skillwiki 0.10.81 → 0.10.82

package/dist/{chunk-OMO45AHI.js → chunk-5BNCYHRN.js}

@@ -6,7 +6,7 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/{chunk-GPUK2IAW.js → chunk-BO7JIJIA.js}

@@ -2,7 +2,7 @@
 import {
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-BPJ5KWIT.js";
+} from "./chunk-JHDN3FSF.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -22,7 +22,7 @@ import {
   resolveExistingRegularFileInsideVault,
   stripFencedBlocks,
   writeLogEvent
-} from "./chunk-OMO45AHI.js";
+} from "./chunk-5BNCYHRN.js";
 import {
   ExitCode,
   FleetManifestSchema,
@@ -41,7 +41,7 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/utils/managed-write-preflight.ts
 import { existsSync as existsSync11 } from "fs";

package/dist/{chunk-NPTIYO2S.js → chunk-CGQQS7MO.js}

@@ -8,7 +8,7 @@ import {
   readLogEvents,
   resolveExistingRegularFileInsideVault,
   writeLogEvent
-} from "./chunk-OMO45AHI.js";
+} from "./chunk-5BNCYHRN.js";
 import {
   ExitCode,
   RawSourceSchema,
@@ -19,7 +19,7 @@ import {
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/commands/sources.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/{chunk-BPJ5KWIT.js → chunk-JHDN3FSF.js}

@@ -8,7 +8,7 @@ import {
   ok,
   scanSensitiveContent,
   scanVault
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/utils/atomic-write.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-HJ4ALQG6.js → chunk-XJR3XXP5.js}

@@ -389,6 +389,7 @@ var VaultSyncConfigSchema = z.object({
   "vault_sync.snapshot_profile": vaultSyncPathOrNone,
   "vault_sync.snapshot_script": vaultSyncPathOrNone,
   "vault_sync.snapshot_worktree": vaultSyncPathOrNone,
+  "vault_sync.push_enabled": vaultSyncBool,
   "vault_sync.fuse_refresh_enabled": vaultSyncBool,
   "vault_sync.fuse_refresh_interval": vaultSyncDuration,
   "vault_sync.fuse_max_dir_cache": vaultSyncDuration,

package/dist/{chunk-G7I34RQW.js → chunk-YEVR5XNN.js}

@@ -6,7 +6,7 @@ import {
 import {
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-KFEOMMWK.js";
+} from "./chunk-ZUHA2EXE.js";
 import {
   CONFIG_KEYS,
   VAULT_HYGIENE_GENERATED_COMMIT_PATHS,
@@ -40,11 +40,11 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-GPUK2IAW.js";
+} from "./chunk-BO7JIJIA.js";
 import {
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-BPJ5KWIT.js";
+} from "./chunk-JHDN3FSF.js";
 import {
   applySourceCompileClaim,
   applySourceCompilePublished,
@@ -57,11 +57,11 @@ import {
   planSourceCompileRelease,
   planSourceReview,
   runSourcesPending
-} from "./chunk-NPTIYO2S.js";
+} from "./chunk-CGQQS7MO.js";
 import {
   eventPathFor,
   writeLogEvent
-} from "./chunk-OMO45AHI.js";
+} from "./chunk-5BNCYHRN.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -82,7 +82,7 @@ import {
   scanVault,
   splitFrontmatter,
   systemdPropertyFor
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/commands/log-append.ts
 import { readFile, stat } from "fs/promises";
@@ -2394,11 +2394,14 @@ function checkRcloneFlagAudit(resolvedPath) {
   }
   return check("pass", "rclone_flags", "rclone VFS flags", `PID ${pid}: all critical flags at safe values`);
 }
-function checkRcloneVersion(resolvedPath, vaultSyncInstalled) {
+function checkRcloneVersion(resolvedPath, vaultSyncInstalled, pushEnabled = true) {
+  const fuse = resolvedPath ? detectFuseMount(resolvedPath) : null;
+  if (pushEnabled === false && !fuse) {
+    return check("pass", "rclone_version", "rclone version", "push not required \u2014 check skipped");
+  }
   if (!resolvedPath && !vaultSyncInstalled) {
     return check("pass", "rclone_version", "rclone version", "No vault path \u2014 check skipped");
   }
-  const fuse = resolvedPath ? detectFuseMount(resolvedPath) : null;
   if (!fuse && !vaultSyncInstalled) {
     return check("pass", "rclone_version", "rclone version", "local disk \u2014 check skipped");
   }
@@ -2518,7 +2521,7 @@ var s3MountHealthProbe = {
       checkS3MountPerf(ctx.resolvedPath),
       checkS3MountFreshness(ctx.resolvedPath),
       checkRcloneFlagAudit(ctx.resolvedPath),
-      checkRcloneVersion(ctx.resolvedPath, ctx.vsConfig.installed),
+      checkRcloneVersion(ctx.resolvedPath, ctx.vsConfig.installed, ctx.vsConfig.pushEnabled !== false),
       checkWriteTest(ctx.resolvedPath),
       checkVfsCacheHealth(ctx.resolvedPath)
     ];
@@ -2802,6 +2805,7 @@ function readVaultSyncConfig(home) {
     let role;
     let serviceScope;
     let snapshotScript;
+    let pushEnabled;
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -2814,8 +2818,9 @@ function readVaultSyncConfig(home) {
       if (k === "vault_sync.role") role = v;
       if (k === "vault_sync.service_scope") serviceScope = v;
       if (k === "vault_sync.snapshot_script") snapshotScript = v;
+      if (k === "vault_sync.push_enabled" && v === "false") pushEnabled = false;
     }
-    return { installed, role, serviceScope, snapshotScript };
+    return { installed, role, serviceScope, snapshotScript, pushEnabled };
   } catch {
     return { installed: false };
   }
@@ -3139,6 +3144,125 @@ function snapshotterHealthChecks(scope, logDir, env) {
   const consecutiveFailures = failureStreak.count >= 2 ? check("error", "vault_sync_snapshot_consecutive_failures", "Vault sync snapshot consecutive failures", consecutiveSnapshotFailureDetail(failureStreak)) : check("pass", "vault_sync_snapshot_consecutive_failures", "Vault sync snapshot consecutive failures", consecutiveSnapshotFailureDetail(failureStreak));
   return [jobs, serviceResult, freshness, consecutiveFailures];
 }
+var PUSH_NOT_IN_PROFILE = "push not part of host profile";
+function checkLastFetchStatus(fetchLogFile) {
+  try {
+    const logContent = readFileSync8(fetchLogFile, "utf8");
+    const lines = logContent.trim().split("\n").filter(Boolean);
+    if (lines.length === 0) {
+      return check(
+        "warn",
+        "vault_sync_last_fetch_status",
+        "Vault sync last fetch status",
+        "Fetch log file is empty"
+      );
+    }
+    const lastLine = lines[lines.length - 1];
+    if (/fetch failed/i.test(lastLine)) {
+      return check(
+        "error",
+        "vault_sync_last_fetch_status",
+        "Vault sync last fetch status",
+        `Last fetch failed: ${lastLine.slice(0, 100)}`
+      );
+    }
+    if (/OK/.test(lastLine)) {
+      return check(
+        "pass",
+        "vault_sync_last_fetch_status",
+        "Vault sync last fetch status",
+        lastLine.slice(0, 100)
+      );
+    }
+    return check(
+      "warn",
+      "vault_sync_last_fetch_status",
+      "Vault sync last fetch status",
+      `Last fetch log entry: ${lastLine.slice(0, 80)}`
+    );
+  } catch {
+    return check(
+      "warn",
+      "vault_sync_last_fetch_status",
+      "Vault sync last fetch status",
+      `Fetch log not found at ${fetchLogFile}`
+    );
+  }
+}
+function checkLeafFetchScheduler(isMac, env) {
+  const fixture = env.VS_LEAF_SCHEDULER_FIXTURE;
+  if (fixture === "enabled") {
+    return check(
+      "pass",
+      "vault_sync_jobs_enabled",
+      "Vault sync jobs enabled",
+      isMac ? "launchd: com.karlchow.wiki-fetch loaded" : "systemd: wiki-fetch.timer enabled"
+    );
+  }
+  if (fixture === "disabled") {
+    return check(
+      "error",
+      "vault_sync_jobs_enabled",
+      "Vault sync jobs enabled",
+      isMac ? "launchd: com.karlchow.wiki-fetch not loaded \u2014 enable wiki-fetch" : "systemd: wiki-fetch.timer is disabled \u2014 enable wiki-fetch.timer"
+    );
+  }
+  if (fixture === "missing") {
+    return check(
+      "error",
+      "vault_sync_jobs_enabled",
+      "Vault sync jobs enabled",
+      "Scheduler check failed \u2014 enable wiki-fetch"
+    );
+  }
+  try {
+    if (isMac) {
+      const uidStr = execSync5("id -u", {
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+      const uid = parseInt(uidStr, 10);
+      execSync5(`launchctl print gui/${uid}/com.karlchow.wiki-fetch`, {
+        encoding: "utf8",
+        timeout: 2e3,
+        stdio: ["pipe", "ignore", "ignore"]
+      });
+      return check(
+        "pass",
+        "vault_sync_jobs_enabled",
+        "Vault sync jobs enabled",
+        "launchd: com.karlchow.wiki-fetch loaded"
+      );
+    }
+    const out = execSync5("systemctl --user is-enabled wiki-fetch.timer", {
+      encoding: "utf8",
+      timeout: 2e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    if (out === "enabled") {
+      return check(
+        "pass",
+        "vault_sync_jobs_enabled",
+        "Vault sync jobs enabled",
+        "systemd: wiki-fetch.timer enabled"
+      );
+    }
+    return check(
+      "error",
+      "vault_sync_jobs_enabled",
+      "Vault sync jobs enabled",
+      `systemd: wiki-fetch.timer is ${out} \u2014 enable wiki-fetch.timer`
+    );
+  } catch {
+    return check(
+      "error",
+      "vault_sync_jobs_enabled",
+      "Vault sync jobs enabled",
+      "Scheduler check failed \u2014 enable wiki-fetch"
+    );
+  }
+}
 function vaultSyncChecks(input) {
   const os = input.os ?? platform3();
   const home = input.home;
@@ -3217,6 +3341,44 @@ function vaultSyncChecks(input) {
     }
     return [c12, ...healthChecks, cFetch2, c42, c52];
   }
+  const env = input.env ?? process.env;
+  const fetchLogFile = join15(logDir, "wiki-fetch.log");
+  if (input.pushEnabled === false) {
+    const fetchHelperPath = join15(shareDir, "wiki-fetch-notify.sh");
+    const c12 = existsSync12(fetchHelperPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${fetchHelperPath}`) : check(
+      "error",
+      "vault_sync_installed",
+      "Vault sync installed",
+      `Fetch helper not found at ${fetchHelperPath}`
+    );
+    const c22 = checkLeafFetchScheduler(isMac, env);
+    const c32 = check(
+      "pass",
+      "vault_sync_last_push_age",
+      "Vault sync last push recency",
+      PUSH_NOT_IN_PROFILE
+    );
+    const cPushResult2 = check(
+      "pass",
+      "vault_sync_last_push_result",
+      "Vault sync last push result",
+      PUSH_NOT_IN_PROFILE
+    );
+    const cFetch2 = checkLastFetchStatus(fetchLogFile);
+    const c42 = check(
+      "pass",
+      "vault_sync_filter_present",
+      "Vault sync filter file present",
+      PUSH_NOT_IN_PROFILE
+    );
+    const c52 = check(
+      "pass",
+      "vault_sync_snapshot_guard",
+      "Snapshot script guard",
+      "Not a snapshotter host \u2014 check skipped"
+    );
+    return [c12, c22, c32, cPushResult2, cFetch2, c42, c52];
+  }
   const pushScriptPath = join15(shareDir, "wiki-push.sh");
   const c1 = existsSync12(pushScriptPath) ? check("pass", "vault_sync_installed", "Vault sync installed", `Found: ${pushScriptPath}`) : check("error", "vault_sync_installed", "Vault sync installed", `Script not found at ${pushScriptPath} \u2014 run vault-sync-install`);
   let c2;
@@ -3321,51 +3483,7 @@ function vaultSyncChecks(input) {
       `result=refused reason=${pushState.reason ?? ""} timestamp=${pushState.timestamp ?? ""}`
     );
   }
-  const fetchLogFile = join15(logDir, "wiki-fetch.log");
-  let cFetch;
-  try {
-    const logContent = readFileSync8(fetchLogFile, "utf8");
-    const lines = logContent.trim().split("\n").filter(Boolean);
-    if (lines.length === 0) {
-      cFetch = check(
-        "warn",
-        "vault_sync_last_fetch_status",
-        "Vault sync last fetch status",
-        "Fetch log file is empty"
-      );
-    } else {
-      const lastLine = lines[lines.length - 1];
-      if (/fetch failed/i.test(lastLine)) {
-        cFetch = check(
-          "error",
-          "vault_sync_last_fetch_status",
-          "Vault sync last fetch status",
-          `Last fetch failed: ${lastLine.slice(0, 100)}`
-        );
-      } else if (/OK/.test(lastLine)) {
-        cFetch = check(
-          "pass",
-          "vault_sync_last_fetch_status",
-          "Vault sync last fetch status",
-          lastLine.slice(0, 100)
-        );
-      } else {
-        cFetch = check(
-          "warn",
-          "vault_sync_last_fetch_status",
-          "Vault sync last fetch status",
-          `Last fetch log entry: ${lastLine.slice(0, 80)}`
-        );
-      }
-    }
-  } catch {
-    cFetch = check(
-      "warn",
-      "vault_sync_last_fetch_status",
-      "Vault sync last fetch status",
-      `Fetch log not found at ${fetchLogFile}`
-    );
-  }
+  const cFetch = checkLastFetchStatus(fetchLogFile);
   let c4;
   try {
     if (!existsSync12(filterPath)) {
@@ -3538,6 +3656,7 @@ var vaultSyncProbe = {
       vaultSyncInstalled: ctx.vsConfig.installed,
       vaultSyncRole: ctx.vsConfig.role,
       vaultSyncServiceScope: ctx.vsConfig.serviceScope,
+      pushEnabled: ctx.vsConfig.pushEnabled,
       snapshotScriptPath: ctx.vsConfig.snapshotScript,
       env: ctx.input.env ?? process.env
     }));
@@ -6332,7 +6451,7 @@ async function runQuery(input) {
   }
   let pendingSources;
   if (input.includePending) {
-    const { runSourcesPending: runSourcesPending2 } = await import("./sources-C4LUWNET.js");
+    const { runSourcesPending: runSourcesPending2 } = await import("./sources-TNX2VEMB.js");
     const pending = await runSourcesPending2({
       vault: input.vault,
       match: input.text,
@@ -7681,7 +7800,9 @@ export {
   runConfigList,
   runConfigPath,
   detectFuseMount,
+  readVaultSyncConfig,
   snapshotterHealthChecks,
+  PUSH_NOT_IN_PROFILE,
   SATELLITE_STALE_MS,
   satelliteLatestRunPath,
   isFailedRunStatus,

package/dist/{chunk-KFEOMMWK.js → chunk-ZUHA2EXE.js}

@@ -3,11 +3,11 @@ import {
   ROOT_INDEX_SECTION_ORDER,
   atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-BPJ5KWIT.js";
+} from "./chunk-JHDN3FSF.js";
 import {
   err,
   ok
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";

package/dist/cli.js

@@ -5,6 +5,7 @@ import {
   DEFAULT_DIRTY_VOLUME_THRESHOLD,
   DEFAULT_NO_DECISION_STREAK,
   GateError,
+  PUSH_NOT_IN_PROFILE,
   SATELLITE_STALE_MS,
   buildVectorIndex,
   configPath,
@@ -18,6 +19,7 @@ import {
   pruneVectorIndex,
   readCliPackageJson,
   readSatelliteLatestRunFromText,
+  readVaultSyncConfig,
   reindexPageInVectorIndex,
   renderIndexUpsert,
   renderProjectIndex,
@@ -50,7 +52,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-G7I34RQW.js";
+} from "./chunk-YEVR5XNN.js";
 import {
   normalizeDistTag,
   readCache,
@@ -63,7 +65,7 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-KFEOMMWK.js";
+} from "./chunk-ZUHA2EXE.js";
 import {
   FLEET_REL_PATH,
   REDACTED_MALFORMED_REFERENCE,
@@ -151,12 +153,12 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-GPUK2IAW.js";
+} from "./chunk-BO7JIJIA.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
   prepareTypedPage
-} from "./chunk-BPJ5KWIT.js";
+} from "./chunk-JHDN3FSF.js";
 import {
   applySourceDisposition,
   decodeSourceActionApproval,
@@ -164,7 +166,7 @@ import {
   inventorySources,
   planSourceDisposition,
   runSourcesPending
-} from "./chunk-NPTIYO2S.js";
+} from "./chunk-CGQQS7MO.js";
 import {
   authorizeRawOperation,
   buildSourceReferenceIndex,
@@ -181,7 +183,7 @@ import {
   resolveExistingRegularFileInsideVault,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-OMO45AHI.js";
+} from "./chunk-5BNCYHRN.js";
 import {
   ExitCode,
   MetaSchema,
@@ -202,7 +204,7 @@ import {
   scanVault,
   splitFrontmatter,
   vaultIoConcurrency
-} from "./chunk-HJ4ALQG6.js";
+} from "./chunk-XJR3XXP5.js";
 
 // src/cli.ts
 import { join as join42 } from "path";
@@ -3136,29 +3138,6 @@ function classifyLog(path, id, label, okPattern) {
   if (okPattern.test(last)) return { id, label, status: "pass", detail: last.slice(0, 120) };
   return { id, label, status: "warn", detail: last.slice(0, 120) };
 }
-function readVaultSyncRoleAndScope(home) {
-  try {
-    const content = readFileSync10(join17(home, ".skillwiki", ".env"), "utf8");
-    let role;
-    let serviceScope;
-    let snapshotScript;
-    for (const line of content.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq <= 0) continue;
-      const k = trimmed.slice(0, eq).trim();
-      const v = trimmed.slice(eq + 1).trim();
-      if (v.length === 0) continue;
-      if (k === "vault_sync.role") role = v;
-      if (k === "vault_sync.service_scope") serviceScope = v;
-      if (k === "vault_sync.snapshot_script") snapshotScript = v;
-    }
-    return { role, serviceScope, snapshotScript };
-  } catch {
-    return {};
-  }
-}
 function runVaultSyncHealth(home, syncMode, env = process.env) {
   if (syncMode === "off") {
     return {
@@ -3174,8 +3153,10 @@ function runVaultSyncHealth(home, syncMode, env = process.env) {
   const logDir = isMac ? join17(home, "Library", "Logs") : join17(home, ".local", "state", "vault-sync", "log");
   const filterPath = join17(home, ".config", "rclone", "wiki-push-filters.txt");
   const checks = [];
-  const pushScript = join17(shareDir, "wiki-push.sh");
-  if (syncMode === "optional" && !existsSync6(pushScript)) {
+  const vsConfig = readVaultSyncConfig(home);
+  const fetchOnly = vsConfig.pushEnabled === false;
+  const installedScript = fetchOnly ? join17(shareDir, "wiki-fetch-notify.sh") : join17(shareDir, "wiki-push.sh");
+  if (syncMode === "optional" && !existsSync6(installedScript)) {
     return {
       status: "pass",
       blocking: false,
@@ -3184,11 +3165,10 @@ function runVaultSyncHealth(home, syncMode, env = process.env) {
       checks: [{
         id: "vault_sync_installed",
         status: "pass",
-        detail: `vault-sync not installed at ${pushScript}; optional check skipped`
+        detail: `vault-sync not installed at ${installedScript}; optional check skipped`
       }]
     };
   }
-  const vsConfig = readVaultSyncRoleAndScope(home);
   if (vsConfig.role === "snapshotter") {
     const snapshotScript = vsConfig.snapshotScript ?? join17(shareDir, "wiki-snapshot.sh");
     const installed = existsSync6(snapshotScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found snapshot script: ${snapshotScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Snapshot script not found at ${snapshotScript}` };
@@ -3212,23 +3192,31 @@ function runVaultSyncHealth(home, syncMode, env = process.env) {
       checks: allChecks.map((c) => ({ id: c.id, status: c.status, detail: c.detail }))
     };
   }
-  checks.push(existsSync6(pushScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${pushScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${pushScript}` });
+  checks.push(existsSync6(installedScript) ? { id: "vault_sync_installed", label: "Vault sync installed", status: "pass", detail: `Found: ${installedScript}` } : { id: "vault_sync_installed", label: "Vault sync installed", status: "error", detail: `Script missing: ${installedScript}` });
   if (isMac) {
     const pushPlist = join17(home, "Library", "LaunchAgents", "com.karlchow.wiki-push.plist");
     const fetchPlist = join17(home, "Library", "LaunchAgents", "com.karlchow.wiki-fetch.plist");
-    checks.push(existsSync6(pushPlist) && existsSync6(fetchPlist) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "launchd unit files missing (read-only mode)" });
+    const jobsOk = fetchOnly ? existsSync6(fetchPlist) : existsSync6(pushPlist) && existsSync6(fetchPlist);
+    checks.push(jobsOk ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: fetchOnly ? "launchd: wiki-fetch unit file present (read-only mode)" : "launchd unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: fetchOnly ? "launchd wiki-fetch unit file missing (read-only mode)" : "launchd unit files missing (read-only mode)" });
     checks.push({ id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "macOS host \u2014 check skipped" });
   } else {
     const pushTimer = join17(home, ".config", "systemd", "user", "wiki-push.timer");
     const fetchTimer = join17(home, ".config", "systemd", "user", "wiki-fetch.timer");
     const fuseTimer = join17(home, ".config", "systemd", "user", "wiki-fuse-refresh.timer");
     const fuseService = join17(home, ".config", "systemd", "user", "wiki-fuse-refresh.service");
-    checks.push(existsSync6(pushTimer) && existsSync6(fetchTimer) ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: "systemd timer unit files missing (read-only mode)" });
+    const jobsOk = fetchOnly ? existsSync6(fetchTimer) : existsSync6(pushTimer) && existsSync6(fetchTimer);
+    checks.push(jobsOk ? { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "pass", detail: fetchOnly ? "systemd: wiki-fetch.timer unit file present (read-only mode)" : "systemd timer unit files present (read-only mode)" } : { id: "vault_sync_jobs_enabled", label: "Vault sync jobs enabled", status: "warn", detail: fetchOnly ? "systemd wiki-fetch.timer unit file missing (read-only mode)" : "systemd timer unit files missing (read-only mode)" });
     checks.push(existsSync6(fuseTimer) && existsSync6(fuseService) ? { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "pass", detail: "wiki-fuse-refresh unit files present (read-only mode)" } : { id: "vault_sync_fuse_refresh_job", label: "Vault sync fuse refresh job", status: "warn", detail: "wiki-fuse-refresh unit files missing (read-only mode)" });
   }
-  checks.push(classifyLog(join17(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  if (fetchOnly) {
+    checks.push({ id: "vault_sync_last_push_age", label: "Vault sync last push recency", status: "pass", detail: PUSH_NOT_IN_PROFILE });
+  } else {
+    checks.push(classifyLog(join17(logDir, "wiki-push.log"), "vault_sync_last_push_age", "Vault sync last push recency", /OK push/));
+  }
   checks.push(classifyLog(join17(logDir, "wiki-fetch.log"), "vault_sync_last_fetch_status", "Vault sync last fetch status", /NOTIFY|OK behind|OK/));
-  if (!existsSync6(filterPath)) {
+  if (fetchOnly) {
+    checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "pass", detail: PUSH_NOT_IN_PROFILE });
+  } else if (!existsSync6(filterPath)) {
     checks.push({ id: "vault_sync_filter_present", label: "Vault sync filter file present", status: "error", detail: `Filter missing: ${filterPath}` });
   } else {
     const content = readFileSync10(filterPath, "utf8");
@@ -3784,7 +3772,7 @@ ${fmRewritten}
   }
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-J5IV7NH3.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-YP4JIMIQ.js");
     const before = await readFile7(join19(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -3907,7 +3895,7 @@ async function runRemove(input) {
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
     const { readFile: readFile22 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-J5IV7NH3.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-YP4JIMIQ.js");
     const before = await readFile22(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -10559,7 +10547,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-DEPLZAA6.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-BAIL5GMW.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,

package/dist/{index-projection-J5IV7NH3.js → index-projection-YP4JIMIQ.js}

@@ -4,9 +4,9 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-KFEOMMWK.js";
-import "./chunk-BPJ5KWIT.js";
-import "./chunk-HJ4ALQG6.js";
+} from "./chunk-ZUHA2EXE.js";
+import "./chunk-JHDN3FSF.js";
+import "./chunk-XJR3XXP5.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{managed-write-preflight-DEPLZAA6.js → managed-write-preflight-BAIL5GMW.js}

@@ -6,10 +6,10 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-GPUK2IAW.js";
-import "./chunk-BPJ5KWIT.js";
-import "./chunk-OMO45AHI.js";
-import "./chunk-HJ4ALQG6.js";
+} from "./chunk-BO7JIJIA.js";
+import "./chunk-JHDN3FSF.js";
+import "./chunk-5BNCYHRN.js";
+import "./chunk-XJR3XXP5.js";
 export {
   DEFAULT_MANAGED_WRITE_WAIT_MS,
   MANAGED_WRITE_POLL_INTERVAL_MS,

package/dist/skillwiki-mcp.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-G7I34RQW.js";
+} from "./chunk-YEVR5XNN.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-KFEOMMWK.js";
-import "./chunk-GPUK2IAW.js";
-import "./chunk-BPJ5KWIT.js";
-import "./chunk-NPTIYO2S.js";
-import "./chunk-OMO45AHI.js";
-import "./chunk-HJ4ALQG6.js";
+import "./chunk-ZUHA2EXE.js";
+import "./chunk-BO7JIJIA.js";
+import "./chunk-JHDN3FSF.js";
+import "./chunk-CGQQS7MO.js";
+import "./chunk-5BNCYHRN.js";
+import "./chunk-XJR3XXP5.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-TNX2VEMB.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-CGQQS7MO.js";
+import "./chunk-5BNCYHRN.js";
+import "./chunk-XJR3XXP5.js";
+export {
+  runSourcesPending
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.81",
+  "version": "0.10.82",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.81",
+  "version": "0.10.82",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.81",
+  "version": "0.10.82",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 21 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.81",
+  "version": "0.10.82",
   "description": "Project-aware Karpathy-style knowledge base: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.81",
+  "version": "0.10.82",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/using-skillwiki/SKILL.md

@@ -247,7 +247,7 @@ Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. Fetch-only leaves set `vault_sync.push_enabled=false`; doctor must not tell them to run `vault-sync-install` to enable wiki-push. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/skills/using-skillwiki/SKILL.md

@@ -247,7 +247,7 @@ Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. Fetch-only leaves set `vault_sync.push_enabled=false`; doctor must not tell them to run `vault-sync-install` to enable wiki-push. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/dist/sources-C4LUWNET.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import {
-  runSourcesPending
-} from "./chunk-NPTIYO2S.js";
-import "./chunk-OMO45AHI.js";
-import "./chunk-HJ4ALQG6.js";
-export {
-  runSourcesPending
-};