skillwiki 0.10.20 → 0.10.22

package/dist/{chunk-I5JD3BQZ.js → chunk-54JVBNWK.js}

@@ -6,7 +6,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/utils/index-projection.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/{chunk-UNPZDCWN.js → chunk-7YDWC6D3.js}

@@ -19,7 +19,7 @@ import {
   splitFrontmatter,
   vaultIoConcurrency,
   writeRootIndexProjection
-} from "./chunk-I5JD3BQZ.js";
+} from "./chunk-54JVBNWK.js";
 import {
   CONFIG_KEYS,
   git,
@@ -34,7 +34,7 @@ import {
   satelliteGateFromFleetLoad,
   snapshotterAliasForLocalHost,
   writeDotenv
-} from "./chunk-GNS2ZV5P.js";
+} from "./chunk-PQG26AGJ.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -49,7 +49,7 @@ import {
   ok,
   parseVaultSyncKeyValue,
   systemdPropertyFor
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/commands/log-append.ts
 import { readFile as readFile2, stat } from "fs/promises";
@@ -315,13 +315,17 @@ function operationMarkers(operationId) {
   }
   return ok([
     `<!-- skillwiki-log-op:${operationId} -->`,
-    `<!-- skillwiki-page-publish:${operationId} -->`
+    `<!-- skillwiki-page-publish:${operationId} -->`,
+    `<!-- skillwiki-project-page-publish:${operationId} -->`
   ]);
 }
 function preferredMarker(operationId, eventKind) {
   if (!eventKind || eventKind === "page-publish") {
     return `<!-- skillwiki-page-publish:${operationId} -->`;
   }
+  if (eventKind === "project-page-publish") {
+    return `<!-- skillwiki-project-page-publish:${operationId} -->`;
+  }
   return `<!-- skillwiki-log-op:${operationId} -->`;
 }
 async function appendWhileLocked(logPath, content, markers, writeMarker) {
@@ -3227,6 +3231,7 @@ function buildCliSurface() {
   program.command("ingest").requiredOption("--vault <path>").requiredOption("--type <type>").requiredOption("--title <title>").option("--tags <csv>").option("--provenance <provenance>").option("--dry-run");
   program.command("fleet");
   program.command("page");
+  program.command("project-page");
   program.command("write-preflight").option("--command <name>").option("--dirty-threshold <n>").option("--skip-dirty").option("--prior-artifact-file <path>").option("--prior-artifact-text <text>").option("--consecutive-no-decision <n>").option("--no-decision-threshold <n>").option("--human-allow").option("--mission-kind <kind>").option("--skip-mission").option("--project <slug>").option("--capture-day <date>").option("--capture-budget <n>").option("--severity <level>").option("--skip-budget").option("--checks <list>").option("--wiki <name>");
   program.command("mcp");
   const graphCmd = program.commands.find((c) => c.name() === "graph");
@@ -3245,7 +3250,9 @@ function buildCliSurface() {
   const tagCmd = program.commands.find((c) => c.name() === "tag");
   tagCmd.command("reconcile").requiredOption("--page <path>").option("--from <path>").option("--tags <csv>").option("--reason <text>").option("--write").option("--wiki <name>");
   const pageCmd = program.commands.find((c) => c.name() === "page");
-  pageCmd.command("publish").requiredOption("--target <path>").option("--log-note <text>").option("--write").option("--wiki <name>");
+  pageCmd.command("publish").requiredOption("--target <path>").option("--log-note <text>").option("--write").option("--approve <token>").option("--wiki <name>");
+  const projectPageCmd = program.commands.find((c) => c.name() === "project-page");
+  projectPageCmd.command("publish").requiredOption("--project <slug>").requiredOption("--target <path>").option("--log-note <text>").option("--write").option("--approve <token>").option("--wiki <name>");
   const logCmd = program.commands.find((c) => c.name() === "log");
   logCmd.command("materialize").option("--write").option("--wiki <name>");
   logCmd.command("migrate-legacy").option("--write").option("--converge-vault <dir>").option("--wiki <name>");

package/dist/{chunk-QJPCCW4N.js → chunk-BASWDOQB.js}

@@ -9,16 +9,16 @@ import {
   resolveConfiguredSnapshotWorktree,
   runVaultSyncPullHelper,
   supersedeStaleReviewRequiredJournals
-} from "./chunk-GNS2ZV5P.js";
+} from "./chunk-PQG26AGJ.js";
 import {
   ExitCode,
   err,
   ok
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/utils/managed-write-preflight.ts
 import { existsSync as existsSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { join as join2, resolve as resolve2 } from "path";
 
 // src/utils/managed-write-lock.ts
 import { randomBytes } from "crypto";
@@ -29,7 +29,8 @@ import {
   unlinkSync,
   writeFileSync
 } from "fs";
-import { dirname, join } from "path";
+import { hostname } from "os";
+import { dirname, join, resolve } from "path";
 function managedWriteLockPath(vault) {
   const gitPath = git(vault, ["rev-parse", "--git-path", "vault-sync/managed-write.lock"]);
   if (gitPath) return gitPath.startsWith("/") ? gitPath : join(vault, gitPath);
@@ -65,19 +66,35 @@ function hasUnsafeGitState(vault) {
   const unmerged = git(vault, ["ls-files", "-u"]);
   return Boolean(unmerged && unmerged.trim().length > 0);
 }
-function reclaimDeadManagedWriteLockOwner(vault) {
+function isGitBackedVault(vault) {
+  return Boolean(git(vault, ["rev-parse", "--absolute-git-dir"]));
+}
+function hasLocalOwnerProof(vault, record) {
+  return isGitBackedVault(vault) || typeof record.owner_hostname === "string" && record.owner_hostname === hostname();
+}
+function reclaimDeadManagedWriteLockOwner(vault, options = {}) {
   const path = managedWriteLockPath(vault);
+  const gitStateVault = resolve(options.gitStateVault ?? vault);
   if (!existsSync(path)) return ok({ reclaimed: false });
   const record = readLockRecord(path);
   if (!record) {
     return err("SYNC_LOCK_HELD", { path, message: "managed-write lock unreadable" });
   }
+  if (!hasLocalOwnerProof(vault, record)) {
+    return err("SYNC_LOCK_HELD", {
+      path,
+      owner_hostname: record.owner_hostname,
+      current_hostname: hostname(),
+      message: "managed-write lock origin is foreign or unknown"
+    });
+  }
   if (isManagedWriteLockOwnerAlive(record.pid)) {
     return err("SYNC_LOCK_HELD", { path, message: "managed-write lock owner is alive" });
   }
-  if (hasUnsafeGitState(vault)) {
+  if (hasUnsafeGitState(gitStateVault)) {
     return err("SYNC_LOCK_HELD", {
       path,
+      git_state_vault: gitStateVault,
       message: "managed-write lock not reclaimed: unsafe git state"
     });
   }
@@ -90,6 +107,7 @@ function reclaimDeadManagedWriteLockOwner(vault) {
       recovered_at: (/* @__PURE__ */ new Date()).toISOString(),
       recovery_reason: "owner_pid_dead",
       owner_pid_alive: false,
+      git_state_vault: gitStateVault,
       lock: record
     };
     writeFileSync(recoveryPath, `${JSON.stringify(meta, null, 2)}
@@ -107,7 +125,13 @@ function tryCreateLock(path, command) {
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(
       path,
-      `${JSON.stringify({ pid: process.pid, owner_token: ownerToken, acquired, command })}
+      `${JSON.stringify({
+        pid: process.pid,
+        owner_hostname: hostname(),
+        owner_token: ownerToken,
+        acquired,
+        command
+      })}
 `,
       { flag: "wx" }
     );
@@ -117,14 +141,14 @@ function tryCreateLock(path, command) {
     return err("WRITE_FAILED", { path, message: String(error) });
   }
 }
-function acquireManagedWriteLock(vault, command) {
+function acquireManagedWriteLock(vault, command, options = {}) {
   const path = managedWriteLockPath(vault);
   const first = tryCreateLock(path, command);
   if (first.ok) {
     return ok({ ...first.data, vault });
   }
   if (first.error !== "SYNC_LOCK_HELD") return first;
-  const reclaimed = reclaimDeadManagedWriteLockOwner(vault);
+  const reclaimed = reclaimDeadManagedWriteLockOwner(vault, options);
   if (!reclaimed.ok || !reclaimed.data.reclaimed) {
     return err("SYNC_LOCK_HELD", { path });
   }
@@ -180,8 +204,8 @@ function isGitVault(vault) {
   return Boolean(git(vault, ["rev-parse", "--absolute-git-dir"]));
 }
 async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
-  const mutationVault = resolve(input.vault);
-  let convergenceVault = input.convergenceVault && resolve(input.convergenceVault) !== mutationVault ? resolve(input.convergenceVault) : void 0;
+  const mutationVault = resolve2(input.vault);
+  let convergenceVault = input.convergenceVault && resolve2(input.convergenceVault) !== mutationVault ? resolve2(input.convergenceVault) : void 0;
   let convergenceSource = convergenceVault ? "explicit" : "single-path";
   const mutationBlocker = preflightBlocker(mutationVault);
   if (mutationBlocker) {
@@ -264,7 +288,7 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
         })
       };
     }
-    convergenceVault = resolve(configured);
+    convergenceVault = resolve2(configured);
     convergenceSource = "configured";
     if (convergenceVault === mutationVault) {
       return {
@@ -373,8 +397,10 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
   };
 }
 async function runManagedWriteTransaction(input, deps = DEFAULT_DEPS) {
-  const mutationVault = resolve(input.vault);
-  const lock = acquireManagedWriteLock(mutationVault, input.command);
+  const mutationVault = resolve2(input.vault);
+  const lock = acquireManagedWriteLock(mutationVault, input.command, {
+    gitStateVault: input.convergenceVault ? resolve2(input.convergenceVault) : mutationVault
+  });
   if (!lock.ok) {
     return { exitCode: ExitCode.SYNC_LOCK_HELD, result: lock };
   }

package/dist/{chunk-Y6KRDGI2.js → chunk-C2DKFJFA.js}

@@ -56,7 +56,12 @@ var ExitCode = {
   SENSITIVE_CONTENT_DETECTED: 51,
   FLEET_SATELLITE_HEALTH_FAILED: 52,
   PROTECTED_SNAPSHOTTER_WRITE_BLOCKED: 53,
-  INVALID_CONFIG_VALUE: 54
+  INVALID_CONFIG_VALUE: 54,
+  APPROVAL_REQUIRED: 55,
+  APPROVAL_INVALID: 56,
+  APPROVAL_MISMATCH: 57,
+  TARGET_DRIFT: 58,
+  RECOVERY_EVIDENCE_MISSING: 59
 };
 
 // ../shared/src/json-output.ts

package/dist/{chunk-GNS2ZV5P.js → chunk-PQG26AGJ.js}

@@ -5,7 +5,7 @@ import {
   err,
   isVaultSyncKey,
   ok
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/utils/dotenv.ts
 import { readFile, writeFile, mkdir } from "fs/promises";