caveat-cli 0.17.2 → 0.17.4

package/dist/{chunk-TRIQ5WFY.js → chunk-ZBHCOA6R.js}

@@ -15233,6 +15233,23 @@ function createKeyserverKeyProvider(opts) {
   };
 }
 
+// ../../packages/core/dist/platform.js
+function isWindows(platform = process.platform) {
+  return platform === "win32";
+}
+function isPrivateOwnerStat(stat, uid, platform = process.platform) {
+  return isWindows(platform) || (stat.mode & 63) === 0 && (uid === void 0 || stat.uid === uid);
+}
+function powershellCallPrefix(platform = process.platform) {
+  return isWindows(platform) ? "& " : "";
+}
+function nodeExecutableNames(platform = process.platform) {
+  return isWindows(platform) ? ["node.exe", "node.cmd", "node.bat", "node"] : ["node"];
+}
+function normalizePathCase(normalizedPath, platform = process.platform) {
+  return isWindows(platform) ? normalizedPath.toLowerCase() : normalizedPath;
+}
+
 // ../../packages/core/dist/sync.js
 import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync7, realpathSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join8, resolve } from "node:path";
@@ -15292,8 +15309,7 @@ var SyncError = class extends Error {
   code;
 };
 function normalizePath(path) {
-  const normalized = resolve(path).replace(/\\/g, "/");
-  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+  return normalizePathCase(resolve(path).replace(/\\/g, "/"));
 }
 async function effectivePushUrls(git) {
   let raw;
@@ -16491,73 +16507,6 @@ function markHit(db, keys, now2 = () => (/* @__PURE__ */ new Date()).toISOString
   }
 }
 
-// ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync7, renameSync as renameSync4, statSync as statSync7, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join11, resolve as resolve3 } from "node:path";
-var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
-var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
-var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
-var fsDependencies = {
-  appendFileSync,
-  chmodSync: chmodSync2,
-  mkdirSync: mkdirSync7,
-  renameSync: renameSync4,
-  statSync: statSync7,
-  unlinkSync: unlinkSync3
-};
-function isMissingPathError(err) {
-  return err instanceof Error && "code" in err && err.code === "ENOENT";
-}
-function chmodExistingFile(path, dependencies) {
-  try {
-    dependencies.chmodSync(path, 384);
-  } catch (err) {
-    if (!isMissingPathError(err)) throw err;
-  }
-}
-function logHookQueryMiss(miss, dependencies = fsDependencies) {
-  if (process.env[CAVEAT_HOOK_QUERY_LOG_ENV] !== "on") return;
-  const metricsDir = join11(resolve3(miss.caveatHome), "metrics");
-  const activePath = join11(metricsDir, "hook-search-misses.jsonl");
-  const backupPath = `${activePath}.1`;
-  const record = JSON.stringify({
-    at: (/* @__PURE__ */ new Date()).toISOString(),
-    agent: miss.agent,
-    surface: miss.surface,
-    query: miss.query.slice(0, HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS)
-  }) + "\n";
-  dependencies.mkdirSync(metricsDir, { recursive: true, mode: 448 });
-  dependencies.chmodSync(metricsDir, 448);
-  chmodExistingFile(activePath, dependencies);
-  chmodExistingFile(backupPath, dependencies);
-  let activeSize = 0;
-  try {
-    activeSize = dependencies.statSync(activePath).size;
-  } catch (err) {
-    if (!isMissingPathError(err)) throw err;
-  }
-  if (activeSize + Buffer.byteLength(record, "utf8") > HOOK_QUERY_LOG_MAX_BYTES) {
-    try {
-      dependencies.unlinkSync(backupPath);
-    } catch (err) {
-      if (!isMissingPathError(err)) throw err;
-    }
-    try {
-      dependencies.renameSync(activePath, backupPath);
-      dependencies.chmodSync(backupPath, 384);
-    } catch (err) {
-      if (!isMissingPathError(err)) throw err;
-    }
-  }
-  dependencies.appendFileSync(activePath, record, { encoding: "utf8", mode: 384 });
-  dependencies.chmodSync(activePath, 384);
-  try {
-    dependencies.chmodSync(backupPath, 384);
-  } catch (err) {
-    if (!isMissingPathError(err)) throw err;
-  }
-}
-
 // ../../packages/core/dist/stale.js
 function listStale(db, opts = {}) {
   const days = opts.days ?? 90;
@@ -16591,7 +16540,7 @@ function listStale(db, opts = {}) {
 // ../../packages/core/dist/publishScan.js
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync14, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join12, basename as basename2 } from "node:path";
+import { join as join11, basename as basename2 } from "node:path";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
 var ALLOW_FILE = ".caveat-publish-allow.json";
 var DIGEST_RE = /^[a-f0-9]{64}$/;
@@ -16820,7 +16769,7 @@ function publishSelfIdentityTokens() {
   return out;
 }
 function loadPublishAllow(knowledgeRepo) {
-  const path = join12(knowledgeRepo, ALLOW_FILE);
+  const path = join11(knowledgeRepo, ALLOW_FILE);
   if (!existsSync14(path)) return /* @__PURE__ */ new Set();
   const parsed = JSON.parse(readFileSync11(path, "utf-8"));
   if (!Array.isArray(parsed.allow)) throw new Error(`${ALLOW_FILE} must contain an "allow" array`);
@@ -16832,7 +16781,7 @@ function savePublishAllow(knowledgeRepo, digests) {
     if (DIGEST_RE.test(digestValue)) existing.add(digestValue);
   }
   const allow = [...existing].sort();
-  writeFileSync7(join12(knowledgeRepo, ALLOW_FILE), `${JSON.stringify({ allow }, null, 2)}
+  writeFileSync7(join11(knowledgeRepo, ALLOW_FILE), `${JSON.stringify({ allow }, null, 2)}
 `, "utf-8");
 }
 var PublishScanError = class extends Error {
@@ -16851,8 +16800,8 @@ var PublishScanError = class extends Error {
 
 // ../../packages/core/dist/publish.js
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname7, join as join13, relative as relative3 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname7, join as join12, relative as relative3 } from "node:path";
 
 // ../../packages/core/dist/visibility.js
 function classifyVisibility(value) {
@@ -16889,7 +16838,7 @@ function collectPublishSet(entriesDir) {
 async function preparePublishMirror(opts) {
   const git = opts.git ?? createGit();
   if (!existsSync15(opts.mirrorDir)) {
-    mkdirSync8(dirname7(opts.mirrorDir), { recursive: true });
+    mkdirSync7(dirname7(opts.mirrorDir), { recursive: true });
     await git.clone(opts.target, opts.mirrorDir);
   } else {
     const mirrorGit2 = createGit(opts.mirrorDir);
@@ -16941,17 +16890,17 @@ function buildSealedReadme(fileCount, files) {
 function writeSealedMirror(opts) {
   for (const item of readdirSync8(opts.mirrorDir, { withFileTypes: true })) {
     if (item.name === ".git") continue;
-    rmSync5(join13(opts.mirrorDir, item.name), { recursive: true, force: true });
+    rmSync5(join12(opts.mirrorDir, item.name), { recursive: true, force: true });
   }
-  const bundlePath = join13(opts.mirrorDir, BUNDLE_RELPATH);
-  mkdirSync8(dirname7(bundlePath), { recursive: true });
-  writeFileSync8(join13(opts.mirrorDir, "README.md"), opts.readme, "utf-8");
+  const bundlePath = join12(opts.mirrorDir, BUNDLE_RELPATH);
+  mkdirSync7(dirname7(bundlePath), { recursive: true });
+  writeFileSync8(join12(opts.mirrorDir, "README.md"), opts.readme, "utf-8");
   writeFileSync8(bundlePath, opts.bundle);
 }
 function* walkAllFiles(root) {
   for (const item of readdirSync8(root, { withFileTypes: true })) {
     if (item.name === ".git") continue;
-    const full = join13(root, item.name);
+    const full = join12(root, item.name);
     if (item.isDirectory()) yield* walkAllFiles(full);
     else yield full;
   }
@@ -16963,11 +16912,11 @@ function verifySealedMirror(opts) {
     throw new Error(`publish mirror verification failed:
 unexpected sealed mirror tree: ${files.join(", ") || "(empty)"}`);
   }
-  const diskReadme = readFileSync12(join13(opts.mirrorDir, "README.md"), "utf-8");
+  const diskReadme = readFileSync12(join12(opts.mirrorDir, "README.md"), "utf-8");
   if (diskReadme !== opts.readme) {
     throw new Error("publish mirror verification failed: README.md content changed after generation");
   }
-  const diskBundle = readFileSync12(join13(opts.mirrorDir, BUNDLE_RELPATH));
+  const diskBundle = readFileSync12(join12(opts.mirrorDir, BUNDLE_RELPATH));
   if (!diskBundle.equals(opts.bundle)) {
     throw new Error("publish mirror verification failed: sealed bundle bytes changed after generation");
   }
@@ -17058,8 +17007,8 @@ async function commitSealedMirror(opts) {
   await opts.git.raw(["gc", "--prune=now"]).catch(() => "");
 }
 function readExistingMirror(mirrorDir) {
-  const readmePath = join13(mirrorDir, "README.md");
-  const bundlePath = join13(mirrorDir, BUNDLE_RELPATH);
+  const readmePath = join12(mirrorDir, "README.md");
+  const bundlePath = join12(mirrorDir, BUNDLE_RELPATH);
   return {
     readme: existsSync15(readmePath) ? readFileSync12(readmePath, "utf-8") : null,
     bundle: existsSync15(bundlePath) ? readFileSync12(bundlePath) : null
@@ -17353,9 +17302,9 @@ function boundedCount(value) {
 // ../../packages/core/dist/runtimeErrors.js
 import { spawnSync } from "node:child_process";
 import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
-import { closeSync as closeSync2, constants, existsSync as existsSync16, fstatSync, lstatSync, mkdirSync as mkdirSync9, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync5, rmSync as rmSync6, statSync as statSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { closeSync as closeSync2, constants, existsSync as existsSync16, fstatSync, lstatSync, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as hostArch, homedir as homedir3, platform as hostPlatform } from "node:os";
-import { dirname as dirname8, join as join14 } from "node:path";
+import { dirname as dirname8, join as join13 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 var RUNTIME_ERRORS_SCHEMA = "caveat.runtime_errors.v1";
 var STATE_VERSION = "1.0";
@@ -17380,14 +17329,14 @@ var validTime = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) &
 var validVersion = (v) => typeof v === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
 var validOs = (v) => typeof v === "string" && ["darwin", "linux", "windows"].includes(v);
 var validArch = (v) => typeof v === "string" && ["x64", "arm64", "arm", "ia32"].includes(v);
-var windows = (env) => env.OS === "Windows_NT" || hostPlatform() === "win32";
+var windows = (env) => env.OS === "Windows_NT" || isWindows(hostPlatform());
 function defaultFactoryReporterConfigPath(env = process.env) {
   const home = env.HOME || env.USERPROFILE || homedir3();
-  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "dotagents", "factory-reporter", "config.json") : join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "dotagents", "factory-reporter.json");
+  return windows(env) ? join13(env.LOCALAPPDATA || join13(home, "AppData", "Local"), "dotagents", "factory-reporter", "config.json") : join13(env.XDG_CONFIG_HOME || join13(home, ".config"), "dotagents", "factory-reporter.json");
 }
 function runtimeErrorsStatePath(env = process.env) {
   const home = env.HOME || env.USERPROFILE || homedir3();
-  return windows(env) ? join14(env.LOCALAPPDATA || join14(home, "AppData", "Local"), "caveat", "runtime-errors.json") : join14(env.XDG_STATE_HOME || join14(home, ".local", "state"), "caveat", "runtime-errors.json");
+  return windows(env) ? join13(env.LOCALAPPDATA || join13(home, "AppData", "Local"), "caveat", "runtime-errors.json") : join13(env.XDG_STATE_HOME || join13(home, ".local", "state"), "caveat", "runtime-errors.json");
 }
 function collectionEnabled(options2 = {}) {
   const env = options2.env ?? process.env;
@@ -17421,7 +17370,7 @@ function fingerprint(code) {
 }
 function ensureSafeDir(dir, isWin, options2 = {}) {
   const existed = existsSync16(dir);
-  mkdirSync9(dir, { recursive: true, mode: 448 });
+  mkdirSync8(dir, { recursive: true, mode: 448 });
   const s = lstatSync(dir);
   if (!s.isDirectory() || s.isSymbolicLink()) throw Error("store_unsafe");
   if (isWin) secureWindowsAcl(dir, options2.aclRunner, true, !existed);
@@ -17442,9 +17391,9 @@ function canonicalReporting(value) {
 }
 var WINDOWS_ACL_VERIFY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)};$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
 var WINDOWS_ACL_APPLY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)};` + WINDOWS_ACL_VERIFY;
-var WINDOWS_ACL_TIMEOUT_MS = 15e3;
+var WINDOWS_ACL_TIMEOUT_MS = 3e4;
 function runWindowsAcl(path, directory, apply) {
-  const result = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
+  const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
   if (result.error !== void 0) throw Error(`store_unsafe: powershell spawn ${result.error.code ?? result.error.message}`);
   if (result.status !== 0) throw Error(`store_unsafe: powershell exit=${result.status} signal=${result.signal ?? "none"} stderr=${(result.stderr ?? "").replace(/\s+/g, " ").trim().slice(0, 400) || "(empty)"}`);
 }
@@ -17462,7 +17411,7 @@ function ensureSafeFile(path, isWin, options2 = {}) {
   const s = lstatSync(path);
   if (!s.isFile() || s.isSymbolicLink()) throw Error("store_unsafe");
   if (isWin) secureWindowsAcl(path, options2.aclRunner);
-  else assertPosix(statSync8(path), 384);
+  else assertPosix(statSync7(path), 384);
 }
 function validate(store) {
   if (!plain(store) || !exact(store, ["schema", "next_sequence", "acknowledged_through", "records"])) throw Error("state_invalid");
@@ -17498,7 +17447,7 @@ function lock(path, isWin, fn, options2 = {}) {
   }
   if (created) {
     if (isWin) secureWindowsAcl(lockPath2, options2.aclRunner, false, true);
-    else assertPosix(statSync8(lockPath2), 384);
+    else assertPosix(statSync7(lockPath2), 384);
   } else ensureSafeFile(lockPath2, isWin, options2);
   const db = new DatabaseSync3(lockPath2);
   let begun = false;
@@ -17521,13 +17470,13 @@ function lock(path, isWin, fn, options2 = {}) {
 function writeStore(path, store, isWin, options2 = {}) {
   validate(store);
   ensureSafeDir(dirname8(path), isWin, options2);
-  const temporary = join14(dirname8(path), `.runtime-errors-${process.pid}-${randomBytes3(6).toString("hex")}`);
+  const temporary = join13(dirname8(path), `.runtime-errors-${process.pid}-${randomBytes3(6).toString("hex")}`);
   try {
     writeFileSync9(temporary, `${JSON.stringify(store)}
 `, { mode: 384, flag: "wx" });
     if (isWin) secureWindowsAcl(temporary, options2.aclRunner, false, true);
-    else assertPosix(statSync8(temporary), 384);
-    renameSync5(temporary, path);
+    else assertPosix(statSync7(temporary), 384);
+    renameSync4(temporary, path);
     ensureSafeFile(path, isWin, options2);
   } finally {
     rmSync6(temporary, { force: true });
@@ -17703,7 +17652,7 @@ function generateSourceSession(now2 = () => /* @__PURE__ */ new Date()) {
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
@@ -17723,13 +17672,13 @@ ${body}${body ? "\n" : ""}`;
 }
 function writeEntryFile(filePath, content) {
   const dir = dirname9(filePath);
-  if (!existsSync17(dir)) mkdirSync10(dir, { recursive: true });
+  if (!existsSync17(dir)) mkdirSync9(dir, { recursive: true });
   writeFileSync10(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
-import { statSync as statSync9 } from "node:fs";
-import { join as join15 } from "node:path";
+import { statSync as statSync8 } from "node:fs";
+import { join as join14 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
   const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -17765,9 +17714,9 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join15(opts.entriesRoot, relPath);
+  const filePath = join14(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
-  const stat = statSync9(filePath);
+  const stat = statSync8(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17795,8 +17744,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync14, statSync as statSync10, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync14, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join15 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -17815,7 +17764,7 @@ function updateEntry(id, patch, opts) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join16(opts.entriesRoot, relPath);
+  const filePath = join15(opts.entriesRoot, relPath);
   const raw = readFileSync14(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
@@ -17858,7 +17807,7 @@ function updateEntry(id, patch, opts) {
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
   writeFileSync11(filePath, built.content, "utf-8");
-  const stat = statSync10(filePath);
+  const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
     source,
@@ -17881,6 +17830,73 @@ function formatYmd2(d) {
   return `${yyyy}-${mm}-${dd}`;
 }
 
+// ../../packages/core/dist/hookQueryLog.js
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync10, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join16, resolve as resolve3 } from "node:path";
+var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
+var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
+var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
+var fsDependencies = {
+  appendFileSync,
+  chmodSync: chmodSync2,
+  mkdirSync: mkdirSync10,
+  renameSync: renameSync5,
+  statSync: statSync10,
+  unlinkSync: unlinkSync3
+};
+function isMissingPathError(err) {
+  return err instanceof Error && "code" in err && err.code === "ENOENT";
+}
+function chmodExistingFile(path, dependencies) {
+  try {
+    dependencies.chmodSync(path, 384);
+  } catch (err) {
+    if (!isMissingPathError(err)) throw err;
+  }
+}
+function logHookQueryMiss(miss, dependencies = fsDependencies) {
+  if (process.env[CAVEAT_HOOK_QUERY_LOG_ENV] !== "on") return;
+  const metricsDir = join16(resolve3(miss.caveatHome), "metrics");
+  const activePath = join16(metricsDir, "hook-search-misses.jsonl");
+  const backupPath = `${activePath}.1`;
+  const record = JSON.stringify({
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    agent: miss.agent,
+    surface: miss.surface,
+    query: miss.query.slice(0, HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS)
+  }) + "\n";
+  dependencies.mkdirSync(metricsDir, { recursive: true, mode: 448 });
+  dependencies.chmodSync(metricsDir, 448);
+  chmodExistingFile(activePath, dependencies);
+  chmodExistingFile(backupPath, dependencies);
+  let activeSize = 0;
+  try {
+    activeSize = dependencies.statSync(activePath).size;
+  } catch (err) {
+    if (!isMissingPathError(err)) throw err;
+  }
+  if (activeSize + Buffer.byteLength(record, "utf8") > HOOK_QUERY_LOG_MAX_BYTES) {
+    try {
+      dependencies.unlinkSync(backupPath);
+    } catch (err) {
+      if (!isMissingPathError(err)) throw err;
+    }
+    try {
+      dependencies.renameSync(activePath, backupPath);
+      dependencies.chmodSync(backupPath, 384);
+    } catch (err) {
+      if (!isMissingPathError(err)) throw err;
+    }
+  }
+  dependencies.appendFileSync(activePath, record, { encoding: "utf8", mode: 384 });
+  dependencies.chmodSync(activePath, 384);
+  try {
+    dependencies.chmodSync(backupPath, 384);
+  } catch (err) {
+    if (!isMissingPathError(err)) throw err;
+  }
+}
+
 // ../../packages/core/dist/proposalEval.js
 import { createHash as createHash8 } from "node:crypto";
 import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "node:path";
@@ -17916,6 +17932,10 @@ export {
   maybeSweepPendingDirs,
   drainPendingRemindersDetailed,
   createKeyserverKeyProvider,
+  isWindows,
+  isPrivateOwnerStat,
+  powershellCallPrefix,
+  nodeExecutableNames,
   SyncError,
   syncOwn,
   KNOWLEDGE_GITIGNORE,
@@ -17985,4 +18005,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-TRIQ5WFY.js.map
+//# sourceMappingURL=chunk-ZBHCOA6R.js.map