caveat-cli 0.19.9 → 0.19.11

package/README.md

@@ -66,6 +66,9 @@ output also exposes `connectors.cursor.compatibility_status` for diagnosis,
 but callers do not duplicate Caveat's Cursor event set, command rules, or
 timeout checks. Without `--require-connector cursor`, the v1 aggregate keeps
 its existing Claude/Codex readiness semantics.
+For Grok, use `caveat factory-diagnostics --json --require-connector grok` to
+check the enabled Caveat MCP registration and executable paths. A live MCP and
+model smoke remain separate checks.
 
 With either host enabled, Caveat surfaces matching entries at three moments:
 before prompts, after failed tools, and after struggle-heavy sessions. Stop
@@ -87,6 +90,8 @@ caveat uninstall                    # reverse `caveat init` Claude integration
 caveat codex-hook diagnostics       # inspect Codex hook availability/install state
 caveat factory-diagnostics --json --require-connector cursor
                                     # machine gate for a host that requires Cursor
+caveat factory-diagnostics --json --require-connector grok
+                                    # machine gate for a host that requires Grok MCP
 ```
 
 ## Sharing: two boundaries, two commands

package/dist/{chunk-ITQLGM4K.js → chunk-PFYFYJNS.js}

@@ -11638,12 +11638,12 @@ var init_task_callback = __esm({
     init_utils();
   }
 });
-function changeWorkingDirectoryTask(directory, root) {
+function changeWorkingDirectoryTask(directory2, root) {
   return adhocExecTask((instance) => {
-    if (!folderExists(directory)) {
-      throw new Error(`Git.cwd: cannot change to non-directory "${directory}"`);
+    if (!folderExists(directory2)) {
+      throw new Error(`Git.cwd: cannot change to non-directory "${directory2}"`);
     }
-    return (root || instance).cwd = directory;
+    return (root || instance).cwd = directory2;
   });
 }
 var init_change_working_directory = __esm({
@@ -13042,15 +13042,15 @@ var init_clone = __esm({
     "use strict";
     init_task();
     init_utils();
-    cloneTask = (repo, directory, customArgs) => {
+    cloneTask = (repo, directory2, customArgs) => {
       const commands = ["clone", ...customArgs];
       filterString(repo) && commands.push(c(repo));
-      filterString(directory) && commands.push(c(directory));
+      filterString(directory2) && commands.push(c(directory2));
       return straightThroughStringTask(commands);
     };
-    cloneMirrorTask = (repo, directory, customArgs) => {
+    cloneMirrorTask = (repo, directory2, customArgs) => {
       append(customArgs, "--mirror");
-      return cloneTask(repo, directory, customArgs);
+      return cloneTask(repo, directory2, customArgs);
     };
   }
 });
@@ -13103,16 +13103,16 @@ var init_simple_git_api = __esm({
           trailingFunctionArgument(arguments)
         );
       }
-      cwd(directory) {
+      cwd(directory2) {
         const next = trailingFunctionArgument(arguments);
-        if (typeof directory === "string") {
-          return this._runTask(changeWorkingDirectoryTask(directory, this._executor), next);
+        if (typeof directory2 === "string") {
+          return this._runTask(changeWorkingDirectoryTask(directory2, this._executor), next);
         }
-        if (typeof directory?.path === "string") {
+        if (typeof directory2?.path === "string") {
           return this._runTask(
             changeWorkingDirectoryTask(
-              directory.path,
-              directory.root && this._executor || void 0
+              directory2.path,
+              directory2.root && this._executor || void 0
             ),
             next
           );
@@ -17156,14 +17156,14 @@ function ensureSafeDir(dir, isWin, options2 = {}) {
 var WINDOWS_ACL_VERIFY = String.raw`$ErrorActionPreference='Stop';$p=$env:CAVEAT_ACL_PATH;$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$acl=Get-Acl -LiteralPath $p;$owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;if($owner -ne $sid){exit 41};$rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));if($rules.Count -ne 1){exit 42};$r=$rules[0];if($r.IdentityReference.Value -ne $sid -or $r.AccessControlType -ne 'Allow' -or $r.IsInherited -or ($r.FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -ne [System.Security.AccessControl.FileSystemRights]::FullControl){exit 43}`;
 var WINDOWS_ACL_APPLY = String.raw`$ErrorActionPreference='Stop';$p=$env:CAVEAT_ACL_PATH;$isDir=$env:CAVEAT_ACL_DIRECTORY -eq '1';$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;$acl=if($isDir){New-Object System.Security.AccessControl.DirectorySecurity}else{New-Object System.Security.AccessControl.FileSecurity};$acl.SetAccessRuleProtection($true,$false);$flags=if($isDir){[System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'}else{[System.Security.AccessControl.InheritanceFlags]::None};$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow);$acl.SetOwner($sid);$acl.AddAccessRule($rule);Set-Acl -LiteralPath $p -AclObject $acl;` + WINDOWS_ACL_VERIFY;
 var WINDOWS_ACL_TIMEOUT_MS = 3e4;
-function runWindowsAcl(path, directory, apply) {
-  const result = spawnSync("pwsh.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
+function runWindowsAcl(path, directory2, apply) {
+  const result = spawnSync("pwsh.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", apply ? WINDOWS_ACL_APPLY : WINDOWS_ACL_VERIFY], { env: { ...process.env, CAVEAT_ACL_PATH: path, CAVEAT_ACL_DIRECTORY: directory2 ? "1" : "0" }, encoding: "utf-8", timeout: WINDOWS_ACL_TIMEOUT_MS, windowsHide: true });
   if (result.error !== void 0) throw Error(`store_unsafe: powershell spawn ${result.error.code ?? result.error.message}`);
   if (result.status !== 0) throw Error(`store_unsafe: powershell exit=${result.status} signal=${result.signal ?? "none"} stderr=${(result.stderr ?? "").replace(/\s+/g, " ").trim().slice(0, 400) || "(empty)"}`);
 }
-function secureWindowsAcl(path, runner, directory = false, apply = false) {
+function secureWindowsAcl(path, runner, directory2 = false, apply = false) {
   try {
-    (runner ?? runWindowsAcl)(path, directory, apply);
+    (runner ?? runWindowsAcl)(path, directory2, apply);
   } catch (cause) {
     throw Error("store_unsafe", { cause });
   }
@@ -17377,6 +17377,63 @@ function compactRuntimeErrors(options2 = {}) {
   return snapshot(normalized);
 }
 
+// ../../packages/core/dist/jevObservations.js
+import { createHash as createHash8, randomBytes as randomBytes4 } from "node:crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync15, readdirSync as readdirSync9, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join14 } from "node:path";
+var JEV_OBSERVATION_SCHEMA = "caveat.jev_observation.v1";
+var directory = (home) => join14(home, "jev-observations");
+var pathFor = (home, id) => {
+  if (!/^[0-9a-f]{64}$/.test(id)) throw new Error("jev_observation_id_invalid");
+  return join14(directory(home), `${id}.json`);
+};
+function jevObservationId(host, sessionId, turnKey) {
+  return createHash8("sha256").update(`${host}\0${sessionId}\0${turnKey}`).digest("hex");
+}
+function validate2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("jev_observation_invalid");
+  const item = value;
+  if (item.schema !== JEV_OBSERVATION_SCHEMA || typeof item.id !== "string" || !/^[0-9a-f]{64}$/.test(item.id) || !["claude", "codex"].includes(item.host) || typeof item.observedAt !== "string" || typeof item.sessionId !== "string" || typeof item.projectRoot !== "string" || typeof item.transcriptPath !== "string" || !Array.isArray(item.turns) || item.turns.some((turn) => typeof turn.originSessionId !== "string" || !Number.isSafeInteger(turn.turnNumber) || typeof turn.truncated !== "boolean") || typeof item.thinkingAvailable !== "boolean" || typeof item.model !== "string" || ![item.repeatedProblem, item.clearlyStuck, item.struggleThreshold, item.matchThreshold].every((score) => typeof score === "number" && Number.isFinite(score) && score >= 0 && score <= 1) || typeof item.struggling !== "boolean" || !Array.isArray(item.termChoices) || item.termChoices.some((choice) => typeof choice.term !== "string" || typeof choice.probability !== "number") || item.noneProbability !== null && typeof item.noneProbability !== "number" || !Array.isArray(item.selectedTerms) || item.selectedTerms.some((term) => typeof term !== "string") || typeof item.query !== "string" || !Array.isArray(item.ftsHits) || item.ftsHits.some((ref) => typeof ref !== "string") || !Array.isArray(item.candidates) || item.candidates.some((candidate) => typeof candidate.ref !== "string" || typeof candidate.score !== "number" || !Number.isFinite(candidate.score)) || item.selectedRef !== null && typeof item.selectedRef !== "string" || item.noticeText !== null && typeof item.noticeText !== "string" || !["below_struggle_threshold", "no_terms", "no_candidates", "below_match_threshold", "matched"].includes(item.decision) || !["none", "pending", "delivered", "suppressed"].includes(item.delivery) || item.review !== null && (!item.review || typeof item.review !== "object" || !["correct", "incorrect", "missed", "none", "unclear"].includes(item.review.verdict) || typeof item.review.note !== "string" || typeof item.review.reviewedAt !== "string")) throw new Error("jev_observation_invalid");
+}
+function readJevObservation(home, id) {
+  const value = JSON.parse(readFileSync15(pathFor(home, id), "utf8"));
+  validate2(value);
+  if (value.id !== id) throw new Error("jev_observation_id_mismatch");
+  return value;
+}
+function listJevObservations(home) {
+  const dir = directory(home);
+  if (!existsSync17(dir)) return [];
+  return readdirSync9(dir).filter((name) => /^[0-9a-f]{64}\.json$/.test(name)).map((name) => readJevObservation(home, name.slice(0, -5))).sort((a, b2) => b2.observedAt.localeCompare(a.observedAt) || b2.id.localeCompare(a.id));
+}
+function writeJevObservation(home, item) {
+  validate2(item);
+  const dir = directory(home);
+  mkdirSync9(dir, { recursive: true, mode: 448 });
+  const path = pathFor(home, item.id);
+  const temporary = `${path}.${randomBytes4(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync10(temporary, `${JSON.stringify(item)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+    renameSync5(temporary, path);
+  } finally {
+    rmSync7(temporary, { force: true });
+  }
+}
+function updateJevDelivery(home, id) {
+  const item = readJevObservation(home, id);
+  if (item.delivery !== "pending") throw new Error("jev_observation_not_pending");
+  writeJevObservation(home, { ...item, delivery: "delivered" });
+}
+function reviewJevObservation(home, id, verdict, note = "") {
+  const item = readJevObservation(home, id);
+  const adviceDelivered = item.delivery === "delivered" && item.selectedRef !== null;
+  if (item.delivery === "pending" || item.delivery === "suppressed" || adviceDelivered && !["correct", "incorrect", "unclear"].includes(verdict) || !adviceDelivered && !["missed", "none", "unclear"].includes(verdict)) throw new Error("jev_review_verdict_invalid");
+  const updated = { ...item, review: { verdict, note, reviewedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+  writeJevObservation(home, updated);
+  return updated;
+}
+
 // ../../packages/core/dist/env.js
 var import_semver = __toESM(require_semver2(), 1);
 function fingerprint2() {
@@ -17410,10 +17467,10 @@ function environmentAppliesToTask(environment, taskText, hostPlatform2) {
 }
 
 // ../../packages/core/dist/id.js
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 function randomHex(hexChars) {
   const bytes = Math.ceil(hexChars / 2);
-  return randomBytes4(bytes).toString("hex").slice(0, hexChars);
+  return randomBytes5(bytes).toString("hex").slice(0, hexChars);
 }
 function slugify(title, now2 = () => /* @__PURE__ */ new Date()) {
   const lowered = title.toLowerCase();
@@ -17438,7 +17495,7 @@ function generateSourceSession(now2 = () => /* @__PURE__ */ new Date()) {
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, writeFileSync as writeFileSync11 } from "node:fs";
 import { dirname as dirname9 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
@@ -17458,13 +17515,13 @@ ${body}${body ? "\n" : ""}`;
 }
 function writeEntryFile(filePath, content) {
   const dir = dirname9(filePath);
-  if (!existsSync17(dir)) mkdirSync9(dir, { recursive: true });
-  writeFileSync10(filePath, content, "utf-8");
+  if (!existsSync18(dir)) mkdirSync10(dir, { recursive: true });
+  writeFileSync11(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
 import { statSync as statSync8 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
   const now2 = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -17500,7 +17557,7 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join14(opts.entriesRoot, relPath);
+  const filePath = join15(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
   const stat = statSync8(filePath);
   upsertEntry(opts.db, {
@@ -17530,8 +17587,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync15, statSync as statSync9, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readFileSync as readFileSync16, statSync as statSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join16 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -17550,8 +17607,8 @@ function updateEntry(id, patch, opts) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join15(opts.entriesRoot, relPath);
-  const raw = readFileSync15(filePath, "utf-8");
+  const filePath = join16(opts.entriesRoot, relPath);
+  const raw = readFileSync16(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -17592,7 +17649,7 @@ function updateEntry(id, patch, opts) {
     }
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
-  writeFileSync11(filePath, built.content, "utf-8");
+  writeFileSync12(filePath, built.content, "utf-8");
   const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
@@ -17629,16 +17686,16 @@ function markHit(db, keys, now2 = () => (/* @__PURE__ */ new Date()).toISOString
 }
 
 // ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync10, renameSync as renameSync5, statSync as statSync10, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join16, resolve as resolve3 } from "node:path";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync11, renameSync as renameSync6, statSync as statSync10, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join17, resolve as resolve3 } from "node:path";
 var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
 var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
 var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
 var fsDependencies = {
   appendFileSync,
   chmodSync: chmodSync2,
-  mkdirSync: mkdirSync10,
-  renameSync: renameSync5,
+  mkdirSync: mkdirSync11,
+  renameSync: renameSync6,
   statSync: statSync10,
   unlinkSync: unlinkSync3
 };
@@ -17654,8 +17711,8 @@ function chmodExistingFile(path, dependencies) {
 }
 function logHookQueryMiss(miss, dependencies = fsDependencies) {
   if (process.env[CAVEAT_HOOK_QUERY_LOG_ENV] !== "on") return;
-  const metricsDir = join16(resolve3(miss.caveatHome), "metrics");
-  const activePath = join16(metricsDir, "hook-search-misses.jsonl");
+  const metricsDir = join17(resolve3(miss.caveatHome), "metrics");
+  const activePath = join17(metricsDir, "hook-search-misses.jsonl");
   const backupPath = `${activePath}.1`;
   const record = JSON.stringify({
     at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -17696,15 +17753,15 @@ function logHookQueryMiss(miss, dependencies = fsDependencies) {
 }
 
 // ../../packages/core/dist/proposalEval.js
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { isAbsolute as isAbsolute2, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // ../../packages/core/dist/proposalExecution.js
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { basename as basename3, isAbsolute as isAbsolute3 } from "node:path";
 
 // ../../packages/core/dist/proposalExecutionCompiler.js
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 
 export {
   __commonJS,
@@ -17778,7 +17835,12 @@ export {
   runtimeErrorsSnapshot,
   acknowledgeRuntimeErrors,
   setRuntimeErrorStatus,
-  compactRuntimeErrors
+  compactRuntimeErrors,
+  jevObservationId,
+  listJevObservations,
+  writeJevObservation,
+  updateJevDelivery,
+  reviewJevObservation
 };
 /*! Bundled license information:
 
@@ -17801,4 +17863,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-ITQLGM4K.js.map
+//# sourceMappingURL=chunk-PFYFYJNS.js.map