caveat-cli 0.7.0 → 0.11.0

package/dist/index.js

@@ -12976,7 +12976,7 @@ import { Command } from "commander";
 
 // src/context.ts
 import { homedir } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 
 // ../../packages/core/dist/db.js
 import { DatabaseSync } from "node:sqlite";
@@ -21203,56 +21203,383 @@ function communityRemove(opts) {
 }
 
 // ../../packages/core/dist/claudeHooks.js
-var CAVEAT_TRIGGERS = [
-  /\b(gpu|cuda|nvidia|amd|rtx|nvenc|nvdec|blackwell|ada|ampere)\b/i,
-  /\bdriver\b/i,
-  /ドライバ/,
-  /\b(vscode|vs\s?code|jetbrains|intellij|pycharm)\b/i,
-  /\bclaude\s?code\b/i,
-  /\b(flaky|intermittent|reproducib|reproduce|repro)\b/i,
-  /再現(しない|性|できない)/,
-  /挙動が(違|おかしい|変)/,
-  /\b(node|python|cuda|cudnn)\s*\d+(\.\d+)?/i,
-  /バージョン(依存|違い|差)/,
-  /\b(prebuild|native\s+module|msvc|gyp)\b/i
-];
-function detectCaveatTrigger(prompt) {
-  if (typeof prompt !== "string" || prompt.length === 0) return false;
-  return CAVEAT_TRIGGERS.some((re) => re.test(prompt));
+var PROMPT_TOKEN_MIN_LENGTH = 3;
+var PROMPT_MAX_CANDIDATE_TOKENS = 50;
+var DEFAULT_REMINDER_HIT_LIMIT = 5;
+var SYMPTOM_EXCERPT_LENGTH2 = 200;
+var SYMPTOM_LINE_MAX = 120;
+var MIN_DISTINCT_TOKEN_MATCHES_CEILING = 2;
+var CJK_CHAR = /[぀-ゟ゠-ヿ一-鿿ｦ-ﾟ]/;
+function isCjkDominated(token) {
+  return CJK_CHAR.test(token);
+}
+function expandToken(token, out) {
+  if (isCjkDominated(token)) {
+    if (token.length < PROMPT_TOKEN_MIN_LENGTH) return;
+    for (let i2 = 0; i2 <= token.length - PROMPT_TOKEN_MIN_LENGTH; i2++) {
+      out.push(token.slice(i2, i2 + PROMPT_TOKEN_MIN_LENGTH));
+    }
+  } else if (token.length >= PROMPT_TOKEN_MIN_LENGTH) {
+    out.push(token);
+  }
+}
+function extractPromptCandidates(prompt) {
+  if (typeof prompt !== "string" || prompt.length === 0) return [];
+  const cleaned = prompt.replace(/[^\p{L}\p{N}\s]/gu, " ");
+  const rawTokens = cleaned.split(/\s+/).filter((t2) => t2.length > 0);
+  const expanded = [];
+  for (const t2 of rawTokens) expandToken(t2, expanded);
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const t2 of expanded) {
+    const key = t2.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(t2);
+  }
+  return unique.slice(0, PROMPT_MAX_CANDIDATE_TOKENS);
+}
+function toSearchResult2(row) {
+  const fm = JSON.parse(row.frontmatter_json);
+  const symptomMatch = /##\s+Symptom\s*\n([\s\S]*?)(?=\n##|\n*$)/.exec(row.body);
+  const symptom = symptomMatch?.[1]?.trim() ?? row.body;
+  return {
+    id: row.id,
+    source: row.source,
+    title: row.title,
+    symptomExcerpt: symptom.slice(0, SYMPTOM_EXCERPT_LENGTH2),
+    confidence: row.confidence,
+    visibility: row.visibility ?? "public",
+    environment: fm.environment ?? {}
+  };
+}
+function findCaveatsForPrompt(db, prompt, opts = {}) {
+  const tokens = extractPromptCandidates(prompt);
+  if (tokens.length === 0) return [];
+  const minMatches = Math.min(MIN_DISTINCT_TOKEN_MATCHES_CEILING, tokens.length);
+  const perEntry = /* @__PURE__ */ new Map();
+  const stmt = db.prepare(
+    "SELECT e.* FROM entries_fts f JOIN entries e ON e.rowid = f.rowid WHERE entries_fts MATCH ?"
+  );
+  for (const tok of tokens) {
+    let rows = [];
+    try {
+      rows = stmt.all(`"${tok}"`);
+    } catch {
+      continue;
+    }
+    for (const row of rows) {
+      const existing = perEntry.get(row.rowid);
+      if (existing) existing.count += 1;
+      else perEntry.set(row.rowid, { count: 1, row });
+    }
+  }
+  const limit = opts.limit ?? DEFAULT_REMINDER_HIT_LIMIT;
+  return [...perEntry.values()].filter(({ count }) => count >= minMatches).sort((a, b2) => b2.count - a.count).slice(0, limit).map(({ row }) => toSearchResult2(row));
+}
+function toolErrorReminderText(hits) {
+  const lines = [];
+  lines.push(
+    `[caveat] \u76F4\u524D\u306E\u30A8\u30E9\u30FC\u306B\u4E00\u81F4\u3059\u308B\u53EF\u80FD\u6027\u306E\u3042\u308B\u65E2\u77E5\u306E\u7F60\u304C ${hits.length} \u4EF6\u3042\u308A\u307E\u3059:`
+  );
+  lines.push("");
+  hits.forEach((h2, i2) => {
+    lines.push(`${i2 + 1}. ${h2.id} (${h2.source}) \u2014 ${h2.title}`);
+    const excerpt = h2.symptomExcerpt.replace(/\s+/g, " ").trim().slice(0, SYMPTOM_LINE_MAX);
+    if (excerpt) lines.push(`   \u75C7\u72B6: ${excerpt}`);
+  });
+  lines.push("");
+  lines.push(
+    "mcp__caveat__caveat_get \u3067\u8A73\u7D30\u3092\u78BA\u8A8D\u3057\u3001documented \u306A\u5BFE\u51E6\u304C\u3042\u308C\u3070\u9069\u7528\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002"
+  );
+  return lines.join("\n");
+}
+function userPromptSubmitReminderText(hits) {
+  const lines = [];
+  lines.push(
+    `[caveat] \u3053\u306E\u30D7\u30ED\u30F3\u30D7\u30C8\u306B\u95A2\u9023\u3059\u308B\u53EF\u80FD\u6027\u306E\u3042\u308B\u65E2\u77E5\u306E\u7F60\u304C ${hits.length} \u4EF6\u3042\u308A\u307E\u3059:`
+  );
+  lines.push("");
+  hits.forEach((h2, i2) => {
+    lines.push(`${i2 + 1}. ${h2.id} (${h2.source}) \u2014 ${h2.title}`);
+    const excerpt = h2.symptomExcerpt.replace(/\s+/g, " ").trim().slice(0, SYMPTOM_LINE_MAX);
+    if (excerpt) lines.push(`   \u75C7\u72B6: ${excerpt}`);
+  });
+  lines.push("");
+  lines.push(
+    "\u8A73\u7D30\u306F mcp__caveat__caveat_get \u306B id + source \u3092\u6E21\u3057\u3066\u53D6\u5F97\u3002environment \u304C\u4E00\u81F4\u3059\u308B\u304B\u78BA\u8A8D\u3057\u3066\u304B\u3089\u9069\u7528\u5224\u65AD\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u7121\u95A2\u4FC2\u3068\u5224\u65AD\u3057\u305F\u3089\u7121\u8996\u3057\u3066\u7D9A\u884C\u3067 OK\u3002"
+  );
+  return lines.join("\n");
+}
+function shortPath(p2) {
+  const parts = p2.split(/[\\/]/);
+  return parts[parts.length - 1] ?? p2;
+}
+function stopReminderText(signals, related) {
+  const lines = [];
+  lines.push("[caveat] \u3053\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u3067\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u5F53\u305F\u3063\u305F\u53EF\u80FD\u6027\u3092\u793A\u3059\u30B7\u30B0\u30CA\u30EB:");
+  if (signals.toolFailureCount > 0) {
+    lines.push(`- tool failure: ${signals.toolFailureCount} \u4EF6`);
+  }
+  if (signals.fileEditCounts.length > 0) {
+    const top = signals.fileEditCounts.slice(0, 3).map((e) => `${shortPath(e.path)} \xD7 ${e.count}`).join(", ");
+    lines.push(`- \u540C\u4E00\u30D5\u30A1\u30A4\u30EB\u8907\u6570\u7DE8\u96C6: ${top}`);
+  }
+  if (signals.webSearchCount > 0) {
+    const sample = signals.searchQueries[0];
+    const note = sample ? ` (\u4F8B: "${sample.slice(0, 60)}")` : "";
+    lines.push(`- WebSearch: ${signals.webSearchCount} \u56DE${note}`);
+  }
+  if (signals.webFetchCount > 0) {
+    lines.push(`- WebFetch: ${signals.webFetchCount} \u56DE`);
+  }
+  if (signals.bashRetryCount > 0) {
+    lines.push(`- \u540C\u4E00 Bash \u30B3\u30DE\u30F3\u30C9\u306E\u518D\u5B9F\u884C: ${signals.bashRetryCount} \u7A2E`);
+  }
+  if (signals.durationMinutes > 0) {
+    lines.push(`- \u7D4C\u904E\u6642\u9593: ${signals.durationMinutes} \u5206`);
+  }
+  const externalLookup = signals.webSearchCount + signals.webFetchCount > 0;
+  lines.push(
+    `- \u5206\u985E\u30D2\u30F3\u30C8: ${externalLookup ? "\u5916\u90E8\u4ED5\u69D8\u8ABF\u67FB\u3042\u308A \u2192 public \u5BC4\u308A" : "\u5916\u90E8\u8ABF\u67FB\u306A\u3057 \u2192 private \u5BC4\u308A"}`
+  );
+  lines.push("");
+  if (related.length > 0) {
+    lines.push(
+      `\u30BB\u30C3\u30B7\u30E7\u30F3\u5185\u5BB9\u3068\u5171\u8D77\u3059\u308B\u65E2\u5B58\u7F60 ${related.length} \u4EF6\uFF08\u95A2\u9023\u304C\u3042\u308C\u3070 mcp__caveat__caveat_update \u3067 last_verified \u3092\u66F4\u65B0 or \u8FFD\u8A18\uFF09:`
+    );
+    related.forEach((h2, i2) => {
+      lines.push(`${i2 + 1}. ${h2.id} (${h2.source}) \u2014 ${h2.title}`);
+    });
+    lines.push("");
+    lines.push(
+      "\u4E0A\u8A18\u3068\u7570\u306A\u308B\u65B0\u898F\u306E\u7F60\u3092\u8E0F\u3093\u3067\u3044\u305F\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible\uFF08\u73FE\u72B6\u306E\u5236\u7D04\u3067\u306F\u4E0D\u53EF\u80FD\u3068\u5224\u5B9A\u3057\u305F\u7D50\u8AD6\uFF09\u3082\u8A18\u9332\u5BFE\u8C61\u3002"
+    );
+  } else {
+    lines.push(
+      "\u65E2\u5B58\u7F60\u306B\u8A72\u5F53\u306A\u3057\u3002\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\u306B\u82E6\u6226\u3057\u3066\u3044\u305F\u306A\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3057\u3066\u304F\u3060\u3055\u3044\u3002outcome: impossible \u3082\u8A18\u9332\u5BFE\u8C61\u3002"
+    );
+  }
+  lines.push(
+    "\u8A18\u9332\u6642\u306F tool \u8AAC\u660E\u306E\u4E8C\u9805\u57FA\u6E96\u3067 visibility \u3092\u9078\u3076\uFF08public = \u7B2C\u4E09\u8005\u518D\u73FE\u53EF\u80FD / private = repo \u56FA\u6709\uFF09\u3002\u8FF7\u3063\u305F\u3089 private\u3002"
+  );
+  return lines.join("\n");
+}
+
+// ../../packages/core/dist/transcriptSignals.js
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
+var MAX_ERROR_SNIPPETS = 10;
+var MAX_ERROR_SNIPPET_LENGTH = 300;
+var MAX_SEARCH_QUERIES = 10;
+var MAX_SEARCH_QUERY_LENGTH = 200;
+var MAX_FILE_EDIT_ENTRIES = 20;
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function extractResultText(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    const parts = [];
+    for (const c3 of content) {
+      if (isRecord(c3) && typeof c3.text === "string") parts.push(c3.text);
+    }
+    return parts.join(" ");
+  }
+  return "";
 }
-function userPromptSubmitReminderText() {
-  return [
-    "[caveat] \u3053\u306E\u30D7\u30ED\u30F3\u30D7\u30C8\u306F\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\uFF08GPU/\u30C9\u30E9\u30A4\u30D0/\u30C4\u30FC\u30EB\u30D0\u30FC\u30B8\u30E7\u30F3/IDE/\u518D\u73FE\u6027\u306E\u4F4E\u3044\u6319\u52D5\uFF09\u306B\u89E6\u308C\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002",
-    "\u5B9F\u88C5\u3092\u59CB\u3081\u308B\u524D\u306B mcp__caveat__caveat_search \u3092\u547C\u3093\u3067\u65E2\u5B58\u306E\u7F60\u30E1\u30E2\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-    "3 \u6587\u5B57\u4EE5\u4E0A\u306E\u30AF\u30A8\u30EA\u3067\u691C\u7D22\u3001\u65E5\u672C\u8A9E\u306F trigram \u4E00\u81F4\u3002\u8A72\u5F53\u306A\u3057\u306A\u3089\u7D9A\u884C\u3001\u8A72\u5F53\u3042\u308C\u3070 environment \u4E00\u81F4\u3092\u898B\u3066\u9069\u7528\u5224\u65AD\u3092\u3002"
-  ].join("\n");
+function parseTimestamp(raw2) {
+  if (typeof raw2 !== "string") return void 0;
+  const ms = Date.parse(raw2);
+  return Number.isNaN(ms) ? void 0 : ms;
 }
-function stopReminderText() {
-  return [
-    "[caveat] \u3053\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u3067\u5916\u90E8\u4ED5\u69D8\u306E\u7F60\uFF08GPU/\u30C9\u30E9\u30A4\u30D0/\u30C4\u30FC\u30EB\u30D0\u30FC\u30B8\u30E7\u30F3/IDE/\u518D\u73FE\u6027\uFF09\u3092\u8E0F\u307F\u3001\u6B21\u56DE\u306E\u81EA\u5206\u306E\u8ABF\u67FB\u304C\u77ED\u7E2E\u3067\u304D\u305D\u3046\u306A\u3089 mcp__caveat__caveat_record \u3067\u767B\u9332\u3092\u691C\u8A0E\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
-    "\u89E3\u6C7A\u3057\u305F\u30B1\u30FC\u30B9\u3060\u3051\u3067\u306A\u304F\u3001\u300C\u73FE\u72B6\u306E\u5236\u7D04\u3067\u306F\u4E0D\u53EF\u80FD\u3068\u5224\u5B9A\u3057\u305F\u300D\u7D50\u8AD6\u3082 outcome: impossible \u3068\u3057\u3066\u8A18\u9332\u5BFE\u8C61\u3002\u6B21\u56DE\u540C\u3058 3 \u6642\u9593\u3092\u6EB6\u304B\u3055\u306A\u3044\u305F\u3081\u306B\u3002",
-    "\u65E2\u306B\u540C\u7B49\u306E caveat \u304C\u3042\u308B\u5834\u5408\u306F caveat_update \u3067\u4E0A\u66F8\u304D\u3001\u307E\u305F\u306F last_verified \u3060\u3051\u66F4\u65B0\u3002"
-  ].join("\n");
+function readSessionSignals(transcriptPath) {
+  if (!transcriptPath || !existsSync7(transcriptPath)) return null;
+  let raw2;
+  try {
+    raw2 = readFileSync5(transcriptPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const editCounts = /* @__PURE__ */ new Map();
+  const bashCounts = /* @__PURE__ */ new Map();
+  const errorSnippets = [];
+  const searchQueries = [];
+  let toolFailureCount = 0;
+  let webSearchCount = 0;
+  let webFetchCount = 0;
+  let firstTs;
+  let lastTs;
+  for (const line of raw2.split("\n")) {
+    if (line.length === 0) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const ts = parseTimestamp(parsed.timestamp);
+    if (ts !== void 0) {
+      if (firstTs === void 0 || ts < firstTs) firstTs = ts;
+      if (lastTs === void 0 || ts > lastTs) lastTs = ts;
+    }
+    if (parsed.type !== "assistant" && parsed.type !== "user") continue;
+    const content = parsed.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const item of content) {
+      if (!isRecord(item)) continue;
+      if (item.type === "tool_use") {
+        const name = item.name;
+        const input = isRecord(item.input) ? item.input : {};
+        if (name === "Edit" || name === "Write" || name === "NotebookEdit") {
+          const p2 = typeof input.file_path === "string" ? input.file_path : "";
+          if (p2) editCounts.set(p2, (editCounts.get(p2) ?? 0) + 1);
+        } else if (name === "WebSearch") {
+          webSearchCount += 1;
+          if (typeof input.query === "string" && searchQueries.length < MAX_SEARCH_QUERIES) {
+            searchQueries.push(input.query.slice(0, MAX_SEARCH_QUERY_LENGTH));
+          }
+        } else if (name === "WebFetch") {
+          webFetchCount += 1;
+        } else if (name === "Bash") {
+          const cmd = typeof input.command === "string" ? input.command : "";
+          if (cmd) bashCounts.set(cmd, (bashCounts.get(cmd) ?? 0) + 1);
+        }
+      } else if (item.type === "tool_result") {
+        if (item.is_error === true) {
+          toolFailureCount += 1;
+          const text2 = extractResultText(item.content).replace(/\s+/g, " ").trim();
+          if (text2 && errorSnippets.length < MAX_ERROR_SNIPPETS) {
+            errorSnippets.push(text2.slice(0, MAX_ERROR_SNIPPET_LENGTH));
+          }
+        }
+      }
+    }
+  }
+  const fileEditCounts = [...editCounts.entries()].filter(([, c3]) => c3 > 1).map(([path, count]) => ({ path, count })).sort((a, b2) => b2.count - a.count).slice(0, MAX_FILE_EDIT_ENTRIES);
+  const bashRetryCount = [...bashCounts.values()].filter((c3) => c3 > 1).length;
+  const durationMinutes = firstTs !== void 0 && lastTs !== void 0 ? Math.max(0, Math.round((lastTs - firstTs) / 6e4)) : 0;
+  return {
+    toolFailureCount,
+    fileEditCounts,
+    webSearchCount,
+    webFetchCount,
+    bashRetryCount,
+    durationMinutes,
+    errorSnippets,
+    searchQueries
+  };
+}
+function hasAnyStruggleSignal(s) {
+  return s.toolFailureCount > 0 || s.fileEditCounts.length > 0 || s.webSearchCount > 0 || s.webFetchCount > 0 || s.bashRetryCount > 0;
+}
+function struggleSearchText(s) {
+  return [...s.errorSnippets, ...s.searchQueries].join(" ");
+}
+
+// ../../packages/core/dist/pendingReminders.js
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join7 } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
+function sanitizeSessionId(raw2) {
+  const clean = raw2.replace(/[^A-Za-z0-9_-]/g, "");
+  return clean.length > 0 ? clean : "_unknown";
+}
+function pendingDirFor(caveatHome, sessionId) {
+  return join7(caveatHome, "pending", sanitizeSessionId(sessionId));
+}
+function appendPendingReminder(caveatHome, sessionId, text2) {
+  const dir = pendingDirFor(caveatHome, sessionId);
+  mkdirSync3(dir, { recursive: true });
+  const name = `${Date.now()}-${randomBytes2(4).toString("hex")}.txt`;
+  const path = join7(dir, name);
+  writeFileSync4(path, text2, "utf-8");
+  return path;
+}
+function drainPendingReminders(caveatHome, sessionId) {
+  const dir = pendingDirFor(caveatHome, sessionId);
+  if (!existsSync8(dir)) return [];
+  let entries;
+  try {
+    entries = readdirSync4(dir).filter((f) => f.endsWith(".txt")).sort();
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const path = join7(dir, entry);
+    try {
+      out.push(readFileSync6(path, "utf-8"));
+    } catch {
+      continue;
+    }
+    try {
+      unlinkSync(path);
+    } catch {
+    }
+  }
+  return out;
+}
+
+// ../../packages/core/dist/markHit.js
+function markHit(db, keys, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  if (keys.length === 0) return;
+  const ts = now();
+  const stmt = db.prepare(
+    "UPDATE entries SET last_hit_at = ? WHERE source = ? AND id = ?"
+  );
+  for (const k2 of keys) {
+    stmt.run(ts, k2.source, k2.id);
+  }
+}
+
+// ../../packages/core/dist/stale.js
+function listStale(db, opts = {}) {
+  const days = opts.days ?? 90;
+  const limit = opts.limit ?? 50;
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  const cutoff = new Date(now.getTime() - days * 24 * 60 * 60 * 1e3).toISOString();
+  const conditions = ["(last_hit_at IS NULL OR last_hit_at < ?)"];
+  const params = [cutoff];
+  if (opts.visibility === "public" || opts.visibility === "private") {
+    conditions.push("visibility = ?");
+    params.push(opts.visibility);
+  }
+  const sql = `
+    SELECT id, source, title, visibility, last_hit_at
+    FROM entries
+    WHERE ${conditions.join(" AND ")}
+    ORDER BY last_hit_at IS NULL DESC, last_hit_at ASC
+    LIMIT ?
+  `;
+  params.push(limit);
+  const rows = db.prepare(sql).all(...params);
+  return rows.map((r2) => ({
+    id: r2.id,
+    source: r2.source,
+    title: r2.title,
+    visibility: r2.visibility ?? "public",
+    last_hit_at: r2.last_hit_at
+  }));
 }
 
 // src/context.ts
 function buildContext(logger, overrides = {}) {
   const userHome = overrides.userHome ?? homedir();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join7(userHome, ".caveatrc.json");
+  const userConfigPath = join8(userHome, ".caveatrc.json");
   const config3 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config3.knowledgeRepo, userHome);
   return { caveatHome, userHome, userConfigPath, config: config3, paths, logger };
 }
 
 // src/version.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname4, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveVersion() {
   try {
     const here2 = dirname4(fileURLToPath3(import.meta.url));
-    const pkg = JSON.parse(readFileSync5(join8(here2, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(join9(here2, "..", "package.json"), "utf-8"));
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
     return "0.0.0";
@@ -21271,14 +21598,15 @@ var stdoutLogger = {
 };
 
 // src/commands/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, renameSync, rmdirSync, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync5, renameSync, rmdirSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname6, join as join11 } from "node:path";
 
 // src/claudeInstall.ts
 import { spawnSync } from "node:child_process";
-import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname5, join as join10 } from "node:path";
 var EVENT_USER_PROMPT_SUBMIT = "UserPromptSubmit";
+var EVENT_POST_TOOL_USE = "PostToolUse";
 var EVENT_STOP = "Stop";
 function quote(p2) {
   return p2.includes(" ") ? `"${p2}"` : p2;
@@ -21311,18 +21639,18 @@ function removeHook(settings, event, command) {
   return true;
 }
 function readSettings(path) {
-  if (!existsSync7(path)) return {};
-  return JSON.parse(readFileSync6(path, "utf-8"));
+  if (!existsSync9(path)) return {};
+  return JSON.parse(readFileSync8(path, "utf-8"));
 }
 function writeSettings(path, settings) {
   const dir = dirname5(path);
-  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync9(dir)) mkdirSync4(dir, { recursive: true });
   let backupPath = "";
-  if (existsSync7(path)) {
+  if (existsSync9(path)) {
     backupPath = `${path}.caveat-backup-${Date.now()}`;
     copyFileSync(path, backupPath);
   }
-  writeFileSync4(path, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   return backupPath;
 }
 var CLAUDE_BIN = "claude";
@@ -21381,33 +21709,38 @@ function unregisterMcp(dryRun, logger) {
   return { action: "skipped", detail: "not registered or removal failed" };
 }
 function installClaudeIntegration(opts) {
-  const settingsPath = join9(opts.claudeDir, "settings.json");
+  const settingsPath = join10(opts.claudeDir, "settings.json");
   const settings = readSettings(settingsPath);
   const usCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
+  const ptCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "post-tool-use");
   const stopCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "stop");
   const userPromptSubmit = upsertHook(settings, EVENT_USER_PROMPT_SUBMIT, usCmd);
+  const postToolUse = upsertHook(settings, EVENT_POST_TOOL_USE, ptCmd);
   const stop = upsertHook(settings, EVENT_STOP, stopCmd);
   let backupPath;
-  if (!opts.dryRun && (userPromptSubmit === "added" || stop === "added")) {
+  const anyAdded = userPromptSubmit === "added" || postToolUse === "added" || stop === "added";
+  if (!opts.dryRun && anyAdded) {
     const backup = writeSettings(settingsPath, settings);
     if (backup) backupPath = backup;
   } else if (opts.dryRun) {
     opts.logger.info(
-      `[dry-run] would ${userPromptSubmit === "added" ? "add" : "keep"} UserPromptSubmit hook and ${stop === "added" ? "add" : "keep"} Stop hook in ${settingsPath}`
+      `[dry-run] would ${userPromptSubmit === "added" ? "add" : "keep"} UserPromptSubmit, ${postToolUse === "added" ? "add" : "keep"} PostToolUse, ${stop === "added" ? "add" : "keep"} Stop hook in ${settingsPath}`
     );
   }
   const mcp = opts.skipMcpRegistration ? { action: "skipped", detail: "skipped by caller" } : registerMcp(opts.nodePath, opts.cliScriptPath, opts.dryRun, opts.logger);
-  return { mcp, hooks: { userPromptSubmit, stop }, backupPath };
+  return { mcp, hooks: { userPromptSubmit, postToolUse, stop }, backupPath };
 }
 function uninstallClaudeIntegration(opts) {
-  const settingsPath = join9(opts.claudeDir, "settings.json");
+  const settingsPath = join10(opts.claudeDir, "settings.json");
   const settings = readSettings(settingsPath);
   const usCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "user-prompt-submit");
+  const ptCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "post-tool-use");
   const stopCmd = hookCommand(opts.nodePath, opts.cliScriptPath, "stop");
   const removedUs = removeHook(settings, EVENT_USER_PROMPT_SUBMIT, usCmd);
+  const removedPt = removeHook(settings, EVENT_POST_TOOL_USE, ptCmd);
   const removedStop = removeHook(settings, EVENT_STOP, stopCmd);
   let backupPath;
-  if (!opts.dryRun && (removedUs || removedStop)) {
+  if (!opts.dryRun && (removedUs || removedPt || removedStop)) {
     const backup = writeSettings(settingsPath, settings);
     if (backup) backupPath = backup;
   }
@@ -21416,6 +21749,7 @@ function uninstallClaudeIntegration(opts) {
     mcp,
     hooks: {
       userPromptSubmit: removedUs ? "added" : "unchanged",
+      postToolUse: removedPt ? "added" : "unchanged",
       stop: removedStop ? "added" : "unchanged"
     },
     backupPath
@@ -21435,22 +21769,22 @@ var KNOWLEDGE_GITIGNORE = [
 async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
   ensureUserConfig(ctx.userConfigPath);
   ctx.logger.info(`user config: ${ctx.userConfigPath}`);
-  if (!existsSync8(ctx.paths.knowledgeRepo)) {
-    mkdirSync4(ctx.paths.knowledgeRepo, { recursive: true });
-    mkdirSync4(ctx.paths.entriesDir, { recursive: true });
+  if (!existsSync10(ctx.paths.knowledgeRepo)) {
+    mkdirSync5(ctx.paths.knowledgeRepo, { recursive: true });
+    mkdirSync5(ctx.paths.entriesDir, { recursive: true });
     ctx.logger.info(`knowledge repo scaffolded: ${ctx.paths.knowledgeRepo}`);
   } else {
     ctx.logger.info(`knowledge repo: ${ctx.paths.knowledgeRepo}`);
   }
   migrateLegacyCommunityDir(ctx);
-  const gitignorePath = join10(ctx.paths.knowledgeRepo, ".gitignore");
-  if (!existsSync8(gitignorePath)) {
-    writeFileSync5(gitignorePath, KNOWLEDGE_GITIGNORE, "utf-8");
+  const gitignorePath = join11(ctx.paths.knowledgeRepo, ".gitignore");
+  if (!existsSync10(gitignorePath)) {
+    writeFileSync6(gitignorePath, KNOWLEDGE_GITIGNORE, "utf-8");
     ctx.logger.info(`.gitignore created: ${gitignorePath}`);
   }
   if (!opts.dryRun) {
     const dbDir = dirname6(ctx.paths.dbPath);
-    if (!existsSync8(dbDir)) mkdirSync4(dbDir, { recursive: true });
+    if (!existsSync10(dbDir)) mkdirSync5(dbDir, { recursive: true });
     const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
     db.close();
     ctx.logger.info(`db initialized: ${ctx.paths.dbPath}`);
@@ -21470,7 +21804,7 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
     return;
   }
   const result = installClaudeIntegration({
-    claudeDir: join10(ctx.userHome, ".claude"),
+    claudeDir: join11(ctx.userHome, ".claude"),
     cliScriptPath,
     nodePath: process.execPath,
     dryRun: opts.dryRun,
@@ -21479,20 +21813,20 @@ async function runInit(ctx, opts = { skipClaude: false, dryRun: false }) {
   reportInstallResult(ctx, result, opts.dryRun);
 }
 function migrateLegacyCommunityDir(ctx) {
-  const legacy = join10(ctx.paths.knowledgeRepo, "community");
+  const legacy = join11(ctx.paths.knowledgeRepo, "community");
   const current = ctx.paths.communityDir;
   if (legacy === current) return;
-  if (!existsSync8(legacy)) return;
-  if (existsSync8(current)) {
+  if (!existsSync10(legacy)) return;
+  if (existsSync10(current)) {
     ctx.logger.warn(
       `legacy community dir still exists at ${legacy} \u2014 remove manually (new location in use)`
     );
     return;
   }
-  mkdirSync4(current, { recursive: true });
-  for (const entry of readdirSync4(legacy, { withFileTypes: true })) {
+  mkdirSync5(current, { recursive: true });
+  for (const entry of readdirSync5(legacy, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    renameSync(join10(legacy, entry.name), join10(current, entry.name));
+    renameSync(join11(legacy, entry.name), join11(current, entry.name));
   }
   try {
     rmdirSync(legacy);
@@ -21507,7 +21841,7 @@ function runUninstall(ctx, opts) {
     process.exit(1);
   }
   const result = uninstallClaudeIntegration({
-    claudeDir: join10(ctx.userHome, ".claude"),
+    claudeDir: join11(ctx.userHome, ".claude"),
     cliScriptPath,
     nodePath: process.execPath,
     dryRun: opts.dryRun,
@@ -21544,29 +21878,29 @@ function reportInstallResult(ctx, result, dryRun) {
 }
 
 // src/commands/indexCmd.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5, mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname7, join as join11 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync6, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname7, join as join12 } from "node:path";
 function runIndex(ctx, opts) {
   const dbDir = dirname7(ctx.paths.dbPath);
-  if (!existsSync9(dbDir)) mkdirSync5(dbDir, { recursive: true });
+  if (!existsSync11(dbDir)) mkdirSync6(dbDir, { recursive: true });
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
   try {
     if (opts.full) {
       ctx.logger.info("full rebuild: DELETE FROM entries");
       rebuildAll(db);
     }
-    if (existsSync9(ctx.paths.entriesDir)) {
+    if (existsSync11(ctx.paths.entriesDir)) {
       const result = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
       ctx.logger.info(`own: +${result.added} ~${result.updated} -${result.deleted}`);
     } else {
       ctx.logger.warn(`entries dir not found: ${ctx.paths.entriesDir}`);
     }
-    if (existsSync9(ctx.paths.communityDir)) {
-      for (const entry of readdirSync5(ctx.paths.communityDir, { withFileTypes: true })) {
+    if (existsSync11(ctx.paths.communityDir)) {
+      for (const entry of readdirSync6(ctx.paths.communityDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
         const source = `community/${entry.name}`;
-        const root = join11(ctx.paths.communityDir, entry.name, "entries");
-        if (!existsSync9(root)) continue;
+        const root = join12(ctx.paths.communityDir, entry.name, "entries");
+        if (!existsSync11(root)) continue;
         const result = scanSource({ db, source, entriesRoot: root });
         ctx.logger.info(`${source}: +${result.added} ~${result.updated} -${result.deleted}`);
       }
@@ -21621,6 +21955,29 @@ function runList(ctx, opts) {
   }
 }
 
+// src/commands/stale.ts
+function runStale(ctx, opts) {
+  const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
+  try {
+    const rows = listStale(db, {
+      days: opts.days,
+      visibility: opts.visibility,
+      limit: opts.limit
+    });
+    if (rows.length === 0) {
+      process.stdout.write("(no stale entries)\n");
+      return;
+    }
+    for (const r2 of rows) {
+      const age = r2.last_hit_at ?? "never";
+      process.stdout.write(`${r2.id} [${r2.source}] (${r2.visibility}) ${age} \u2014 ${r2.title}
+`);
+    }
+  } finally {
+    db.close();
+  }
+}
+
 // src/commands/show.ts
 function runShow(ctx, opts) {
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
@@ -22340,11 +22697,11 @@ var serve = (options2, listeningListener) => {
 
 // ../web/dist/context.js
 import { homedir as homedir2 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function buildWebContext(overrides = {}) {
   const userHome = overrides.userHome ?? homedir2();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join12(userHome, ".caveatrc.json");
+  const userConfigPath = join13(userHome, ".caveatrc.json");
   const logger = overrides.logger ?? stderrLogger;
   const config3 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config3.knowledgeRepo, userHome);
@@ -30089,14 +30446,14 @@ function createDetailRoute(ctx) {
 }
 
 // ../web/dist/routes/community.js
-import { existsSync as existsSync10, readdirSync as readdirSync6, statSync as statSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync7, statSync as statSync5 } from "node:fs";
+import { join as join14 } from "node:path";
 function listCommunity(communityDir, db) {
-  if (!existsSync10(communityDir)) return [];
+  if (!existsSync12(communityDir)) return [];
   const handles = [];
-  for (const entry of readdirSync6(communityDir, { withFileTypes: true })) {
+  for (const entry of readdirSync7(communityDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const handlePath = join13(communityDir, entry.name);
+    const handlePath = join14(communityDir, entry.name);
     const countRow = db.prepare("SELECT COUNT(*) AS n FROM entries WHERE source = ?").get(`community/${entry.name}`);
     handles.push({
       handle: entry.name,
@@ -44394,11 +44751,11 @@ var StdioServerTransport = class {
 
 // ../mcp/dist/context.js
 import { homedir as homedir3 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function buildMcpContext(overrides = {}) {
   const userHome = overrides.userHome ?? homedir3();
   const caveatHome = overrides.caveatHome ?? findCaveatHome(userHome);
-  const userConfigPath = join14(userHome, ".caveatrc.json");
+  const userConfigPath = join15(userHome, ".caveatrc.json");
   const logger = overrides.logger ?? stderrLogger;
   const config3 = loadConfig(userConfigPath);
   const paths = resolvePaths(caveatHome, config3.knowledgeRepo, userHome);
@@ -44409,12 +44766,24 @@ function buildMcpContext(overrides = {}) {
 // ../mcp/dist/tools/search.js
 var sourceFilter = external_exports.enum(["own", "community", "all"]);
 var confidenceSchema = external_exports.enum(["confirmed", "reproduced", "tentative"]);
+var visibilityFilter = external_exports.enum(["public", "private", "all"]);
 var searchInputShape = {
   query: external_exports.string().describe("FTS query (3+ chars for trigram). Empty string lists without text filter."),
   filters: external_exports.object({
     tags: external_exports.array(external_exports.string()).optional(),
     confidence: external_exports.array(confidenceSchema).optional(),
-    source: sourceFilter.optional()
+    source: sourceFilter.optional(),
+    visibility: visibilityFilter.optional().describe(
+      [
+        "Narrow by publish tier.",
+        "'public' = external-spec gotchas reproducible by any third party (PyInstaller, Stripe, Claude Code hook behavior, etc).",
+        "'private' = your own cross-project notes (repo-specific, your workflow, intentional non-standard design).",
+        "'all' (or omit) = both tiers.",
+        "Use 'public' when drafting externally-visible output (PR descriptions, public docs, answers to third parties) so private notes do not bleed into external content.",
+        "Use 'private' when specifically recalling your own past decisions.",
+        "Default to omitting this filter \u2014 narrowing too aggressively hides relevant entries."
+      ].join(" ")
+    )
   }).optional(),
   limit: external_exports.number().int().min(1).max(200).optional()
 };
@@ -44424,6 +44793,7 @@ function handleSearch(ctx, args) {
     filters: args.filters,
     limit: args.limit
   });
+  if (results.length > 0) markHit(ctx.db, results);
   return results;
 }
 
@@ -44455,7 +44825,14 @@ var recordInputShape = {
   confidence: confidenceSchema2.optional(),
   outcome: outcomeSchema.optional(),
   visibility: visibilitySchema.describe(
-    'REQUIRED. Ask the user "public (share to community) or private (keep local only)?" before calling \u2014 never auto-classify. The user owns the knowledge; they decide its reach.'
+    [
+      "REQUIRED. Classify using this binary criterion:",
+      "- 'public' if a third party running the same external tool/spec could reproduce this gotcha (external-spec trap, e.g. PyInstaller/Stripe/Podman/Claude Code hook behavior).",
+      "- 'private' if it is specific to your repo, your workflow, an intentional non-standard design, or context that only exists in this project.",
+      "- When unclear, prefer 'private' (leak-safety).",
+      `Exception: if the user explicitly asks to record it as private/public (e.g. "save this as private", "\u3053\u308C\u306F\u81EA\u5206\u7528\u306B\u30E1\u30E2\u3057\u3066"), follow the user's instruction regardless of the criterion \u2014 explicit user intent overrides auto-classification.`,
+      "When recording with visibility: 'private', always include repo-specific identifiers (function names, file paths, class names, custom terminology) in the body so the entry can be retrieved later by co-occurrence FTS when you touch that area again."
+    ].join(" ")
   ),
   tags: external_exports.array(external_exports.string()).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
@@ -44476,7 +44853,13 @@ var patchFrontmatterSchema = external_exports.object({
   title: external_exports.string().optional(),
   confidence: confidenceSchema3.optional(),
   outcome: outcomeSchema2.optional(),
-  visibility: visibilitySchema2.optional(),
+  visibility: visibilitySchema2.optional().describe(
+    [
+      "Change the publish tier. Use the same binary criterion as caveat_record:",
+      "'public' if third-party reproducible, 'private' if repo-specific/your-workflow-specific.",
+      "When unclear, prefer 'private'. Explicit user instruction overrides auto-classification."
+    ].join(" ")
+  ),
   tags: external_exports.array(external_exports.string()).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   last_verified: external_exports.string().optional()
@@ -44507,13 +44890,13 @@ function handleListRecent(ctx, args) {
 }
 
 // ../mcp/dist/tools/pull.js
-import { existsSync as existsSync11, readdirSync as readdirSync7 } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync8 } from "node:fs";
+import { join as join16 } from "node:path";
 var pullInputShape = {};
 async function handlePull(ctx, _args = {}) {
   const pulled = [];
   const indexed = [];
-  if (existsSync11(ctx.paths.communityDir)) {
+  if (existsSync13(ctx.paths.communityDir)) {
     const results = await communityPull({
       communityDir: ctx.paths.communityDir,
       logger: ctx.logger
@@ -44523,16 +44906,16 @@ async function handlePull(ctx, _args = {}) {
     }
   }
   rebuildAll(ctx.db);
-  if (existsSync11(ctx.paths.entriesDir)) {
+  if (existsSync13(ctx.paths.entriesDir)) {
     const own = scanSource({ db: ctx.db, source: "own", entriesRoot: ctx.paths.entriesDir });
     indexed.push({ source: "own", ...own });
   }
-  if (existsSync11(ctx.paths.communityDir)) {
-    for (const entry of readdirSync7(ctx.paths.communityDir, { withFileTypes: true })) {
+  if (existsSync13(ctx.paths.communityDir)) {
+    for (const entry of readdirSync8(ctx.paths.communityDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const source = `community/${entry.name}`;
-      const root = join15(ctx.paths.communityDir, entry.name, "entries");
-      if (!existsSync11(root)) continue;
+      const root = join16(ctx.paths.communityDir, entry.name, "entries");
+      if (!existsSync13(root)) continue;
       const scan = scanSource({ db: ctx.db, source, entriesRoot: root });
       indexed.push({ source, ...scan });
     }
@@ -44645,6 +45028,19 @@ async function runMcpServer() {
 }
 
 // src/commands/hookCmd.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync14, readFileSync as readFileSync9, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join17 } from "node:path";
+import { randomBytes as randomBytes3 } from "node:crypto";
+var silentLogger = {
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: (m) => process.stderr.write(`[caveat:hook] ${m}
+`)
+};
 async function readStdin() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -44663,7 +45059,163 @@ function parsePayload(raw2) {
     return {};
   }
 }
-async function runHook(name) {
+function getSessionId(payload) {
+  const v = payload.session_id ?? payload.sessionId;
+  return typeof v === "string" && v.length > 0 ? v : "_unknown";
+}
+function buildContextSafely() {
+  try {
+    return buildContext(silentLogger);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] context error: ${msg}
+`);
+    return null;
+  }
+}
+function searchCaveatsFromTextSafely(text2) {
+  if (!text2) return [];
+  let db;
+  try {
+    const ctx = buildContextSafely();
+    if (!ctx || !existsSync14(ctx.paths.dbPath)) return [];
+    db = openDb({ path: ctx.paths.dbPath });
+    const hits = findCaveatsForPrompt(db, text2);
+    if (hits.length > 0) {
+      try {
+        markHit(db, hits);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[caveat:hook] markHit error: ${msg}
+`);
+      }
+    }
+    return hits;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] search error: ${msg}
+`);
+    return [];
+  } finally {
+    db?.close();
+  }
+}
+function loadSignalsSafely(path) {
+  try {
+    return readSessionSignals(path);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] transcript read error: ${msg}
+`);
+    return null;
+  }
+}
+function drainForSession(sessionId) {
+  const ctx = buildContextSafely();
+  if (!ctx) return;
+  const reminders = drainPendingReminders(ctx.caveatHome, sessionId);
+  for (const text2 of reminders) {
+    process.stdout.write(`<system-reminder>${text2}</system-reminder>
+`);
+  }
+}
+function extractToolResponseText(response) {
+  if (typeof response === "string") return response;
+  if (Array.isArray(response)) {
+    const parts = [];
+    for (const item of response) {
+      if (typeof item === "string") parts.push(item);
+      else if (item !== null && typeof item === "object" && typeof item.text === "string") {
+        parts.push(item.text);
+      }
+    }
+    return parts.join(" ");
+  }
+  if (response !== null && typeof response === "object") {
+    const r2 = response;
+    if (typeof r2.content === "string") return r2.content;
+    if (Array.isArray(r2.content)) return extractToolResponseText(r2.content);
+    if (typeof r2.output === "string") return r2.output;
+    if (typeof r2.stdout === "string" || typeof r2.stderr === "string") {
+      return [r2.stdout, r2.stderr].filter((x2) => typeof x2 === "string").join(" ");
+    }
+  }
+  return "";
+}
+function isToolError(payload) {
+  const resp = payload.tool_response ?? payload.toolResponse;
+  if (resp !== null && typeof resp === "object" && !Array.isArray(resp)) {
+    if (resp.is_error === true) return true;
+  }
+  if (payload.is_error === true) return true;
+  return false;
+}
+function spawnWorker(job) {
+  const workFile = join17(
+    tmpdir(),
+    `caveat-worker-${Date.now()}-${randomBytes3(4).toString("hex")}.json`
+  );
+  try {
+    writeFileSync7(workFile, JSON.stringify(job), "utf-8");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] worker writefile error: ${msg}
+`);
+    return;
+  }
+  const cliScript = process.argv[1];
+  if (!cliScript) return;
+  try {
+    const child = spawn2(
+      process.execPath,
+      ["--disable-warning=ExperimentalWarning", cliScript, "hook", "worker", workFile],
+      { detached: true, stdio: "ignore", windowsHide: true }
+    );
+    child.unref();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[caveat:hook] worker spawn error: ${msg}
+`);
+    try {
+      unlinkSync2(workFile);
+    } catch {
+    }
+  }
+}
+async function runWorker(workFile) {
+  let raw2;
+  try {
+    raw2 = readFileSync9(workFile, "utf-8");
+  } catch {
+    process.exit(0);
+  }
+  try {
+    unlinkSync2(workFile);
+  } catch {
+  }
+  let job;
+  try {
+    job = JSON.parse(raw2);
+  } catch {
+    process.exit(0);
+  }
+  if (!job.searchText || !job.sessionId) process.exit(0);
+  const hits = searchCaveatsFromTextSafely(job.searchText);
+  if (hits.length === 0) process.exit(0);
+  const ctx = buildContextSafely();
+  if (!ctx) process.exit(0);
+  try {
+    appendPendingReminder(ctx.caveatHome, job.sessionId, toolErrorReminderText(hits));
+  } catch {
+  }
+  process.exit(0);
+}
+async function runHook(name, arg) {
+  if (name === "worker") {
+    if (!arg) process.exit(0);
+    await runWorker(arg);
+    return;
+  }
   let raw2 = "";
   try {
     raw2 = await readStdin();
@@ -44674,22 +45226,37 @@ async function runHook(name) {
     process.exit(0);
   }
   const payload = parsePayload(raw2);
+  const sessionId = getSessionId(payload);
+  drainForSession(sessionId);
   if (name === "user-prompt-submit") {
     const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
-    if (detectCaveatTrigger(prompt)) {
+    const hits = searchCaveatsFromTextSafely(prompt);
+    if (hits.length > 0) {
       process.stdout.write(
-        `<system-reminder>${userPromptSubmitReminderText()}</system-reminder>
+        `<system-reminder>${userPromptSubmitReminderText(hits)}</system-reminder>
 `
       );
     }
     process.exit(0);
   }
-  if (name === "stop") {
-    if (payload.stop_hook_active === true) {
-      process.exit(0);
+  if (name === "post-tool-use") {
+    if (!isToolError(payload)) process.exit(0);
+    const errText = extractToolResponseText(payload.tool_response ?? payload);
+    if (errText) {
+      spawnWorker({ sessionId, searchText: errText });
     }
-    process.stdout.write(`<system-reminder>${stopReminderText()}</system-reminder>
-`);
+    process.exit(0);
+  }
+  if (name === "stop") {
+    if (payload.stop_hook_active === true) process.exit(0);
+    const transcriptPath = typeof payload.transcript_path === "string" ? payload.transcript_path : "";
+    const signals = transcriptPath ? loadSignalsSafely(transcriptPath) : null;
+    if (!signals || !hasAnyStruggleSignal(signals)) process.exit(0);
+    const related = searchCaveatsFromTextSafely(struggleSearchText(signals));
+    process.stdout.write(
+      `<system-reminder>${stopReminderText(signals, related)}</system-reminder>
+`
+    );
     process.exit(0);
   }
   process.stderr.write(`[caveat:hook] unknown hook name: ${name}
@@ -44698,10 +45265,10 @@ async function runHook(name) {
 }
 
 // src/commands/pull.ts
-import { existsSync as existsSync12, readdirSync as readdirSync8 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync15, readdirSync as readdirSync9 } from "node:fs";
+import { join as join18 } from "node:path";
 async function runPull(ctx) {
-  if (!existsSync12(ctx.paths.communityDir)) {
+  if (!existsSync15(ctx.paths.communityDir)) {
     ctx.logger.info(
       "no community repos yet \u2014 add one with `caveat community add <github-url>`."
     );
@@ -44721,15 +45288,15 @@ async function runPull(ctx) {
   const db = openDb({ path: ctx.paths.dbPath, logger: ctx.logger });
   try {
     rebuildAll(db);
-    if (existsSync12(ctx.paths.entriesDir)) {
+    if (existsSync15(ctx.paths.entriesDir)) {
       const own = scanSource({ db, source: "own", entriesRoot: ctx.paths.entriesDir });
       ctx.logger.info(`own: +${own.added}`);
     }
-    for (const entry of readdirSync8(ctx.paths.communityDir, { withFileTypes: true })) {
+    for (const entry of readdirSync9(ctx.paths.communityDir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const source = `community/${entry.name}`;
-      const root = join16(ctx.paths.communityDir, entry.name, "entries");
-      if (!existsSync12(root)) continue;
+      const root = join18(ctx.paths.communityDir, entry.name, "entries");
+      if (!existsSync15(root)) continue;
       const scan = scanSource({ db, source, entriesRoot: root });
       ctx.logger.info(`${source}: +${scan.added}`);
     }
@@ -44853,6 +45420,13 @@ program.command("list").description("List caveats by updated_at DESC").option("-
   const ctx = buildContext(stdoutLogger);
   runList(ctx, { limit: opts.recent });
 });
+program.command("stale").description(
+  "List entries not surfaced by retrieval for N days (default 90). Use this to find private caveats that may be buried \u2014 if a 3-month-old private entry never surfaces, rewrite its body to include repo-specific identifiers, or delete it."
+).option("--days <n>", "age threshold in days", (v) => Number(v), 90).option("--visibility <v>", "public | private").option("--limit <n>", "max rows", (v) => Number(v), 50).action((opts) => {
+  const ctx = buildContext(stdoutLogger);
+  const vis = opts.visibility === "public" || opts.visibility === "private" ? opts.visibility : void 0;
+  runStale(ctx, { days: opts.days, visibility: vis, limit: opts.limit });
+});
 program.command("show").description("Show full caveat by id").argument("<id>", "entry id").option("--source <source>", "own or community/<handle>", "own").action((id, opts) => {
   const ctx = buildContext(stdoutLogger);
   runShow(ctx, { id, source: opts.source });
@@ -44873,8 +45447,10 @@ program.command("serve").description("Start the read-only web share portal").opt
 program.command("mcp-server").description("Run the MCP stdio server (registered by `caveat init`)").action(async () => {
   await runMcpServer();
 });
-program.command("hook <name>").description("Run a Claude Code hook. name: user-prompt-submit | stop").action(async (name) => {
-  await runHook(name);
+program.command("hook <name> [arg]").description(
+  "Run a Claude Code hook. name: user-prompt-submit | post-tool-use | stop | worker"
+).action(async (name, arg) => {
+  await runHook(name, arg);
 });
 var community = program.command("community").description("Manage community caveat repos (shallow clones under <knowledgeRepo>/community/)");
 community.command("add <url>").description("Shallow-clone a GitHub caveat repo into community/<handle>/").action(async (url) => {