caveat-cli 0.17.8 → 0.19.0

package/README.md

@@ -1,47 +1,72 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/kitepon-rgb/Caveat/main/.github/og.png" alt="Caveat — long-term memory layer for coding agents" width="100%">
+  <img src="https://raw.githubusercontent.com/kitepon/Caveat/main/.github/og.png" alt="Caveat — long-term memory layer for coding agents" width="100%">
 </p>
 
 # Caveat
 
 [![npm](https://img.shields.io/npm/v/caveat-cli?color=cb3837&label=caveat-cli)](https://www.npmjs.com/package/caveat-cli)
-[![CI](https://github.com/kitepon-rgb/Caveat/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon-rgb/Caveat/actions/workflows/ci.yml)
-[![license](https://img.shields.io/npm/l/caveat-cli?color=blue)](https://github.com/kitepon-rgb/Caveat/blob/main/LICENSE)
+[![CI](https://github.com/kitepon/Caveat/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon/Caveat/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/caveat-cli?color=blue)](https://github.com/kitepon/Caveat/blob/main/LICENSE)
 
-> **Stop rediscovering the same trap.** Caveat is a long-term memory layer for Claude Code and Codex: record a hard-won external-spec quirk or repo-specific oddity once, and the relevant note surfaces before an AI repeats it.
+> **Stop rediscovering the same trap.** Caveat is a long-term memory layer for Claude Code, Codex, and Cursor: record a hard-won external-spec quirk or repo-specific oddity once, and the relevant note surfaces before an AI repeats it.
 
-🇯🇵 **日本語版**: [README.ja.md](https://github.com/kitepon-rgb/Caveat/blob/main/README.ja.md)
+🇯🇵 **日本語版**: [README.ja.md](https://github.com/kitepon/Caveat/blob/main/README.ja.md)
 
 Built and maintained by [Quo](https://x.com/QLyun35332) at [kitepon.dev](https://kitepon.dev/en).
 
-**Source / full docs**: [github.com/kitepon-rgb/Caveat](https://github.com/kitepon-rgb/Caveat)
+**Source / full docs**: [github.com/kitepon/Caveat](https://github.com/kitepon/Caveat)
 
 ## Install
 
 ```sh
 npm install -g caveat-cli
-caveat init                          # Claude Code MCP + hooks
-caveat codex-hook install            # optional: native Codex hooks
+caveat init                          # state + available Claude/Codex/Cursor integrations
 ```
 
 On macOS with Homebrew Node, Caveat installs hook commands through the stable
 `/opt/homebrew/bin/node` symlink when it points at the current Node binary. This
-keeps Claude Code and Codex hooks working after Homebrew moves Node between
+keeps Claude Code, Codex, and Cursor hooks working after Homebrew moves Node between
 `/opt/homebrew/Cellar/node/<version>/...` directories.
 
-`caveat init` (idempotent, `--dry-run` supported) does the Claude Code setup:
+`caveat init` (idempotent, `--dry-run` supported) does the product setup:
 
 1. Scaffolds `~/.caveat/own/` (your personal knowledge repo) + `~/.caveat/index/caveat.db`
-2. Registers the MCP server with Claude Code (`claude mcp add --scope user`)
+2. Claudeのuser設定へMCPを登録し、既存の環境変数と他の登録を保持
 3. Merges `UserPromptSubmit` / `PostToolUse` / `PostToolUseFailure` / `Stop` hooks into `~/.claude/settings.json` (existing entries preserved, backup written before any change)
+4. Installs product-owned Codex and Cursor hooks when those hosts are available
+
+同じ`init`がCodex・Grok・CursorへもMCPを登録します。CodexはCLIまたは設定ディレクトリ、Grok・Cursorは
+設定ディレクトリの存在で導入対象を決めます。`CODEX_HOME` / `GROK_HOME` / `CURSOR_HOME` /
+`CLAUDE_CONFIG_DIR`を尊重し、既存の環境変数・timeout・無効化指定・他の登録を保持します。
+設定変更前のバックアップと読戻しを行い、MCP登録失敗は非0終了します。
+`--skip-codex-hook` / `--skip-cursor-hook`はhookだけを省略します。
+
+private remoteの初期化・同期は`caveat init --sync --yes`で完結します。端末でも質問を挟まず、
+公開ミラーは明示しなければ変更しません。新規remoteの作成には認証済みの`gh`が必要です。
+It uses the account already authenticated in `gh`, is idempotent, and exits
+non-zero if the explicitly requested sync fails. Callers do not inspect product
+state or run separate Caveat hook installers around this entry.
 
 Opt-out: `--skip-claude`. `caveat uninstall` reverses the Claude Code changes without touching `~/.caveat/`. **No central DB is auto-subscribed** — add knowledge sources explicitly with `caveat community add`.
 
-For Codex, run `caveat codex-hook diagnostics` first if you want a health check,
+For a targeted Codex repair, run `caveat codex-hook diagnostics` first,
 then `caveat codex-hook install`. It registers Caveat-owned
 `UserPromptSubmit`, `PostToolUse`, and `Stop` entries in `~/.codex/hooks.json`
 and enables Codex's native hook runtime.
 
+For a targeted Cursor repair, run `caveat cursor-hook install`. It upserts Caveat-owned
+`beforeSubmitPrompt`, `postToolUse`, `postToolUseFailure`, and `stop` entries
+in `~/.cursor/hooks.json` while preserving unrelated hooks. Use
+`caveat cursor-hook diagnostics` to inspect the installed contract.
+
+Automation uses the aggregate product contract instead:
+`caveat factory-diagnostics --json --require-connector cursor`. Its versioned
+schema, top-level `overall.status`, and exit status are the complete gate. The
+output also exposes `connectors.cursor.compatibility_status` for diagnosis,
+but callers do not duplicate Caveat's Cursor event set, command rules, or
+timeout checks. Without `--require-connector cursor`, the v1 aggregate keeps
+its existing Claude/Codex readiness semantics.
+
 With either host enabled, Caveat surfaces matching entries at three moments:
 before prompts, after failed tools, and after struggle-heavy sessions. Stop
 reminders are queued for the next context-capable hook tick so the agent's final
@@ -60,29 +85,38 @@ caveat pull                         # community pull + re-index everything
 caveat serve                        # http://localhost:4242 read-only portal
 caveat uninstall                    # reverse `caveat init` Claude integration
 caveat codex-hook diagnostics       # inspect Codex hook availability/install state
+caveat factory-diagnostics --json --require-connector cursor
+                                    # machine gate for a host that requires Cursor
 ```
 
-## Sharing with a team
-
-There is no `caveat push` (since v0.7). To share with teammates, use plain git:
+## Sharing: two boundaries, two commands
 
-1. Create a GitHub repo (private or public), e.g. `acme-corp/caveats`, with an `entries/` directory.
-2. Either point your `knowledgeRepo` at that repo (write directly to it) or copy shareable entries into it by hand. Then `git push` as usual.
-3. Each teammate runs `caveat community add https://github.com/acme-corp/caveats` once, and `caveat pull` to refresh.
+- `caveat sync` synchronizes both private and public entries to an authenticated,
+  non-anonymously-readable private remote owned by you or your group.
+- `caveat publish` writes only public entries to a separate public mirror. It
+  publishes a deterministic AES-256-GCM sealed bundle plus README metadata;
+  subscribers decrypt in-process with the configured keyserver.
 
-Trust is defined socially — by who has write access to your group repo — instead of by automated content gates on stranger PRs.
+The publish scan fails closed if private content, an invalid destination, or
+missing keyserver configuration is detected. Trust in a private source is still
+social — subscribers choose which repository owners to trust.
 
 ## MCP tools (6)
 
-Exposed to Claude Code via the MCP server that `caveat init` registers:
+`caveat init`が登録するMCPを通じて、Claude Code・Codex・Grok・Cursorから利用できます。
 
 `caveat_search`, `caveat_get`, `caveat_record`, `caveat_update`, `caveat_list_recent`, `caveat_pull`.
 
-Claude can autonomously pull subscribed-repo updates (safe, idempotent). Recording / updating writes to your local `~/.caveat/own/` only — sharing is done by you via `git push` to your group repo.
+Claude can autonomously pull subscribed-repo updates (safe, idempotent).
+Recording and updating writes locally; use `caveat sync` for the private
+ownership boundary and `caveat publish` for the public sealed boundary.
 
-Codex uses native hooks rather than MCP for automatic surfacing. The optional
-`codex-sidecar` commands remain available for bounded second opinions, review,
-risk-check, and isolated work.
+Codex and Cursor use native hooks rather than MCP for automatic surfacing. A
+native reminder inspects an entry with
+`caveat show <id> --source <source>`, then updates or creates Markdown in the
+own knowledge repo and runs `caveat index`. Community entries are subscriptions
+and are not edited locally. The optional `codex-sidecar` commands remain
+available for bounded second opinions, review, risk-check, and isolated work.
 
 ## Pointing at a different knowledge repo
 
@@ -92,21 +126,38 @@ If you want `~/.caveat/own/` to live elsewhere (e.g. a git-tracked directory you
 { "knowledgeRepo": "/absolute/path/to/your/caveats-repo" }
 ```
 
+## Runtime error diagnostics (explicit opt-in)
+
+Local runtime error collection is disabled by default. Enable it in the same
+`~/.caveatrc.json` file while preserving any existing keys:
+
+```json
+{ "runtimeErrors": true }
+```
+
+Use `caveat runtime-errors diagnostics --json` and
+`caveat runtime-errors snapshot --json` to inspect it. The lifecycle commands
+are `ack <cursor>`, `resolve <fingerprint>`, `reopen <fingerprint>`, and
+`compact`; each requires `--json`. A missing key or any value other than the
+boolean `true` keeps collection disabled. Runtime state lives under Caveat's
+own state directory, independently of the knowledge index and host hook files.
+
 ## Requirements
 
 - Node 22.5+ (for built-in `node:sqlite`)
+- WindowsではPowerShell 7（`pwsh.exe`）を使います。エラー収集用ストレージのACL処理も同じ入口です。
 - `git` for `caveat community add` / `caveat community pull`
 - Claude Code installed if you want Claude MCP / hooks integration. Without it, `caveat init --skip-claude` still provisions local state.
 - Codex installed if you want native Codex hooks via `caveat codex-hook install`.
+- Cursor installed if you want native Cursor hooks via `caveat cursor-hook install`.
 
 Release install smoke:
 
 ```sh
-npm uninstall -g caveat-cli
-npm install -g caveat-cli
+npm install -g caveat-cli@latest
 caveat --version
-caveat init
-caveat codex-hook install
+caveat init --sync --yes
+caveat factory-diagnostics --json --require-connector cursor
 ```
 
 ## License

package/dist/{chunk-ZBHCOA6R.js → chunk-ULK7SZG6.js}

@@ -5122,10 +5122,10 @@ var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports2, module2) {
     "use strict";
     var parse2 = require_parse2();
-    var constants2 = require_constants();
+    var constants = require_constants();
     var SemVer = require_semver();
     var truncate2 = (version, truncation, options2) => {
-      if (!constants2.RELEASE_TYPES.includes(truncation)) {
+      if (!constants.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
       const clonedVersion = cloneInputVersion(version, options2);
@@ -6174,7 +6174,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/index.js"(exports2, module2) {
     "use strict";
     var internalRe = require_re();
-    var constants2 = require_constants();
+    var constants = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse2 = require_parse2();
@@ -6258,8 +6258,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants2.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -15237,6 +15237,9 @@ function createKeyserverKeyProvider(opts) {
 function isWindows(platform = process.platform) {
   return platform === "win32";
 }
+function isWindowsEnv(env, platform = process.platform) {
+  return env.OS === "Windows_NT" || isWindows(platform);
+}
 function isPrivateOwnerStat(stat, uid, platform = process.platform) {
   return isWindows(platform) || (stat.mode & 63) === 0 && (uid === void 0 || stat.uid === uid);
 }
@@ -15251,7 +15254,7 @@ function normalizePathCase(normalizedPath, platform = process.platform) {
 }
 
 // ../../packages/core/dist/sync.js
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync7, realpathSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, readdirSync as readdirSync7, realpathSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join8, resolve } from "node:path";
 
 // ../../packages/core/dist/remoteVisibility.js
@@ -15459,6 +15462,12 @@ function scaffold(ownDir) {
   const gitignore = join8(ownDir, ".gitignore");
   if (!existsSync8(gitignore)) writeFileSync4(gitignore, KNOWLEDGE_GITIGNORE, "utf-8");
 }
+function removeCanonicalScaffoldBeforeCheckout(ownDir) {
+  const gitignore = join8(ownDir, ".gitignore");
+  if (existsSync8(gitignore) && readFileSync7(gitignore, "utf-8") === KNOWLEDGE_GITIGNORE) {
+    rmSync4(gitignore);
+  }
+}
 async function defaultRemoteBranch(git, url) {
   const symref = await git.raw(["ls-remote", "--symref", url, "HEAD"]);
   const match = /^ref: refs\/heads\/([^\s]+)\s+HEAD$/m.exec(symref);
@@ -15498,6 +15507,7 @@ async function initOwnSync(opts) {
     }
     const branch = await defaultRemoteBranch(git, opts.url);
     await git.fetch("origin", branch);
+    removeCanonicalScaffoldBeforeCheckout(ownDir);
     await git.checkout(["--track", "-B", branch, `origin/${branch}`]);
     await reindexAndMark(opts);
     return { ownDir, branch, remoteWasEmpty: false };
@@ -15516,7 +15526,7 @@ function errorMessage2(err) {
 // ../../packages/core/dist/autoSync.js
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname5, join as join9 } from "node:path";
 var AUTO_SYNC_DEBOUNCE_MS = 15 * 60 * 1e3;
 var AUTO_SYNC_RECORD_DEBOUNCE_MS = 60 * 1e3;
@@ -15536,7 +15546,7 @@ function autoSyncLockPath(caveatHome) {
 }
 function readAutoSyncState(caveatHome) {
   try {
-    const value = JSON.parse(readFileSync7(autoSyncStatePath(caveatHome), "utf-8"));
+    const value = JSON.parse(readFileSync8(autoSyncStatePath(caveatHome), "utf-8"));
     if (!isAutoSyncState(value)) return null;
     return value;
   } catch {
@@ -15888,16 +15898,17 @@ function resolvePaths(caveatHome, knowledgeRepo, userHome) {
 }
 
 // ../../packages/core/dist/config.js
-import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
 var DEFAULT_CONFIG = {
   knowledgeRepo: "own",
   semverKeys: ["driver", "cuda", "node"],
   publishTarget: null,
   sealedKeyId: "v1",
-  sealedKeyserverUrl: null
+  sealedKeyserverUrl: null,
+  runtimeErrors: false
 };
 function loadConfig(userConfigPath) {
-  const userCfg = existsSync11(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
+  const userCfg = existsSync11(userConfigPath) ? JSON.parse(readFileSync9(userConfigPath, "utf-8")) : {};
   return deepMerge(DEFAULT_CONFIG, userCfg);
 }
 function ensureUserConfig(userConfigPath) {
@@ -15906,7 +15917,7 @@ function ensureUserConfig(userConfigPath) {
   }
 }
 function writeUserConfigPatch(userConfigPath, patch) {
-  const existing = existsSync11(userConfigPath) ? JSON.parse(readFileSync8(userConfigPath, "utf-8")) : {};
+  const existing = existsSync11(userConfigPath) ? JSON.parse(readFileSync9(userConfigPath, "utf-8")) : {};
   writeFileSync6(userConfigPath, `${JSON.stringify({ ...existing, ...patch }, null, 2)}
 `, "utf-8");
 }
@@ -16125,7 +16136,19 @@ function reminderSymptomLine(symptomExcerpt) {
   const excerpt2 = sanitizeReminderDisplay(symptomExcerpt, SYMPTOM_LINE_MAX);
   return excerpt2 ? `   \u75C7\u72B6: ${excerpt2}` : null;
 }
-function toolErrorReminderText(hits) {
+function detailGuidance(surface) {
+  if (surface === "native-cli") {
+    return "\u8A73\u7D30\u306F `caveat show <id> --source <source>` \u3067\u53D6\u5F97\u3057\u3001documented \u306A\u5BFE\u51E6\u3068 environment \u304C\u4E00\u81F4\u3059\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304B\u3089\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002";
+  }
+  return "mcp__caveat__caveat_get \u3067\u8A73\u7D30\u3092\u78BA\u8A8D\u3057\u3001documented \u306A\u5BFE\u51E6\u304C\u3042\u308C\u3070\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002";
+}
+function promptDetailGuidance(surface) {
+  if (surface === "native-cli") {
+    return "\u8A73\u7D30\u306F `caveat show <id> --source <source>` \u3067\u53D6\u5F97\u3002environment \u304C\u4E00\u81F4\u3059\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304B\u3089\u9069\u7528\u5224\u65AD\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002";
+  }
+  return "\u8A73\u7D30\u306F mcp__caveat__caveat_get \u306B id + source \u3092\u6E21\u3057\u3066\u53D6\u5F97\u3002environment \u304C\u4E00\u81F4\u3059\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304B\u3089\u9069\u7528\u5224\u65AD\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002";
+}
+function toolErrorReminderText(hits, actionSurface = "claude-mcp") {
   const lines = [];
   lines.push(
     `[caveat] \u76F4\u524D\u306E\u30A8\u30E9\u30FC\u306B\u4E00\u81F4\u3059\u308B\u53EF\u80FD\u6027\u306E\u3042\u308B\u65E2\u77E5\u306E\u7F60\u304C ${hits.length} \u4EF6\u3042\u308A\u307E\u3059:`
@@ -16137,12 +16160,10 @@ function toolErrorReminderText(hits) {
     if (symptomLine) lines.push(symptomLine);
   });
   lines.push("");
-  lines.push(
-    "mcp__caveat__caveat_get \u3067\u8A73\u7D30\u3092\u78BA\u8A8D\u3057\u3001documented \u306A\u5BFE\u51E6\u304C\u3042\u308C\u3070\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002"
-  );
+  lines.push(detailGuidance(actionSurface));
   return lines.join("\n");
 }
-function userPromptSubmitReminderText(hits) {
+function userPromptSubmitReminderText(hits, actionSurface = "claude-mcp") {
   const lines = [];
   lines.push(
     `[caveat] \u3053\u306E\u30D7\u30ED\u30F3\u30D7\u30C8\u306B\u95A2\u9023\u3059\u308B\u53EF\u80FD\u6027\u306E\u3042\u308B\u65E2\u77E5\u306E\u7F60\u304C ${hits.length} \u4EF6\u3042\u308A\u307E\u3059:`
@@ -16154,16 +16175,14 @@ function userPromptSubmitReminderText(hits) {
     if (symptomLine) lines.push(symptomLine);
   });
   lines.push("");
-  lines.push(
-    "\u8A73\u7D30\u306F mcp__caveat__caveat_get \u306B id + source \u3092\u6E21\u3057\u3066\u53D6\u5F97\u3002environment \u304C\u4E00\u81F4\u3059\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304B\u3089\u9069\u7528\u5224\u65AD\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002"
-  );
+  lines.push(promptDetailGuidance(actionSurface));
   return lines.join("\n");
 }
 function shortPath(p2) {
   const parts = p2.split(/[\\/]/);
   return parts[parts.length - 1] ?? p2;
 }
-function stopReminderText(signals, related) {
+function stopReminderText(signals, related, actionSurface = "claude-mcp") {
   const lines = [];
   lines.push("[caveat] \u3053\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u3067\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u5F53\u305F\u3063\u305F\u53EF\u80FD\u6027\u3092\u793A\u3059\u30B7\u30B0\u30CA\u30EB:");
   if (signals.toolFailureCount > 0) {
@@ -16193,29 +16212,21 @@ function stopReminderText(signals, related) {
   );
   lines.push("");
   if (related.length > 0) {
-    lines.push(
-      `\u30BB\u30C3\u30B7\u30E7\u30F3\u5185\u5BB9\u3068\u5171\u8D77\u3059\u308B\u65E2\u5B58\u7F60 ${related.length} \u4EF6\uFF08\u95A2\u9023\u304C\u3042\u308C\u3070 mcp__caveat__caveat_update \u3067 last_verified \u3092\u66F4\u65B0 or \u8FFD\u8A18\uFF09:`
-    );
+    lines.push(actionSurface === "native-cli" ? `\u30BB\u30C3\u30B7\u30E7\u30F3\u5185\u5BB9\u3068\u5171\u8D77\u3059\u308B\u65E2\u5B58\u7F60 ${related.length} \u4EF6\uFF08\u8A73\u7D30\u306F \`caveat show <id> --source <source>\` \u3067\u78BA\u8A8D\uFF09:` : `\u30BB\u30C3\u30B7\u30E7\u30F3\u5185\u5BB9\u3068\u5171\u8D77\u3059\u308B\u65E2\u5B58\u7F60 ${related.length} \u4EF6\uFF08\u95A2\u9023\u304C\u3042\u308C\u3070 mcp__caveat__caveat_update \u3067 last_verified \u3092\u66F4\u65B0 or \u8FFD\u8A18\uFF09:`);
     related.forEach((h2, i2) => {
       lines.push(reminderHitLine(h2, i2));
     });
     lines.push("");
-    lines.push(
-      "\u4E0A\u8A18\u3068\u7570\u306A\u308B\u65B0\u898F\u306E\u7F60\u3092\u8E0F\u3093\u3067\u3044\u305F\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible\uFF08\u73FE\u72B6\u306E\u5236\u7D04\u3067\u306F\u4E0D\u53EF\u80FD\u3068\u5224\u5B9A\u3057\u305F\u7D50\u8AD6\uFF09\u3082\u8A18\u9332\u5BFE\u8C61\u3002"
-    );
+    lines.push(actionSurface === "native-cli" ? "\u95A2\u9023\u3059\u308B own \u30A8\u30F3\u30C8\u30EA\u306F `caveat show <id> --source own` \u304C\u793A\u3059 path \u306E Markdown\u3067 last_verified \u3084\u672C\u6587\u3092\u66F4\u65B0\u3057\u3001`caveat index` \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002community \u30A8\u30F3\u30C8\u30EA\u306F\u8CFC\u8AAD\u7269\u306A\u306E\u3067\u76F4\u63A5\u7DE8\u96C6\u3057\u307E\u305B\u3093\u3002\u4E0A\u8A18\u3068\u7570\u306A\u308B\u65B0\u898F\u306E\u7F60\u306F Caveat \u306E own knowledge repo \u3078 Markdown \u3067\u8A18\u9332\u3057\u3001`caveat index` \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible\uFF08\u73FE\u72B6\u306E\u5236\u7D04\u3067\u306F\u4E0D\u53EF\u80FD\u3068\u5224\u5B9A\u3057\u305F\u7D50\u8AD6\uFF09\u3082\u8A18\u9332\u5BFE\u8C61\u3002" : "\u4E0A\u8A18\u3068\u7570\u306A\u308B\u65B0\u898F\u306E\u7F60\u3092\u8E0F\u3093\u3067\u3044\u305F\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible\uFF08\u73FE\u72B6\u306E\u5236\u7D04\u3067\u306F\u4E0D\u53EF\u80FD\u3068\u5224\u5B9A\u3057\u305F\u7D50\u8AD6\uFF09\u3082\u8A18\u9332\u5BFE\u8C61\u3002");
   } else {
-    lines.push(
-      "\u65E2\u5B58\u7F60\u306B\u8A72\u5F53\u306A\u3057\u3002\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u82E6\u6226\u3057\u3066\u3044\u305F\u306A\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible \u3082\u8A18\u9332\u5BFE\u8C61\u3002"
-    );
+    lines.push(actionSurface === "native-cli" ? "\u65E2\u5B58\u7F60\u306B\u8A72\u5F53\u306A\u3057\u3002\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u82E6\u6226\u3057\u3066\u3044\u305F\u306A\u3089 Caveat \u306E own knowledge repo \u3078 Markdown \u3067\u8A18\u9332\u3057\u3001`caveat index` \u3092\u5B9F\u884C\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible \u3082\u8A18\u9332\u5BFE\u8C61\u3002" : "\u65E2\u5B58\u7F60\u306B\u8A72\u5F53\u306A\u3057\u3002\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u82E6\u6226\u3057\u3066\u3044\u305F\u306A\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible \u3082\u8A18\u9332\u5BFE\u8C61\u3002");
   }
-  lines.push(
-    "\u8A18\u9332\u6642\u306F tool \u8AAC\u660E\u306E\u4E8C\u9805\u57FA\u6E96\u3067 visibility \u3092\u9078\u3076\uFF08public = \u7B2C\u4E09\u8005\u518D\u73FE\u53EF\u80FD / private = repo \u56FA\u6709\uFF09\u3002\u8FF7\u3063\u305F\u3089 private\u3002"
-  );
+  lines.push(actionSurface === "native-cli" ? "\u8A18\u9332\u6642\u306F visibility \u3092\u4E8C\u9805\u57FA\u6E96\u3067\u9078\u3076\uFF08public = \u7B2C\u4E09\u8005\u518D\u73FE\u53EF\u80FD / private = repo \u56FA\u6709\uFF09\u3002\u8FF7\u3063\u305F\u3089 private\u3002" : "\u8A18\u9332\u6642\u306F tool \u8AAC\u660E\u306E\u4E8C\u9805\u57FA\u6E96\u3067 visibility \u3092\u9078\u3076\uFF08public = \u7B2C\u4E09\u8005\u518D\u73FE\u53EF\u80FD / private = repo \u56FA\u6709\uFF09\u3002\u8FF7\u3063\u305F\u3089 private\u3002");
   return lines.join("\n");
 }
 
 // ../../packages/core/dist/transcriptSignals.js
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync10 } from "node:fs";
 var MAX_ERROR_SNIPPETS = 10;
 var MAX_ERROR_SNIPPET_LENGTH = 300;
 var MAX_SEARCH_QUERIES = 10;
@@ -16244,7 +16255,7 @@ function readSessionSignals(transcriptPath) {
   if (!transcriptPath || !existsSync12(transcriptPath)) return null;
   let raw;
   try {
-    raw = readFileSync9(transcriptPath, "utf-8");
+    raw = readFileSync10(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -16325,7 +16336,7 @@ function struggleSearchText(s) {
 }
 
 // ../../packages/core/dist/codexTranscriptSignals.js
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "node:fs";
 var MAX_ERROR_SNIPPETS2 = 10;
 var MAX_ERROR_SNIPPET_LENGTH2 = 300;
 var MAX_SEARCH_QUERIES2 = 10;
@@ -16393,7 +16404,7 @@ function readCodexSessionSignals(transcriptPath) {
   if (!transcriptPath || !existsSync13(transcriptPath)) return null;
   let raw;
   try {
-    raw = readFileSync10(transcriptPath, "utf-8");
+    raw = readFileSync11(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -16539,7 +16550,7 @@ function listStale(db, opts = {}) {
 
 // ../../packages/core/dist/publishScan.js
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join11, basename as basename2 } from "node:path";
 import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
 var ALLOW_FILE = ".caveat-publish-allow.json";
@@ -16771,7 +16782,7 @@ function publishSelfIdentityTokens() {
 function loadPublishAllow(knowledgeRepo) {
   const path = join11(knowledgeRepo, ALLOW_FILE);
   if (!existsSync14(path)) return /* @__PURE__ */ new Set();
-  const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+  const parsed = JSON.parse(readFileSync12(path, "utf-8"));
   if (!Array.isArray(parsed.allow)) throw new Error(`${ALLOW_FILE} must contain an "allow" array`);
   return new Set(parsed.allow.filter((value) => typeof value === "string" && DIGEST_RE.test(value)));
 }
@@ -16800,7 +16811,7 @@ var PublishScanError = class extends Error {
 
 // ../../packages/core/dist/publish.js
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync12, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync13, readdirSync as readdirSync8, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname7, join as join12, relative as relative3 } from "node:path";
 
 // ../../packages/core/dist/visibility.js
@@ -16819,7 +16830,7 @@ function collectPublishSet(entriesDir) {
   if (!existsSync15(entriesDir)) return { files, invalid };
   for (const path of walkMarkdown(entriesDir)) {
     const relPath = relative3(entriesDir, path).replace(/\\/g, "/");
-    const content = readFileSync12(path);
+    const content = readFileSync13(path);
     try {
       const parsed = parseMarkdown(content.toString("utf-8"));
       const visibility = classifyVisibility(parsed.frontmatter.visibility);
@@ -16874,7 +16885,7 @@ function buildSealedReadme(fileCount, files) {
     "",
     `Public entries: ${fileCount}`,
     "",
-    "Caveat: https://github.com/kitepon-rgb/Caveat",
+    "Caveat: https://github.com/kitepon/Caveat",
     ""
   ];
   const showcase = files.filter((f) => f.showcase).sort((a, b2) => Buffer.compare(Buffer.from(a.relPath, "utf-8"), Buffer.from(b2.relPath, "utf-8")));
@@ -16912,11 +16923,11 @@ function verifySealedMirror(opts) {
     throw new Error(`publish mirror verification failed:
 unexpected sealed mirror tree: ${files.join(", ") || "(empty)"}`);
   }
-  const diskReadme = readFileSync12(join12(opts.mirrorDir, "README.md"), "utf-8");
+  const diskReadme = readFileSync13(join12(opts.mirrorDir, "README.md"), "utf-8");
   if (diskReadme !== opts.readme) {
     throw new Error("publish mirror verification failed: README.md content changed after generation");
   }
-  const diskBundle = readFileSync12(join12(opts.mirrorDir, BUNDLE_RELPATH));
+  const diskBundle = readFileSync13(join12(opts.mirrorDir, BUNDLE_RELPATH));
   if (!diskBundle.equals(opts.bundle)) {
     throw new Error("publish mirror verification failed: sealed bundle bytes changed after generation");
   }
@@ -17010,8 +17021,8 @@ function readExistingMirror(mirrorDir) {
   const readmePath = join12(mirrorDir, "README.md");
   const bundlePath = join12(mirrorDir, BUNDLE_RELPATH);
   return {
-    readme: existsSync15(readmePath) ? readFileSync12(readmePath, "utf-8") : null,
-    bundle: existsSync15(bundlePath) ? readFileSync12(bundlePath) : null
+    readme: existsSync15(readmePath) ? readFileSync13(readmePath, "utf-8") : null,
+    bundle: existsSync15(bundlePath) ? readFileSync13(bundlePath) : null
   };
 }
 async function publishOwn(opts) {
@@ -17302,7 +17313,7 @@ function boundedCount(value) {
 // ../../packages/core/dist/runtimeErrors.js
 import { spawnSync } from "node:child_process";
 import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
-import { closeSync as closeSync2, constants, existsSync as existsSync16, fstatSync, lstatSync, mkdirSync as mkdirSync8, openSync as openSync2, readFileSync as readFileSync13, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync16, lstatSync, mkdirSync as mkdirSync8, readFileSync as readFileSync14, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as hostArch, homedir as homedir3, platform as hostPlatform } from "node:os";
 import { dirname as dirname8, join as join13 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
@@ -17310,7 +17321,6 @@ var RUNTIME_ERRORS_SCHEMA = "caveat.runtime_errors.v1";
 var STATE_VERSION = "1.0";
 var MAX_RECORDS = 256;
 var RETENTION_MS = 30 * 864e5;
-var MAX_CONFIG_BYTES = 64 * 1024;
 var definitions = {
   "CAVEAT.DATABASE_OPEN_FAILED": { component: "database", severity: "high", template: "Caveat database open failed" },
   "CAVEAT.INDEX_FAILED": { component: "index", severity: "high", template: "Caveat index operation failed" },
@@ -17318,7 +17328,8 @@ var definitions = {
   "CAVEAT.MCP_SERVER_FAILED": { component: "mcp", severity: "high", template: "Caveat MCP server failed" },
   "CAVEAT.MCP_TOOL_FAILED": { component: "mcp_tool", severity: "high", template: "Caveat MCP tool handler failed" },
   "CAVEAT.CLAUDE_HOOK_FAILED": { component: "claude_hook", severity: "high", template: "Caveat Claude hook failed" },
-  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", severity: "high", template: "Caveat Codex hook failed" }
+  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", severity: "high", template: "Caveat Codex hook failed" },
+  "CAVEAT.CURSOR_HOOK_FAILED": { component: "cursor_hook", severity: "high", template: "Caveat Cursor hook failed" }
 };
 function normalizeOptions(options2 = {}) {
   return "env" in options2 || "configPath" in options2 || "storePath" in options2 || "version" in options2 || "isWindows" in options2 ? options2 : { env: options2 };
@@ -17329,10 +17340,10 @@ var validTime = (v) => typeof v === "string" && Number.isFinite(Date.parse(v)) &
 var validVersion = (v) => typeof v === "string" && /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(v);
 var validOs = (v) => typeof v === "string" && ["darwin", "linux", "windows"].includes(v);
 var validArch = (v) => typeof v === "string" && ["x64", "arm64", "arm", "ia32"].includes(v);
-var windows = (env) => env.OS === "Windows_NT" || isWindows(hostPlatform());
-function defaultFactoryReporterConfigPath(env = process.env) {
-  const home = env.HOME || env.USERPROFILE || homedir3();
-  return windows(env) ? join13(env.LOCALAPPDATA || join13(home, "AppData", "Local"), "dotagents", "factory-reporter", "config.json") : join13(env.XDG_CONFIG_HOME || join13(home, ".config"), "dotagents", "factory-reporter.json");
+var windows = (env) => isWindowsEnv(env, hostPlatform());
+function runtimeErrorsConfigPath(env = process.env) {
+  const home = windows(env) ? env.USERPROFILE || env.HOME || homedir3() : env.HOME || env.USERPROFILE || homedir3();
+  return join13(home, ".caveatrc.json");
 }
 function runtimeErrorsStatePath(env = process.env) {
   const home = env.HOME || env.USERPROFILE || homedir3();
@@ -17341,24 +17352,8 @@ function runtimeErrorsStatePath(env = process.env) {
 function collectionEnabled(options2 = {}) {
   const env = options2.env ?? process.env;
   try {
-    const path = options2.configPath ?? defaultFactoryReporterConfigPath(env);
-    const isWin = (options2.isWindows ?? windows)(env);
-    const before = lstatSync(path);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_CONFIG_BYTES) return false;
-    if (isWin) secureWindowsAcl(path, options2.aclRunner);
-    else assertPosix(before, 384);
-    const fd = openSync2(path, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
-    let text;
-    try {
-      const after = fstatSync(fd);
-      if (before.dev !== after.dev || before.ino !== after.ino || after.size > MAX_CONFIG_BYTES) return false;
-      if (!isWin) assertPosix(after, 384);
-      text = readFileSync13(fd, "utf8");
-    } finally {
-      closeSync2(fd);
-    }
-    const config = JSON.parse(text);
-    return plain(config) && exact(config, ["schema_version", "host", "collection", "reporting"]) && config.schema_version === "1.0" && plain(config.host) && exact(config.host, ["id", "profile"]) && typeof config.host.id === "string" && /^[a-z0-9][a-z0-9._-]{0,63}$/.test(config.host.id) && ["server", "mac", "wsl", "windows-native"].includes(config.host.profile) && plain(config.collection) && exact(config.collection, ["enabled"]) && config.collection.enabled === true && canonicalReporting(config.reporting);
+    const path = options2.configPath ?? runtimeErrorsConfigPath(env);
+    return loadConfig(path).runtimeErrors === true;
   } catch {
     return false;
   }
@@ -17376,32 +17371,19 @@ function ensureSafeDir(dir, isWin, options2 = {}) {
   if (isWin) secureWindowsAcl(dir, options2.aclRunner, true, !existed);
   else assertPosix(s, 448);
 }
-function canonicalReporting(value) {
-  if (!plain(value) || !Object.keys(value).every((key) => ["enabled", "endpoint", "credential_file"].includes(key)) || typeof value.enabled !== "boolean") return false;
-  if (value.endpoint !== void 0) {
-    if (typeof value.endpoint !== "string" || value.endpoint.length > 2048) return false;
-    try {
-      if (!["http:", "https:"].includes(new URL(value.endpoint).protocol)) return false;
-    } catch {
-      return false;
-    }
-  }
-  if (value.credential_file !== void 0 && (typeof value.credential_file !== "string" || value.credential_file.length < 1 || value.credential_file.length > 4096)) return false;
-  return !value.enabled || value.endpoint !== void 0 && value.credential_file !== void 0;
-}
-var WINDOWS_ACL_VERIFY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=if($isDir){[System.IO.Directory]::GetAccessControl($p)}else{[System.IO.File]::GetAccessControl($p)};$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
-var WINDOWS_ACL_APPLY = String.raw`$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);if($isDir){[System.IO.Directory]::SetAccessControl($p,$acl)}else{[System.IO.File]::SetAccessControl($p,$acl)};` + WINDOWS_ACL_VERIFY;
+var WINDOWS_ACL_VERIFY = String.raw`$ErrorActionPreference='Stop';$p=$env:CAVEAT_ACL_PATH;$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=Get-Acl -LiteralPath $p;$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
+var WINDOWS_ACL_APPLY = String.raw`$ErrorActionPreference='Stop';$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);Set-Acl -LiteralPath $p -AclObject $acl;` + WINDOWS_ACL_VERIFY;
 var WINDOWS_ACL_TIMEOUT_MS = 3e4;
 function runWindowsAcl(path, directory, apply) {
-  const result = spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
+  const result = spawnSync("pwsh.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
   if (result.error !== void 0) throw Error(`store_unsafe: powershell spawn ${result.error.code ?? result.error.message}`);
   if (result.status !== 0) throw Error(`store_unsafe: powershell exit=${result.status} signal=${result.signal ?? "none"} stderr=${(result.stderr ?? "").replace(/\s+/g, " ").trim().slice(0, 400) || "(empty)"}`);
 }
 function secureWindowsAcl(path, runner, directory = false, apply = false) {
   try {
     (runner ?? runWindowsAcl)(path, directory, apply);
-  } catch {
-    throw Error("store_unsafe");
+  } catch (cause) {
+    throw Error("store_unsafe", { cause });
   }
 }
 function assertPosix(info, mode) {
@@ -17431,7 +17413,7 @@ function validate(store) {
 function readStore(path, isWin, options2 = {}) {
   if (!existsSync16(path)) return empty();
   ensureSafeFile(path, isWin, options2);
-  const value = JSON.parse(readFileSync13(path, "utf8"));
+  const value = JSON.parse(readFileSync14(path, "utf8"));
   validate(value);
   return value;
 }
@@ -17744,7 +17726,7 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync14, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { readFileSync as readFileSync15, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join15 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
@@ -17765,7 +17747,7 @@ function updateEntry(id, patch, opts) {
   }
   const relPath = row.path;
   const filePath = join15(opts.entriesRoot, relPath);
-  const raw = readFileSync14(filePath, "utf-8");
+  const raw = readFileSync15(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -17936,7 +17918,6 @@ export {
   isPrivateOwnerStat,
   powershellCallPrefix,
   nodeExecutableNames,
-  SyncError,
   syncOwn,
   KNOWLEDGE_GITIGNORE,
   initOwnSync,
@@ -18005,4 +17986,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-ZBHCOA6R.js.map
+//# sourceMappingURL=chunk-ULK7SZG6.js.map