@indigoai-us/hq-cli 5.158.0 → 5.159.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.159.0] — 2026-09-24
+
+### Fixed
+
+- Hook timeout reports now identify the slow child hook and group concurrent
+  session-wide slowness together. Update checks have bounded network calls, and
+  the core-write guard avoids repeated subprocess work.
+- Machine-wide hook warnings and exceeded timeouts now keep separate Sentry
+  groups, and per-script rate limits no longer suppress a later machine-wide
+  report from the same session.
+
 ## [5.158.0] — 2026-09-24
 
 ### Added

package/dist/lib/core-utils/sentry-report.d.ts

@@ -27,7 +27,7 @@ export declare const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
  * is owner-approved telemetry for the exact hook script and may include a
  * company directory; it is never a substitute for hook input or a transcript.
  */
-export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence"];
+export declare const ALLOWED_SENTRY_REPORT_METADATA_KEYS: readonly ["hook_name", "hook_path", "hook_event", "hook_script", "tool_name", "session_id", "declared_timeout_ms", "elapsed_ms", "remaining_ms", "watchdog_timeout_ms", "hook_timeout_ms", "hq_version", "platform", "load_average", "spawn_ms", "slow_child", "slow_child_ms", "exit_code", "final_elapsed_ms", "bash_env_set", "cwd_kind", "shell", "nproc", "hook_sequence"];
 export declare const MAX_SENTRY_REPORT_METADATA_KEYS: number;
 export type HookSequenceEntry = {
     script: string;

package/dist/lib/core-utils/sentry-report.js

@@ -45,11 +45,26 @@ const HOOK_TIMEOUT_WARNING_METRIC = "hq.hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_METRIC = "hq.hook_timeout_exceeded";
 const HOOK_TIMEOUT_EXCEEDED_FINGERPRINT = "hook-timeout-exceeded";
 const HOOK_TIMEOUT_WARNING_FINGERPRINT = "hook-timeout";
+const HOOK_TIMEOUT_MACHINE_WIDE_FINGERPRINT = "hq-hook-slow";
 const MAX_HOOK_SEQUENCE_ENTRIES = 20;
 const HOOK_TIMEOUT_RATE_LIMIT_WINDOW_MS = 10 * 60 * 1_000;
 const RATE_LIMIT_LOCK_WAIT_MS = 500;
 const RATE_LIMIT_LOCK_POLL_MS = 5;
 const RATE_LIMIT_LOCK_STALE_MS = 5_000;
+const KNOWN_HOOK_SCRIPTS = new Set([
+    "master-hook.sh",
+    "hook-gate.sh",
+    "hook-timeout-watchdog.sh",
+    "check-hq-update.sh",
+    "block-core-writes-bash.sh",
+    "block-core-writes.sh",
+    "block-hq-worktree-session.sh",
+    "inject-policy-on-trigger.sh",
+    "inject-local-context.sh",
+    "session-title.sh",
+    "45-lanes-senior-monitor.sh",
+    "lanes-senior-monitor-stop-gate.sh",
+]);
 /**
  * The only hook diagnostics that can be attached as metadata. The list omits
  * command text, prompts, payloads, company names, and repositories. `hook_path`
@@ -71,6 +86,9 @@ export const ALLOWED_SENTRY_REPORT_METADATA_KEYS = [
     "hq_version",
     "platform",
     "load_average",
+    "spawn_ms",
+    "slow_child",
+    "slow_child_ms",
     "exit_code",
     "final_elapsed_ms",
     "bash_env_set",
@@ -223,6 +241,9 @@ export function parseSentryReportEvent(stdin) {
                 ? boundedHookSequence(rawMetadata[key])
                 : rawMetadata[key];
     }
+    if (typeof metadata.slow_child === "string") {
+        metadata.slow_child = safeSlowChild(metadata);
+    }
     return {
         code: 0,
         event: {
@@ -311,6 +332,63 @@ function loadBucket(loadAverage) {
         return "10-20";
     return ">=20";
 }
+function parsedLoadAverage(metadata) {
+    const value = metadata.load_average;
+    if (typeof value === "number" && Number.isFinite(value) && value >= 0)
+        return value;
+    if (typeof value !== "string")
+        return undefined;
+    if (value === "unavailable")
+        return "unavailable";
+    const match = /^\s*\{?\s*([0-9]+(?:\.[0-9]+)?)/.exec(value);
+    if (!match)
+        return undefined;
+    const parsed = Number(match[1]);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function operatingSystemName(metadata) {
+    const platform = stringMetadata(metadata, "platform", "").toLowerCase();
+    if (/windows|win32|mingw|msys|cygwin/.test(platform))
+        return "windows";
+    if (/darwin|macos|mac os/.test(platform))
+        return "macos";
+    if (/linux/.test(platform))
+        return "linux";
+    return "other";
+}
+function spawnMsBucket(metadata) {
+    const value = metadata.spawn_ms;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        return "unavailable";
+    if (value < 100)
+        return "<100ms";
+    if (value < 500)
+        return "100-499ms";
+    if (value < 1_000)
+        return "500-999ms";
+    return ">=1000ms";
+}
+function safeSlowChild(metadata) {
+    const value = metadata.slow_child;
+    if (typeof value !== "string" || value.length === 0)
+        return "other";
+    const script = basenameFromPath(value);
+    return KNOWN_HOOK_SCRIPTS.has(script) ? script : "other";
+}
+function isMachineWideHookSlowness(metadata) {
+    const spawnMs = metadata.spawn_ms;
+    if (typeof spawnMs === "number" && Number.isFinite(spawnMs) && spawnMs >= 500)
+        return true;
+    if (!Array.isArray(metadata.hook_sequence))
+        return false;
+    const slowScripts = new Set();
+    for (const entry of metadata.hook_sequence) {
+        if (entry.ms < 20_000 || !SAFE_HOOK_SCRIPT.test(entry.script))
+            continue;
+        slowScripts.add(entry.script);
+    }
+    return slowScripts.size >= 3;
+}
 function bashEnvTag(metadata) {
     const value = metadata.bash_env_set;
     if (value === true || value === "set")
@@ -330,7 +408,8 @@ function hookTimeoutTags(event) {
         : undefined;
     const shell = stringMetadata(metadata, "shell");
     const nproc = metadata.nproc;
-    const loadAverage = metadata.load_average;
+    const loadAverage = parsedLoadAverage(metadata);
+    const slowChildMs = metadata.slow_child_ms;
     return {
         hook_event: hookEvent(metadata),
         hook_script: hookScript(metadata),
@@ -346,7 +425,14 @@ function hookTimeoutTags(event) {
         shell: safeTagValue(shell),
         bash_env: bashEnvTag(metadata),
         cwd_kind: safeMetadataTag(metadata, "cwd_kind"),
-        load_bucket: typeof loadAverage === "number" ? loadBucket(loadAverage) : "unknown",
+        os_name: operatingSystemName(metadata),
+        load_bucket: loadAverage === "unavailable" ? "unavailable" : loadBucket(loadAverage),
+        spawn_ms_bucket: spawnMsBucket(metadata),
+        slow_child: safeSlowChild(metadata),
+        slow_child_ms_bucket: typeof slowChildMs === "number" && Number.isFinite(slowChildMs)
+            ? elapsedBucket(slowChildMs)
+            : "unknown",
+        machine_wide: isMachineWideHookSlowness(metadata) ? "true" : "false",
         nproc: typeof nproc === "number" || typeof nproc === "string"
             ? safeTagValue(String(nproc), SAFE_NPROC)
             : "unknown",
@@ -393,7 +479,20 @@ function hookTimeoutExceededOverrides(event) {
     const eventName = hookEvent(event.metadata);
     if (!isHookTimeoutEvent(event))
         return undefined;
-    if (hookTimeoutKind(event) === "warning") {
+    const kind = hookTimeoutKind(event);
+    if (isMachineWideHookSlowness(event.metadata)) {
+        return {
+            level: "warning",
+            fingerprint: [
+                HOOK_TIMEOUT_MACHINE_WIDE_FINGERPRINT,
+                "machine-wide",
+                operatingSystemName(event.metadata),
+                eventName,
+                kind,
+            ],
+        };
+    }
+    if (kind === "warning") {
         return {
             level: "warning",
             fingerprint: [HOOK_TIMEOUT_WARNING_FINGERPRINT, eventName, hookScript(event.metadata)],
@@ -536,7 +635,11 @@ function pruneExpiredRateLimitState(directory, now, protectedStatePath) {
 }
 function timeoutRateLimitLease(event, kind, options, dependencies) {
     const sessionId = stringMetadata(event.metadata, "session_id");
-    const key = `${sessionId}\0${hookEvent(event.metadata)}\0${hookScript(event.metadata)}\0${kind}`;
+    const machineWide = isMachineWideHookSlowness(event.metadata);
+    const classification = machineWide
+        ? `machine-wide\0${operatingSystemName(event.metadata)}`
+        : `per-script\0${hookScript(event.metadata)}`;
+    const key = `${sessionId}\0${hookEvent(event.metadata)}\0${kind}\0${classification}`;
     const directory = rateLimitDirectory(options, dependencies);
     const statePath = rateLimitStatePath(directory, key);
     const releaseLock = acquireRateLimitLock(directory);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.158.0",
+  "version": "5.159.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {