caveat-cli 0.18.0 → 0.19.0

package/dist/index.js

@@ -7,7 +7,6 @@ import {
   CAVEAT_AUTO_SYNC_ENV,
   KNOWLEDGE_GITIGNORE,
   PublishScanError,
-  SyncError,
   __commonJS,
   __export,
   __toESM,
@@ -76,7 +75,7 @@ import {
   userPromptSubmitReminderText,
   writeDigestMarker,
   writeUserConfigPatch
-} from "./chunk-KAULUIC4.js";
+} from "./chunk-ULK7SZG6.js";
 
 // ../../node_modules/.pnpm/ajv@8.18.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -206,10 +205,10 @@ var require_code = __commonJS({
     function interpolate(x) {
       return typeof x == "number" || typeof x == "boolean" || x === null ? x : safeStringify(Array.isArray(x) ? x.join(",") : x);
     }
-    function stringify(x) {
+    function stringify2(x) {
       return new _Code(safeStringify(x));
     }
-    exports.stringify = stringify;
+    exports.stringify = stringify2;
     function safeStringify(x) {
       return JSON.stringify(x).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
     }
@@ -3624,24 +3623,24 @@ var require_fast_uri = __commonJS({
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse3(uri, options), options);
+        serialize(parse4(uri, options), options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
-        parse3(serialize(uri, options), options);
+        parse4(serialize(uri, options), options);
       }
       return uri;
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
+      const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
     function resolveComponent(base, relative, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
-        base = parse3(serialize(base, options), options);
-        relative = parse3(serialize(relative, options), options);
+        base = parse4(serialize(base, options), options);
+        relative = parse4(serialize(relative, options), options);
       }
       options = options || {};
       if (!options.tolerant && relative.scheme) {
@@ -3693,13 +3692,13 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       if (typeof uriA === "string") {
         uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse3(uriA, options), true), { ...options, skipEscape: true });
+        uriA = serialize(normalizeComponentEncoding(parse4(uriA, options), true), { ...options, skipEscape: true });
       } else if (typeof uriA === "object") {
         uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
       }
       if (typeof uriB === "string") {
         uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse3(uriB, options), true), { ...options, skipEscape: true });
+        uriB = serialize(normalizeComponentEncoding(parse4(uriB, options), true), { ...options, skipEscape: true });
       } else if (typeof uriB === "object") {
         uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
       }
@@ -3768,7 +3767,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse3(uri, opts) {
+    function parse4(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -3862,7 +3861,7 @@ var require_fast_uri = __commonJS({
       resolveComponent,
       equal,
       serialize,
-      parse: parse3
+      parse: parse4
     };
     module.exports = fastUri;
     module.exports.default = fastUri;
@@ -6888,18 +6887,18 @@ var stdoutLogger = {
 };
 
 // src/commands/init.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync, renameSync, rmdirSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join9 } from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readdirSync, renameSync, rmdirSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join10 } from "node:path";
 
 // src/claudeInstall.ts
-import { spawnSync } from "node:child_process";
-import { constants, existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { constants, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 
 // src/installShared.ts
 import { accessSync, copyFileSync, existsSync, mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
-import { dirname as dirname2, isAbsolute } from "node:path";
+import { dirname as dirname2, isAbsolute, join as join3 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 function quoteCommandPath(p) {
   return /[\s\\]/.test(p) ? `"${p}"` : p;
 }
@@ -6939,15 +6938,73 @@ function writeJsonWithBackup(path, value) {
   return writeFileWithBackup(path, `${JSON.stringify(value, null, 2)}
 `);
 }
+function resolveAgentConfigPaths(userHome = homedir2(), env = process.env) {
+  const claudeDir = env.CLAUDE_CONFIG_DIR || join3(userHome, ".claude");
+  return {
+    claudeDir,
+    claudeMcp: claudeMcpConfigPath(claudeDir, env),
+    codexHome: env.CODEX_HOME || join3(userHome, ".codex"),
+    grokHome: env.GROK_HOME || join3(userHome, ".grok"),
+    cursorDir: env.CURSOR_HOME || join3(userHome, ".cursor")
+  };
+}
+function claudeMcpConfigPath(claudeDir, env = process.env) {
+  return join3(env.CLAUDE_CONFIG_DIR ? claudeDir : dirname2(claudeDir), ".claude.json");
+}
+
+// src/mcpInstall.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import { parse, stringify } from "smol-toml";
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function installMcpClient(options) {
+  return updateMcpClient(options, (previous) => ({
+    ...previous,
+    ...options.client === "claude" ? { type: "stdio", env: previous?.env ?? {} } : {},
+    command: options.nodePath,
+    args: ["--disable-warning=ExperimentalWarning", options.cliScriptPath, "mcp-server"]
+  }));
+}
+function uninstallMcpClient(options) {
+  return updateMcpClient(options, () => void 0);
+}
+function updateMcpClient(options, update) {
+  const { client, configPath, dryRun } = options;
+  const json2 = client === "cursor" || client === "claude";
+  const decode3 = (text) => json2 ? JSON.parse(text) : parse(text);
+  const current = existsSync2(configPath) ? decode3(readFileSync2(configPath, "utf8")) : {};
+  const key = json2 ? "mcpServers" : "mcp_servers";
+  if (!object(current) || current[key] !== void 0 && !object(current[key])) {
+    throw new Error(`mcp_config_invalid: ${client}\u306EMCP\u8A2D\u5B9A\u304Cobject\u3067\u306F\u3042\u308A\u307E\u305B\u3093`);
+  }
+  const servers = current[key] ?? {};
+  if (servers.caveat !== void 0 && !object(servers.caveat)) {
+    throw new Error(`mcp_config_invalid: ${client}\u306ECaveat\u767B\u9332\u304Cobject\u3067\u306F\u3042\u308A\u307E\u305B\u3093`);
+  }
+  const previous = servers.caveat;
+  const registration = update(previous);
+  if (isDeepStrictEqual(previous, registration)) return "unchanged";
+  if (dryRun) return "dry-run";
+  const nextServers = { ...servers };
+  if (registration === void 0) delete nextServers.caveat;
+  else nextServers.caveat = registration;
+  const next = { ...current, [key]: nextServers };
+  writeFileWithBackup(configPath, json2 ? `${JSON.stringify(next, null, 2)}
+` : stringify(next));
+  const observed = decode3(readFileSync2(configPath, "utf8"));
+  if (!isDeepStrictEqual(observed, next)) {
+    throw new Error(`mcp_config_readback_failed: ${client}\u306E\u8A2D\u5B9A\u8AAD\u623B\u3057\u304C\u4E00\u81F4\u3057\u307E\u305B\u3093`);
+  }
+  return "configured";
+}
 
 // src/claudeInstall.ts
 var EVENT_USER_PROMPT_SUBMIT = "UserPromptSubmit";
 var EVENT_POST_TOOL_USE = "PostToolUse";
 var EVENT_POST_TOOL_USE_FAILURE = "PostToolUseFailure";
 var EVENT_STOP = "Stop";
-function mcpArgs(cliScriptPath) {
-  return ["--disable-warning=ExperimentalWarning", cliScriptPath, "mcp-server"];
-}
 function hookCommand(nodePath, cliScriptPath, event) {
   return `${quoteCommandPath(nodePath)} ${quoteCommandPath(cliScriptPath)} hook ${event}`;
 }
@@ -6999,79 +7056,37 @@ function isCaveatClaudeHookCommand(actual, event) {
 }
 function isCanonicalCaveatClaudeHookCommand(actual, event, nodePath, cliScriptPath) {
   const tokens = commandTokens(actual);
-  if (tokens?.length !== 4 || tokens[2] !== "hook" || tokens[3] !== event) return false;
-  if (actual !== hookCommand(tokens[0], tokens[1], event)) return false;
-  return isCanonicalAsset(tokens[0], nodePath, constants.X_OK) && isCanonicalAsset(tokens[1], cliScriptPath, constants.R_OK);
+  const [actualNodePath, actualCliScriptPath, subcommand, actualEvent] = tokens ?? [];
+  if (tokens?.length !== 4 || actualNodePath === void 0 || actualCliScriptPath === void 0 || subcommand !== "hook" || actualEvent !== event) return false;
+  if (actual !== hookCommand(actualNodePath, actualCliScriptPath, event)) return false;
+  return isCanonicalAsset(actualNodePath, nodePath, constants.X_OK) && isCanonicalAsset(actualCliScriptPath, cliScriptPath, constants.R_OK);
 }
 function isCaveatClaudeMcpRegistration(value, nodePath, cliScriptPath) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const server = value;
-  return Object.keys(server).length === 4 && ["args", "command", "env", "type"].every((key) => Object.hasOwn(server, key)) && server.type === "stdio" && isCanonicalAsset(server.command, nodePath, constants.X_OK) && Array.isArray(server.args) && server.args.length === 3 && server.args[0] === "--disable-warning=ExperimentalWarning" && isCanonicalAsset(server.args[1], cliScriptPath, constants.R_OK) && server.args[2] === "mcp-server" && server.env !== null && typeof server.env === "object" && !Array.isArray(server.env) && Object.keys(server.env).length === 0;
+  return ["args", "command", "env", "type"].every((key) => Object.hasOwn(server, key)) && server.type === "stdio" && isCanonicalAsset(server.command, nodePath, constants.X_OK) && Array.isArray(server.args) && server.args.length === 3 && server.args[0] === "--disable-warning=ExperimentalWarning" && isCanonicalAsset(server.args[1], cliScriptPath, constants.R_OK) && server.args[2] === "mcp-server" && server.env !== null && typeof server.env === "object" && !Array.isArray(server.env) && Object.values(server.env).every((value2) => typeof value2 === "string");
 }
 function readSettings(path) {
-  if (!existsSync2(path)) return {};
-  return JSON.parse(readFileSync2(path, "utf-8"));
+  if (!existsSync3(path)) return {};
+  return JSON.parse(readFileSync3(path, "utf-8"));
 }
 function writeSettings(path, settings) {
   return writeJsonWithBackup(path, settings);
 }
-var CLAUDE_BIN = "claude";
-function shellQuote(s) {
-  return /[\s&|<>^()]/.test(s) ? `"${s}"` : s;
-}
-function runClaude(args) {
-  const line = [CLAUDE_BIN, ...args].map(shellQuote).join(" ");
-  return spawnSync(line, { shell: true, encoding: "utf-8" });
-}
-function registerMcp(nodePath, cliScriptPath, dryRun, logger) {
-  const args = mcpArgs(cliScriptPath);
-  if (dryRun) {
-    logger.info(
-      `[dry-run] claude mcp add --scope user caveat -- ${nodePath} ${args.join(" ")}`
-    );
-    return { action: "skipped", detail: "dry-run" };
-  }
-  runClaude(["mcp", "remove", "--scope", "user", "caveat"]);
-  const result = runClaude([
-    "mcp",
-    "add",
-    "--scope",
-    "user",
-    "caveat",
-    "--",
-    nodePath,
-    ...args
-  ]);
-  if (result.status === 0) {
-    return { action: "registered" };
-  }
-  if (result.error && "code" in result.error && result.error.code === "ENOENT") {
-    return {
-      action: "skipped",
-      detail: "claude CLI not found in PATH; install Claude Code to enable MCP"
-    };
-  }
-  const stderr = typeof result.stderr === "string" ? result.stderr : "";
-  const stdout = typeof result.stdout === "string" ? result.stdout : "";
-  return {
-    action: "failed",
-    detail: (stderr || stdout || "unknown error").trim()
-  };
-}
-function unregisterMcp(dryRun, logger) {
-  if (dryRun) {
-    logger.info("[dry-run] claude mcp remove --scope user caveat");
-    return { action: "skipped", detail: "dry-run" };
-  }
-  const result = runClaude(["mcp", "remove", "--scope", "user", "caveat"]);
-  if (result.status === 0) return { action: "registered", detail: "removed" };
-  if (result.error && "code" in result.error && result.error.code === "ENOENT") {
-    return { action: "skipped", detail: "claude CLI not found" };
+function configureMcp(opts, remove = false) {
+  const configPath = opts.mcpConfigPath ?? claudeMcpConfigPath(opts.claudeDir);
+  try {
+    const options = { client: "claude", configPath, dryRun: opts.dryRun };
+    const action = remove ? uninstallMcpClient(options) : installMcpClient({ ...options, nodePath: opts.nodePath, cliScriptPath: opts.cliScriptPath });
+    const detail = remove && action === "configured" ? "removed" : action;
+    opts.logger.info(`Claude MCP: ${detail}`);
+    return { action: opts.dryRun ? "skipped" : "registered", detail };
+  } catch (error51) {
+    return { action: "failed", detail: error51 instanceof Error ? error51.message : String(error51) };
   }
-  return { action: "skipped", detail: "not registered or removal failed" };
 }
 function installClaudeIntegration(opts) {
-  const settingsPath = join3(opts.claudeDir, "settings.json");
+  const settingsPath = join4(opts.claudeDir, "settings.json");
   const settings = readSettings(settingsPath);
   const usCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
   const ptCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "post-tool-use");
@@ -7095,7 +7110,7 @@ function installClaudeIntegration(opts) {
       `[dry-run] would ${userPromptSubmit === "added" ? "add" : "keep"} UserPromptSubmit, ${postToolUse === "added" ? "add" : "keep"} PostToolUse, ${postToolUseFailure === "added" ? "add" : "keep"} PostToolUseFailure, ${stop === "added" ? "add" : "keep"} Stop hook in ${settingsPath}`
     );
   }
-  const mcp = opts.skipMcpRegistration ? { action: "skipped", detail: "skipped by caller" } : registerMcp(opts.nodePath, opts.cliScriptPath, opts.dryRun, opts.logger);
+  const mcp = opts.skipMcpRegistration ? { action: "skipped", detail: "skipped by caller" } : configureMcp(opts);
   return {
     mcp,
     hooks: { userPromptSubmit, postToolUse, postToolUseFailure, stop },
@@ -7103,7 +7118,7 @@ function installClaudeIntegration(opts) {
   };
 }
 function uninstallClaudeIntegration(opts) {
-  const settingsPath = join3(opts.claudeDir, "settings.json");
+  const settingsPath = join4(opts.claudeDir, "settings.json");
   const settings = readSettings(settingsPath);
   const usCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
   const ptCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "post-tool-use");
@@ -7117,7 +7132,7 @@ function uninstallClaudeIntegration(opts) {
     const backup = writeSettings(settingsPath, settings);
     if (backup) backupPath = backup;
   }
-  const mcp = opts.skipMcpRegistration ? { action: "skipped", detail: "skipped by caller" } : unregisterMcp(opts.dryRun, opts.logger);
+  const mcp = opts.skipMcpRegistration ? { action: "skipped", detail: "skipped by caller" } : configureMcp(opts, true);
   return {
     mcp,
     hooks: {
@@ -7131,8 +7146,8 @@ function uninstallClaudeIntegration(opts) {
 }
 
 // src/codexHookInstall.ts
-import { constants as constants2, existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { constants as constants2, existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import { join as join5 } from "node:path";
 import { parse as parseToml } from "smol-toml";
 function hookCommand2(nodePath, cliScriptPath, event, platform = process.platform) {
   return `${powershellCallPrefix(platform)}${quoteCommandPath(nodePath)} ${quoteCommandPath(cliScriptPath)} codex-hook ${event}`;
@@ -7168,8 +7183,8 @@ function hasCaveatHook(hooksJson, event, fragment) {
   ) ?? false;
 }
 function readHooks(path) {
-  if (!existsSync3(path)) return {};
-  return JSON.parse(readFileSync3(path, "utf-8"));
+  if (!existsSync4(path)) return {};
+  return JSON.parse(readFileSync4(path, "utf-8"));
 }
 function upsertHook2(hooksJson, event, command, subcommand) {
   hooksJson.hooks ??= {};
@@ -7393,9 +7408,9 @@ function maskTomlStringsAndComments(raw) {
   return output;
 }
 function installCodexHooks(opts) {
-  const hooksPath = join4(opts.codexHome, "hooks.json");
-  const configPath = join4(opts.codexHome, "config.toml");
-  const rawConfig = existsSync3(configPath) ? readFileSync3(configPath, "utf-8") : "";
+  const hooksPath = join5(opts.codexHome, "hooks.json");
+  const configPath = join5(opts.codexHome, "config.toml");
+  const rawConfig = existsSync4(configPath) ? readFileSync4(configPath, "utf-8") : "";
   const enabled = enableCodexHooksFeature(rawConfig);
   if (enabled.status === "blocked") {
     return {
@@ -7447,7 +7462,7 @@ function installCodexHooks(opts) {
   };
 }
 function uninstallCodexHooks(opts) {
-  const hooksPath = join4(opts.codexHome, "hooks.json");
+  const hooksPath = join5(opts.codexHome, "hooks.json");
   const hooksJson = readHooks(hooksPath);
   const userPromptSubmitRemoved = removeHook2(
     hooksJson,
@@ -7485,7 +7500,7 @@ function uninstallCodexHooks(opts) {
   };
 }
 function detectCodexHookInstallation(codexHome) {
-  const hooksPath = join4(codexHome, "hooks.json");
+  const hooksPath = join5(codexHome, "hooks.json");
   const hooksJson = readHooks(hooksPath);
   const hooks = {
     userPromptSubmit: hasCaveatHook(
@@ -7513,8 +7528,8 @@ function detectCodexHookInstallation(codexHome) {
 }
 
 // src/cursorInstall.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5 } from "node:fs";
+import { join as join6 } from "node:path";
 import { constants as constants3 } from "node:fs";
 var TIMEOUT_SEC = 10;
 function hookCommand3(nodePath, cliScriptPath, event) {
@@ -7527,9 +7542,18 @@ function isCaveatCursorHookCommand(actual, event) {
   const lower = actual.toLowerCase();
   return lower.includes("caveat") && actual.includes(eventCommandFragment2(event));
 }
+function isCanonicalCaveatCursorHookCommand(actual, event, nodePath, cliScriptPath) {
+  const tokens = commandTokens(actual);
+  return tokens?.length === 4 && isCanonicalAsset(tokens[0], nodePath, constants3.X_OK) && isCanonicalAsset(tokens[1], cliScriptPath, constants3.R_OK) && tokens[2] === "cursor-hook" && tokens[3] === event;
+}
+function isCanonicalCaveatCursorHookEntry(value, event, nodePath, cliScriptPath) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const entry = value;
+  return typeof entry.command === "string" && isCanonicalCaveatCursorHookCommand(entry.command, event, nodePath, cliScriptPath) && entry.timeout === TIMEOUT_SEC;
+}
 function readHooks2(path) {
-  if (!existsSync4(path)) return { version: 1, hooks: {} };
-  const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+  if (!existsSync5(path)) return { version: 1, hooks: {} };
+  const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`${path} \u306F object \u3067\u3042\u308B\u5FC5\u8981\u304C\u3042\u308A\u307E\u3059`);
   }
@@ -7588,7 +7612,7 @@ function hasCaveatHook2(file2, event, fragment) {
   );
 }
 function persist(opts, file2, changed) {
-  const hooksPath = join5(opts.cursorDir, "hooks.json");
+  const hooksPath = join6(opts.cursorDir, "hooks.json");
   if (opts.dryRun) {
     opts.logger.info(`[dry-run] would write Cursor hooks to ${hooksPath}`);
     return void 0;
@@ -7600,7 +7624,7 @@ function persist(opts, file2, changed) {
   return backup || void 0;
 }
 function installCursorHooks(opts) {
-  const hooksPath = join5(opts.cursorDir, "hooks.json");
+  const hooksPath = join6(opts.cursorDir, "hooks.json");
   const file2 = readHooks2(hooksPath);
   const promptCmd = hookCommand3(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
   const toolCmd = hookCommand3(opts.nodePath, opts.cliScriptPath, "post-tool-use");
@@ -7616,7 +7640,7 @@ function installCursorHooks(opts) {
   return { hooks, backupPath };
 }
 function uninstallCursorHooks(opts) {
-  const hooksPath = join5(opts.cursorDir, "hooks.json");
+  const hooksPath = join6(opts.cursorDir, "hooks.json");
   const file2 = readHooks2(hooksPath);
   const promptCmd = hookCommand3(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
   const toolCmd = hookCommand3(opts.nodePath, opts.cliScriptPath, "post-tool-use");
@@ -7640,8 +7664,8 @@ function uninstallCursorHooks(opts) {
   };
 }
 function detectCursorHookInstallation(cursorDir) {
-  const hooksPath = join5(cursorDir, "hooks.json");
-  const file2 = existsSync4(hooksPath) ? readHooks2(hooksPath) : { version: 1, hooks: {} };
+  const hooksPath = join6(cursorDir, "hooks.json");
+  const file2 = existsSync5(hooksPath) ? readHooks2(hooksPath) : { version: 1, hooks: {} };
   const hooks = {
     beforeSubmitPrompt: hasCaveatHook2(file2, "beforeSubmitPrompt", eventCommandFragment2("user-prompt-submit")),
     postToolUse: hasCaveatHook2(file2, "postToolUse", eventCommandFragment2("post-tool-use")),
@@ -7655,12 +7679,44 @@ function detectCursorHookInstallation(cursorDir) {
     hooks
   };
 }
+function diagnoseCursorHookConnector(cursorDir, nodePath, cliScriptPath) {
+  const ready = () => ({ status: "ready", reason_code: "ready" });
+  const notReady = () => ({ status: "not_ready", reason_code: "not_installed" });
+  const unreadable = () => ({ status: "unverified", reason_code: "config_unreadable" });
+  const unreadableHooks = {
+    before_submit_prompt: unreadable(),
+    post_tool_use: unreadable(),
+    post_tool_use_failure: unreadable(),
+    stop: unreadable()
+  };
+  const hooksPath = join6(cursorDir, "hooks.json");
+  let file2;
+  try {
+    file2 = existsSync5(hooksPath) ? readHooks2(hooksPath) : { version: 1, hooks: {} };
+  } catch {
+    return { compatibility_status: "unverified", hooks: unreadableHooks };
+  }
+  const exact = (event, subcommand) => listFor(file2, event).some(
+    (entry) => isCanonicalCaveatCursorHookEntry(entry, subcommand, nodePath, cliScriptPath)
+  ) ? ready() : notReady();
+  const hooks = {
+    before_submit_prompt: exact("beforeSubmitPrompt", "user-prompt-submit"),
+    post_tool_use: exact("postToolUse", "post-tool-use"),
+    post_tool_use_failure: exact("postToolUseFailure", "post-tool-use"),
+    stop: exact("stop", "stop")
+  };
+  const statuses = Object.values(hooks).map((item) => item.status);
+  return {
+    compatibility_status: statuses.includes("not_ready") ? "not_ready" : statuses.includes("unverified") ? "unverified" : "ready",
+    hooks
+  };
+}
 
 // src/ghSetup.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { readSync } from "node:fs";
 function runGh(args) {
-  const result = spawnSync2("gh", args, { encoding: "utf-8" });
+  const result = spawnSync("gh", args, { encoding: "utf-8" });
   return { status: result.status, stdout: typeof result.stdout === "string" ? result.stdout : "", stderr: typeof result.stderr === "string" ? result.stderr : "" };
 }
 function commandError(result, fallback) {
@@ -7680,6 +7736,10 @@ function defaultGitHubRepoUrl(opts) {
     throw new Error(`gh is not authenticated; run \`gh auth login\`, then retry \`${opts.retryCommand}\``);
   }
   const login = user.stdout.trim();
+  const setupGit = opts.ghRunner(["auth", "setup-git"]);
+  if (setupGit.status !== 0) {
+    throw commandError(setupGit, "gh auth setup-git failed");
+  }
   const qualifiedName = `${login}/${opts.repositoryName}`;
   const view = opts.ghRunner(["repo", "view", qualifiedName]);
   if (view.status !== 0) {
@@ -7703,8 +7763,8 @@ function askOnce(question) {
 }
 
 // src/nodePath.ts
-import { existsSync as existsSync5, realpathSync as realpathSync2 } from "node:fs";
-import { delimiter, join as join6 } from "node:path";
+import { existsSync as existsSync6, realpathSync as realpathSync2 } from "node:fs";
+import { delimiter, join as join7 } from "node:path";
 var defaultRealpath = (path) => realpathSync2.native(path);
 function safeRealpath(path, realpath = defaultRealpath) {
   try {
@@ -7717,7 +7777,7 @@ function resolveHookNodePath({
   env = process.env,
   execPath = process.execPath,
   platform = process.platform,
-  exists = existsSync5,
+  exists = existsSync6,
   realpath = defaultRealpath
 } = {}) {
   const execRealpath = safeRealpath(execPath, realpath);
@@ -7725,7 +7785,7 @@ function resolveHookNodePath({
   const names = nodeExecutableNames(platform);
   for (const dir of pathEnv.split(delimiter).filter(Boolean)) {
     for (const name of names) {
-      const candidate = join6(dir, name);
+      const candidate = join7(dir, name);
       if (!exists(candidate)) continue;
       const candidateRealpath = safeRealpath(candidate, realpath);
       if (execRealpath && candidateRealpath && candidateRealpath === execRealpath) {
@@ -7737,14 +7797,14 @@ function resolveHookNodePath({
 }
 
 // src/commands/publish.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // src/commands/codexSidecarAdvisory.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { mkdtempSync, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 var DEFAULT_HOOK_SIDECAR_TIMEOUT_MS = 12e4;
 var MAX_HOOK_SIDECAR_TIMEOUT_MS = 24e4;
 function resolveHookSidecarTimeoutMs(raw) {
@@ -7800,11 +7860,11 @@ function runCodexSidecarAdvisory(input) {
   let resultDir;
   let advisory;
   try {
-    resultDir = mkdtempSync(join7(tmpdir(), "caveat-codex-advisory-"));
-    const resultFile = join7(resultDir, "result.json");
+    resultDir = mkdtempSync(join8(tmpdir(), "caveat-codex-advisory-"));
+    const resultFile = join8(resultDir, "result.json");
     args.push("--save-result", resultFile);
     if (input.additionalContext) {
-      const additionalContextFile = join7(resultDir, "hook-signal.json");
+      const additionalContextFile = join8(resultDir, "hook-signal.json");
       writeFileSync2(additionalContextFile, JSON.stringify({ context: [input.additionalContext] }) + "\n", { encoding: "utf-8", mode: 384, flag: "wx" });
       args.push("--additional-context-file", additionalContextFile);
     }
@@ -7815,7 +7875,7 @@ function runCodexSidecarAdvisory(input) {
       const command = process.env.CAVEAT_CODEX_SIDECAR_COMMAND;
       if (command) args.push("--command", command);
     }
-    const result = spawnSync3(process.execPath, args, {
+    const result = spawnSync2(process.execPath, args, {
       cwd: input.projectRoot,
       encoding: "utf-8",
       // Keep at least one minute between the longest supported model call and
@@ -7832,7 +7892,7 @@ function runCodexSidecarAdvisory(input) {
         message: `sidecar command failed: ${sidecarFailureDetail(detail)}`
       };
     } else {
-      const parsed = JSON.parse(readFileSync5(resultFile, "utf-8"));
+      const parsed = JSON.parse(readFileSync6(resultFile, "utf-8"));
       if (parsed.status !== "ok" || typeof parsed.summary !== "string") {
         advisory = {
           status: "failed",
@@ -7900,7 +7960,7 @@ async function runPublish(ctx, opts, dependencies = {}) {
     const isTty = dependencies.isTty ?? (() => Boolean(process.stdin.isTTY));
     const confirm = dependencies.confirm ?? askOnce;
     const projectRoot = process.cwd();
-    const hasCodexSidecarConfig = dependencies.hasCodexSidecarConfig ?? ((root) => existsSync6(join8(root, ".codex-sidecar.yml")));
+    const hasCodexSidecarConfig = dependencies.hasCodexSidecarConfig ?? ((root) => existsSync7(join9(root, ".codex-sidecar.yml")));
     const publishAdvisory = hasCodexSidecarConfig(projectRoot) ? (changes) => {
       try {
         return dependencies.runCodexSidecarAdvisory?.(changes, projectRoot) ?? formatCodexSidecarAdvisory(runCodexSidecarAdvisory({
@@ -7955,27 +8015,32 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
   const isTty = dependencies.isTty ?? (() => Boolean(process.stdin.isTTY));
   const confirm = dependencies.confirm ?? askOnce;
   const ghRunner = dependencies.ghRunner ?? runGh;
+  const env = dependencies.env ?? process.env;
+  const { claudeDir, claudeMcp, codexHome, cursorDir, grokHome } = resolveAgentConfigPaths(ctx.userHome, env);
+  const codexAvailable = (dependencies.codexAvailable ?? detectCodexAvailability)();
   let publishTarget = ctx.config.publishTarget;
   let codexHookState = "not-installed";
   let cursorHookState = "not-installed";
-  ensureUserConfig(ctx.userConfigPath);
+  if (!opts.dryRun) ensureUserConfig(ctx.userConfigPath);
   ctx.logger.info(`user config: ${ctx.userConfigPath}`);
-  if (!existsSync7(ctx.paths.knowledgeRepo)) {
-    mkdirSync3(ctx.paths.knowledgeRepo, { recursive: true });
-    mkdirSync3(ctx.paths.entriesDir, { recursive: true });
-    ctx.logger.info(`knowledge repo scaffolded: ${ctx.paths.knowledgeRepo}`);
+  if (!existsSync8(ctx.paths.knowledgeRepo)) {
+    if (!opts.dryRun) {
+      mkdirSync3(ctx.paths.knowledgeRepo, { recursive: true });
+      mkdirSync3(ctx.paths.entriesDir, { recursive: true });
+    }
+    ctx.logger.info(`${opts.dryRun ? "[dry-run] would scaffold" : "knowledge repo scaffolded"}: ${ctx.paths.knowledgeRepo}`);
   } else {
     ctx.logger.info(`knowledge repo: ${ctx.paths.knowledgeRepo}`);
   }
-  migrateLegacyCommunityDir(ctx);
-  const gitignorePath = join9(ctx.paths.knowledgeRepo, ".gitignore");
-  if (!existsSync7(gitignorePath)) {
-    writeFileSync3(gitignorePath, KNOWLEDGE_GITIGNORE, "utf-8");
-    ctx.logger.info(`.gitignore created: ${gitignorePath}`);
+  if (!opts.dryRun) migrateLegacyCommunityDir(ctx);
+  const gitignorePath = join10(ctx.paths.knowledgeRepo, ".gitignore");
+  if (!existsSync8(gitignorePath)) {
+    if (!opts.dryRun) writeFileSync3(gitignorePath, KNOWLEDGE_GITIGNORE, "utf-8");
+    ctx.logger.info(`${opts.dryRun ? "[dry-run] would create .gitignore" : ".gitignore created"}: ${gitignorePath}`);
   }
   if (!opts.dryRun) {
     const dbDir = dirname3(ctx.paths.dbPath);
-    if (!existsSync7(dbDir)) mkdirSync3(dbDir, { recursive: true });
+    if (!existsSync8(dbDir)) mkdirSync3(dbDir, { recursive: true });
     const keyProvider = createKeyserverKeyProvider({ caveatHome: ctx.caveatHome });
     const failures = await prewarmSealedKeys({ paths: ctx.paths, keyProvider });
     for (const failure of failures) {
@@ -8008,7 +8073,7 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
   );
   let syncRequested = opts.sync !== void 0 && opts.sync !== false;
   let syncNudgeAccepted = false;
-  if (opts.sync === void 0 && isTty()) {
+  if (opts.sync === void 0 && !opts.yes && isTty()) {
     syncNudgeAccepted = confirm("private \u540C\u671F\u3092\u4ECA\u3059\u3050\u8A2D\u5B9A\u3059\u308B\uFF1F [y/N]");
     syncRequested = syncNudgeAccepted;
   }
@@ -8018,40 +8083,50 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
         const target = typeof opts.sync === "string" ? opts.sync : "<user>/Caveat-Private";
         ctx.logger.info(`[dry-run] would initialize private sync: ${target}`);
       } else {
-        const url2 = typeof opts.sync === "string" ? opts.sync : defaultGitHubRepoUrl({
-          repositoryName: "Caveat-Private",
-          visibility: "private",
-          yes: (opts.yes ?? false) || syncNudgeAccepted,
-          retryCommand: "caveat init --sync <url>",
-          ghRunner,
-          isTty,
-          confirm
-        });
-        const result = await initOwnSync({
-          ownDir: ctx.paths.knowledgeRepo,
-          url: url2,
-          caveatHome: ctx.caveatHome,
-          paths: ctx.paths,
-          logger: ctx.logger,
-          // file: remotes are governed by local filesystem permissions and have
-          // no anonymous HTTP surface for the remote-visibility probe to inspect.
-          trustRemotePrivate: isFileRemote(url2)
-        });
-        ctx.logger.info(
-          result.remoteWasEmpty ? `initialized private sync remote: ${url2}` : `checked out existing private remote: ${url2} (branch ${result.branch})`
-        );
+        const ownGit = join10(ctx.paths.knowledgeRepo, ".git");
+        if (existsSync8(ownGit)) {
+          const remote = gitOutput(["-C", ctx.paths.knowledgeRepo, "remote", "get-url", "origin"]);
+          const result = await syncOwn({
+            ownDir: ctx.paths.knowledgeRepo,
+            caveatHome: ctx.caveatHome,
+            paths: ctx.paths,
+            logger: ctx.logger,
+            trustRemotePrivate: remote !== null && isFileRemote(remote)
+          });
+          const rebased = result.pulled ? ", rebased onto remote" : "";
+          ctx.logger.info(`synced existing private remote: ${result.branch} (${result.changedFiles} local change(s)${rebased})`);
+        } else {
+          const url2 = typeof opts.sync === "string" ? opts.sync : defaultGitHubRepoUrl({
+            repositoryName: "Caveat-Private",
+            visibility: "private",
+            yes: (opts.yes ?? false) || syncNudgeAccepted,
+            retryCommand: "caveat init --sync <url>",
+            ghRunner,
+            isTty,
+            confirm
+          });
+          const result = await initOwnSync({
+            ownDir: ctx.paths.knowledgeRepo,
+            url: url2,
+            caveatHome: ctx.caveatHome,
+            paths: ctx.paths,
+            logger: ctx.logger,
+            // file: remotes are governed by local filesystem permissions and have
+            // no anonymous HTTP surface for the remote-visibility probe to inspect.
+            trustRemotePrivate: isFileRemote(url2)
+          });
+          ctx.logger.info(
+            result.remoteWasEmpty ? `initialized private sync remote: ${url2}` : `checked out existing private remote: ${url2} (branch ${result.branch})`
+          );
+        }
       }
     } catch (err) {
-      if (err instanceof SyncError && err.code === "OWN_REPO_EXISTS") {
-        ctx.logger.info("private sync already configured (own repo exists); skipped");
-      } else {
-        ctx.logger.warn(`private sync setup skipped: ${errorMessage(err)}`);
-      }
+      throw new Error(`private sync setup failed: ${errorMessage(err)}`, { cause: err });
     }
   }
   let publishRequested = opts.publishTarget !== void 0 && opts.publishTarget !== false;
   let publishNudgeAccepted = false;
-  if (opts.publishTarget === void 0 && isTty()) {
+  if (opts.publishTarget === void 0 && !opts.yes && isTty()) {
     publishNudgeAccepted = confirm("\u516C\u958B repo\uFF08\u5C01\u7DD8\u30DF\u30E9\u30FC\uFF09\u3082\u8A2D\u5B9A\u3059\u308B\uFF1F [y/N]");
     publishRequested = publishNudgeAccepted;
   }
@@ -8084,33 +8159,36 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
   if (opts.skipClaude) {
     ctx.logger.info("Claude Code integration skipped (--skip-claude)");
   } else {
-    const cliScriptPath = process.argv[1];
-    if (!cliScriptPath) {
+    const cliScriptPath2 = process.argv[1];
+    if (!cliScriptPath2) {
       ctx.logger.warn("cannot determine CLI script path; skipping Claude integration");
     } else {
       const result = installClaudeIntegration({
-        claudeDir: join9(ctx.userHome, ".claude"),
-        cliScriptPath,
+        claudeDir,
+        mcpConfigPath: claudeMcp,
+        cliScriptPath: cliScriptPath2,
         nodePath: resolveHookNodePath(),
         dryRun: opts.dryRun,
         logger: ctx.logger
       });
       reportInstallResult(ctx, result, opts.dryRun);
+      if (result.mcp.action === "failed") {
+        throw new Error(`mcp_setup_failed: Claude Code: ${result.mcp.detail}`);
+      }
     }
   }
   if (opts.skipCodexHook) {
     codexHookState = "skipped";
     ctx.logger.info("Codex hook integration skipped (--skip-codex-hook)");
-  } else if ((dependencies.codexAvailable ?? detectCodexAvailability)()) {
-    const cliScriptPath = process.argv[1];
-    if (!cliScriptPath) {
+  } else if (codexAvailable) {
+    const cliScriptPath2 = process.argv[1];
+    if (!cliScriptPath2) {
       codexHookState = "skipped";
       ctx.logger.warn("cannot determine CLI script path; skipping Codex hook integration");
     } else {
-      const codexHome = join9(ctx.userHome, ".codex");
       const result = installCodexHooks({
         codexHome,
-        cliScriptPath,
+        cliScriptPath: cliScriptPath2,
         nodePath: resolveHookNodePath(),
         dryRun: opts.dryRun,
         logger: ctx.logger
@@ -8118,7 +8196,7 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
       if (result.feature === "blocked") {
         codexHookState = "skipped";
         ctx.logger.warn(
-          `${result.blockedReason}; preserving explicit consent. Set \`hooks = true\` in ${join9(codexHome, "config.toml")}, then rerun \`caveat init\`.`
+          `${result.blockedReason}; preserving explicit consent. Set \`hooks = true\` in ${join10(codexHome, "config.toml")}, then rerun \`caveat init\`.`
         );
       } else if (opts.dryRun) {
         codexHookState = "skipped";
@@ -8131,16 +8209,15 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
   if (opts.skipCursorHook) {
     cursorHookState = "skipped";
     ctx.logger.info("Cursor hook integration skipped (--skip-cursor-hook)");
-  } else if (existsSync7(join9(ctx.userHome, ".cursor"))) {
-    const cliScriptPath = process.argv[1];
-    if (!cliScriptPath) {
+  } else if (existsSync8(cursorDir)) {
+    const cliScriptPath2 = process.argv[1];
+    if (!cliScriptPath2) {
       cursorHookState = "skipped";
       ctx.logger.warn("cannot determine CLI script path; skipping Cursor hook integration");
     } else {
-      const cursorDir = join9(ctx.userHome, ".cursor");
       const result = installCursorHooks({
         cursorDir,
-        cliScriptPath,
+        cliScriptPath: cliScriptPath2,
         nodePath: resolveHookNodePath(),
         dryRun: opts.dryRun,
         logger: ctx.logger
@@ -8156,10 +8233,21 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }, depende
       }
     }
   }
+  const cliScriptPath = process.argv[1];
+  if (!cliScriptPath) throw new Error("mcp_setup_failed: CLI\u306E\u5B9F\u884C\u30D1\u30B9\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093");
+  for (const [client, configPath, available] of [
+    ["codex", join10(codexHome, "config.toml"), codexAvailable || existsSync8(codexHome)],
+    ["grok", join10(grokHome, "config.toml"), existsSync8(grokHome)],
+    ["cursor", join10(cursorDir, "mcp.json"), existsSync8(cursorDir)]
+  ]) {
+    if (!available) continue;
+    const action = installMcpClient({ client, configPath, cliScriptPath, nodePath: resolveHookNodePath(), dryRun: opts.dryRun });
+    ctx.logger.info(`${client} MCP: ${action}`);
+  }
   reportEnvironmentSummary(ctx, publishTarget, codexHookState, cursorHookState, opts.dryRun);
 }
 function detectCodexAvailability() {
-  const result = spawnSync4("codex --version", {
+  const result = spawnSync3("codex --version", {
     shell: true,
     encoding: "utf-8",
     stdio: "ignore"
@@ -8174,14 +8262,14 @@ function isFileRemote(url2) {
   }
 }
 function gitOutput(args) {
-  const result = spawnSync4("git", args, { encoding: "utf-8" });
+  const result = spawnSync3("git", args, { encoding: "utf-8" });
   return result.status === 0 && typeof result.stdout === "string" ? result.stdout.trim() : null;
 }
 function reportEnvironmentSummary(ctx, publishTarget, codexHookState, cursorHookState, dryRun) {
   const prefix = dryRun ? "[dry-run] would have " : "";
   const isRepo = gitOutput(["-C", ctx.paths.knowledgeRepo, "rev-parse", "--is-inside-work-tree"]) === "true";
   const remote = isRepo ? gitOutput(["-C", ctx.paths.knowledgeRepo, "config", "--get", "remote.origin.url"]) : null;
-  const communityCount = existsSync7(ctx.paths.communityDir) ? readdirSync(ctx.paths.communityDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length : 0;
+  const communityCount = existsSync8(ctx.paths.communityDir) ? readdirSync(ctx.paths.communityDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length : 0;
   ctx.logger.info(`${prefix}environment summary:`);
   ctx.logger.info(`  own git: ${isRepo ? "repository" : "not initialized"}`);
   ctx.logger.info(`  private remote: ${remote || "not configured"}`);
@@ -8194,11 +8282,11 @@ function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function migrateLegacyCommunityDir(ctx) {
-  const legacy = join9(ctx.paths.knowledgeRepo, "community");
+  const legacy = join10(ctx.paths.knowledgeRepo, "community");
   const current = ctx.paths.communityDir;
   if (legacy === current) return;
-  if (!existsSync7(legacy)) return;
-  if (existsSync7(current)) {
+  if (!existsSync8(legacy)) return;
+  if (existsSync8(current)) {
     ctx.logger.warn(
       `legacy community dir still exists at ${legacy} \u2014 remove manually (new location in use)`
     );
@@ -8207,7 +8295,7 @@ function migrateLegacyCommunityDir(ctx) {
   mkdirSync3(current, { recursive: true });
   for (const entry of readdirSync(legacy, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    renameSync(join9(legacy, entry.name), join9(current, entry.name));
+    renameSync(join10(legacy, entry.name), join10(current, entry.name));
   }
   try {
     rmdirSync(legacy);
@@ -8221,13 +8309,16 @@ function runUninstall(ctx, opts) {
     ctx.logger.error("cannot determine CLI script path");
     process.exit(1);
   }
+  const { claudeDir, claudeMcp } = resolveAgentConfigPaths(ctx.userHome);
   const result = uninstallClaudeIntegration({
-    claudeDir: join9(ctx.userHome, ".claude"),
+    claudeDir,
+    mcpConfigPath: claudeMcp,
     cliScriptPath,
     nodePath: resolveHookNodePath(),
     dryRun: opts.dryRun,
     logger: ctx.logger
   });
+  if (result.mcp.action === "failed") throw new Error(`mcp_uninstall_failed: Claude Code: ${result.mcp.detail}`);
   ctx.logger.info(
     `MCP: ${result.mcp.action}${result.mcp.detail ? ` (${result.mcp.detail})` : ""}`
   );
@@ -8269,11 +8360,11 @@ function reportInstallResult(ctx, result, dryRun) {
 }
 
 // src/commands/indexCmd.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 async function runIndex(ctx, opts) {
   const dbDir = dirname4(ctx.paths.dbPath);
-  if (!existsSync8(dbDir)) mkdirSync4(dbDir, { recursive: true });
+  if (!existsSync9(dbDir)) mkdirSync4(dbDir, { recursive: true });
   const keyProvider = createKeyserverKeyProvider({ caveatHome: ctx.caveatHome });
   const failures = await prewarmSealedKeys({ paths: ctx.paths, keyProvider });
   for (const failure of failures) {
@@ -8457,7 +8548,7 @@ function runStats(ctx) {
 
 // src/commands/serve.ts
 async function runServe(opts) {
-  const { startServer } = await import("./server-HKXLHXNN.js");
+  const { startServer } = await import("./server-H6MVY5OK.js");
   const { port, host } = startServer({ port: opts.port });
   process.stdout.write(`[caveat] web portal: http://${host}:${port}/
 `);
@@ -8496,10 +8587,10 @@ var util;
       return obj[e];
     });
   };
-  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object3) => {
+  util2.objectKeys = typeof Object.keys === "function" ? (obj) => Object.keys(obj) : (object4) => {
     const keys = [];
-    for (const key in object3) {
-      if (Object.prototype.hasOwnProperty.call(object3, key)) {
+    for (const key in object4) {
+      if (Object.prototype.hasOwnProperty.call(object4, key)) {
         keys.push(key);
       }
     }
@@ -12600,7 +12691,7 @@ __export(core_exports2, {
   isValidJWT: () => isValidJWT2,
   locales: () => locales_exports,
   meta: () => meta,
-  parse: () => parse,
+  parse: () => parse2,
   parseAsync: () => parseAsync,
   prettifyError: () => prettifyError,
   process: () => process2,
@@ -12819,9 +12910,9 @@ function floatSafeRemainder2(val, step) {
   return ratio - roundedRatio;
 }
 var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-function defineLazy(object3, key, getter) {
+function defineLazy(object4, key, getter) {
   let value = void 0;
-  Object.defineProperty(object3, key, {
+  Object.defineProperty(object4, key, {
     get() {
       if (value === EVALUATING) {
         return void 0;
@@ -12833,7 +12924,7 @@ function defineLazy(object3, key, getter) {
       return value;
     },
     set(v) {
-      Object.defineProperty(object3, key, {
+      Object.defineProperty(object4, key, {
         value: v
         // configurable: true,
       });
@@ -13545,7 +13636,7 @@ var _parse = (_Err) => (schema, value, _ctx, _params) => {
   }
   return result.value;
 };
-var parse = /* @__PURE__ */ _parse($ZodRealError);
+var parse2 = /* @__PURE__ */ _parse($ZodRealError);
 var _parseAsync = (_Err) => async (schema, value, _ctx, params) => {
   const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
   let result = schema._zod.run({ value, issues: [] }, ctx);
@@ -16337,10 +16428,10 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       throw new Error("implement() must be called with a function");
     }
     return function(...args) {
-      const parsedArgs = inst._def.input ? parse(inst._def.input, args) : args;
+      const parsedArgs = inst._def.input ? parse2(inst._def.input, args) : args;
       const result = Reflect.apply(func, this, parsedArgs);
       if (inst._def.output) {
-        return parse(inst._def.output, result);
+        return parse2(inst._def.output, result);
       }
       return result;
     };
@@ -24494,7 +24585,7 @@ var ZodMiniType = /* @__PURE__ */ $constructor("ZodMiniType", (inst, def) => {
   $ZodType.init(inst, def);
   inst.def = def;
   inst.type = def.type;
-  inst.parse = (data, params) => parse(inst, data, params, { callee: inst.parse });
+  inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
   inst.safeParse = (data, params) => safeParse(inst, data, params);
   inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
   inst.safeParseAsync = async (data, params) => safeParseAsync(inst, data, params);
@@ -24524,7 +24615,7 @@ var ZodMiniObject = /* @__PURE__ */ $constructor("ZodMiniObject", (inst, def) =>
   defineLazy(inst, "shape", () => def.shape);
 });
 // @__NO_SIDE_EFFECTS__
-function object(shape, params) {
+function object2(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -24541,11 +24632,11 @@ function isZ4Schema(s) {
 function objectFromShape(shape) {
   const values = Object.values(shape);
   if (values.length === 0)
-    return object({});
+    return object2({});
   const allV4 = values.every(isZ4Schema);
   const allV3 = values.every((s) => !isZ4Schema(s));
   if (allV4)
-    return object(shape);
+    return object2(shape);
   if (allV3)
     return objectType(shape);
   throw new Error("Mixed Zod versions detected in object shape.");
@@ -24857,10 +24948,10 @@ __export(external_exports, {
   nullable: () => nullable,
   nullish: () => nullish2,
   number: () => number2,
-  object: () => object2,
+  object: () => object3,
   optional: () => optional,
   overwrite: () => _overwrite,
-  parse: () => parse2,
+  parse: () => parse3,
   parseAsync: () => parseAsync2,
   partialRecord: () => partialRecord,
   pipe: () => pipe,
@@ -25054,7 +25145,7 @@ __export(schemas_exports2, {
   nullable: () => nullable,
   nullish: () => nullish2,
   number: () => number2,
-  object: () => object2,
+  object: () => object3,
   optional: () => optional,
   partialRecord: () => partialRecord,
   pipe: () => pipe,
@@ -25207,7 +25298,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, {
 });
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/parse.js
-var parse2 = /* @__PURE__ */ _parse(ZodRealError);
+var parse3 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse3 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync3 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -25270,7 +25361,7 @@ var ZodType2 = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   inst.def = def;
   inst.type = def.type;
   Object.defineProperty(inst, "_def", { value: def });
-  inst.parse = (data, params) => parse2(inst, data, params, { callee: inst.parse });
+  inst.parse = (data, params) => parse3(inst, data, params, { callee: inst.parse });
   inst.safeParse = (data, params) => safeParse3(inst, data, params);
   inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
   inst.safeParseAsync = async (data, params) => safeParseAsync3(inst, data, params);
@@ -25929,7 +26020,7 @@ var ZodObject2 = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
     }
   });
 });
-function object2(shape, params) {
+function object3(shape, params) {
   const def = {
     type: "object",
     shape: shape ?? {},
@@ -27062,10 +27153,10 @@ var TaskCreationParamsSchema = looseObject({
    */
   pollInterval: number2().optional()
 });
-var TaskMetadataSchema = object2({
+var TaskMetadataSchema = object3({
   ttl: number2().optional()
 });
-var RelatedTaskMetadataSchema = object2({
+var RelatedTaskMetadataSchema = object3({
   taskId: string2()
 });
 var RequestMetaSchema = looseObject({
@@ -27078,7 +27169,7 @@ var RequestMetaSchema = looseObject({
    */
   [RELATED_TASK_META_KEY]: RelatedTaskMetadataSchema.optional()
 });
-var BaseRequestParamsSchema = object2({
+var BaseRequestParamsSchema = object3({
   /**
    * See [General fields: `_meta`](/specification/draft/basic/index#meta) for notes on `_meta` usage.
    */
@@ -27096,18 +27187,18 @@ var TaskAugmentedRequestParamsSchema = BaseRequestParamsSchema.extend({
   task: TaskMetadataSchema.optional()
 });
 var isTaskAugmentedRequestParams = (value) => TaskAugmentedRequestParamsSchema.safeParse(value).success;
-var RequestSchema = object2({
+var RequestSchema = object3({
   method: string2(),
   params: BaseRequestParamsSchema.loose().optional()
 });
-var NotificationsParamsSchema = object2({
+var NotificationsParamsSchema = object3({
   /**
    * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
    * for notes on _meta usage.
    */
   _meta: RequestMetaSchema.optional()
 });
-var NotificationSchema = object2({
+var NotificationSchema = object3({
   method: string2(),
   params: NotificationsParamsSchema.loose().optional()
 });
@@ -27119,18 +27210,18 @@ var ResultSchema = looseObject({
   _meta: RequestMetaSchema.optional()
 });
 var RequestIdSchema = union([string2(), number2().int()]);
-var JSONRPCRequestSchema = object2({
+var JSONRPCRequestSchema = object3({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema,
   ...RequestSchema.shape
 }).strict();
 var isJSONRPCRequest = (value) => JSONRPCRequestSchema.safeParse(value).success;
-var JSONRPCNotificationSchema = object2({
+var JSONRPCNotificationSchema = object3({
   jsonrpc: literal(JSONRPC_VERSION),
   ...NotificationSchema.shape
 }).strict();
 var isJSONRPCNotification = (value) => JSONRPCNotificationSchema.safeParse(value).success;
-var JSONRPCResultResponseSchema = object2({
+var JSONRPCResultResponseSchema = object3({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema,
   result: ResultSchema
@@ -27147,10 +27238,10 @@ var ErrorCode;
   ErrorCode2[ErrorCode2["InternalError"] = -32603] = "InternalError";
   ErrorCode2[ErrorCode2["UrlElicitationRequired"] = -32042] = "UrlElicitationRequired";
 })(ErrorCode || (ErrorCode = {}));
-var JSONRPCErrorResponseSchema = object2({
+var JSONRPCErrorResponseSchema = object3({
   jsonrpc: literal(JSONRPC_VERSION),
   id: RequestIdSchema.optional(),
-  error: object2({
+  error: object3({
     /**
      * The error type that occurred.
      */
@@ -27190,7 +27281,7 @@ var CancelledNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/cancelled"),
   params: CancelledNotificationParamsSchema
 });
-var IconSchema = object2({
+var IconSchema = object3({
   /**
    * URL or data URI for the icon.
    */
@@ -27215,7 +27306,7 @@ var IconSchema = object2({
    */
   theme: _enum2(["light", "dark"]).optional()
 });
-var IconsSchema = object2({
+var IconsSchema = object3({
   /**
    * Optional set of sized icons that the client can display in a user interface.
    *
@@ -27229,7 +27320,7 @@ var IconsSchema = object2({
    */
   icons: array(IconSchema).optional()
 });
-var BaseMetadataSchema = object2({
+var BaseMetadataSchema = object3({
   /** Intended for programmatic or logical use, but used as a display name in past specs or fallback */
   name: string2(),
   /**
@@ -27259,7 +27350,7 @@ var ImplementationSchema = BaseMetadataSchema.extend({
    */
   description: string2().optional()
 });
-var FormElicitationCapabilitySchema = intersection(object2({
+var FormElicitationCapabilitySchema = intersection(object3({
   applyDefaults: boolean2().optional()
 }), record(string2(), unknown()));
 var ElicitationCapabilitySchema = preprocess((value) => {
@@ -27269,7 +27360,7 @@ var ElicitationCapabilitySchema = preprocess((value) => {
     }
   }
   return value;
-}, intersection(object2({
+}, intersection(object3({
   form: FormElicitationCapabilitySchema.optional(),
   url: AssertObjectSchema.optional()
 }), record(string2(), unknown()).optional()));
@@ -27321,7 +27412,7 @@ var ServerTasksCapabilitySchema = looseObject({
     }).optional()
   }).optional()
 });
-var ClientCapabilitiesSchema = object2({
+var ClientCapabilitiesSchema = object3({
   /**
    * Experimental, non-standard capabilities that the client supports.
    */
@@ -27329,7 +27420,7 @@ var ClientCapabilitiesSchema = object2({
   /**
    * Present if the client supports sampling from an LLM.
    */
-  sampling: object2({
+  sampling: object3({
     /**
      * Present if the client supports context inclusion via includeContext parameter.
      * If not declared, servers SHOULD only use `includeContext: "none"` (or omit it).
@@ -27347,7 +27438,7 @@ var ClientCapabilitiesSchema = object2({
   /**
    * Present if the client supports listing roots.
    */
-  roots: object2({
+  roots: object3({
     /**
      * Whether the client supports issuing notifications for changes to the roots list.
      */
@@ -27374,7 +27465,7 @@ var InitializeRequestSchema = RequestSchema.extend({
   method: literal("initialize"),
   params: InitializeRequestParamsSchema
 });
-var ServerCapabilitiesSchema = object2({
+var ServerCapabilitiesSchema = object3({
   /**
    * Experimental, non-standard capabilities that the server supports.
    */
@@ -27390,7 +27481,7 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server offers any prompt templates.
    */
-  prompts: object2({
+  prompts: object3({
     /**
      * Whether this server supports issuing notifications for changes to the prompt list.
      */
@@ -27399,7 +27490,7 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server offers any resources to read.
    */
-  resources: object2({
+  resources: object3({
     /**
      * Whether this server supports clients subscribing to resource updates.
      */
@@ -27412,7 +27503,7 @@ var ServerCapabilitiesSchema = object2({
   /**
    * Present if the server offers any tools to call.
    */
-  tools: object2({
+  tools: object3({
     /**
      * Whether this server supports issuing notifications for changes to the tool list.
      */
@@ -27449,7 +27540,7 @@ var PingRequestSchema = RequestSchema.extend({
   method: literal("ping"),
   params: BaseRequestParamsSchema.optional()
 });
-var ProgressSchema = object2({
+var ProgressSchema = object3({
   /**
    * The progress thus far. This should increase every time progress is made, even if the total is unknown.
    */
@@ -27463,7 +27554,7 @@ var ProgressSchema = object2({
    */
   message: optional(string2())
 });
-var ProgressNotificationParamsSchema = object2({
+var ProgressNotificationParamsSchema = object3({
   ...NotificationsParamsSchema.shape,
   ...ProgressSchema.shape,
   /**
@@ -27493,7 +27584,7 @@ var PaginatedResultSchema = ResultSchema.extend({
   nextCursor: CursorSchema.optional()
 });
 var TaskStatusSchema = _enum2(["working", "input_required", "completed", "failed", "cancelled"]);
-var TaskSchema = object2({
+var TaskSchema = object3({
   taskId: string2(),
   status: TaskStatusSchema,
   /**
@@ -27550,7 +27641,7 @@ var CancelTaskRequestSchema = RequestSchema.extend({
   })
 });
 var CancelTaskResultSchema = ResultSchema.merge(TaskSchema);
-var ResourceContentsSchema = object2({
+var ResourceContentsSchema = object3({
   /**
    * The URI of this resource.
    */
@@ -27586,7 +27677,7 @@ var BlobResourceContentsSchema = ResourceContentsSchema.extend({
   blob: Base64Schema
 });
 var RoleSchema = _enum2(["user", "assistant"]);
-var AnnotationsSchema = object2({
+var AnnotationsSchema = object3({
   /**
    * Intended audience(s) for the resource.
    */
@@ -27600,7 +27691,7 @@ var AnnotationsSchema = object2({
    */
   lastModified: iso_exports2.datetime({ offset: true }).optional()
 });
-var ResourceSchema = object2({
+var ResourceSchema = object3({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   /**
@@ -27633,7 +27724,7 @@ var ResourceSchema = object2({
    */
   _meta: optional(looseObject({}))
 });
-var ResourceTemplateSchema = object2({
+var ResourceTemplateSchema = object3({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   /**
@@ -27712,7 +27803,7 @@ var ResourceUpdatedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/resources/updated"),
   params: ResourceUpdatedNotificationParamsSchema
 });
-var PromptArgumentSchema = object2({
+var PromptArgumentSchema = object3({
   /**
    * The name of the argument.
    */
@@ -27726,7 +27817,7 @@ var PromptArgumentSchema = object2({
    */
   required: optional(boolean2())
 });
-var PromptSchema = object2({
+var PromptSchema = object3({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   /**
@@ -27763,7 +27854,7 @@ var GetPromptRequestSchema = RequestSchema.extend({
   method: literal("prompts/get"),
   params: GetPromptRequestParamsSchema
 });
-var TextContentSchema = object2({
+var TextContentSchema = object3({
   type: literal("text"),
   /**
    * The text content of the message.
@@ -27779,7 +27870,7 @@ var TextContentSchema = object2({
    */
   _meta: record(string2(), unknown()).optional()
 });
-var ImageContentSchema = object2({
+var ImageContentSchema = object3({
   type: literal("image"),
   /**
    * The base64-encoded image data.
@@ -27799,7 +27890,7 @@ var ImageContentSchema = object2({
    */
   _meta: record(string2(), unknown()).optional()
 });
-var AudioContentSchema = object2({
+var AudioContentSchema = object3({
   type: literal("audio"),
   /**
    * The base64-encoded audio data.
@@ -27819,7 +27910,7 @@ var AudioContentSchema = object2({
    */
   _meta: record(string2(), unknown()).optional()
 });
-var ToolUseContentSchema = object2({
+var ToolUseContentSchema = object3({
   type: literal("tool_use"),
   /**
    * The name of the tool to invoke.
@@ -27842,7 +27933,7 @@ var ToolUseContentSchema = object2({
    */
   _meta: record(string2(), unknown()).optional()
 });
-var EmbeddedResourceSchema = object2({
+var EmbeddedResourceSchema = object3({
   type: literal("resource"),
   resource: union([TextResourceContentsSchema, BlobResourceContentsSchema]),
   /**
@@ -27865,7 +27956,7 @@ var ContentBlockSchema = union([
   ResourceLinkSchema,
   EmbeddedResourceSchema
 ]);
-var PromptMessageSchema = object2({
+var PromptMessageSchema = object3({
   role: RoleSchema,
   content: ContentBlockSchema
 });
@@ -27880,7 +27971,7 @@ var PromptListChangedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/prompts/list_changed"),
   params: NotificationsParamsSchema.optional()
 });
-var ToolAnnotationsSchema = object2({
+var ToolAnnotationsSchema = object3({
   /**
    * A human-readable title for the tool.
    */
@@ -27919,7 +28010,7 @@ var ToolAnnotationsSchema = object2({
    */
   openWorldHint: boolean2().optional()
 });
-var ToolExecutionSchema = object2({
+var ToolExecutionSchema = object3({
   /**
    * Indicates the tool's preference for task-augmented execution.
    * - "required": Clients MUST invoke the tool as a task
@@ -27930,7 +28021,7 @@ var ToolExecutionSchema = object2({
    */
   taskSupport: _enum2(["required", "optional", "forbidden"]).optional()
 });
-var ToolSchema = object2({
+var ToolSchema = object3({
   ...BaseMetadataSchema.shape,
   ...IconsSchema.shape,
   /**
@@ -27941,7 +28032,7 @@ var ToolSchema = object2({
    * A JSON Schema 2020-12 object defining the expected parameters for the tool.
    * Must have type: 'object' at the root level per MCP spec.
    */
-  inputSchema: object2({
+  inputSchema: object3({
     type: literal("object"),
     properties: record(string2(), AssertObjectSchema).optional(),
     required: array(string2()).optional()
@@ -27951,7 +28042,7 @@ var ToolSchema = object2({
    * returned in the structuredContent field of a CallToolResult.
    * Must have type: 'object' at the root level per MCP spec.
    */
-  outputSchema: object2({
+  outputSchema: object3({
     type: literal("object"),
     properties: record(string2(), AssertObjectSchema).optional(),
     required: array(string2()).optional()
@@ -28027,7 +28118,7 @@ var ToolListChangedNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/tools/list_changed"),
   params: NotificationsParamsSchema.optional()
 });
-var ListChangedOptionsBaseSchema = object2({
+var ListChangedOptionsBaseSchema = object3({
   /**
    * If true, the list will be refreshed automatically when a list changed notification is received.
    * The callback will be called with the updated list.
@@ -28076,13 +28167,13 @@ var LoggingMessageNotificationSchema = NotificationSchema.extend({
   method: literal("notifications/message"),
   params: LoggingMessageNotificationParamsSchema
 });
-var ModelHintSchema = object2({
+var ModelHintSchema = object3({
   /**
    * A hint for a model name.
    */
   name: string2().optional()
 });
-var ModelPreferencesSchema = object2({
+var ModelPreferencesSchema = object3({
   /**
    * Optional hints to use for model selection.
    */
@@ -28100,7 +28191,7 @@ var ModelPreferencesSchema = object2({
    */
   intelligencePriority: number2().min(0).max(1).optional()
 });
-var ToolChoiceSchema = object2({
+var ToolChoiceSchema = object3({
   /**
    * Controls when tools are used:
    * - "auto": Model decides whether to use tools (default)
@@ -28109,11 +28200,11 @@ var ToolChoiceSchema = object2({
    */
   mode: _enum2(["auto", "required", "none"]).optional()
 });
-var ToolResultContentSchema = object2({
+var ToolResultContentSchema = object3({
   type: literal("tool_result"),
   toolUseId: string2().describe("The unique identifier for the corresponding tool call."),
   content: array(ContentBlockSchema).default([]),
-  structuredContent: object2({}).loose().optional(),
+  structuredContent: object3({}).loose().optional(),
   isError: boolean2().optional(),
   /**
    * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
@@ -28129,7 +28220,7 @@ var SamplingMessageContentBlockSchema = discriminatedUnion("type", [
   ToolUseContentSchema,
   ToolResultContentSchema
 ]);
-var SamplingMessageSchema = object2({
+var SamplingMessageSchema = object3({
   role: RoleSchema,
   content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)]),
   /**
@@ -28229,13 +28320,13 @@ var CreateMessageResultWithToolsSchema = ResultSchema.extend({
    */
   content: union([SamplingMessageContentBlockSchema, array(SamplingMessageContentBlockSchema)])
 });
-var BooleanSchemaSchema = object2({
+var BooleanSchemaSchema = object3({
   type: literal("boolean"),
   title: string2().optional(),
   description: string2().optional(),
   default: boolean2().optional()
 });
-var StringSchemaSchema = object2({
+var StringSchemaSchema = object3({
   type: literal("string"),
   title: string2().optional(),
   description: string2().optional(),
@@ -28244,7 +28335,7 @@ var StringSchemaSchema = object2({
   format: _enum2(["email", "uri", "date", "date-time"]).optional(),
   default: string2().optional()
 });
-var NumberSchemaSchema = object2({
+var NumberSchemaSchema = object3({
   type: _enum2(["number", "integer"]),
   title: string2().optional(),
   description: string2().optional(),
@@ -28252,24 +28343,24 @@ var NumberSchemaSchema = object2({
   maximum: number2().optional(),
   default: number2().optional()
 });
-var UntitledSingleSelectEnumSchemaSchema = object2({
+var UntitledSingleSelectEnumSchemaSchema = object3({
   type: literal("string"),
   title: string2().optional(),
   description: string2().optional(),
   enum: array(string2()),
   default: string2().optional()
 });
-var TitledSingleSelectEnumSchemaSchema = object2({
+var TitledSingleSelectEnumSchemaSchema = object3({
   type: literal("string"),
   title: string2().optional(),
   description: string2().optional(),
-  oneOf: array(object2({
+  oneOf: array(object3({
     const: string2(),
     title: string2()
   })),
   default: string2().optional()
 });
-var LegacyTitledEnumSchemaSchema = object2({
+var LegacyTitledEnumSchemaSchema = object3({
   type: literal("string"),
   title: string2().optional(),
   description: string2().optional(),
@@ -28278,26 +28369,26 @@ var LegacyTitledEnumSchemaSchema = object2({
   default: string2().optional()
 });
 var SingleSelectEnumSchemaSchema = union([UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema]);
-var UntitledMultiSelectEnumSchemaSchema = object2({
+var UntitledMultiSelectEnumSchemaSchema = object3({
   type: literal("array"),
   title: string2().optional(),
   description: string2().optional(),
   minItems: number2().optional(),
   maxItems: number2().optional(),
-  items: object2({
+  items: object3({
     type: literal("string"),
     enum: array(string2())
   }),
   default: array(string2()).optional()
 });
-var TitledMultiSelectEnumSchemaSchema = object2({
+var TitledMultiSelectEnumSchemaSchema = object3({
   type: literal("array"),
   title: string2().optional(),
   description: string2().optional(),
   minItems: number2().optional(),
   maxItems: number2().optional(),
-  items: object2({
-    anyOf: array(object2({
+  items: object3({
+    anyOf: array(object3({
       const: string2(),
       title: string2()
     }))
@@ -28322,7 +28413,7 @@ var ElicitRequestFormParamsSchema = TaskAugmentedRequestParamsSchema.extend({
    * A restricted subset of JSON Schema.
    * Only top-level properties are allowed, without nesting.
    */
-  requestedSchema: object2({
+  requestedSchema: object3({
     type: literal("object"),
     properties: record(string2(), PrimitiveSchemaDefinitionSchema),
     required: array(string2()).optional()
@@ -28378,14 +28469,14 @@ var ElicitResultSchema = ResultSchema.extend({
    */
   content: preprocess((val) => val === null ? void 0 : val, record(string2(), union([string2(), number2(), boolean2(), array(string2())])).optional())
 });
-var ResourceTemplateReferenceSchema = object2({
+var ResourceTemplateReferenceSchema = object3({
   type: literal("ref/resource"),
   /**
    * The URI or URI template of the resource.
    */
   uri: string2()
 });
-var PromptReferenceSchema = object2({
+var PromptReferenceSchema = object3({
   type: literal("ref/prompt"),
   /**
    * The name of the prompt or prompt template
@@ -28397,7 +28488,7 @@ var CompleteRequestParamsSchema = BaseRequestParamsSchema.extend({
   /**
    * The argument's information
    */
-  argument: object2({
+  argument: object3({
     /**
      * The name of the argument
      */
@@ -28407,7 +28498,7 @@ var CompleteRequestParamsSchema = BaseRequestParamsSchema.extend({
      */
     value: string2()
   }),
-  context: object2({
+  context: object3({
     /**
      * Previously-resolved variables in a URI template or prompt.
      */
@@ -28446,7 +28537,7 @@ var CompleteResultSchema = ResultSchema.extend({
     hasMore: optional(boolean2())
   })
 });
-var RootSchema = object2({
+var RootSchema = object3({
   /**
    * The URI identifying the root. This *must* start with file:// for now.
    */
@@ -29310,11 +29401,11 @@ function parseMapDef(def, refs) {
 
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@4.4.3/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
 function parseNativeEnumDef(def) {
-  const object3 = def.values;
+  const object4 = def.values;
   const actualKeys = Object.keys(def.values).filter((key) => {
-    return typeof object3[object3[key]] !== "number";
+    return typeof object4[object4[key]] !== "number";
   });
-  const actualValues = actualKeys.map((key) => object3[key]);
+  const actualValues = actualKeys.map((key) => object4[key]);
   const parsedTypes = Array.from(new Set(actualValues.map((values) => typeof values)));
   return {
     type: parsedTypes.length === 1 ? parsedTypes[0] === "string" ? "string" : "number" : ["string", "number"],
@@ -32528,8 +32619,8 @@ var StdioServerTransport = class {
 };
 
 // ../mcp/dist/context.js
-import { homedir as homedir2 } from "node:os";
-import { join as join10 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join11 } from "node:path";
 
 // ../mcp/dist/autoSyncTrigger.js
 function triggerAutoSyncAfterWrite(caveatHome, logger) {
@@ -32546,9 +32637,9 @@ function triggerAutoSyncAfterWrite(caveatHome, logger) {
 
 // ../mcp/dist/context.js
 function buildMcpContext(overrides = {}) {
-  const userHome = overrides.userHome ?? homedir2();
+  const userHome = overrides.userHome ?? homedir3();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join10(userHome, ".caveatrc.json");
+  const userConfigPath = join11(userHome, ".caveatrc.json");
   const logger = overrides.logger ?? stderrLogger;
   const config2 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config2.knowledgeRepo, userHome);
@@ -32697,12 +32788,12 @@ function handleListRecent(ctx, args) {
 }
 
 // ../mcp/dist/tools/pull.js
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 var pullInputShape = {};
 async function handlePull(ctx, _args = {}) {
   const pulled = [];
   const indexed = [];
-  if (existsSync9(ctx.paths.communityDir)) {
+  if (existsSync10(ctx.paths.communityDir)) {
     const results = await communityPull({
       communityDir: ctx.paths.communityDir,
       logger: ctx.logger
@@ -32858,28 +32949,28 @@ async function runMcpServer() {
 import { spawn as spawn2 } from "node:child_process";
 import {
   chmodSync,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   lstatSync,
   mkdtempSync as mkdtempSync2,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   realpathSync as realpathSync3,
   rmSync as rmSync2,
   writeFileSync as writeFileSync5
 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename, dirname as dirname5, join as join13 } from "node:path";
+import { basename, dirname as dirname5, join as join14 } from "node:path";
 import { randomBytes } from "node:crypto";
 
 // src/autoReindexTrigger.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join12 } from "node:path";
 function maybeTriggerAutoReindex(ctx) {
   if (process.env.CAVEAT_INDEX_AUTOSYNC === "off") return;
-  if (!existsSync10(ctx.paths.dbPath)) return;
-  if (existsSync10(join11(ctx.caveatHome, "index", ".reindex-lock"))) return;
+  if (!existsSync11(ctx.paths.dbPath)) return;
+  if (existsSync11(join12(ctx.caveatHome, "index", ".reindex-lock"))) return;
   const current = computeEntriesDigest(ctx.paths);
   const marker = readDigestMarker(ctx.caveatHome);
   if (marker?.digest === current.digest && marker.fileCount === current.fileCount) return;
@@ -32905,8 +32996,8 @@ function maybeTriggerAutoSync(ctx, debounceMs = AUTO_SYNC_DEBOUNCE_MS) {
 }
 
 // src/hookShared.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join13 } from "node:path";
 import { createHash } from "node:crypto";
 var MAX_CONTEXT_BLOCKS = 3;
 var STOP_REMINDER_PREFIX = "[caveat] \u3053\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u3067\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u5F53\u305F\u3063\u305F\u53EF\u80FD\u6027\u3092\u793A\u3059\u30B7\u30B0\u30CA\u30EB:";
@@ -32961,7 +33052,7 @@ function searchCaveatsSafely(host, input) {
   let hits;
   try {
     const ctx = buildContextSafely(host);
-    if (!ctx || !existsSync11(ctx.paths.dbPath)) return [];
+    if (!ctx || !existsSync12(ctx.paths.dbPath)) return [];
     caveatHome = ctx.caveatHome;
     db = openDb({ path: ctx.paths.dbPath });
     const searchOptions = {
@@ -33047,19 +33138,19 @@ function stopSignalKey(signals, related) {
   return createHash("sha256").update(body).digest("hex");
 }
 function stopStatePath(host, caveatHome, sessionId) {
-  return join12(caveatHome, host.stopStateDir, `${sanitizeStateId(sessionId)}.txt`);
+  return join13(caveatHome, host.stopStateDir, `${sanitizeStateId(sessionId)}.txt`);
 }
 function wasStopReminderQueued(host, caveatHome, sessionId, key) {
   const path = stopStatePath(host, caveatHome, sessionId);
   try {
-    return readFileSync6(path, "utf-8") === key;
+    return readFileSync7(path, "utf-8") === key;
   } catch {
     return false;
   }
 }
 function markStopReminderQueued(host, caveatHome, sessionId, key) {
   const path = stopStatePath(host, caveatHome, sessionId);
-  mkdirSync5(join12(caveatHome, host.stopStateDir), { recursive: true });
+  mkdirSync5(join13(caveatHome, host.stopStateDir), { recursive: true });
   writeFileSync4(path, key, "utf-8");
 }
 function queueStopForSession(host, sessionId, signals, related, buildText) {
@@ -33171,9 +33262,9 @@ function spawnWorker(job) {
   try {
     root = workerRoot();
     sweepStaleWorkerDirs(Date.now(), root);
-    workDir = mkdtempSync2(join13(root, "job-"));
+    workDir = mkdtempSync2(join14(root, "job-"));
     chmodSync(workDir, 448);
-    workFile = join13(workDir, `${randomBytes(4).toString("hex")}.json`);
+    workFile = join14(workDir, `${randomBytes(4).toString("hex")}.json`);
     writeFileSync5(workFile, JSON.stringify({ ...job, schemaVersion: "caveat-worker-job/v2" }), { encoding: "utf-8", mode: 384, flag: "wx" });
   } catch (err) {
     process.stderr.write(`[caveat:hook] worker writefile error: ${errorMessage4(err)}
@@ -33205,7 +33296,7 @@ function spawnWorker(job) {
 async function runWorker(workFile) {
   let raw;
   try {
-    raw = readFileSync7(workFile, "utf-8");
+    raw = readFileSync8(workFile, "utf-8");
   } catch {
     process.exit(0);
   }
@@ -33269,7 +33360,7 @@ function sweepStaleWorkerDirs(now = Date.now(), root = workerRoot()) {
   }
   for (const entry of entries) {
     if (!entry.startsWith("job-")) continue;
-    const path = join13(root, entry);
+    const path = join14(root, entry);
     try {
       if (!isOwnedWorkerDir(path, root)) continue;
       const stat = lstatSync(path);
@@ -33281,29 +33372,29 @@ function sweepStaleWorkerDirs(now = Date.now(), root = workerRoot()) {
   }
 }
 function workerRoot(base = tmpdir2()) {
-  const root = join13(base, WORKER_ROOT);
+  const root = join14(base, WORKER_ROOT);
   mkdirSync6(root, { recursive: true, mode: 448 });
   const stat = lstatSync(root);
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
   if (!stat.isDirectory() || stat.isSymbolicLink() || !hasPrivateOwnership(stat, uid)) throw new Error("worker root is unsafe");
-  const marker = join13(root, WORKER_MARKER);
+  const marker = join14(root, WORKER_MARKER);
   try {
     writeFileSync5(marker, "caveat-worker/v1\n", { mode: 384, flag: "wx" });
   } catch (error51) {
     if (!(error51 && typeof error51 === "object" && "code" in error51 && error51.code === "EEXIST")) throw error51;
   }
   const markerStat = lstatSync(marker);
-  if (!markerStat.isFile() || markerStat.isSymbolicLink() || !hasPrivateOwnership(markerStat, uid) || readFileSync7(marker, "utf-8") !== "caveat-worker/v1\n") throw new Error("worker root marker is invalid");
+  if (!markerStat.isFile() || markerStat.isSymbolicLink() || !hasPrivateOwnership(markerStat, uid) || readFileSync8(marker, "utf-8") !== "caveat-worker/v1\n") throw new Error("worker root marker is invalid");
   return root;
 }
 function isStaleWorkerJobDir(path) {
   const entries = readdirSync2(path);
   if (entries.length !== 1 || !entries[0].endsWith(".json")) return false;
-  const file2 = join13(path, entries[0]);
+  const file2 = join14(path, entries[0]);
   const stat = lstatSync(file2);
   const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
   if (!stat.isFile() || stat.isSymbolicLink() || !hasPrivateOwnership(stat, uid)) return false;
-  return isKnownStaleWorkerJob(JSON.parse(readFileSync7(file2, "utf-8")));
+  return isKnownStaleWorkerJob(JSON.parse(readFileSync8(file2, "utf-8")));
 }
 function hasPrivateOwnership(stat, uid) {
   return isPrivateOwnerStat(stat, uid);
@@ -33325,7 +33416,7 @@ function isKnownStaleWorkerJob(value) {
 }
 function writeLastReindex(caveatHome, value) {
   try {
-    writeFileSync5(join13(caveatHome, "index", ".last-reindex.json"), JSON.stringify(value), "utf-8");
+    writeFileSync5(join14(caveatHome, "index", ".last-reindex.json"), JSON.stringify(value), "utf-8");
   } catch (err) {
     process.stderr.write(`[caveat:hook] reindex status write error: ${errorMessage4(err)}
 `);
@@ -33337,7 +33428,7 @@ async function runReindexWorker() {
     return;
   }
   const ctx = buildContextSafely(CLAUDE_HOST);
-  if (!ctx || !existsSync12(ctx.paths.dbPath)) {
+  if (!ctx || !existsSync13(ctx.paths.dbPath)) {
     process.stderr.write("[caveat:hook] auto reindex skipped: index database does not exist\n");
     return;
   }
@@ -33404,7 +33495,7 @@ function buildToolErrorReminder(job, hits) {
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync12(join13(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync13(join14(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: job.failureText,
@@ -33440,7 +33531,7 @@ function buildStopReminder(signals, related) {
   const mode = hookCodexSidecarMode();
   if (mode === "off") return base;
   const projectRoot = process.cwd();
-  const hasSidecarConfig = existsSync12(join13(projectRoot, ".codex-sidecar.yml"));
+  const hasSidecarConfig = existsSync13(join14(projectRoot, ".codex-sidecar.yml"));
   if (mode === "auto" && !hasSidecarConfig) return base;
   const advisory = runCodexSidecarAdvisory({
     searchText: struggleSearchText(signals),
@@ -33579,10 +33670,10 @@ async function runHook(name, arg) {
 }
 
 // src/commands/codexHookCmd.ts
-import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir3, tmpdir as tmpdir3 } from "node:os";
-import { join as join14 } from "node:path";
+import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir4, tmpdir as tmpdir3 } from "node:os";
+import { join as join15 } from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
 var CODEX_HOST = {
   agent: "codex",
@@ -33612,10 +33703,10 @@ function processExitCodeFromText(text) {
   return m ? Number(m[1]) : null;
 }
 function transcriptToolOutput(transcriptPath, toolUseId) {
-  if (!transcriptPath || !toolUseId || !existsSync13(transcriptPath)) return null;
+  if (!transcriptPath || !toolUseId || !existsSync14(transcriptPath)) return null;
   let raw = "";
   try {
-    raw = readFileSync8(transcriptPath, "utf-8");
+    raw = readFileSync9(transcriptPath, "utf-8");
   } catch {
     return null;
   }
@@ -33749,7 +33840,7 @@ async function processCodexWorkerJob(job, opts = { waitForTranscript: true }) {
       agent: "codex",
       surface: "tool_error",
       refs: hits
-    }), () => toolErrorReminderText(hits));
+    }), () => toolErrorReminderText(hits, "native-cli"));
   } catch {
     process.stderr.write("[caveat:codex-hook] pending reminder build or publish failed\n");
     return;
@@ -33759,7 +33850,7 @@ async function processCodexWorkerJob(job, opts = { waitForTranscript: true }) {
 async function runCodexWorker(workFile) {
   let raw;
   try {
-    raw = readFileSync8(workFile, "utf-8");
+    raw = readFileSync9(workFile, "utf-8");
   } catch {
     process.exit(0);
   }
@@ -33776,8 +33867,8 @@ async function runCodexWorker(workFile) {
   await processCodexWorkerJob(job);
   process.exit(0);
 }
-function runDiagnostics(codexHome = process.env.CODEX_HOME ?? join14(homedir3(), ".codex")) {
-  const features = spawnSync5("codex", ["features", "list"], {
+function runDiagnostics(codexHome = process.env.CODEX_HOME ?? join15(homedir4(), ".codex")) {
+  const features = spawnSync4("codex", ["features", "list"], {
     encoding: "utf-8",
     maxBuffer: 1024 * 1024,
     env: codexFeatureListEnv(codexHome)
@@ -33828,7 +33919,7 @@ async function runCodexHook(name, arg) {
     const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
     const hits = searchCaveatsSafely(CODEX_HOST, { topicText: prompt, failureText: prompt, surface: "user_prompt" });
     if (hits.length > 0) {
-      contexts.push(userPromptSubmitReminderText(hits));
+      contexts.push(userPromptSubmitReminderText(hits, "native-cli"));
     }
     const compacted = compactContexts(CODEX_HOST, contexts);
     if (compacted.length > 0) {
@@ -33873,7 +33964,7 @@ async function runCodexHook(name, arg) {
       failureText,
       surface: "stop"
     })));
-    if (sessionId) queueStopForSession(CODEX_HOST, sessionId, signals, related, () => stopReminderText(signals, related));
+    if (sessionId) queueStopForSession(CODEX_HOST, sessionId, signals, related, () => stopReminderText(signals, related, "native-cli"));
     process.exit(0);
   }
   process.stderr.write(`[caveat:codex-hook] unknown hook name: ${name}
@@ -33882,8 +33973,8 @@ async function runCodexHook(name, arg) {
 }
 
 // src/commands/cursorHookCmd.ts
-import { homedir as homedir4 } from "node:os";
-import { join as join15 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join16 } from "node:path";
 var CURSOR_HOST = {
   agent: "cursor",
   stderrTag: "caveat:cursor-hook",
@@ -33923,7 +34014,7 @@ function loadSignalsSafely3(path) {
     return null;
   }
 }
-function runDiagnostics2(cursorDir = join15(homedir4(), ".cursor")) {
+function runDiagnostics2(cursorDir = join16(homedir5(), ".cursor")) {
   const installation = detectCursorHookInstallation(cursorDir);
   process.stdout.write(`${JSON.stringify({
     installation: installation.installation,
@@ -33956,7 +34047,7 @@ async function runCursorHook(name, arg) {
       failureText: prompt,
       surface: "user_prompt"
     });
-    if (hits.length > 0) contexts.push(userPromptSubmitReminderText(hits));
+    if (hits.length > 0) contexts.push(userPromptSubmitReminderText(hits, "native-cli"));
     const compacted = compactContexts(CURSOR_HOST, contexts);
     if (compacted.length > 0) {
       process.stdout.write(`${cursorContextOutput(compacted.join("\n\n"))}
@@ -33974,7 +34065,7 @@ async function runCursorHook(name, arg) {
         failureText: errText,
         surface: "tool_error"
       });
-      if (hits.length > 0) contexts.push(toolErrorReminderText(hits));
+      if (hits.length > 0) contexts.push(toolErrorReminderText(hits, "native-cli"));
     }
     const compacted = compactContexts(CURSOR_HOST, contexts);
     if (compacted.length > 0) {
@@ -34014,7 +34105,7 @@ async function runCursorHook(name, arg) {
       failureText,
       surface: "stop"
     })));
-    queueStopForSession(CURSOR_HOST, sessionId, signals, related, () => stopReminderText(signals, related));
+    queueStopForSession(CURSOR_HOST, sessionId, signals, related, () => stopReminderText(signals, related, "native-cli"));
     process.exit(0);
   }
   process.stderr.write(`[caveat:cursor-hook] unknown hook name: ${name}
@@ -34023,9 +34114,9 @@ async function runCursorHook(name, arg) {
 }
 
 // src/commands/pull.ts
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 async function runPull(ctx) {
-  const hasCommunityDir = existsSync14(ctx.paths.communityDir);
+  const hasCommunityDir = existsSync15(ctx.paths.communityDir);
   if (!hasCommunityDir) {
     ctx.logger.info(
       "no community repos yet \u2014 add one with `caveat community add <github-url>`."
@@ -34124,10 +34215,10 @@ async function runSync(ctx, opts, dependencies = {}) {
 }
 
 // src/commands/codexSidecar.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { closeSync, constants as constants4, fstatSync, lstatSync as lstatSync2, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, openSync, readSync as readSync2, realpathSync as realpathSync4, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { basename as basename2, dirname as dirname6, join as join16 } from "node:path";
+import { basename as basename2, dirname as dirname6, join as join17 } from "node:path";
 import { cwd, exit } from "node:process";
 function runCodexSidecarDiagnostics(logger, opts) {
   const plan = buildCodexSidecarDiagnosticsCommand({
@@ -34159,8 +34250,8 @@ function runCodexSidecarWithCaveats(ctx, workflow, prompt, opts) {
     process.stdout.write(JSON.stringify({ status: "skipped", decision }, null, 2) + "\n");
     exit(0);
   }
-  const contextDir = mkdtempSync3(join16(tmpdir4(), "caveat-sidecar-context-"));
-  const contextFile = join16(contextDir, "context.json");
+  const contextDir = mkdtempSync3(join17(tmpdir4(), "caveat-sidecar-context-"));
+  const contextFile = join17(contextDir, "context.json");
   let status2 = 1;
   try {
     const blocks = collectCaveatContextBlocks(ctx, {
@@ -34309,7 +34400,7 @@ function defaultPreset(workflow) {
 }
 function executePlan(logger, command, args, options = {}) {
   logger.info(`[codex-sidecar] ${command} ${args.map(shellDisplayQuote).join(" ")}`);
-  const result = spawnSync6(command, args, { encoding: "utf-8", stdio: "pipe" });
+  const result = spawnSync5(command, args, { encoding: "utf-8", stdio: "pipe" });
   if (result.stdout) process.stdout.write(result.stdout);
   if (result.stderr) process.stderr.write(result.stderr);
   if (options.saveResult && result.stdout) {
@@ -34412,8 +34503,8 @@ function runCommunityRemove(ctx, handle, opts) {
 
 // src/commands/factoryDiagnostics.ts
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
-import { join as join17 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
+import { join as join18 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { parse as parseToml2 } from "smol-toml";
 var status = (ok, reason) => ({ status: ok ? "ready" : "not_ready", reason_code: ok ? "ready" : reason });
@@ -34424,20 +34515,19 @@ function hook(present) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function claudeRegistration(home, nodePath, cliScriptPath) {
-  const path = join17(home, ".claude.json");
-  if (!existsSync15(path)) return status(false, "not_registered");
+function claudeRegistration(path, nodePath, cliScriptPath) {
+  if (!existsSync16(path)) return status(false, "not_registered");
   try {
-    const value = JSON.parse(readFileSync9(path, "utf8"));
+    const value = JSON.parse(readFileSync10(path, "utf8"));
     if (!isRecord2(value) || !isRecord2(value.mcpServers)) return status(false, "not_registered");
     return status(isCaveatClaudeMcpRegistration(value.mcpServers.caveat, nodePath, cliScriptPath), "not_registered");
   } catch {
     return unverified("config_unreadable");
   }
 }
-function claudeHooks(home, nodePath, cliScriptPath) {
+function claudeHooks(claudeDir, nodePath, cliScriptPath) {
   try {
-    const settings = JSON.parse(readFileSync9(join17(home, ".claude", "settings.json"), "utf8"));
+    const settings = JSON.parse(readFileSync10(join18(claudeDir, "settings.json"), "utf8"));
     const present = (event, subcommand) => settings.hooks?.[event]?.some((entry) => entry.hooks?.some((item) => typeof item.command === "string" && isCanonicalCaveatClaudeHookCommand(item.command, subcommand, nodePath, cliScriptPath))) ?? false;
     return { user_prompt_submit: hook(present("UserPromptSubmit", "user-prompt-submit")), post_tool_use: hook(present("PostToolUse", "post-tool-use")), post_tool_use_failure: hook(present("PostToolUseFailure", "post-tool-use")), stop: hook(present("Stop", "stop")) };
   } catch {
@@ -34454,12 +34544,12 @@ var EXPECTED_SEARCH_SQL = /* @__PURE__ */ new Map([
 function strictSearchSchema(db) {
   const normalize = (sql) => (sql ?? "").toLowerCase().replace(/\s+/g, " ");
   const objects = db.prepare("SELECT name, sql FROM sqlite_master WHERE name = 'entries_fts' OR (type = 'trigger' AND tbl_name = 'entries')").all();
-  if (objects.length !== EXPECTED_SEARCH_SQL.size || objects.some((object3) => normalize(object3.sql) !== EXPECTED_SEARCH_SQL.get(object3.name))) return false;
+  if (objects.length !== EXPECTED_SEARCH_SQL.size || objects.some((object4) => normalize(object4.sql) !== EXPECTED_SEARCH_SQL.get(object4.name))) return false;
   const columns = db.prepare("PRAGMA table_xinfo(entries_fts)").all();
   return columns.map((column) => `${column.name}:${column.hidden}`).join(",") === "id:0,title:0,body:0,tags:0,entries_fts:1,rank:1";
 }
 function database(path) {
-  if (!existsSync15(path)) return { status: "not_ready", reason_code: "missing", schema_version: null, supported_schema_version: 3, migration_status: "unverified" };
+  if (!existsSync16(path)) return { status: "not_ready", reason_code: "missing", schema_version: null, supported_schema_version: 3, migration_status: "unverified" };
   try {
     const db = new DatabaseSync(path, { readOnly: true });
     try {
@@ -34484,10 +34574,10 @@ function database(path) {
   }
 }
 function codexFeature(codexHome) {
-  const path = join17(codexHome, "config.toml");
-  if (!existsSync15(path)) return status(false, "feature_disabled");
+  const path = join18(codexHome, "config.toml");
+  if (!existsSync16(path)) return status(false, "feature_disabled");
   try {
-    const config2 = parseToml2(readFileSync9(path, "utf8"));
+    const config2 = parseToml2(readFileSync10(path, "utf8"));
     if (!isRecord2(config2.features)) return status(false, "feature_disabled");
     const features = config2.features;
     return status(features.hooks === true && features.codex_hooks === void 0, "feature_disabled");
@@ -34496,7 +34586,7 @@ function codexFeature(codexHome) {
   }
 }
 function codexHooks(codexHome, nodePath, cliScriptPath) {
-  const value = JSON.parse(readFileSync9(join17(codexHome, "hooks.json"), "utf8"));
+  const value = JSON.parse(readFileSync10(join18(codexHome, "hooks.json"), "utf8"));
   if (!isRecord2(value) || !isRecord2(value.hooks)) throw Error("config_unreadable");
   const hooks = value.hooks;
   const present = (event, subcommand) => Array.isArray(hooks[event]) && hooks[event].some((entry) => isRecord2(entry) && Array.isArray(entry.hooks) && entry.hooks.some((item) => isCanonicalCaveatCodexHookEntry(item, subcommand, nodePath, cliScriptPath)));
@@ -34531,7 +34621,8 @@ function sync(own) {
     return unverified("upstream_unavailable");
   }
 }
-function factoryDiagnostics(ctx, codexHome = process.env.CODEX_HOME ?? join17(ctx.userHome, ".codex")) {
+function factoryDiagnostics(ctx, codexHome = resolveAgentConfigPaths(ctx.userHome).codexHome, requiredConnectors = []) {
+  const { claudeDir, claudeMcp, cursorDir } = resolveAgentConfigPaths(ctx.userHome);
   const nodePath = process.execPath;
   const cliScriptPath = process.argv[1] ?? "";
   const db = database(ctx.paths.dbPath);
@@ -34542,12 +34633,13 @@ function factoryDiagnostics(ctx, codexHome = process.env.CODEX_HOME ?? join17(ct
   } catch {
   }
   const codexHook2 = (present) => present === void 0 ? unverified("config_unreadable") : !present ? hook(false) : feature.status === "ready" ? hook(true) : { ...feature };
-  const output = { schema: "caveat.native_factory_diagnostics.v1", product: "caveat", version: CAVEAT_VERSION, overall: { status: "unverified" }, database: db, sync: sync(ctx.paths.knowledgeRepo), connectors: { claude: { status: "unverified", mcp: claudeRegistration(ctx.userHome, nodePath, cliScriptPath), hooks: claudeHooks(ctx.userHome, nodePath, cliScriptPath) }, codex: { status: "unverified", hooks: { user_prompt_submit: codexHook2(installedCodexHooks?.userPromptSubmit), post_tool_use: codexHook2(installedCodexHooks?.postToolUse), stop: codexHook2(installedCodexHooks?.stop) } } } };
+  const output = { schema: "caveat.native_factory_diagnostics.v1", product: "caveat", version: CAVEAT_VERSION, overall: { status: "unverified" }, database: db, sync: sync(ctx.paths.knowledgeRepo), connectors: { claude: { status: "unverified", mcp: claudeRegistration(claudeMcp, nodePath, cliScriptPath), hooks: claudeHooks(claudeDir, nodePath, cliScriptPath) }, codex: { status: "unverified", hooks: { user_prompt_submit: codexHook2(installedCodexHooks?.userPromptSubmit), post_tool_use: codexHook2(installedCodexHooks?.postToolUse), stop: codexHook2(installedCodexHooks?.stop) } }, cursor: diagnoseCursorHookConnector(cursorDir, nodePath, cliScriptPath) } };
   const aggregate = (all) => all.includes("not_ready") ? "not_ready" : all.includes("unverified") ? "unverified" : "ready";
   const connectorStatus = (connector) => aggregate([...Object.values(connector.hooks), ...connector.mcp ? [connector.mcp] : []].map((v) => v.status));
   output.connectors.claude.status = connectorStatus(output.connectors.claude);
   output.connectors.codex.status = connectorStatus(output.connectors.codex);
   const statuses = [output.database.status, output.sync.status, output.connectors.claude.status, output.connectors.codex.status];
+  if (requiredConnectors.includes("cursor")) statuses.push(output.connectors.cursor.compatibility_status);
   output.overall.status = aggregate(statuses);
   return output;
 }
@@ -34572,12 +34664,16 @@ function parseCursor(value) {
 
 // src/index.ts
 var program = new Command();
+var agentPaths = resolveAgentConfigPaths();
 function collectRepeatable(value, previous) {
   return [...previous, value];
 }
 program.name("caveat").description("External spec gotcha knowledge base CLI").version(CAVEAT_VERSION);
-program.command("factory-diagnostics").description("Emit read-only factory diagnostics").requiredOption("--json", "emit the versioned JSON contract").action((opts) => {
-  const output = factoryDiagnostics(buildContext(stdoutLogger));
+program.command("factory-diagnostics").description("Emit read-only factory diagnostics").requiredOption("--json", "emit the versioned JSON contract").option("--require-connector <name>", "include a connector in overall readiness (repeatable)", collectRepeatable, []).action((opts) => {
+  const unsupported = opts.requireConnector.filter((name) => name !== "cursor");
+  if (unsupported.length > 0) throw new Error(`unsupported factory connector: ${unsupported.join(", ")}`);
+  const requiredConnectors = [...new Set(opts.requireConnector)];
+  const output = factoryDiagnostics(buildContext(stdoutLogger), void 0, requiredConnectors);
   process.stdout.write(`${JSON.stringify(output)}
 `);
   if (output.overall.status !== "ready") process.exitCode = 1;
@@ -34605,7 +34701,7 @@ for (const action of ["resolve", "reopen"]) runtimeErrors.command(`${action} <fi
 `);
 });
 program.command("init").description(
-  "Initialize ~/.caveatrc.json, ~/.caveat/, and register Claude Code integration. Add knowledge sources later with `caveat community add <github-url>`."
+  "Initialize Caveat state and available host integrations, with optional private sync. Add knowledge sources later with `caveat community add <github-url>`."
 ).option("--skip-claude", "skip Claude Code MCP + hook registration", false).option("--sync [url]", "initialize private sync (optionally with its URL)").option("--publish-target [url]", "configure the sealed public mirror target").option("--yes", "approve creating conventional GitHub repositories", false).option("--skip-codex-hook", "skip Codex hook installation", false).option("--skip-cursor-hook", "skip Cursor hook installation", false).option("--dry-run", "show planned changes without writing", false).option(
   "--pending-stale-days <days>",
   "sweep `<caveatHome>/pending/<sessionId>/` whose newest entry is older than this (default 7)",
@@ -34695,7 +34791,7 @@ program.command("hook <name> [arg]").description(
   await runHook(name, arg);
 });
 var codexHook = program.command("codex-hook").description("Install or run Codex hooks for Caveat");
-codexHook.command("install").description("Install Caveat hooks into ~/.codex/hooks.json and enable hooks").option("--dry-run", "show planned changes without writing", false).option("--codex-home <path>", "Codex home directory", process.env.CODEX_HOME ?? `${process.env.HOME}/.codex`).action((opts) => {
+codexHook.command("install").description("Install Caveat hooks into ~/.codex/hooks.json and enable hooks").option("--dry-run", "show planned changes without writing", false).option("--codex-home <path>", "Codex home directory", agentPaths.codexHome).action((opts) => {
   const cliScriptPath = process.argv[1];
   if (!cliScriptPath) {
     process.stderr.write("[caveat:error] cannot determine CLI script path\n");
@@ -34722,7 +34818,7 @@ codexHook.command("install").description("Install Caveat hooks into ~/.codex/hoo
     stdoutLogger.info(`config.toml backed up: ${result.configBackupPath}`);
   }
 });
-codexHook.command("uninstall").description("Remove Caveat-owned Codex hooks from ~/.codex/hooks.json").option("--dry-run", "show planned changes without writing", false).option("--codex-home <path>", "Codex home directory", process.env.CODEX_HOME ?? `${process.env.HOME}/.codex`).action((opts) => {
+codexHook.command("uninstall").description("Remove Caveat-owned Codex hooks from ~/.codex/hooks.json").option("--dry-run", "show planned changes without writing", false).option("--codex-home <path>", "Codex home directory", agentPaths.codexHome).action((opts) => {
   const cliScriptPath = process.argv[1];
   if (!cliScriptPath) {
     process.stderr.write("[caveat:error] cannot determine CLI script path\n");
@@ -34740,7 +34836,7 @@ codexHook.command("uninstall").description("Remove Caveat-owned Codex hooks from
   stdoutLogger.info(`Stop hook: ${result.hooks.stop === "added" ? "removed" : "not present"}`);
   if (result.backupPath) stdoutLogger.info(`hooks.json backed up: ${result.backupPath}`);
 });
-codexHook.command("diagnostics").description("Check local Codex hook availability").option("--codex-home <path>", "Codex home directory", process.env.CODEX_HOME ?? `${process.env.HOME}/.codex`).action(async (opts) => {
+codexHook.command("diagnostics").description("Check local Codex hook availability").option("--codex-home <path>", "Codex home directory", agentPaths.codexHome).action(async (opts) => {
   await runCodexHook("diagnostics", opts.codexHome);
 });
 codexHook.command("user-prompt-submit").description("Run the Codex UserPromptSubmit hook").action(async () => {
@@ -34756,7 +34852,7 @@ codexHook.command("worker <workFile>").description("Run the detached Codex hook
   await runCodexHook("worker", workFile);
 });
 var cursorHook = program.command("cursor-hook").description("Install or run Cursor hooks for Caveat");
-cursorHook.command("install").description("Install Caveat hooks into ~/.cursor/hooks.json (factory hooks are kept)").option("--dry-run", "show planned changes without writing", false).option("--cursor-dir <path>", "Cursor home directory", `${process.env.HOME}/.cursor`).action((opts) => {
+cursorHook.command("install").description("Install Caveat hooks into ~/.cursor/hooks.json (factory hooks are kept)").option("--dry-run", "show planned changes without writing", false).option("--cursor-dir <path>", "Cursor home directory", agentPaths.cursorDir).action((opts) => {
   const cliScriptPath = process.argv[1];
   if (!cliScriptPath) {
     process.stderr.write("[caveat:error] cannot determine CLI script path\n");
@@ -34775,7 +34871,7 @@ cursorHook.command("install").description("Install Caveat hooks into ~/.cursor/h
   stdoutLogger.info(`stop hook: ${result.hooks.stop}`);
   if (result.backupPath) stdoutLogger.info(`hooks.json backed up: ${result.backupPath}`);
 });
-cursorHook.command("uninstall").description("Remove Caveat-owned Cursor hooks from ~/.cursor/hooks.json").option("--dry-run", "show planned changes without writing", false).option("--cursor-dir <path>", "Cursor home directory", `${process.env.HOME}/.cursor`).action((opts) => {
+cursorHook.command("uninstall").description("Remove Caveat-owned Cursor hooks from ~/.cursor/hooks.json").option("--dry-run", "show planned changes without writing", false).option("--cursor-dir <path>", "Cursor home directory", agentPaths.cursorDir).action((opts) => {
   const cliScriptPath = process.argv[1];
   if (!cliScriptPath) {
     process.stderr.write("[caveat:error] cannot determine CLI script path\n");
@@ -34794,7 +34890,7 @@ cursorHook.command("uninstall").description("Remove Caveat-owned Cursor hooks fr
   stdoutLogger.info(`stop hook: ${result.hooks.stop === "added" ? "removed" : "not present"}`);
   if (result.backupPath) stdoutLogger.info(`hooks.json backed up: ${result.backupPath}`);
 });
-cursorHook.command("diagnostics").description("Check local Cursor hook installation").option("--cursor-dir <path>", "Cursor home directory", `${process.env.HOME}/.cursor`).action(async (opts) => {
+cursorHook.command("diagnostics").description("Check local Cursor hook installation").option("--cursor-dir <path>", "Cursor home directory", agentPaths.cursorDir).action(async (opts) => {
   await runCursorHook("diagnostics", opts.cursorDir);
 });
 cursorHook.command("user-prompt-submit").description("Run the Cursor beforeSubmitPrompt hook").action(async () => {