ../../packages/core/dist/proposalExecutionCompiler.js
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 
 export {
   __commonJS,
@@ -17531,7 +17843,13 @@ export {
   decideCodexSidecarExecution,
   buildCodexSidecarDiagnosticsCommand,
   buildCodexSidecarReadOnlySmokeCommand,
-  buildCodexSidecarRunCommand
+  buildCodexSidecarRunCommand,
+  runtimeErrorsDiagnostics,
+  observeRuntimeError,
+  runtimeErrorsSnapshot,
+  acknowledgeRuntimeErrors,
+  setRuntimeErrorStatus,
+  compactRuntimeErrors
 };
 /*! Bundled license information:
 
@@ -17554,4 +17872,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-3MLJQLWY.js.map
+//# sourceMappingURL=chunk-PD5E6TFL.js.map