caveat-cli 0.16.3 → 0.17.0

package/dist/{chunk-PD5E6TFL.js → chunk-7FEOFAMA.js}

@@ -15434,11 +15434,17 @@ function errorMessage2(err) {
 }
 
 // ../../packages/core/dist/autoSync.js
+import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
-var AUTO_SYNC_DEBOUNCE_MS = 24 * 60 * 60 * 1e3;
+var AUTO_SYNC_DEBOUNCE_MS = 15 * 60 * 1e3;
+var AUTO_SYNC_RECORD_DEBOUNCE_MS = 60 * 1e3;
+var AUTO_SYNC_SUSPEND_THRESHOLD = 3;
+var AUTO_SYNC_DEGRADED_RETRY_MS = 6 * 60 * 60 * 1e3;
+var AUTO_SYNC_NOTICE_REPEAT_MS = 24 * 60 * 60 * 1e3;
 var CAVEAT_AUTO_SYNC_ENV = "CAVEAT_AUTO_SYNC";
+var CAVEAT_AUTO_SYNC_DEBOUNCE_ENV = "CAVEAT_AUTO_SYNC_DEBOUNCE_MS";
 function syncDir(caveatHome) {
   return join9(caveatHome, "sync");
 }
@@ -15471,6 +15477,7 @@ function resetAutoSyncFailureState(caveatHome) {
     writeAutoSyncState(caveatHome, {
       finishedAt: current?.finishedAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
       signature: current?.signature ?? "",
+      lastNotifiedAt: current?.lastNotifiedAt,
       ownSync: { consecutiveFailureSignature: null, consecutiveFailureCount: 0 }
     });
   } catch {
@@ -15479,7 +15486,15 @@ function resetAutoSyncFailureState(caveatHome) {
 function isAutoSyncState(value) {
   if (value === null || typeof value !== "object") return false;
   const candidate = value;
-  return typeof candidate.finishedAt === "string" && typeof candidate.signature === "string" && candidate.ownSync !== null && typeof candidate.ownSync === "object" && (candidate.ownSync.consecutiveFailureSignature === null || typeof candidate.ownSync.consecutiveFailureSignature === "string") && Number.isInteger(candidate.ownSync.consecutiveFailureCount) && candidate.ownSync.consecutiveFailureCount >= 0;
+  return typeof candidate.finishedAt === "string" && typeof candidate.signature === "string" && isOptionalString(candidate.lastNotifiedAt) && candidate.ownSync !== null && typeof candidate.ownSync === "object" && (candidate.ownSync.consecutiveFailureSignature === null || typeof candidate.ownSync.consecutiveFailureSignature === "string") && Number.isInteger(candidate.ownSync.consecutiveFailureCount) && candidate.ownSync.consecutiveFailureCount >= 0 && isOptionalString(candidate.ownSync.lastAttemptAt);
+}
+function isOptionalString(value) {
+  return value === void 0 || typeof value === "string";
+}
+function parseTimestamp(value) {
+  if (value === void 0) return 0;
+  const ms = Date.parse(value);
+  return Number.isFinite(ms) ? ms : 0;
 }
 function classifyOwnSyncOutcome(err, lastProbe) {
   if (!(err instanceof SyncError)) return "fail";
@@ -15507,8 +15522,9 @@ function autoSyncNotification(outcome) {
   if (outcome.own.pulled === true) {
     lines.push("autosync: pulled updates from your private remote");
   }
-  if (outcome.own.escalated === true) {
-    lines.push("autosync: own sync failed 3x in a row and auto-retry is paused. run `caveat sync` manually to resolve and resume.");
+  const backoffHours = Math.round(AUTO_SYNC_DEGRADED_RETRY_MS / (60 * 60 * 1e3));
+  if (outcome.own.degraded === true) {
+    lines.push(`autosync: own sync keeps failing; auto-retry is backed off to every ${backoffHours}h. run \`caveat sync\` to resolve now.`);
   } else if (outcome.own.disposition === "fail") {
     lines.push(`autosync: own sync failed (${outcome.own.code ?? "UNKNOWN"}). run \`caveat sync\` to resolve.`);
   }
@@ -15517,17 +15533,7 @@ function autoSyncNotification(outcome) {
     lines.push(`autosync: community pull failed: ${failedHandles.join(", ")}`);
   }
   const text = lines.length > 0 ? lines.join("\n") : null;
-  const signature = sha256(JSON.stringify({
-    lines,
-    own: {
-      disposition: outcome.own.disposition,
-      code: outcome.own.code ?? null,
-      pulled: outcome.own.pulled ?? null,
-      suspended: outcome.own.suspended ?? false,
-      escalated: outcome.own.escalated ?? false
-    },
-    communityFailed: failedHandles
-  }));
+  const signature = sha256(JSON.stringify(lines));
   return { signature, text };
 }
 async function runAutoSync(opts) {
@@ -15538,6 +15544,9 @@ async function runAutoSync(opts) {
   try {
     reindexLock = acquireReindexLock(opts.caveatHome);
     if (!reindexLock) return { ran: false };
+    const nowDate = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+    const nowMs = nowDate.getTime();
+    const nowIso = nowDate.toISOString();
     const previousState = readAutoSyncState(opts.caveatHome);
     let ownSyncState = previousState?.ownSync ?? {
       consecutiveFailureSignature: null,
@@ -15549,9 +15558,12 @@ async function runAutoSync(opts) {
       gitTimeoutMs: opts.gitTimeoutMs ?? BACKGROUND_GIT_TIMEOUT_MS
     });
     let own;
-    if (ownSyncState.consecutiveFailureCount >= 3) {
+    const degraded = ownSyncState.consecutiveFailureCount >= AUTO_SYNC_SUSPEND_THRESHOLD;
+    const retryDue = nowMs - parseTimestamp(ownSyncState.lastAttemptAt) >= AUTO_SYNC_DEGRADED_RETRY_MS;
+    if (degraded && !retryDue) {
       own = { disposition: "skip", suspended: true };
     } else {
+      ownSyncState = { ...ownSyncState, lastAttemptAt: nowIso };
       let lastProbe;
       try {
         const result = await syncOwn({
@@ -15582,23 +15594,27 @@ async function runAutoSync(opts) {
           const consecutiveFailureCount = ownSyncState.consecutiveFailureSignature === failureSignature ? ownSyncState.consecutiveFailureCount + 1 : 1;
           ownSyncState = {
             consecutiveFailureSignature: failureSignature,
-            consecutiveFailureCount
+            consecutiveFailureCount,
+            lastAttemptAt: nowIso
           };
-          if (consecutiveFailureCount === 3) own.escalated = true;
+          if (consecutiveFailureCount === AUTO_SYNC_SUSPEND_THRESHOLD) own.escalated = true;
         }
       }
     }
+    if (ownSyncState.consecutiveFailureCount >= AUTO_SYNC_SUSPEND_THRESHOLD) own.degraded = true;
     await reindexAndMark2(opts);
     const outcome = { community, own };
     const { signature, text } = autoSyncNotification(outcome);
+    const repeatDue = own.degraded === true && nowMs - parseTimestamp(previousState?.lastNotifiedAt) >= AUTO_SYNC_NOTICE_REPEAT_MS;
     let notified = false;
-    if (text !== null && previousState?.signature !== signature) {
+    if (text !== null && (previousState?.signature !== signature || repeatDue)) {
       appendGlobalPendingReminder(opts.caveatHome, text);
       notified = true;
     }
     writeAutoSyncState(opts.caveatHome, {
-      finishedAt: (opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+      finishedAt: nowIso,
       signature,
+      lastNotifiedAt: notified ? nowIso : previousState?.lastNotifiedAt,
       ownSync: ownSyncState
     });
     return { ran: true, outcome, notified };
@@ -15620,6 +15636,35 @@ async function runAutoSync(opts) {
     }
   }
 }
+function triggerAutoSync(opts) {
+  if (process.env[CAVEAT_AUTO_SYNC_ENV] === "off") return;
+  const debounceMs = resolveTriggerDebounceMs(opts.debounceMs ?? AUTO_SYNC_DEBOUNCE_MS);
+  const statePath = autoSyncStatePath(opts.caveatHome);
+  try {
+    if (existsSync9(statePath) && Date.now() - statSync6(statePath).mtimeMs < debounceMs) return;
+  } catch {
+  }
+  if (!opts.cliScript) throw new Error("current Caveat CLI script path is unavailable");
+  const child = spawn2(
+    process.execPath,
+    [...process.execArgv, "--disable-warning=ExperimentalWarning", opts.cliScript, "hook", "autosync"],
+    { detached: true, stdio: "ignore", windowsHide: true }
+  );
+  child.unref();
+}
+function resolveTriggerDebounceMs(fallback) {
+  const raw = process.env[CAVEAT_AUTO_SYNC_DEBOUNCE_ENV];
+  if (raw === void 0) return fallback;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    process.stderr.write(
+      `[caveat] ${CAVEAT_AUTO_SYNC_DEBOUNCE_ENV}=${raw} is not a non-negative number; using ${fallback}ms
+`
+    );
+    return fallback;
+  }
+  return parsed;
+}
 async function reindexAndMark2(opts) {
   const keyProvider = createKeyserverKeyProvider({ caveatHome: opts.caveatHome });
   const failures = await prewarmSealedKeys({ paths: opts.paths, keyProvider });
@@ -15731,7 +15776,7 @@ function toSearchResult(row) {
 }
 
 // ../../packages/core/dist/paths.js
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { dirname as dirname6, isAbsolute, join as join10, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function expandHome(p2, userHome) {
@@ -15763,7 +15808,7 @@ function resolvePaths(caveatHome, knowledgeRepo, userHome) {
 }
 
 // ../../packages/core/dist/config.js
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
 var DEFAULT_CONFIG = {
   knowledgeRepo: "own",
   semverKeys: ["driver", "cuda", "node"],
@@ -15772,16 +15817,16 @@ var DEFAULT_CONFIG = {
   sealedKeyserverUrl: null
 };
 function loadConfig(userConfigPath) {
-  const userCfg = existsSync10(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
+  const userCfg = existsSync11(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
   return deepMerge(DEFAULT_CONFIG, userCfg);
 }
 function ensureUserConfig(userConfigPath) {
-  if (!existsSync10(userConfigPath)) {
+  if (!existsSync11(userConfigPath)) {
     writeFileSync6(userConfigPath, "{}\n", "utf-8");
   }
 }
 function writeUserConfigPatch(userConfigPath, patch) {
-  const existing = existsSync10(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
+  const existing = existsSync11(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
   writeFileSync6(userConfigPath, `${JSON.stringify({ ...existing, ...patch }, null, 2)}
 `, "utf-8");
 }
@@ -16090,7 +16135,7 @@ function stopReminderText(signals, related) {
 }
 
 // ../../packages/core/dist/transcriptSignals.js
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
 var MAX_ERROR_SNIPPETS = 10;
 var MAX_ERROR_SNIPPET_LENGTH = 300;
 var MAX_SEARCH_QUERIES = 10;
@@ -16110,13 +16155,13 @@ function extractResultText(content) {
   }
   return "";
 }
-function parseTimestamp(raw) {
+function parseTimestamp2(raw) {
   if (typeof raw !== "string") return void 0;
   const ms = Date.parse(raw);
   return Number.isNaN(ms) ? void 0 : ms;
 }
 function readSessionSignals(transcriptPath) {
-  if (!transcriptPath || !existsSync11(transcriptPath)) return null;
+  if (!transcriptPath || !existsSync12(transcriptPath)) return null;
   let raw;
   try {
     raw = readFileSync9(transcriptPath, "utf-8");
@@ -16140,7 +16185,7 @@ function readSessionSignals(transcriptPath) {
     } catch {
       continue;
     }
-    const ts = parseTimestamp(parsed.timestamp);
+    const ts = parseTimestamp2(parsed.timestamp);
     if (ts !== void 0) {
       if (firstTs === void 0 || ts < firstTs) firstTs = ts;
       if (lastTs === void 0 || ts > lastTs) lastTs = ts;
@@ -16200,7 +16245,7 @@ function struggleSearchText(s) {
 }
 
 // ../../packages/core/dist/codexTranscriptSignals.js
-import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
 var MAX_ERROR_SNIPPETS2 = 10;
 var MAX_ERROR_SNIPPET_LENGTH2 = 300;
 var MAX_SEARCH_QUERIES2 = 10;
@@ -16209,7 +16254,7 @@ var MAX_FILE_EDIT_ENTRIES2 = 20;
 function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function parseTimestamp2(raw) {
+function parseTimestamp3(raw) {
   if (typeof raw !== "string") return void 0;
   const ms = Date.parse(raw);
   return Number.isNaN(ms) ? void 0 : ms;
@@ -16265,7 +16310,7 @@ function addQuery(searchQueries, query) {
   searchQueries.push(query.slice(0, MAX_SEARCH_QUERY_LENGTH2));
 }
 function readCodexSessionSignals(transcriptPath) {
-  if (!transcriptPath || !existsSync12(transcriptPath)) return null;
+  if (!transcriptPath || !existsSync13(transcriptPath)) return null;
   let raw;
   try {
     raw = readFileSync10(transcriptPath, "utf-8");
@@ -16291,7 +16336,7 @@ function readCodexSessionSignals(transcriptPath) {
     } catch {
       continue;
     }
-    const ts = parseTimestamp2(parsed.timestamp);
+    const ts = parseTimestamp3(parsed.timestamp);
     if (ts !== void 0) {
       if (firstTs === void 0 || ts < firstTs) firstTs = ts;
       if (lastTs === void 0 || ts > lastTs) lastTs = ts;
@@ -16383,7 +16428,7 @@ function markHit(db, keys, now2 = () => (/* @__PURE__ */ new Date()).toISOString
 }
 
 // ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync6, unlinkSync as unlinkSync3 } from "node:fs";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync7, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join11, resolve as resolve3 } from "node:path";
 var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
 var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
@@ -16393,7 +16438,7 @@ var fsDependencies = {
   chmodSync: chmodSync2,
   mkdirSync: mkdirSync7,
   renameSync: renameSync4,
-  statSync: statSync6,
+  statSync: statSync7,
   unlinkSync: unlinkSync3
 };
 function isMissingPathError(err) {
@@ -16481,7 +16526,7 @@ function listStale(db, opts = {}) {
 
 // ../../packages/core/dist/publishScan.js
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join12, basename as basename2 } from "node:path";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
 var ALLOW_FILE = ".caveat-publish-allow.json";
@@ -16712,7 +16757,7 @@ function publishSelfIdentityTokens() {
 }
 function loadPublishAllow(knowledgeRepo) {
   const path = join12(knowledgeRepo, ALLOW_FILE);
-  if (!existsSync13(path)) return /* @__PURE__ */ new Set();
+  if (!existsSync14(path)) return /* @__PURE__ */ new Set();
   const parsed = JSON.parse(readFileSync11(path, "utf-8"));
   if (!Array.isArray(parsed.allow)) throw new Error(`${ALLOW_FILE} must contain an "allow" array`);
   return new Set(parsed.allow.filter((value) => typeof value === "string" && DIGEST_RE.test(value)));
@@ -16742,7 +16787,7 @@ var PublishScanError = class extends Error {
 
 // ../../packages/core/dist/publish.js
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname7, join as join13, relative as relative3 } from "node:path";
 
 // ../../packages/core/dist/visibility.js
@@ -16758,7 +16803,7 @@ var TMP_BRANCH = "caveat-publish-tmp";
 function collectPublishSet(entriesDir) {
   const files = [];
   const invalid = [];
-  if (!existsSync14(entriesDir)) return { files, invalid };
+  if (!existsSync15(entriesDir)) return { files, invalid };
   for (const path of walkMarkdown(entriesDir)) {
     const relPath = relative3(entriesDir, path).replace(/\\/g, "/");
     const content = readFileSync12(path);
@@ -16779,7 +16824,7 @@ function collectPublishSet(entriesDir) {
 }
 async function preparePublishMirror(opts) {
   const git = opts.git ?? createGit();
-  if (!existsSync14(opts.mirrorDir)) {
+  if (!existsSync15(opts.mirrorDir)) {
     mkdirSync8(dirname7(opts.mirrorDir), { recursive: true });
     await git.clone(opts.target, opts.mirrorDir);
   } else {
@@ -16952,8 +16997,8 @@ function readExistingMirror(mirrorDir) {
   const readmePath = join13(mirrorDir, "README.md");
   const bundlePath = join13(mirrorDir, BUNDLE_RELPATH);
   return {
-    readme: existsSync14(readmePath) ? readFileSync12(readmePath, "utf-8") : null,
-    bundle: existsSync14(bundlePath) ? readFileSync12(bundlePath) : null
+    readme: existsSync15(readmePath) ? readFileSync12(readmePath, "utf-8") : null,
+    bundle: existsSync15(bundlePath) ? readFileSync12(bundlePath) : null
   };
 }
 async function publishOwn(opts) {
@@ -17244,7 +17289,7 @@ function boundedCount(value) {
 // ../../packages/core/dist/runtimeErrors.js
 import { spawnSync } from "node:child_process";
 import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
-import { closeSync as closeSync2, constants, existsSync as existsSync15, fstatSync, lstatSync, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { closeSync as closeSync2, constants, existsSync as existsSync16, fstatSync, lstatSync, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync8, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as hostArch, homedir as homedir3, platform as hostPlatform } from "node:os";
 import { dirname as dirname8, join as join14 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
@@ -17311,7 +17356,7 @@ function fingerprint(code) {
   return createHash7("sha256").update(`caveat\0${d.component}\0${code}\0${d.template}`).digest("hex");
 }
 function ensureSafeDir(dir, isWin, options2 = {}) {
-  const existed = existsSync15(dir);
+  const existed = existsSync16(dir);
   mkdirSync9(dir, { recursive: true, mode: 448 });
   const s = lstatSync(dir);
   if (!s.isDirectory() || s.isSymbolicLink()) throw Error("store_unsafe");
@@ -17333,9 +17378,11 @@ function canonicalReporting(value) {
 }
 var WINDOWS_ACL_VERIFY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)};$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
 var WINDOWS_ACL_APPLY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)};` + WINDOWS_ACL_VERIFY;
+var WINDOWS_ACL_TIMEOUT_MS = 15e3;
 function runWindowsAcl(path, directory, apply) {
-  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, stdio: "ignore", timeout: 3e3, windowsHide: true });
-  if (result.status !== 0) throw Error("store_unsafe");
+  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
+  if (result.error !== void 0) throw Error(`store_unsafe: powershell spawn ${result.error.code ?? result.error.message}`);
+  if (result.status !== 0) throw Error(`store_unsafe: powershell exit=${result.status} signal=${result.signal ?? "none"} stderr=${(result.stderr ?? "").replace(/\s+/g, " ").trim().slice(0, 400) || "(empty)"}`);
 }
 function secureWindowsAcl(path, runner, directory = false, apply = false) {
   try {
@@ -17351,7 +17398,7 @@ function ensureSafeFile(path, isWin, options2 = {}) {
   const s = lstatSync(path);
   if (!s.isFile() || s.isSymbolicLink()) throw Error("store_unsafe");
   if (isWin) secureWindowsAcl(path, options2.aclRunner);
-  else assertPosix(statSync7(path), 384);
+  else assertPosix(statSync8(path), 384);
 }
 function validate(store) {
   if (!plain(store) || !exact(store, ["schema", "next_sequence", "acknowledged_through", "records"])) throw Error("state_invalid");
@@ -17369,7 +17416,7 @@ function validate(store) {
   }
 }
 function readStore(path, isWin, options2 = {}) {
-  if (!existsSync15(path)) return empty();
+  if (!existsSync16(path)) return empty();
   ensureSafeFile(path, isWin, options2);
   const value = JSON.parse(readFileSync13(path, "utf8"));
   validate(value);
@@ -17387,7 +17434,7 @@ function lock(path, isWin, fn, options2 = {}) {
   }
   if (created) {
     if (isWin) secureWindowsAcl(lockPath2, options2.aclRunner, false, true);
-    else assertPosix(statSync7(lockPath2), 384);
+    else assertPosix(statSync8(lockPath2), 384);
   } else ensureSafeFile(lockPath2, isWin, options2);
   const db = new DatabaseSync3(lockPath2);
   let begun = false;
@@ -17415,7 +17462,7 @@ function writeStore(path, store, isWin, options2 = {}) {
     writeFileSync9(temporary, `${JSON.stringify(store)}
 `, { mode: 384, flag: "wx" });
     if (isWin) secureWindowsAcl(temporary, options2.aclRunner, false, true);
-    else assertPosix(statSync7(temporary), 384);
+    else assertPosix(statSync8(temporary), 384);
     renameSync5(temporary, path);
     ensureSafeFile(path, isWin, options2);
   } finally {
@@ -17592,7 +17639,7 @@ function generateSourceSession(now2 = () => /* @__PURE__ */ new Date()) {
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
@@ -17612,12 +17659,12 @@ ${body}${body ? "\n" : ""}`;
 }
 function writeEntryFile(filePath, content) {
   const dir = dirname9(filePath);
-  if (!existsSync16(dir)) mkdirSync10(dir, { recursive: true });
+  if (!existsSync17(dir)) mkdirSync10(dir, { recursive: true });
   writeFileSync10(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
-import { statSync as statSync8 } from "node:fs";
+import { statSync as statSync9 } from "node:fs";
 import { join as join15 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
@@ -17656,7 +17703,7 @@ function recordEntry(input, opts) {
   const relPath = `${category}/${id}.md`;
   const filePath = join15(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
-  const stat = statSync8(filePath);
+  const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17684,7 +17731,7 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync14, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync14, statSync as statSync10, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join16 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
@@ -17747,7 +17794,7 @@ function updateEntry(id, patch, opts) {
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
   writeFileSync11(filePath, built.content, "utf-8");
-  const stat = statSync9(filePath);
+  const stat = statSync10(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17810,9 +17857,11 @@ export {
   KNOWLEDGE_GITIGNORE,
   initOwnSync,
   AUTO_SYNC_DEBOUNCE_MS,
+  AUTO_SYNC_RECORD_DEBOUNCE_MS,
   CAVEAT_AUTO_SYNC_ENV,
   resetAutoSyncFailureState,
   runAutoSync,
+  triggerAutoSync,
   search,
   get,
   listRecent,
@@ -17872,4 +17921,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-PD5E6TFL.js.map
+//# sourceMappingURL=chunk-7FEOFAMA.js.map