caveat-cli 0.20.1 → 0.20.3

package/README.md

@@ -146,6 +146,14 @@ are `ack <cursor>`, `resolve <fingerprint>`, `reopen <fingerprint>`, and
 boolean `true` keeps collection disabled. Runtime state lives under Caveat's
 own state directory, independently of the knowledge index and host hook files.
 
+Handled sync cancellation and remote failures retain local input and show a
+non-zero result without automatic app repair registration. Failed recovery is
+still reported. Severity uses observed impact (`warn` for a failed operation,
+`high` for an unavailable feature or failed recovery, `fatal` for confirmed data
+loss); occurrence counts do not raise it. Existing serious unresolved records
+remain unchanged until reviewed. Cause and recovery need diagnostic evidence.
+See the [reporting contract](https://github.com/kitepon/Caveat/blob/main/docs/01_plan.md#通信失敗の報告と重大度).
+
 Nothing is sent anywhere by default and the package contains no destination.
 To report to a collector you operate, also set
 `"runtimeErrorReportCredentialFile"` to the absolute path of the credential

package/dist/{chunk-G52CLPRY.js → chunk-TGIVITP4.js}

@@ -8976,16 +8976,22 @@ function openDb(opts) {
   const parent = dirname(opts.path);
   if (!existsSync(parent)) mkdirSync(parent, { recursive: true });
   const db = new DatabaseSync(opts.path);
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
-  const { user_version } = db.prepare("PRAGMA user_version").get();
-  if (user_version === 0) {
-    db.exec(readFileSync(SCHEMA_PATH, "utf-8"));
-  } else {
-    applyMigrations(db, user_version);
-    backfillRoleTexts(db);
+  try {
+    db.exec("PRAGMA busy_timeout = 1000");
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA foreign_keys = ON");
+    const { user_version } = db.prepare("PRAGMA user_version").get();
+    if (user_version === 0) {
+      db.exec(readFileSync(SCHEMA_PATH, "utf-8"));
+    } else {
+      applyMigrations(db, user_version);
+      backfillRoleTexts(db);
+    }
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
   }
-  return db;
 }
 function backfillRoleTexts(db) {
   let rows;
@@ -15307,6 +15313,34 @@ var SyncError = class extends Error {
   }
   code;
 };
+var SyncRemoteError = class extends Error {
+  constructor(phase, cause) {
+    super(`sync ${phase} did not complete; local entries are retained; remote result may be unknown: ${errorMessage2(cause)}`, { cause });
+    this.phase = phase;
+    this.name = "SyncRemoteError";
+  }
+  phase;
+};
+var SyncRecoveryError = class extends Error {
+  constructor(cause) {
+    super("sync recovery failed; inspect the local rebase before retrying", { cause });
+    this.name = "SyncRecoveryError";
+  }
+};
+async function remoteOperation(phase, run) {
+  try {
+    return await run();
+  } catch (cause) {
+    throw new SyncRemoteError(phase, cause);
+  }
+}
+async function activeRebase(git, ownDir) {
+  for (const name of ["rebase-merge", "rebase-apply"]) {
+    const path = (await git.raw(["rev-parse", "--git-path", name])).trim();
+    if (existsSync8(resolve(ownDir, path))) return true;
+  }
+  return false;
+}
 function normalizePath(path) {
   return normalizePathCase(resolve(path).replace(/\\/g, "/"));
 }
@@ -15353,6 +15387,9 @@ async function preflightSync(ownDir, opts = {}) {
   if (normalizePath(root) !== normalizePath(requested)) {
     throw new SyncError("EXTERNAL_TOPLEVEL", `EXTERNAL_TOPLEVEL: own directory must be the repository root: ${requested} (root: ${root})`);
   }
+  if (await activeRebase(git, requested)) {
+    throw new SyncError("REBASE_IN_PROGRESS", "a rebase is already active; inspect and finish or abort it before syncing");
+  }
   let branch;
   try {
     branch = (await git.raw(["symbolic-ref", "--short", "HEAD"])).trim();
@@ -15399,23 +15436,32 @@ async function syncOwn(opts) {
     await git.commit(`caveat sync: ${changed} changed file${changed === 1 ? "" : "s"}`);
     committed = true;
   }
-  const remoteBranch = (await git.raw(["ls-remote", "--heads", "origin", preflight.branch])).trim();
+  const remoteBranch = (await remoteOperation("inspect", () => git.raw(["ls-remote", "--heads", "origin", preflight.branch]))).trim();
   let pulled = false;
   if (remoteBranch) {
     try {
       await git.pull("origin", preflight.branch, ["--rebase"]);
       pulled = true;
     } catch (err) {
+      let rebasing;
+      try {
+        rebasing = await activeRebase(git, preflight.ownDir);
+      } catch (cause) {
+        throw new SyncRecoveryError(cause);
+      }
+      if (!rebasing) throw new SyncRemoteError("pull", err);
       try {
         await git.raw(["rebase", "--abort"]);
-      } catch {
+        if (await activeRebase(git, preflight.ownDir)) throw Error("rebase still active");
+      } catch (cause) {
+        throw new SyncRecoveryError(cause);
       }
       const detail = err instanceof Error ? err.message : String(err);
       throw new SyncError("SYNC_CONFLICT", `sync rebase failed and was aborted: ${detail}`);
     }
   }
   await reindexAndMark(opts);
-  await git.push("origin", preflight.branch, ["-u"]);
+  await remoteOperation("push", () => git.push("origin", preflight.branch, ["-u"]));
   return {
     ...preflight,
     committed,
@@ -15465,10 +15511,10 @@ function removeCanonicalScaffoldBeforeCheckout(ownDir) {
   }
 }
 async function defaultRemoteBranch(git, url) {
-  const symref = await git.raw(["ls-remote", "--symref", url, "HEAD"]);
+  const symref = await remoteOperation("inspect", () => git.raw(["ls-remote", "--symref", url, "HEAD"]));
   const match = /^ref: refs\/heads\/([^\s]+)\s+HEAD$/m.exec(symref);
   if (match) return match[1];
-  const heads = await git.raw(["ls-remote", "--heads", url]);
+  const heads = await remoteOperation("inspect", () => git.raw(["ls-remote", "--heads", url]));
   const first2 = /refs\/heads\/([^\s]+)\s*$/m.exec(heads);
   if (!first2) throw new Error(`remote has refs but no branch heads: ${url}`);
   return first2[1];
@@ -15481,7 +15527,7 @@ async function initOwnSync(opts) {
     throw new SyncError("OWN_REPO_EXISTS", `own knowledge directory is already a git repository: ${ownDir}`);
   }
   const inspector = createGit(ownDir);
-  const refs = (await inspector.raw(["ls-remote", "--heads", opts.url])).trim();
+  const refs = (await remoteOperation("inspect", () => inspector.raw(["ls-remote", "--heads", opts.url]))).trim();
   const entryCount = countMarkdownEntries(ownDir);
   if (refs && entryCount > 0) {
     throw new SyncError("BOTH_HAVE_ENTRIES", "local and remote both contain entries; resolve the ownership conflict before initializing sync");
@@ -15497,12 +15543,12 @@ async function initOwnSync(opts) {
       await git.add("-A");
       await git.commit(`caveat sync: initial import (${entryCount} entries)`);
       const branch2 = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
-      await git.push("origin", branch2, ["-u"]);
+      await remoteOperation("push", () => git.push("origin", branch2, ["-u"]));
       await reindexAndMark(opts);
       return { ownDir, branch: branch2, remoteWasEmpty: true };
     }
     const branch = await defaultRemoteBranch(git, opts.url);
-    await git.fetch("origin", branch);
+    await remoteOperation("fetch", () => git.fetch("origin", branch));
     removeCanonicalScaffoldBeforeCheckout(ownDir);
     await git.checkout(["--track", "-B", branch, `origin/${branch}`]);
     await reindexAndMark(opts);
@@ -15510,7 +15556,8 @@ async function initOwnSync(opts) {
   } catch (err) {
     try {
       rmSync4(createdGitDir, { recursive: true, force: true });
-    } catch {
+    } catch (cause) {
+      throw new SyncRecoveryError(cause);
     }
     throw err;
   }
@@ -15594,13 +15641,20 @@ function classifyOwnSyncOutcome(err, lastProbe) {
       return "skip";
     case "REMOTE_PUBLIC":
     case "SYNC_CONFLICT":
+    case "REBASE_IN_PROGRESS":
       return "fail";
     case "REMOTE_VISIBILITY_INDETERMINATE":
       return lastProbe?.kind === "indeterminate" && lastProbe.reason === PROBE_REQUEST_FAILED_REASON ? "network-skip" : "fail";
   }
 }
+function syncFailureCode(err) {
+  if (err instanceof SyncError) return err.code;
+  if (err instanceof SyncRemoteError) return `REMOTE_${err.phase.toUpperCase()}_FAILED`;
+  if (err instanceof SyncRecoveryError) return "RECOVERY_FAILED";
+  return "UNKNOWN";
+}
 function ownSyncFailureSignature(err) {
-  const code = err instanceof SyncError ? err.code : "UNKNOWN";
+  const code = syncFailureCode(err);
   return sha256(code);
 }
 function autoSyncNotification(outcome) {
@@ -15673,8 +15727,8 @@ async function runAutoSync(opts) {
         ownSyncState = { consecutiveFailureSignature: null, consecutiveFailureCount: 0 };
       } catch (err) {
         const disposition = classifyOwnSyncOutcome(err, lastProbe);
-        const code = err instanceof SyncError ? err.code : void 0;
-        own = { disposition, code };
+        const code = syncFailureCode(err);
+        own = { disposition, code: code === "UNKNOWN" ? void 0 : code };
         if (disposition === "fail") {
           const failureSignature = ownSyncFailureSignature(err);
           const consecutiveFailureCount = ownSyncState.consecutiveFailureSignature === failureSignature ? ownSyncState.consecutiveFailureCount + 1 : 1;
@@ -17105,15 +17159,25 @@ var STATE_VERSION = "1.0";
 var MAX_RECORDS = 256;
 var RETENTION_MS = 30 * 864e5;
 var definitions = {
-  "CAVEAT.DATABASE_OPEN_FAILED": { component: "database", severity: "high", template: "Caveat database open failed" },
-  "CAVEAT.INDEX_FAILED": { component: "index", severity: "high", template: "Caveat index operation failed" },
-  "CAVEAT.SYNC_FAILED": { component: "sync", severity: "high", template: "Caveat own sync failed" },
-  "CAVEAT.MCP_SERVER_FAILED": { component: "mcp", severity: "high", template: "Caveat MCP server failed" },
-  "CAVEAT.MCP_TOOL_FAILED": { component: "mcp_tool", severity: "high", template: "Caveat MCP tool handler failed" },
-  "CAVEAT.CLAUDE_HOOK_FAILED": { component: "claude_hook", severity: "high", template: "Caveat Claude hook failed" },
-  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", severity: "high", template: "Caveat Codex hook failed" },
-  "CAVEAT.CURSOR_HOOK_FAILED": { component: "cursor_hook", severity: "high", template: "Caveat Cursor hook failed" }
+  "CAVEAT.DATABASE_OPEN_FAILED": { component: "database", template: "Caveat database open failed" },
+  "CAVEAT.INDEX_FAILED": { component: "index", template: "Caveat index operation failed" },
+  "CAVEAT.SYNC_FAILED": { component: "sync", template: "Caveat own sync failed" },
+  "CAVEAT.MCP_SERVER_FAILED": { component: "mcp", template: "Caveat MCP server failed" },
+  "CAVEAT.MCP_TOOL_FAILED": { component: "mcp_tool", template: "Caveat MCP tool handler failed" },
+  "CAVEAT.CLAUDE_HOOK_FAILED": { component: "claude_hook", template: "Caveat Claude hook failed" },
+  "CAVEAT.CODEX_HOOK_FAILED": { component: "codex_hook", template: "Caveat Codex hook failed" },
+  "CAVEAT.CURSOR_HOOK_FAILED": { component: "cursor_hook", template: "Caveat Cursor hook failed" }
 };
+function runtimeErrorSeverity(impact) {
+  if (impact === "data_lost") return "fatal";
+  if (impact === "operation_failed") return "warn";
+  if (impact === void 0 || impact === "feature_unavailable" || impact === "recovery_failed" || impact === "mutation_outcome_unverified") return "high";
+  throw Error("invalid_runtime_impact");
+}
+function highestSeverity(previous, current) {
+  const rank = ["info", "warn", "high", "fatal"];
+  return rank.indexOf(previous) >= rank.indexOf(current) ? previous : current;
+}
 function normalizeOptions(options2 = {}) {
   return "env" in options2 || "configPath" in options2 || "storePath" in options2 || "version" in options2 || "isWindows" in options2 ? options2 : { env: options2 };
 }
@@ -17188,7 +17252,7 @@ function validate(store) {
     if (!plain(record) || !exact(record, ["product", "product_version", "component", "error_code", "message_template", "severity", "fingerprint", "count", "first_seen", "last_seen", "state_schema_version", "os", "arch", "status", "resolved_at", "reason_code", "sequence"])) throw Error("state_invalid");
     const code = typeof record.error_code === "string" ? record.error_code : void 0;
     const d = code && definitions[code];
-    if (!d || record.product !== "caveat" || !validVersion(record.product_version) || record.component !== d.component || record.message_template !== d.template || record.severity !== d.severity || record.fingerprint !== fingerprint(code) || seen.has(record.fingerprint) || !Number.isSafeInteger(record.count) || record.count < 1 || !validTime(record.first_seen) || !validTime(record.last_seen) || Date.parse(record.first_seen) > Date.parse(record.last_seen) || record.state_schema_version !== STATE_VERSION || !validOs(record.os) || !validArch(record.arch) || !Number.isSafeInteger(record.sequence) || record.sequence <= previous || record.sequence >= checked.next_sequence || !["open", "resolved"].includes(record.status) || record.status === "open" && (record.resolved_at !== null || record.reason_code !== null) || record.status === "resolved" && (typeof record.resolved_at !== "string" || !validTime(record.resolved_at) || Date.parse(record.resolved_at) < Date.parse(record.last_seen) || record.reason_code !== "operator_resolved")) throw Error("state_invalid");
+    if (!d || record.product !== "caveat" || !validVersion(record.product_version) || record.component !== d.component || record.message_template !== d.template || !["fatal", "high", "warn", "info"].includes(record.severity) || record.fingerprint !== fingerprint(code) || seen.has(record.fingerprint) || !Number.isSafeInteger(record.count) || record.count < 1 || !validTime(record.first_seen) || !validTime(record.last_seen) || Date.parse(record.first_seen) > Date.parse(record.last_seen) || record.state_schema_version !== STATE_VERSION || !validOs(record.os) || !validArch(record.arch) || !Number.isSafeInteger(record.sequence) || record.sequence <= previous || record.sequence >= checked.next_sequence || !["open", "resolved"].includes(record.status) || record.status === "open" && (record.resolved_at !== null || record.reason_code !== null) || record.status === "resolved" && (typeof record.resolved_at !== "string" || !validTime(record.resolved_at) || Date.parse(record.resolved_at) < Date.parse(record.last_seen) || record.reason_code !== "operator_resolved")) throw Error("state_invalid");
     seen.add(record.fingerprint);
     previous = record.sequence;
   }
@@ -17296,6 +17360,7 @@ function recordRuntimeError(code, options2 = {}) {
     const definition = definitions[code];
     if (!definition) throw Error("unknown_runtime_code");
     const key = fingerprint(code);
+    const severity = runtimeErrorSeverity(options2.impact);
     const sequence = store.next_sequence++;
     const time = now(options2);
     const existing = store.records.find((r2) => r2.fingerprint === key);
@@ -17308,6 +17373,7 @@ function recordRuntimeError(code, options2 = {}) {
       existing.os = os;
       existing.arch = arch;
       existing.count += 1;
+      existing.severity = existing.status === "resolved" ? severity : highestSeverity(existing.severity, severity);
       existing.last_seen = time;
       existing.sequence = sequence;
       existing.status = "open";
@@ -17315,7 +17381,7 @@ function recordRuntimeError(code, options2 = {}) {
       existing.reason_code = null;
     } else {
       if (store.records.length >= MAX_RECORDS) throw Error("store_overflow");
-      store.records.push({ product: "caveat", product_version: version, component: definition.component, error_code: code, message_template: definition.template, severity: definition.severity, fingerprint: key, count: 1, first_seen: time, last_seen: time, state_schema_version: STATE_VERSION, os, arch, status: "open", resolved_at: null, reason_code: null, sequence });
+      store.records.push({ product: "caveat", product_version: version, component: definition.component, error_code: code, message_template: definition.template, severity, fingerprint: key, count: 1, first_seen: time, last_seen: time, state_schema_version: STATE_VERSION, os, arch, status: "open", resolved_at: null, reason_code: null, sequence });
     }
     store.records.sort((a, b2) => a.sequence - b2.sequence);
     writeStore(path, store, isWin, options2);
@@ -17379,11 +17445,82 @@ function compactRuntimeErrors(options2 = {}) {
 }
 var runtimeErrorsInternal = { validate, definitions, collectionEnabled, optionsFor, lock, readStore, ensureSafeDir, ensureSafeFile, secureWindowsAcl, assertPosix, now, validVersion };
 
+// ../../packages/core/dist/hookDiagnostics.js
+import { existsSync as existsSync17, readFileSync as readFileSync15, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname9, join as join14 } from "node:path";
+import { randomBytes as randomBytes4 } from "node:crypto";
+var phases = ["json parse error", "context error", "search error", "markHit error", "query log error"];
+var kinds = ["invalid_json", "sqlite_busy", "sqlite_readonly", "sqlite_corrupt", "permission_denied", "missing_path", "other"];
+var codes = ["CAVEAT.CLAUDE_HOOK_FAILED", "CAVEAT.CODEX_HOOK_FAILED", "CAVEAT.CURSOR_HOOK_FAILED"];
+var SCHEMA = "caveat.local_hook_diagnostics.v1";
+var MAX_DETAILS = 64;
+function hookDiagnosticKind(error) {
+  if (error instanceof SyntaxError) return "invalid_json";
+  if (typeof error !== "object" || error === null) return "other";
+  const err = error;
+  if (err.code === "ERR_SQLITE_ERROR" && Number.isInteger(err.errcode)) {
+    const code = err.errcode & 255;
+    if (code === 5 || code === 6) return "sqlite_busy";
+    if (code === 8) return "sqlite_readonly";
+    if (code === 11 || code === 26) return "sqlite_corrupt";
+  }
+  if (err.code === "EACCES" || err.code === "EPERM") return "permission_denied";
+  if (err.code === "ENOENT") return "missing_path";
+  return "other";
+}
+function readDetails(path, isWin, options2) {
+  if (!existsSync17(path)) return [];
+  runtimeErrorsInternal.ensureSafeFile(path, isWin, options2);
+  const value = JSON.parse(readFileSync15(path, "utf8"));
+  if (!value || Object.keys(value).sort().join(",") !== "records,schema" || value.schema !== SCHEMA || !Array.isArray(value.records) || value.records.length > MAX_DETAILS) throw Error("hook_diagnostics_invalid");
+  for (const record of value.records) {
+    if (!record || Object.keys(record).sort().join(",") !== "at,error_code,kind,phase,version" || !Number.isFinite(Date.parse(record.at)) || new Date(record.at).toISOString() !== record.at || !runtimeErrorsInternal.validVersion(record.version) || !codes.includes(record.error_code) || !phases.includes(record.phase) || !kinds.includes(record.kind)) throw Error("hook_diagnostics_invalid");
+  }
+  return value.records;
+}
+function observeHookDiagnostic(errorCode, phase, error, options2 = {}) {
+  if (!runtimeErrorsInternal.collectionEnabled(options2)) return;
+  try {
+    if (!codes.includes(errorCode) || !phases.includes(phase)) throw Error("hook_diagnostics_invalid");
+    const { path: storePath, isWin } = runtimeErrorsInternal.optionsFor(options2);
+    const path = join14(dirname9(storePath), "hook-diagnostics.json");
+    runtimeErrorsInternal.lock(path, isWin, () => {
+      const records = readDetails(path, isWin, options2);
+      const version = options2.version ?? "0.0.0";
+      if (!runtimeErrorsInternal.validVersion(version)) throw Error("hook_diagnostics_invalid");
+      records.push({ at: runtimeErrorsInternal.now(options2), version, error_code: errorCode, phase, kind: hookDiagnosticKind(error) });
+      const temporary = join14(dirname9(path), `.hook-diagnostics-${process.pid}-${randomBytes4(6).toString("hex")}`);
+      try {
+        writeFileSync10(temporary, JSON.stringify({ schema: SCHEMA, records: records.slice(-MAX_DETAILS) }) + "\n", { mode: 384, flag: "wx" });
+        if (isWin) runtimeErrorsInternal.secureWindowsAcl(temporary, options2.aclRunner, false, true);
+        runtimeErrorsInternal.ensureSafeFile(temporary, isWin, options2);
+        renameSync5(temporary, path);
+      } finally {
+        rmSync7(temporary, { force: true });
+      }
+    }, options2);
+  } catch {
+    try {
+      process.stderr.write("[caveat:hook-diagnostics] unavailable\n");
+    } catch {
+    }
+  }
+}
+function localHookDiagnostics(options2 = {}) {
+  if (!runtimeErrorsInternal.collectionEnabled(options2)) return { schema: SCHEMA, status: "disabled", records: [] };
+  try {
+    const { path: storePath, isWin } = runtimeErrorsInternal.optionsFor(options2);
+    return { schema: SCHEMA, status: "ready", records: readDetails(join14(dirname9(storePath), "hook-diagnostics.json"), isWin, options2) };
+  } catch {
+    return { schema: SCHEMA, status: "unavailable", records: [] };
+  }
+}
+
 // ../../packages/core/dist/runtimeErrorReport.js
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash8, createHmac as createHmac2, randomBytes as randomBytes4, randomUUID, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-import { closeSync as closeSync2, constants, existsSync as existsSync17, fstatSync, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync15, renameSync as renameSync5, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname9, isAbsolute as isAbsolute2, join as join14 } from "node:path";
+import { createHash as createHash8, createHmac as createHmac2, randomBytes as randomBytes5, randomUUID, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { closeSync as closeSync2, constants, existsSync as existsSync18, fstatSync, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync16, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname10, isAbsolute as isAbsolute2, join as join15 } from "node:path";
 var RUNTIME_ERROR_REPORT_SCHEMA_VERSION = "1.0";
 var REPORT_STATE_SCHEMA = "caveat.runtime_error_report_state.v1";
 var REPORT_STATUS_SCHEMA = "caveat.runtime_error_report_status.v1";
@@ -17426,7 +17563,7 @@ var validTime2 = (v) => typeof v === "string" && Number.isFinite(Date.parse(v))
 var emptyState = () => ({ schema: REPORT_STATE_SCHEMA, last_attempt_at: null, last_outcome: null, last_accepted_at: null, next_attempt_at: null });
 var result = (status, outcome = null, counts = {}) => ({ schema: REPORT_RESULT_SCHEMA, status, outcome, runtime_error_count: counts.errors ?? 0, resolution_count: counts.resolutions ?? 0, acknowledged_through: counts.acknowledged ?? null });
 function reportStatePath(storePath) {
-  return join14(dirname9(storePath), "runtime-error-report.json");
+  return join15(dirname10(storePath), "runtime-error-report.json");
 }
 function configuredCredentialPath(options2) {
   try {
@@ -17460,7 +17597,7 @@ function loadCredential(path, isWin, options2) {
     try {
       const after = fstatSync(fd);
       if (before.dev !== after.dev || before.ino !== after.ino || after.size > MAX_CREDENTIAL_BYTES) throw new ReportFailure("credential_unsafe");
-      text = readFileSync15(fd, "utf8");
+      text = readFileSync16(fd, "utf8");
     } finally {
       closeSync2(fd);
     }
@@ -17499,7 +17636,7 @@ function sameHex(expected, actual) {
 }
 function readReportState(path) {
   try {
-    const value = JSON.parse(readFileSync15(path, "utf8"));
+    const value = JSON.parse(readFileSync16(path, "utf8"));
     if (!plain2(value) || value.schema !== REPORT_STATE_SCHEMA) return emptyState();
     const time = (v) => validTime2(v) ? v : null;
     const outcome = typeof value.last_outcome === "string" && Object.hasOwn(OUTCOME_RETRY_MS, value.last_outcome) ? value.last_outcome : null;
@@ -17509,23 +17646,23 @@ function readReportState(path) {
   }
 }
 function writeReportState(path, state, isWin, options2) {
-  ensureSafeDir2(dirname9(path), isWin, options2);
-  const temporary = join14(dirname9(path), `.runtime-error-report-${process.pid}-${randomBytes4(6).toString("hex")}`);
+  ensureSafeDir2(dirname10(path), isWin, options2);
+  const temporary = join15(dirname10(path), `.runtime-error-report-${process.pid}-${randomBytes5(6).toString("hex")}`);
   try {
-    writeFileSync10(temporary, `${JSON.stringify(state)}
+    writeFileSync11(temporary, `${JSON.stringify(state)}
 `, { mode: 384, flag: "wx" });
     if (isWin) secureWindowsAcl2(temporary, options2.aclRunner, false, true);
     else assertPosix2(lstatSync2(temporary), 384);
-    renameSync5(temporary, path);
+    renameSync6(temporary, path);
   } finally {
-    rmSync7(temporary, { force: true });
+    rmSync8(temporary, { force: true });
   }
 }
 function nextState(previous, outcome, at) {
   return { schema: REPORT_STATE_SCHEMA, last_attempt_at: at, last_outcome: outcome, last_accepted_at: outcome === "accepted" ? at : previous.last_accepted_at, next_attempt_at: new Date(Date.parse(at) + OUTCOME_RETRY_MS[outcome]).toISOString() };
 }
 function claimPending(storePath, isWin, at, options2) {
-  if (!existsSync17(storePath)) return "nothing_pending";
+  if (!existsSync18(storePath)) return "nothing_pending";
   return lock2(storePath, isWin, () => {
     const statePath = reportStatePath(storePath);
     const state = readReportState(statePath);
@@ -17629,8 +17766,8 @@ function runtimeErrorReportDue(options2 = {}) {
   try {
     if (!collectionEnabled2(options2) || configuredCredentialPath(options2) === null) return false;
     const { path: storePath } = optionsFor2(options2);
-    if (!existsSync17(storePath)) return false;
-    const store = JSON.parse(readFileSync15(storePath, "utf8"));
+    if (!existsSync18(storePath)) return false;
+    const store = JSON.parse(readFileSync16(storePath, "utf8"));
     if (!plain2(store) || typeof store.next_sequence !== "number" || typeof store.acknowledged_through !== "number" || store.next_sequence - 1 <= store.acknowledged_through) return false;
     const next = readReportState(reportStatePath(storePath)).next_attempt_at;
     return next === null || Date.parse(now2(options2)) >= Date.parse(next);
@@ -17644,7 +17781,7 @@ function runtimeErrorReportStatus(options2 = {}) {
   if (configuredCredentialPath(options2) === null) return { ...base, reporting: "not_configured", status: "not_applicable" };
   try {
     const { path: storePath, isWin } = optionsFor2(options2);
-    const store = existsSync17(storePath) ? readStore2(storePath, isWin, options2) : null;
+    const store = existsSync18(storePath) ? readStore2(storePath, isWin, options2) : null;
     const state = readReportState(reportStatePath(storePath));
     return { schema: REPORT_STATUS_SCHEMA, reporting: "enabled", status: "ready", pending_count: store ? store.records.filter((record) => record.sequence > store.acknowledged_through).length : 0, last_attempt_at: state.last_attempt_at, last_outcome: state.last_outcome, last_accepted_at: state.last_accepted_at, next_attempt_at: state.next_attempt_at };
   } catch {
@@ -17653,14 +17790,14 @@ function runtimeErrorReportStatus(options2 = {}) {
 }
 
 // ../../packages/core/dist/jevObservations.js
-import { createHash as createHash9, randomBytes as randomBytes5 } from "node:crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync16, readdirSync as readdirSync9, renameSync as renameSync6, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join15 } from "node:path";
+import { createHash as createHash9, randomBytes as randomBytes6 } from "node:crypto";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync17, readdirSync as readdirSync9, renameSync as renameSync7, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join16 } from "node:path";
 var JEV_OBSERVATION_SCHEMA = "caveat.jev_observation.v1";
-var directory = (home) => join15(home, "jev-observations");
+var directory = (home) => join16(home, "jev-observations");
 var pathFor = (home, id) => {
   if (!/^[0-9a-f]{64}$/.test(id)) throw new Error("jev_observation_id_invalid");
-  return join15(directory(home), `${id}.json`);
+  return join16(directory(home), `${id}.json`);
 };
 function jevObservationId(host, sessionId, turnKey) {
   return createHash9("sha256").update(`${host}\0${sessionId}\0${turnKey}`).digest("hex");
@@ -17671,14 +17808,14 @@ function validate2(value) {
   if (item.schema !== JEV_OBSERVATION_SCHEMA || typeof item.id !== "string" || !/^[0-9a-f]{64}$/.test(item.id) || !["claude", "codex"].includes(item.host) || typeof item.observedAt !== "string" || typeof item.sessionId !== "string" || typeof item.projectRoot !== "string" || typeof item.transcriptPath !== "string" || !Array.isArray(item.turns) || item.turns.some((turn) => typeof turn.originSessionId !== "string" || !Number.isSafeInteger(turn.turnNumber) || typeof turn.truncated !== "boolean") || typeof item.thinkingAvailable !== "boolean" || typeof item.model !== "string" || ![item.repeatedProblem, item.clearlyStuck, item.struggleThreshold, item.matchThreshold].every((score) => typeof score === "number" && Number.isFinite(score) && score >= 0 && score <= 1) || typeof item.struggling !== "boolean" || !Array.isArray(item.termChoices) || item.termChoices.some((choice) => typeof choice.term !== "string" || typeof choice.probability !== "number") || item.noneProbability !== null && typeof item.noneProbability !== "number" || !Array.isArray(item.selectedTerms) || item.selectedTerms.some((term) => typeof term !== "string") || typeof item.query !== "string" || !Array.isArray(item.ftsHits) || item.ftsHits.some((ref) => typeof ref !== "string") || !Array.isArray(item.candidates) || item.candidates.some((candidate) => typeof candidate.ref !== "string" || typeof candidate.score !== "number" || !Number.isFinite(candidate.score)) || item.selectedRef !== null && typeof item.selectedRef !== "string" || item.noticeText !== null && typeof item.noticeText !== "string" || !["below_struggle_threshold", "no_terms", "no_candidates", "below_match_threshold", "matched"].includes(item.decision) || !["none", "pending", "delivered", "suppressed"].includes(item.delivery) || item.review !== null && (!item.review || typeof item.review !== "object" || !["correct", "incorrect", "missed", "none", "unclear"].includes(item.review.verdict) || typeof item.review.note !== "string" || typeof item.review.reviewedAt !== "string")) throw new Error("jev_observation_invalid");
 }
 function readJevObservation(home, id) {
-  const value = JSON.parse(readFileSync16(pathFor(home, id), "utf8"));
+  const value = JSON.parse(readFileSync17(pathFor(home, id), "utf8"));
   validate2(value);
   if (value.id !== id) throw new Error("jev_observation_id_mismatch");
   return value;
 }
 function listJevObservations(home) {
   const dir = directory(home);
-  if (!existsSync18(dir)) return [];
+  if (!existsSync19(dir)) return [];
   return readdirSync9(dir).filter((name) => /^[0-9a-f]{64}\.json$/.test(name)).map((name) => readJevObservation(home, name.slice(0, -5))).sort((a, b2) => b2.observedAt.localeCompare(a.observedAt) || b2.id.localeCompare(a.id));
 }
 function writeJevObservation(home, item) {
@@ -17686,13 +17823,13 @@ function writeJevObservation(home, item) {
   const dir = directory(home);
   mkdirSync9(dir, { recursive: true, mode: 448 });
   const path = pathFor(home, item.id);
-  const temporary = `${path}.${randomBytes5(6).toString("hex")}.tmp`;
+  const temporary = `${path}.${randomBytes6(6).toString("hex")}.tmp`;
   try {
-    writeFileSync11(temporary, `${JSON.stringify(item)}
+    writeFileSync12(temporary, `${JSON.stringify(item)}
 `, { encoding: "utf8", mode: 384, flag: "wx" });
-    renameSync6(temporary, path);
+    renameSync7(temporary, path);
   } finally {
-    rmSync8(temporary, { force: true });
+    rmSync9(temporary, { force: true });
   }
 }
 function updateJevDelivery(home, id) {
@@ -17742,10 +17879,10 @@ function environmentAppliesToTask(environment, taskText, hostPlatform2) {
 }
 
 // ../../packages/core/dist/id.js
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 function randomHex(hexChars) {
   const bytes = Math.ceil(hexChars / 2);
-  return randomBytes6(bytes).toString("hex").slice(0, hexChars);
+  return randomBytes7(bytes).toString("hex").slice(0, hexChars);
 }
 function slugify(title, now3 = () => /* @__PURE__ */ new Date()) {
   const lowered = title.toLowerCase();
@@ -17770,8 +17907,8 @@ function generateSourceSession(now3 = () => /* @__PURE__ */ new Date()) {
 }
 
 // ../../packages/core/dist/writer.js
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname10 } from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync10, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname11 } from "node:path";
 function buildEntry(frontmatter, sections) {
   const bodyParts = [];
   for (const [heading, content2] of Object.entries(sections)) {
@@ -17789,14 +17926,14 @@ ${body}${body ? "\n" : ""}`;
   return { content, body };
 }
 function writeEntryFile(filePath, content) {
-  const dir = dirname10(filePath);
-  if (!existsSync19(dir)) mkdirSync10(dir, { recursive: true });
-  writeFileSync12(filePath, content, "utf-8");
+  const dir = dirname11(filePath);
+  if (!existsSync20(dir)) mkdirSync10(dir, { recursive: true });
+  writeFileSync13(filePath, content, "utf-8");
 }
 
 // ../../packages/core/dist/record.js
 import { statSync as statSync8 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var DEFAULT_CATEGORY = "misc";
 function recordEntry(input, opts) {
   const now3 = opts.now ?? (() => /* @__PURE__ */ new Date());
@@ -17832,7 +17969,7 @@ function recordEntry(input, opts) {
   const built = buildEntry(frontmatter, sections);
   const category = input.category ?? DEFAULT_CATEGORY;
   const relPath = `${category}/${id}.md`;
-  const filePath = join16(opts.entriesRoot, relPath);
+  const filePath = join17(opts.entriesRoot, relPath);
   writeEntryFile(filePath, built.content);
   const stat = statSync8(filePath);
   upsertEntry(opts.db, {
@@ -17862,8 +17999,8 @@ function formatYmd(d) {
 }
 
 // ../../packages/core/dist/update.js
-import { readFileSync as readFileSync17, statSync as statSync9, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join17 } from "node:path";
+import { readFileSync as readFileSync18, statSync as statSync9, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join18 } from "node:path";
 var IMMUTABLE_KEYS = /* @__PURE__ */ new Set([
   "id",
   "created_at",
@@ -17882,8 +18019,8 @@ function updateEntry(id, patch, opts) {
     throw new Error(`caveat not found: id=${id} source=${source}`);
   }
   const relPath = row.path;
-  const filePath = join17(opts.entriesRoot, relPath);
-  const raw = readFileSync17(filePath, "utf-8");
+  const filePath = join18(opts.entriesRoot, relPath);
+  const raw = readFileSync18(filePath, "utf-8");
   const parsed = parseMarkdown(raw);
   if (patch.frontmatter) {
     for (const key of Object.keys(patch.frontmatter)) {
@@ -17924,7 +18061,7 @@ function updateEntry(id, patch, opts) {
     }
   }
   const built = buildEntry(mergedFrontmatter, mergedSections);
-  writeFileSync13(filePath, built.content, "utf-8");
+  writeFileSync14(filePath, built.content, "utf-8");
   const stat = statSync9(filePath);
   upsertEntry(opts.db, {
     id,
@@ -17961,8 +18098,8 @@ function markHit(db, keys, now3 = () => (/* @__PURE__ */ new Date()).toISOString
 }
 
 // ../../packages/core/dist/hookQueryLog.js
-import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync11, renameSync as renameSync7, statSync as statSync10, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join18, resolve as resolve3 } from "node:path";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync11, renameSync as renameSync8, statSync as statSync10, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join19, resolve as resolve3 } from "node:path";
 var CAVEAT_HOOK_QUERY_LOG_ENV = "CAVEAT_HOOK_QUERY_LOG";
 var HOOK_QUERY_LOG_MAX_BYTES = 1024 * 1024;
 var HOOK_QUERY_LOG_MAX_QUERY_CODE_UNITS = 1e3;
@@ -17970,7 +18107,7 @@ var fsDependencies = {
   appendFileSync,
   chmodSync: chmodSync2,
   mkdirSync: mkdirSync11,
-  renameSync: renameSync7,
+  renameSync: renameSync8,
   statSync: statSync10,
   unlinkSync: unlinkSync3
 };
@@ -17986,8 +18123,8 @@ function chmodExistingFile(path, dependencies) {
 }
 function logHookQueryMiss(miss, dependencies = fsDependencies) {
   if (process.env[CAVEAT_HOOK_QUERY_LOG_ENV] !== "on") return;
-  const metricsDir = join18(resolve3(miss.caveatHome), "metrics");
-  const activePath = join18(metricsDir, "hook-search-misses.jsonl");
+  const metricsDir = join19(resolve3(miss.caveatHome), "metrics");
+  const activePath = join19(metricsDir, "hook-search-misses.jsonl");
   const backupPath = `${activePath}.1`;
   const record = JSON.stringify({
     at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -18070,6 +18207,9 @@ export {
   peekPendingRemindersDetailed,
   acknowledgePendingReminders,
   createKeyserverKeyProvider,
+  SyncError,
+  SyncRemoteError,
+  SyncRecoveryError,
   syncOwn,
   KNOWLEDGE_GITIGNORE,
   initOwnSync,
@@ -18111,6 +18251,8 @@ export {
   acknowledgeRuntimeErrors,
   setRuntimeErrorStatus,
   compactRuntimeErrors,
+  observeHookDiagnostic,
+  localHookDiagnostics,
   sendRuntimeErrorReport,
   runtimeErrorReportDue,
   runtimeErrorReportStatus,
@@ -18141,4 +18283,4 @@ strip-bom-string/index.js:
 js-yaml/dist/js-yaml.mjs:
   (*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT *)
 */
-//# sourceMappingURL=chunk-G52CLPRY.js.map
+//# sourceMappingURL=chunk-TGIVITP4.js.map