@indigoai-us/hq-cli 5.303.0 → 5.305.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [5.305.0] — 2026-10-01
+
+- Work Mesh project discovery skips projects whose matching local lifecycle state is archived or retired.
+
+- `hq lanes show` now treats a newer terminal primary mirror as authoritative when an Outpost owner snapshot is behind, avoiding a misleading refresh warning while preserving warnings for nonterminal conflicts.
+- Self-updates detect an unwritable npm global prefix before install, show the command to repair that install, and report the handled permission state as a rate-limited warning.
+- Keep Work Mesh held events unique by event ID across retries, including interrupted overflow recovery.
+- Added `hq mcp list` as an alias for the existing MCP status command. `hq version` can show cached CLI update guidance on stderr when the default-off `cli.version-update-nudge` flag is enabled. Bare `hq --version` prints only the installed CLI semver and starts no flag or network work.
+- Keep-alive no longer lets a newer terminal lane or a same-profile lane under a distinct lane senior supersede a running lane.
+- With `cli.company-errors-sdk-warning` enabled, `hq people` uses shared active-company guidance when local metadata is missing, and files commands show the AWS SDK Node-version notice only with verbose diagnostics.
+- Remove the unrelated secret-sharing hint from active member listings.
+
+## [5.304.0] — 2026-10-01
+- `hq lanes show` skips owner refresh only when a failed Outpost dispatch explicitly recorded `pickup_persisted: false` and no owner heartbeat; it reports `remote_refresh: "skipped_undispatched"` in that case.
+
 ## [5.303.0] — 2026-10-01
 - Fixed bundled shell scripts failing on Windows when Git Bash is installed but `bash` is not on `PATH`.
 - The bundled token usage script now reads Claude sessions from `CLAUDE_CONFIG_DIR/projects` and the standard Claude project directories, including nested session folders (subagent transcripts are skipped), when no project directory is given.

package/dist/command-catalog.generated.d.ts

@@ -3622,7 +3622,7 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly subcommands: readonly [{
         readonly name: "status";
         readonly description: "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)";
-        readonly aliases: readonly [];
+        readonly aliases: readonly ["list"];
         readonly hidden: false;
         readonly usage: "[options]";
         readonly arguments: readonly [];

package/dist/command-catalog.generated.js

@@ -4674,7 +4674,9 @@ export const COMMAND_CATALOG = [
             {
                 "name": "status",
                 "description": "Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)",
-                "aliases": [],
+                "aliases": [
+                    "list"
+                ],
                 "hidden": false,
                 "usage": "[options]",
                 "arguments": [],

package/dist/command-registration-plan.js

@@ -85,6 +85,7 @@ export const REGISTRATION_PLAN = [
 ];
 async function executePlan(program, steps) {
     const parents = new Map([["program", program]]);
+    let filesRuntimeConfigured = false;
     for (const step of steps) {
         if (step.type === "group") {
             const group = program.command(step.name, step.hidden ? { hidden: true } : {});
@@ -94,6 +95,13 @@ async function executePlan(program, steps) {
         const parent = parents.get(step.parent);
         if (!parent)
             throw new Error(`Missing command parent '${step.parent}' for '${step.exportName}'`);
+        if (step.root === "files" && !filesRuntimeConfigured) {
+            // The SDK emits its Node support notice during module evaluation. Set
+            // its narrow suppression switch before loading any files command module.
+            const { configureAwsSdkNodeVersionWarningOutput } = await import("./lib/aws-sdk-node-warning-output.js");
+            configureAwsSdkNodeVersionWarningOutput();
+            filesRuntimeConfigured = true;
+        }
         const imported = await import(step.module);
         const register = imported[step.exportName];
         if (!register)

package/dist/commands/lanes.d.ts

@@ -132,6 +132,8 @@ export declare function parseMaxRuntimeSeconds(raw: unknown, workerId: string):
 export declare const PICKUP_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "model_unsupported"];
 export declare const DISPATCH_TERMINAL_REASON: "outpost_dispatch_failed";
 export type PickupTerminalReason = (typeof PICKUP_TERMINAL_REASONS)[number];
+/** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
+export declare function isUndispatchedOutpostMirror(lane: LaneRecord): boolean;
 /**
  * The CAS updater a pickup failure applies. A lane that is already terminal
  * for any reason (a cancel that landed after the caller's last read, an

package/dist/commands/lanes.js

@@ -1284,9 +1284,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
         ((parentLaneIds === undefined || (lane.senior.kind === "lane" &&
             lane.senior.id !== undefined &&
             parentLaneIds.has(lane.senior.id))) || options.laneIds?.has(lane.lane_id) === true) &&
-        !(isTerminalLaneState(lane.state) &&
-            lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
-            lane.last_host_report_at === undefined) &&
+        !isUndispatchedOutpostMirror(lane) &&
         (options.includeTerminalMirrors === true || !isTerminalLaneState(lane.state)))
         .sort((a, b) => {
         const terminalOrder = Number(isTerminalLaneState(a.state)) - Number(isTerminalLaneState(b.state));
@@ -2524,6 +2522,14 @@ export const PICKUP_TERMINAL_REASONS = [
     "model_unsupported",
 ];
 export const DISPATCH_TERMINAL_REASON = "outpost_dispatch_failed";
+/** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
+export function isUndispatchedOutpostMirror(lane) {
+    return lane.host.kind === "outpost" &&
+        isTerminalLaneState(lane.state) &&
+        lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
+        lane.terminal_details?.pickup_persisted === false &&
+        lane.last_host_report_at == null;
+}
 function parsePickupTerminalReason(value) {
     if (PICKUP_TERMINAL_REASONS.includes(value)) {
         return value;
@@ -3647,6 +3653,9 @@ async function dispatchCreatedOutpostLane(ctx, input) {
                 command_id: dispatched.commandId,
                 exit_code: dispatched.exitCode,
                 status: dispatched.status,
+                ...(remote?.pickup_persisted === false || ownerError.details.pickup_persisted === false
+                    ? { pickup_persisted: false }
+                    : {}),
                 owner_error: ownerError,
             });
             await emitLaneTerminalStateSoft(ctx, failed);
@@ -5038,13 +5047,17 @@ async function runOutpostIdentityBackfillTarget(ctx, opts) {
 }
 async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
     if (lane.host.kind !== "outpost" || laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
-        return lane;
+        return { lane };
+    }
+    if (isUndispatchedOutpostMirror(lane)) {
+        return { lane, remoteRefresh: "skipped_undispatched" };
     }
     const outpostId = lane.host.id;
     const descendantIds = localLanes
         .filter((candidate) => candidate.lane_id !== lane.lane_id &&
         candidate.host.kind === "outpost" && candidate.host.id === outpostId &&
         walkHitsLane(ctx.hqRoot(), candidate.senior, lane.lane_id, ctx))
+        .filter((candidate) => !isUndispatchedOutpostMirror(candidate))
         .map((candidate) => candidate.lane_id);
     const refresh = async (laneId) => {
         try {
@@ -5052,6 +5065,19 @@ async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
             return syncLaneRecordFromOwner(ctx.hqRoot(), laneId, outpostId, ownerLane, undefined, { allowNonTerminal: true });
         }
         catch (err) {
+            if (isLanesError(err) && err.error === "outpost_lane_sync_conflict") {
+                const ownerVersion = err.details.owner_version;
+                const primaryVersion = err.details.primary_version;
+                if (typeof ownerVersion === "number" &&
+                    typeof primaryVersion === "number" &&
+                    ownerVersion < primaryVersion) {
+                    const currentPrimary = readLane(ctx.hqRoot(), laneId);
+                    if (currentPrimary.version === primaryVersion &&
+                        isTerminalLaneState(currentPrimary.state)) {
+                        return currentPrimary;
+                    }
+                }
+            }
             const detail = isLanesError(err)
                 ? `${err.error}: ${err.message}`
                 : `outpost_lane_sync_unavailable: ${dispatchErrorMessage(err)}`;
@@ -5061,13 +5087,14 @@ async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
     };
     const refreshed = await mapWithConcurrency([lane.lane_id, ...descendantIds], OUTPOST_HIRE_SUMMARY_CONCURRENCY, refresh);
     const refreshedLane = refreshed[0] ?? null;
-    return refreshedLane ?? lane;
+    return { lane: refreshedLane ?? lane };
 }
 async function runShow(ctx, laneId, hasPendingQuestionForLane) {
     const hqRoot = ctx.hqRoot();
     const initialLane = readLane(hqRoot, laneId);
     const initialLanes = loadAllLanes(hqRoot);
-    const storedLane = await refreshOutpostLaneCopiesForShow(ctx, initialLane, initialLanes);
+    const showRefresh = await refreshOutpostLaneCopiesForShow(ctx, initialLane, initialLanes);
+    const storedLane = showRefresh.lane;
     const allLanes = loadAllLanes(hqRoot);
     const hire = await laneHirePresentation(ctx, storedLane, allLanes);
     const remoteQueued = storedLane.state === "queued" &&
@@ -5152,6 +5179,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
         stalled_reason: lane.stalled_reason ?? null,
         ask_delivery_failed: askDeliveryFailed,
         delivery,
+        ...(showRefresh.remoteRefresh === undefined ? {} : { remote_refresh: showRefresh.remoteRefresh }),
         provider_session_id: lane.provider_session_id ?? null,
         provider_session_id_absent: lane.provider_session_id_absent ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,

package/dist/commands/mcp-status.js

@@ -374,6 +374,7 @@ export function registerMcpCommand(program) {
         .description('MCP pack observability (read-only) across Claude + Codex');
     mcp
         .command('status')
+        .alias('list')
         .description('Show installed MCP packs/servers and their health in BOTH Claude and Codex (PARTIAL/DRIFT flagged; secrets redacted)')
         .option('--json', 'Emit the structured report as JSON (for CI / scripting)')
         .action((opts) => {

package/dist/commands/members.js

@@ -672,7 +672,6 @@ export function registerMembersCommand(program) {
                 const name = m.personName ?? m.personSlug ?? "";
                 console.log([email.padEnd(emailW), m.role.padEnd(roleW), name].join("  "));
             }
-            console.log(chalk.gray("Share a secret with a member: hq secrets share <path> --with <email>"));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {

package/dist/commands/people.d.ts

@@ -17,6 +17,9 @@ import { resolveNameToEmail, type PersonRecord } from "../utils/people.js";
 export type FetchPeopleRoster = (hqRoot: string, companySlug: string) => Promise<PersonRecord[]>;
 interface PeopleCommandDeps {
     fetchRoster?: FetchPeopleRoster;
+    /** Test seam for the shared active-membership ambiguity resolver. */
+    resolveMissingManifestMemberships?: () => Promise<void>;
+    companySelectionGuidanceEnabled?: () => boolean;
 }
 interface PeopleLookupOpts {
     localOnly?: boolean;

package/dist/commands/people.js

@@ -19,6 +19,7 @@ import { findHqRoot } from "../utils/manifest.js";
 import { manifestPath } from "./cloud-provision.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
+import { companyErrorsSdkWarningEnabled } from "../lib/company-errors-sdk-warning-flag.js";
 import { listActiveMembers } from "./members.js";
 import { assertSafeCompanySlug, listCompanyPeople, searchPeople, resolveNameToEmail, companyPeopleDir, } from "../utils/people.js";
 function slugify(value) {
@@ -108,6 +109,29 @@ export function resolveCompanySlug(hqRoot, explicit) {
     throw new Error("Multiple companies found — re-run with --company <slug> to pick one:\n" +
         slugs.map((s) => `  --company ${s}`).join("\n"));
 }
+async function resolvePeopleCompanySlug(hqRoot, explicit, localOnly, deps) {
+    try {
+        return resolveCompanySlug(hqRoot, explicit);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const ambiguous = message.includes("companies/manifest.yaml not found") ||
+            message.startsWith("Multiple companies found");
+        const enabled = (deps.companySelectionGuidanceEnabled ?? companyErrorsSdkWarningEnabled)();
+        if (!explicit && !localOnly && enabled && ambiguous) {
+            const resolveMemberships = deps.resolveMissingManifestMemberships ??
+                (async () => {
+                    const token = await ensureCognitoToken();
+                    await getCompanyUid(token, undefined);
+                });
+            // The shared resolver throws members-style guidance for multiple active
+            // companies. A single membership cannot provide a local slug without a
+            // manifest, so preserve the existing missing-manifest error in that case.
+            await resolveMemberships();
+        }
+        throw error;
+    }
+}
 /** Resolve the HQ root: explicit override (tests) → cwd walk-up. */
 function resolveHqRoot(opts) {
     return opts.hqRoot ?? findHqRoot();
@@ -192,7 +216,7 @@ export function registerPeopleCommand(program, deps = {}) {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
             let records = listCompanyPeople(hqRoot, slug);
             if (!opts.localOnly) {
                 const roster = await tryFetchRoster(deps.fetchRoster ?? fetchMembershipRoster, hqRoot, slug);
@@ -223,7 +247,7 @@ export function registerPeopleCommand(program, deps = {}) {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
             const matches = await searchPeopleWithRosterFallback({
                 hqRoot,
                 slug,
@@ -255,7 +279,7 @@ export function registerPeopleCommand(program, deps = {}) {
         try {
             const scope = people.opts();
             const hqRoot = resolveHqRoot(scope);
-            const slug = resolveCompanySlug(hqRoot, scope.company);
+            const slug = await resolvePeopleCompanySlug(hqRoot, scope.company, opts.localOnly, deps);
             const result = await resolvePersonWithRosterFallback({
                 hqRoot,
                 slug,

package/dist/index.js

@@ -22,9 +22,14 @@ if (isVersionRequest(process.argv)) {
     // compare). `hq version` and `--json` print the labelled HQ/CLI report.
     // Lazy so this path still skips the command graph.
     if (wantsLabelledVersionReport(process.argv)) {
-        void import("./utils/version-report.js").then(({ runVersionCommand }) => runVersionCommand(process.argv));
+        void import("./lib/flag-registry.js").then(({ kickFlagRegistryReadiness }) => {
+            kickFlagRegistryReadiness();
+            return import("./utils/version-report.js").then(({ runVersionCommand }) => runVersionCommand(process.argv));
+        });
     }
     else {
+        // Keep the benchmarked updater fast route limited to the installed semver.
+        // Registry checks and flag resolution belong to the regular command path.
         void import("./cli-version.js").then(({ CLI_VERSION }) => {
             process.stdout.write(`${CLI_VERSION}\n`);
         });

package/dist/lazy-commands.js

@@ -55,8 +55,11 @@ function commandForToken(token) {
  * preserve the complete help and unknown-command recovery surfaces.
  */
 export function findLazyCommand(argv) {
-    const first = argv[2];
-    const token = first === "help" ? argv[3] : first;
+    let commandIndex = 2;
+    while (argv[commandIndex] === "--verbose")
+        commandIndex += 1;
+    const first = argv[commandIndex];
+    const token = first === "help" ? argv[commandIndex + 1] : first;
     if (typeof token !== "string" || token.startsWith("-"))
         return null;
     const command = commandForToken(token);

package/dist/lib/aws-sdk-node-warning-output.d.ts

@@ -0,0 +1,12 @@
+export declare const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
+export interface AwsSdkWarningOutputOptions {
+    argv?: readonly string[];
+    env?: NodeJS.ProcessEnv;
+    enabled?: boolean;
+}
+/**
+ * Configure the AWS SDK's documented, warning-specific switch before loading
+ * the files command and its SDK clients. No other SDK warnings are affected.
+ */
+export declare function configureAwsSdkNodeVersionWarningOutput(options?: AwsSdkWarningOutputOptions): void;
+//# sourceMappingURL=aws-sdk-node-warning-output.d.ts.map

package/dist/lib/aws-sdk-node-warning-output.js

@@ -0,0 +1,22 @@
+import { companyErrorsSdkWarningEnabled } from "./company-errors-sdk-warning-flag.js";
+export const AWS_SDK_NODE_VERSION_WARNING_ENV = "AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED";
+/**
+ * Configure the AWS SDK's documented, warning-specific switch before loading
+ * the files command and its SDK clients. No other SDK warnings are affected.
+ */
+export function configureAwsSdkNodeVersionWarningOutput(options = {}) {
+    const env = options.env ?? process.env;
+    const argv = options.argv ?? process.argv;
+    const enabled = options.enabled ?? companyErrorsSdkWarningEnabled();
+    if (!enabled)
+        return;
+    const verbose = argv.includes("--verbose");
+    const debug = /^(1|true|yes)$/i.test(env.HQ_DEBUG?.trim() ?? "");
+    if (verbose || debug) {
+        delete env[AWS_SDK_NODE_VERSION_WARNING_ENV];
+    }
+    else {
+        env[AWS_SDK_NODE_VERSION_WARNING_ENV] = "true";
+    }
+}
+//# sourceMappingURL=aws-sdk-node-warning-output.js.map

package/dist/lib/company-errors-sdk-warning-flag.d.ts

@@ -0,0 +1,5 @@
+export declare const COMPANY_ERRORS_SDK_WARNING_FLAG = "cli.company-errors-sdk-warning";
+export declare const COMPANY_ERRORS_SDK_WARNING_FALLBACK = false;
+/** One default-off rollout gate for the two US-163 CLI compatibility fixes. */
+export declare function companyErrorsSdkWarningEnabled(): boolean;
+//# sourceMappingURL=company-errors-sdk-warning-flag.d.ts.map

package/dist/lib/company-errors-sdk-warning-flag.js

@@ -0,0 +1,8 @@
+import { resolveProcessFlagGate } from "./flag-registry.js";
+export const COMPANY_ERRORS_SDK_WARNING_FLAG = "cli.company-errors-sdk-warning";
+export const COMPANY_ERRORS_SDK_WARNING_FALLBACK = false;
+/** One default-off rollout gate for the two US-163 CLI compatibility fixes. */
+export function companyErrorsSdkWarningEnabled() {
+    return resolveProcessFlagGate(COMPANY_ERRORS_SDK_WARNING_FLAG, {}, () => COMPANY_ERRORS_SDK_WARNING_FALLBACK);
+}
+//# sourceMappingURL=company-errors-sdk-warning-flag.js.map

package/dist/lib/doctor/checks/work-context.js

@@ -10,7 +10,7 @@ import { readDeviceConfig, } from "../../work-context/config.js";
 import { outboxStats, listOutboxOperations } from "../../work-context/outbox.js";
 import { outboxQuarantineStatusEnabled } from "../../work-context/outbox-quarantine-status-flag.js";
 import { workContextRoot, workContextSessionsDir } from "../../work-context/paths.js";
-import { countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
+import { countDistinctHeldEvents, countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../../mesh/live/paths.js";
 import { collectDaemonDoctor, formatDaemonDoctor, } from "../../mesh/live/daemon/doctor.js";
 export const WORK_CONTEXT_FAMILY_ID = "work-context";
@@ -139,7 +139,7 @@ function runChecks(deps) {
     const heldPath = workMeshHeldPath(meshRoot);
     const deadLetterPath = workMeshDeadLetterPath(meshRoot);
     const spoolDepth = countJsonlLines(spoolPath);
-    const heldDepth = countJsonlLines(heldPath);
+    const heldDepth = countDistinctHeldEvents(heldPath);
     results.push({
         status: "PASS",
         checkId: "work-context.spool-depth",

package/dist/lib/doctor/deep/executor.d.ts

@@ -55,7 +55,7 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 10000;
  */
 export declare const SANDBOX_COPY_RELPATHS: readonly string[];
 /** One gate execution's inputs. */
-export interface GateRunInput {
+interface GateRunInput {
     /** Absolute path to the sandboxed `hook-gate.sh`. */
     gatePath: string;
     /** Absolute path to the sandboxed hook script the gate delegates to. */
@@ -72,7 +72,7 @@ export interface GateRunInput {
     timeoutMs: number;
 }
 /** One gate execution's observed outcome. */
-export interface GateRunResult {
+interface GateRunResult {
     /** True when the execution exceeded {@link GateRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Gate exit code, or null when it did not exit normally (timeout/signal). */
@@ -81,14 +81,7 @@ export interface GateRunResult {
     stderr: string;
 }
 /** Executes one gate invocation. Injectable so the aggregation is unit-testable. */
-export type GateRunner = (input: GateRunInput) => GateRunResult;
-/**
- * The real runner: spawn `bash hook-gate.sh <id> <script>` with the payload on
- * stdin, `HQ_HOOK_PROFILE` set, and a hard timeout. A timeout is detected by the
- * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
- * a hook cannot ignore the bound.
- */
-export declare const defaultGateRunner: GateRunner;
+type GateRunner = (input: GateRunInput) => GateRunResult;
 /** Options for {@link runDeepGuardTests}. All are injectable for testing. */
 export interface DeepTestOptions {
     /** Per-case time bound. Default: {@link DEFAULT_PER_CASE_TIMEOUT_MS}. */
@@ -109,4 +102,5 @@ export declare function cleanupAllDeepSandboxes(): void;
  * an empty list — creating no sandbox — when there is nothing to run.
  */
 export declare function runDeepGuardTests(context: CheckContext, options?: DeepTestOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=executor.d.ts.map

package/dist/lib/doctor/deep/executor.js

@@ -74,7 +74,7 @@ export const SANDBOX_COPY_RELPATHS = [
  * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
  * a hook cannot ignore the bound.
  */
-export const defaultGateRunner = (input) => {
+const defaultGateRunner = (input) => {
     const result = spawnSync("bash", [input.gatePath, input.hookId, input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,

package/dist/lib/doctor/deep/parity.d.ts

@@ -46,14 +46,6 @@ import { type PlatformId } from "../payload-shapes.js";
 export declare const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export declare const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
-/** Default per-case, per-platform time bound. */
-export declare const DEFAULT_PARITY_TIMEOUT_MS = 10000;
-/** The gate profile the replay runs each hook under. Strict is the broadest
- * allowlist, so profile gating never suppresses the hook whose LOGIC is being
- * compared across platforms — profile-specific behaviour is US-008's concern. */
-export declare const PARITY_GATE_PROFILE = "strict";
-/** The session id stamped onto every replay payload. */
-export declare const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 /** One platform replay's inputs. */
 export interface PlatformRunInput {
     /** Which platform's adapter path to exercise. */
@@ -85,27 +77,7 @@ export interface PlatformRunOutput {
 /** Executes one platform replay. Injectable so the comparison is unit-testable. */
 export type PlatformRunner = (input: PlatformRunInput) => PlatformRunOutput;
 /** The real runner set, keyed by platform. */
-export type PlatformRunners = Record<PlatformId, PlatformRunner>;
-/** The real Claude runner: the canonical script through the Claude gate. */
-export declare const defaultClaudeRunner: PlatformRunner;
-/** The real Codex runner: the duplicated mirror through the Codex gate. */
-export declare const defaultCodexRunner: PlatformRunner;
-/**
- * The real Grok runner. Grok shares the canonical `.claude/hooks/` scripts with
- * Claude — it has no mirror of its own — and its adapter's whole job is to read
- * the camelCase payload, map the tool alias back to canonical, build the Claude
- * JSON, and pipe it to the same `hook-gate.sh`. We reproduce that routing here
- * (via {@link toGrokPayload} + {@link grokToSnakePayload}) rather than spawn the
- * adapter directly, for two reasons: the live adapter runs a whole tool
- * *sequence* where the replay needs one isolated hook, and its user-global
- * bridge cannot be simulated from a project-local run (US-005 keeps bridge
- * presence a wiring check). The Grok block protocol still applies — the gate's
- * non-zero exit is what the adapter would translate into a stdout `deny`
- * ({@link interpretGrokBlock} in verdictFor recognises both).
- */
-export declare const defaultGrokRunner: PlatformRunner;
-/** The default real runner set wired to each platform's real adapter path. */
-export declare const defaultPlatformRunners: PlatformRunners;
+type PlatformRunners = Record<PlatformId, PlatformRunner>;
 /** Options for {@link runParityReplay}. All injectable for testing. */
 export interface ParityOptions {
     /** Per-case, per-platform time bound. Default: {@link DEFAULT_PARITY_TIMEOUT_MS}. */
@@ -126,4 +98,5 @@ export declare function cleanupAllParitySandboxes(): void;
  * empty list — creating no sandbox — when there is nothing to replay.
  */
 export declare function runParityReplay(context: CheckContext, options?: ParityOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=parity.d.ts.map

package/dist/lib/doctor/deep/parity.js

@@ -52,13 +52,13 @@ export const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
 /** Default per-case, per-platform time bound. */
-export const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
+const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
 /** The gate profile the replay runs each hook under. Strict is the broadest
  * allowlist, so profile gating never suppresses the hook whose LOGIC is being
  * compared across platforms — profile-specific behaviour is US-008's concern. */
-export const PARITY_GATE_PROFILE = "strict";
+const PARITY_GATE_PROFILE = "strict";
 /** The session id stamped onto every replay payload. */
-export const PARITY_SESSION_ID = "hq-doctor-parity-replay";
+const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 function spawnWithStdin(command, args, stdin, input) {
     const result = spawnSync(command, args, {
         input: stdin,
@@ -96,12 +96,12 @@ function runThroughGate(input, platformDir, payload) {
     return { ...spawned };
 }
 /** The real Claude runner: the canonical script through the Claude gate. */
-export const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
+const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
 /** The real Codex runner: the duplicated mirror through the Codex gate. */
-export const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
+const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
@@ -118,7 +118,7 @@ export const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSO
  * non-zero exit is what the adapter would translate into a stdout `deny`
  * ({@link interpretGrokBlock} in verdictFor recognises both).
  */
-export const defaultGrokRunner = (input) => {
+const defaultGrokRunner = (input) => {
     const grokPayload = toGrokPayload(input.testCase, {
         cwd: input.sandbox,
         sessionId: PARITY_SESSION_ID,
@@ -127,7 +127,7 @@ export const defaultGrokRunner = (input) => {
     return runThroughGate(input, ".claude", JSON.stringify(snake));
 };
 /** The default real runner set wired to each platform's real adapter path. */
-export const defaultPlatformRunners = {
+const defaultPlatformRunners = {
     claude: defaultClaudeRunner,
     codex: defaultCodexRunner,
     grok: defaultGrokRunner,

package/dist/lib/doctor/deep/sandbox.d.ts

@@ -46,21 +46,10 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 15000;
  * come under sandboxed execution.
  */
 export type Precondition = "git-repo" | "session-metadata" | "company-scaffold";
-/** Every precondition the default seeder knows how to provide. */
-export declare const KNOWN_PRECONDITIONS: readonly Precondition[];
-/**
- * Tree entries copied from the live tree into every sandbox — the same curated
- * set US-008 uses: the hook scripts and gate, the settings a hook may read, the
- * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
- * skipped so a partial tree still sandboxes cleanly.
- */
-export declare const SANDBOX_SEED_RELPATHS: readonly string[];
 /** Remove every side-effect sandbox still on disk. Safe to call repeatedly. */
 export declare function cleanupAllSandboxes(): void;
 /** The sandbox roots this process is still tracking (for tests). */
 export declare function trackedSandboxRoots(): string[];
-/** Remove one sandbox and stop tracking it. Idempotent. */
-export declare function destroySandbox(root: string): void;
 /** The outcome of seeding one sandbox. */
 export interface SeedResult {
     /** Absolute, realpath'd sandbox root under the OS temp dir. */
@@ -91,7 +80,7 @@ export interface SeedOptions {
  */
 export declare function seedSandbox(hqRoot: string, opts?: SeedOptions): SeedResult;
 /** One hook execution's inputs. */
-export interface HookRunInput {
+interface HookRunInput {
     /** Absolute path to the sandboxed hook script. */
     hookScriptPath: string;
     /** The JSON payload piped to the hook's stdin. */
@@ -104,7 +93,7 @@ export interface HookRunInput {
     timeoutMs: number;
 }
 /** One hook execution's observed result (exit code is diagnostic only). */
-export interface HookRunResult {
+interface HookRunResult {
     /** True when the execution exceeded {@link HookRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Exit code, or null when it did not exit normally (timeout/signal). */
@@ -113,17 +102,9 @@ export interface HookRunResult {
     stderr: string;
 }
 /** Runs one hook. Injectable so the tier's aggregation is unit-testable. */
-export type HookRunner = (input: HookRunInput) => HookRunResult;
-/**
- * The real runner: fire the hook script directly with the payload on stdin, its
- * cwd and session env pointed at the sandbox, and a hard timeout. Unlike a pure
- * guard (US-008), a side-effecting hook is run directly rather than through the
- * gate — its exit code is irrelevant here; what matters is the effect it leaves
- * on the sandbox, which effects.ts reads afterwards.
- */
-export declare const defaultHookRunner: HookRunner;
+type HookRunner = (input: HookRunInput) => HookRunResult;
 /** One parsed side-effecting fixture case (its own shape, not the US-007 schema). */
-export interface SideEffectCase {
+interface SideEffectCase {
     name: string;
     event: string;
     tool: string;
@@ -136,13 +117,13 @@ export interface SideEffectCase {
     expectedFailure?: ExpectedFailure;
 }
 /** A validated side-effecting fixture. */
-export interface SideEffectFixture {
+interface SideEffectFixture {
     hookId: string;
     relpath: string;
     cases: SideEffectCase[];
 }
 /** A side-effecting fixture that could not be parsed. */
-export interface SideEffectFixtureError {
+interface SideEffectFixtureError {
     hookId: string | null;
     relpath: string;
     message: string;
@@ -187,4 +168,5 @@ export interface SideEffectTestOptions {
  * Returns an empty list when there is nothing side-effecting to run.
  */
 export declare function runSideEffectTests(context: CheckContext, options?: SideEffectTestOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/lib/doctor/deep/sandbox.js

@@ -46,7 +46,7 @@ import { captureEffectBaseline, describeEffect, defaultGitProbe, evaluateEffects
 /** Default per-case time bound. No latency target, but no case may hang. */
 export const DEFAULT_PER_CASE_TIMEOUT_MS = 15_000;
 /** Every precondition the default seeder knows how to provide. */
-export const KNOWN_PRECONDITIONS = [
+const KNOWN_PRECONDITIONS = [
     "git-repo",
     "session-metadata",
     "company-scaffold",
@@ -57,7 +57,7 @@ export const KNOWN_PRECONDITIONS = [
  * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
  * skipped so a partial tree still sandboxes cleanly.
  */
-export const SANDBOX_SEED_RELPATHS = [
+const SANDBOX_SEED_RELPATHS = [
     ".claude/hooks",
     ".claude/settings.json",
     ".claude/settings.local.json",
@@ -100,7 +100,7 @@ function removeTree(root) {
     }
 }
 /** Remove one sandbox and stop tracking it. Idempotent. */
-export function destroySandbox(root) {
+function destroySandbox(root) {
     removeTree(root);
     trackedSandboxes.delete(root);
 }
@@ -198,7 +198,7 @@ function git(root, args) {
  * gate — its exit code is irrelevant here; what matters is the effect it leaves
  * on the sandbox, which effects.ts reads afterwards.
  */
-export const defaultHookRunner = (input) => {
+const defaultHookRunner = (input) => {
     const result = spawnSync("bash", [input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,