@indigoai-us/hq-cli 5.308.0 → 5.309.1

package/dist/commands/lanes-checks.js

@@ -12,6 +12,37 @@ import { DEFAULT_ORPHAN_USER_IDLE_HOURS, findOrphanLanes, parseOrphanMinAge, par
 import { LANES_RUNS_REL } from "../lib/lanes/spawn.js";
 import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { checkCompanyPath } from "../lib/lanes/checked-company-path.js";
+export function mappingIncludesStory(mapping, storyId) {
+    return (mapping.storyPrefix === undefined || storyId.startsWith(mapping.storyPrefix))
+        && (mapping.excludePrefix === undefined || !storyId.startsWith(mapping.excludePrefix));
+}
+function mappingsOverlap(left, right) {
+    const includes = [left.storyPrefix, right.storyPrefix].filter((value) => value !== undefined);
+    if (includes.length === 2 && !includes[0].startsWith(includes[1]) && !includes[1].startsWith(includes[0]))
+        return false;
+    const commonPrefix = includes.sort((a, b) => b.length - a.length)[0] ?? "";
+    return ![left.excludePrefix, right.excludePrefix].some((excluded) => excluded !== undefined && commonPrefix.startsWith(excluded));
+}
+function ambiguousProjectMappings(mappings) {
+    const byProject = new Map();
+    for (const mapping of mappings)
+        byProject.set(mapping.projectId, [...(byProject.get(mapping.projectId) ?? []), mapping]);
+    const ambiguous = new Map();
+    for (const [projectId, rows] of byProject) {
+        const conflicts = new Set();
+        for (let i = 0; i < rows.length; i++) {
+            for (let j = i + 1; j < rows.length; j++) {
+                if (mappingsOverlap(rows[i], rows[j])) {
+                    conflicts.add(rows[i].team);
+                    conflicts.add(rows[j].team);
+                }
+            }
+        }
+        if (conflicts.size > 0)
+            ambiguous.set(projectId, [...conflicts].sort());
+    }
+    return ambiguous;
+}
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
 }
@@ -165,16 +196,26 @@ export function loadProjectMappings(root, company, requestedProject) {
             const team = validSegment(entry.team, "team");
             const leadLaneId = validSegment(entry.lane, "lead lane id");
             const statusPath = checkCompanyPath(root, company, entry.status, registryPath);
-            if (mappings.has(projectId))
-                return fail("tracker_checks_mapping_ambiguous", "More than one active team maps to a project", { path: registryPath, project_id: projectId });
-            mappings.set(projectId, { projectId, team, leadLaneId, statusPath });
+            const parsePrefix = (field) => {
+                const value = entry[field];
+                if (value === undefined)
+                    return undefined;
+                if (typeof value !== "string" || value.trim() === "") {
+                    return fail("tracker_checks_mapping_invalid", `${field} must be a non-empty string`, { path: registryPath, index, field });
+                }
+                return value.trim();
+            };
+            const storyPrefix = parsePrefix("story_prefix");
+            const excludePrefix = parsePrefix("exclude_prefix");
+            const key = `${projectId}:${team}:${index}`;
+            mappings.set(key, { projectId, team, leadLaneId, statusPath, ...(storyPrefix === undefined ? {} : { storyPrefix }), ...(excludePrefix === undefined ? {} : { excludePrefix }) });
         }
     }
     const projectsRoot = path.join(root, "companies", company, "projects");
     const knownProjectIds = new Set(projectDirectories(root, company));
     for (const projectId of knownProjectIds) {
-        if (projectHasTrackerRecords(root, company, projectId) && !mappings.has(projectId)) {
-            mappings.set(projectId, {
+        if (projectHasTrackerRecords(root, company, projectId) && ![...mappings.values()].some((mapping) => mapping.projectId === projectId)) {
+            mappings.set(`${projectId}:tracker`, {
                 projectId,
                 team: projectId,
                 statusPath: path.join(projectsRoot, projectId, "manager-status.json"),
@@ -183,10 +224,10 @@ export function loadProjectMappings(root, company, requestedProject) {
     }
     if (requestedProject !== undefined) {
         const projectId = validSegment(requestedProject, "project");
-        if (!knownProjectIds.has(projectId) && !mappings.has(projectId)) {
+        if (!knownProjectIds.has(projectId) && ![...mappings.values()].some((mapping) => mapping.projectId === projectId)) {
             return fail("tracker_project_not_found", "Project directory was not found for this company", { project_id: projectId, path: path.join(projectsRoot, projectId) });
         }
-        return new Map([...mappings].filter(([mappedProjectId]) => mappedProjectId === projectId));
+        return new Map([...mappings].filter(([, mapping]) => mapping.projectId === projectId));
     }
     return mappings;
 }
@@ -539,17 +580,18 @@ function readCompanyQuestions(root, company, projectId) {
         surfaced_at: surfacedAt.get(question.question_id) ?? null,
     }));
 }
-function readTeamInputs(root, company, projects, lanes) {
+export function readTeamInputs(root, company, projects, lanes) {
     const inputs = [];
     for (const project of projects) {
         const projectPath = path.join(root, "companies", company.slug, "projects", project.projectId);
         const prdPath = path.join(projectPath, "prd.json");
         const { stories, mtime } = readProject(root, company.slug, prdPath);
-        const teamLanes = lanes.filter((lane) => sameCompanyLane(lane, company) && laneMatchesProject(lane, project.projectId));
+        const teamLanes = lanes.filter((lane) => sameCompanyLane(lane, company) && laneMatchesProject(lane, project.projectId)
+            && (lane.lane_id === project.leadLaneId || mappingIncludesStory(project, lane.story_id)));
         const lead = project.leadLaneId === undefined
             ? undefined
             : teamLanes.find((lane) => lane.lane_id === project.leadLaneId);
-        const openStories = stories.filter((story) => !storyIsDone(story));
+        const openStories = stories.filter((story) => mappingIncludesStory(project, String(story.id)) && !storyIsDone(story));
         const openPrRefs = new Set();
         for (const story of openStories) {
             for (const ref of pullRequestReferences(story.prs ?? []))
@@ -599,7 +641,7 @@ function requiredRecordTimestamp(kind, record, projectDirectory, field, value) {
         return parseTimestamp(value, field, pathForTrackerRecord(projectDirectory, kind, record.id));
     return value;
 }
-export function listTrackerRecords(projectDirectory, kind) {
+function listTrackerRecords(projectDirectory, kind) {
     try {
         return createLocalTrackerStore(projectDirectory).list(kind);
     }
@@ -658,7 +700,7 @@ async function readTrackerCheckRecords(root, company, projects) {
     const blockers = [];
     const kpis = [];
     const directives = [];
-    for (const project of projects) {
+    for (const project of [...new Map(projects.map((project) => [project.projectId, project])).values()]) {
         const absoluteDirectory = path.join(root, "companies", company.slug, "projects", project.projectId);
         const store = createLocalTrackerStore(absoluteDirectory);
         const records = {
@@ -715,7 +757,7 @@ export async function resolveTrackerCompany(deps, requested) {
         fail("tracker_company_unresolved", "The active HQ company could not be resolved", {});
     return company;
 }
-async function checkReport(root, company, projects, directiveProjects, projectFilter, minAgeMinutes, now, deps) {
+async function checkReport(root, company, projects, directiveProjects, projectFilter, minAgeMinutes, now, deps, projectErrors) {
     const selectedProjects = [...projects.values()];
     const laneRecords = readScopedLanes(root, company, selectedProjects);
     const warnings = laneRecords.flatMap((lane) => {
@@ -773,6 +815,7 @@ async function checkReport(root, company, projects, directiveProjects, projectFi
         company: company.slug,
         generated_at: now.toISOString(),
         ...(warnings.length === 0 ? {} : { warnings }),
+        ...(projectErrors.length === 0 ? {} : { project_errors: projectErrors }),
         checks,
     };
 }
@@ -855,13 +898,20 @@ export function registerLaneChecksCommand(parent, deps, wrap) {
         const root = deps.hqRoot();
         const projectFilter = options.project === undefined ? undefined : validSegment(options.project, "project");
         const minAgeMinutes = parseOrphanMinAge(options.minAge);
-        const projects = loadProjectMappings(root, company.slug, projectFilter);
-        const directiveProjects = projectFilter === undefined
-            ? projects
-            : loadProjectMappings(root, company.slug);
-        const report = await checkReport(root, company, projects, directiveProjects, projectFilter, minAgeMinutes, deps.now(), deps);
+        const allProjects = loadProjectMappings(root, company.slug);
+        const ambiguous = ambiguousProjectMappings([...allProjects.values()]);
+        const selectedAll = projectFilter === undefined ? [...allProjects.values()] : [...allProjects.values()].filter((mapping) => mapping.projectId === projectFilter);
+        const projectErrors = [...ambiguous].filter(([projectId]) => projectFilter === undefined || projectId === projectFilter).map(([project_id, teams]) => ({
+            project_id,
+            code: "tracker_checks_mapping_ambiguous",
+            teams,
+            message: "Team story prefixes overlap for this project",
+        }));
+        const projects = new Map(selectedAll.filter((mapping) => !ambiguous.has(mapping.projectId)).map((mapping, index) => [`${mapping.projectId}:${mapping.team}:${index}`, mapping]));
+        const directiveProjects = new Map([...allProjects.values()].filter((mapping) => !ambiguous.has(mapping.projectId)).map((mapping, index) => [`${mapping.projectId}:${mapping.team}:${index}`, mapping]));
+        const report = await checkReport(root, company, projects, directiveProjects, projectFilter, minAgeMinutes, deps.now(), deps, projectErrors);
         console.log(JSON.stringify(report, null, 2));
-        if (report.checks.some((item) => item.result === "failing"))
+        if (report.checks.some((item) => item.result === "failing") || projectErrors.length > 0)
             process.exitCode = 2;
     }));
     parent.command("orphans")

package/dist/commands/lanes-report.js

@@ -6,7 +6,7 @@ import { normalizeIsoTimestamp } from "../lib/lanes/timestamp.js";
 import { mapSourceStoryStatus } from "../lib/mesh/story-status.js";
 import { buildTrackerOwnerReport, buildTrackerTeamPage, renderTrackerOwnerReportText, renderTrackerTeamPageText, } from "../lib/lanes/tracker-report.js";
 import { FIRST_TRACKER_REPORT_SINCE, readTrackerReportState, writeTrackerReportState, } from "../lib/lanes/tracker-report-state.js";
-import { listTrackerRecordsTolerant, loadCompanyQuestionRecords, loadProjectMappings, pathForTrackerRecord, readProject, resolveTrackerCompany, } from "./lanes-checks.js";
+import { listTrackerRecordsTolerant, loadCompanyQuestionRecords, loadProjectMappings, mappingIncludesStory, pathForTrackerRecord, readProject, resolveTrackerCompany, } from "./lanes-checks.js";
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
 }
@@ -184,6 +184,8 @@ async function teamInput(root, company, project, questions, deps, errors = []) {
             errors.push({ path: prdPath, field: "id", message: "Story id must be a non-empty string" });
             continue;
         }
+        if (!mappingIncludesStory(project, id))
+            continue;
         const title = typeof story.title === "string" ? story.title : "";
         if (!title.trim()) {
             errors.push({ path: prdPath, field: "title", story_id: id, message: "Story title must be a non-empty string" });
@@ -217,7 +219,8 @@ async function teamInput(root, company, project, questions, deps, errors = []) {
         stories.push({ id, title, status, references: refs.references, ...(normalizedUpdatedAt ? { updated_at: normalizedUpdatedAt } : {}), source_path: prdPath });
     }
     const teamQuestions = [];
-    for (const record of questions.filter((question) => question.project_id === project.projectId)) {
+    for (const record of questions.filter((question) => question.project_id === project.projectId
+        && (typeof question.story_id !== "string" || mappingIncludesStory(project, question.story_id)))) {
         const sourcePath = questionRecordPath(root, record.question_id);
         try {
             const body = deps.readQuestionBody(root, record);

package/dist/commands/lanes.d.ts

@@ -112,8 +112,6 @@ export declare function parseQuestionBody(raw: unknown): QuestionBody | null;
  */
 export declare const ASK_BACKOFF_MS: readonly [5000, 15000];
 export declare const ASK_ATTEMPTS: number;
-/** Flip to true in the next release to make --priority mandatory. */
-export declare const ASK_PRIORITY_REQUIRED = false;
 export declare function casUpdateQuestion(hqRoot: string, questionId: string, updater: (current: QuestionRecord) => QuestionRecord): QuestionRecord;
 export declare function casUpdateLane(hqRoot: string, laneId: string, updater: (current: LaneRecord) => LaneRecord): LaneRecord;
 /**
@@ -128,12 +126,7 @@ export declare function composeWorkerBrief(worker: ResolvedLaneWorker, taskBrief
  * and the foreground-only rule.
  */
 export declare function composeGeneralBrief(taskBrief: string): string;
-export declare function parseMaxRuntimeSeconds(raw: unknown, workerId: string): number | undefined;
-export declare const PICKUP_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "model_unsupported"];
 export declare const DISPATCH_TERMINAL_REASON: "outpost_dispatch_failed";
-export type PickupTerminalReason = (typeof PICKUP_TERMINAL_REASONS)[number];
-/** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
-export declare function isUndispatchedOutpostMirror(lane: LaneRecord): boolean;
 /**
  * The CAS updater a pickup failure applies. A lane that is already terminal
  * for any reason (a cancel that landed after the caller's last read, an
@@ -149,9 +142,5 @@ export declare function pickupFailureUpdater(reasonRaw: string, details: Record<
 export declare function applyOutpostAccountPickup(hqRoot: string, laneId: string, modelDeps?: KnownModelsDeps): LaneRecord;
 export declare function cancelPendingQuestionsForLane(hqRoot: string, laneId: string, nowIso: string, operatorReason?: string): QuestionRecord[];
 export declare function stopCommittedState(state: LaneRecord["state"]): "cancelled" | "killed";
-/** Stderr notice that `stop` ends a lane for good, naming the resumable path. */
-export declare function stopTerminalWarning(laneId: string): string;
-/** Stderr notice when an interrupted lane has no session to resume from. */
-export declare function interruptNotResumableWarning(laneId: string): string;
 export declare function registerLanesCommand(parent: Command, deps?: LanesCommandDeps): Command;
 //# sourceMappingURL=lanes.d.ts.map

package/dist/commands/lanes.js

@@ -2253,7 +2253,7 @@ function assertKnownOutpost(requested, known) {
 export const ASK_BACKOFF_MS = [5_000, 15_000];
 export const ASK_ATTEMPTS = ASK_BACKOFF_MS.length + 1;
 /** Flip to true in the next release to make --priority mandatory. */
-export const ASK_PRIORITY_REQUIRED = false;
+const ASK_PRIORITY_REQUIRED = false;
 const ASK_PRIORITY_WARNING = "--priority will be required in the next release.";
 const QUESTION_PRIORITIES = ["P0", "P1", "P2"];
 function withCasRetry(fn, attempts = 5) {
@@ -2390,7 +2390,7 @@ export function composeGeneralBrief(taskBrief) {
         "",
     ].join("\n");
 }
-export function parseMaxRuntimeSeconds(raw, workerId) {
+function parseMaxRuntimeSeconds(raw, workerId) {
     if (raw === undefined || raw === null || raw === "")
         return undefined;
     if (typeof raw === "number") {
@@ -2540,7 +2540,7 @@ async function storyBoardCheck(ctx, company, projectId, storyIds) {
         throw err;
     }
 }
-export const PICKUP_TERMINAL_REASONS = [
+const PICKUP_TERMINAL_REASONS = [
     "account_not_logged_in",
     "unknown_account",
     "account_disabled",
@@ -2548,7 +2548,7 @@ export const PICKUP_TERMINAL_REASONS = [
 ];
 export const DISPATCH_TERMINAL_REASON = "outpost_dispatch_failed";
 /** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
-export function isUndispatchedOutpostMirror(lane) {
+function isUndispatchedOutpostMirror(lane) {
     return lane.host.kind === "outpost" &&
         isTerminalLaneState(lane.state) &&
         lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
@@ -7302,7 +7302,7 @@ async function runStop(ctx, laneId, reason, quiet = false) {
         });
 }
 /** Stderr notice that `stop` ends a lane for good, naming the resumable path. */
-export function stopTerminalWarning(laneId) {
+function stopTerminalWarning(laneId) {
     return `hq lanes: warning: stop kills lane ${laneId} and it cannot be resumed. ` +
         `To pause it and keep it resumable, use hq lanes interrupt ${laneId}.\n`;
 }
@@ -7395,7 +7395,7 @@ function persistInterruptedSession(hqRoot, lane) {
         : { ...current, provider_session_id: sessionId, provider_session_id_absent: undefined });
 }
 /** Stderr notice when an interrupted lane has no session to resume from. */
-export function interruptNotResumableWarning(laneId) {
+function interruptNotResumableWarning(laneId) {
     return `hq lanes: warning: lane ${laneId} was interrupted before its provider reported a session id, ` +
         `so hq lanes resume cannot continue it. Start a new lane for the remaining work.\n`;
 }

package/dist/commands/mcp-registration.d.ts

@@ -74,8 +74,8 @@ export declare class ConfigParseError extends McpRegistrationError {
 export declare class ConfigPermissionError extends McpRegistrationError {
     readonly code: "ConfigPermissionError";
 }
-export type CodexMcpCollisionOwner = 'hq' | 'foreign' | 'unknown';
-export type CodexMcpCollisionField = 'command' | 'args' | 'env' | 'url' | 'other';
+type CodexMcpCollisionOwner = 'hq' | 'foreign' | 'unknown';
+type CodexMcpCollisionField = 'command' | 'args' | 'env' | 'url' | 'other';
 /** Safe, value-free context for a Codex name collision reported to Sentry. */
 export interface CodexMcpCollisionDiagnostics {
     client: 'codex';
@@ -146,7 +146,7 @@ export declare function backupRoot(env: SafeWriteEnv): string;
 /** `~/.hq/logs/mcp-registry.log` — the append-only JSONL audit log (mirrors backupRoot style). */
 export declare function mcpRegistryLogPath(env: SafeWriteEnv): string;
 /** The action recorded on an audit line. */
-export type AuditAction = 'register' | 'unregister';
+type AuditAction = 'register' | 'unregister';
 /**
  * The result recorded on an audit line:
  *   - `registered`   — a register write that changed the file.
@@ -156,7 +156,7 @@ export type AuditAction = 'register' | 'unregister';
  *                      foreign/unstamped entry left in place). PARTIAL is auditable.
  *   - `error`        — the surface emit threw (the operation failed for this surface).
  */
-export type AuditResult = 'registered' | 'unregistered' | 'noop' | 'skipped' | 'error';
+type AuditResult = 'registered' | 'unregistered' | 'noop' | 'skipped' | 'error';
 /**
  * One append-only audit-log entry. EXACT shape (field order is the JSON key order):
  *   `{ ts, action, pack, server, transport, target, file, prevHash, newHash, result }`.
@@ -213,8 +213,6 @@ export declare function codexConfigPath(env: SafeWriteEnv): string;
 export declare function isCodexInstalled(env: SafeWriteEnv): boolean;
 /** `~/.claude.json` — the PINNED single Claude surface (top-level mcpServers). */
 export declare function claudeConfigPath(env: SafeWriteEnv): string;
-/** `~/.mcp.json` — the project-pinned Claude surface (a symlink on this host). */
-export declare function mcpJsonPath(env: SafeWriteEnv): string;
 /** Outcome of {@link readConfigDoc}: a parsed doc plus whether the file pre-existed. */
 export interface ReadConfigResult<T> {
     /** The parsed doc, or the `emptyDoc` when the file is absent/empty. */
@@ -284,10 +282,6 @@ export declare function readConfigDoc<T>(target: string, format: ConfigFormat<T>
  * separate snippet block) cannot leak. The result never contains raw file content.
  */
 export declare function sanitizeParserMessage(message: string): string;
-/** Default stale-lock timeout — a lock older than this whose PID is dead is broken. */
-export declare const DEFAULT_LOCK_STALE_MS = 30000;
-/** Default total time to wait for a held lock before giving up. */
-export declare const DEFAULT_LOCK_WAIT_MS = 10000;
 /** A held advisory lock; release with {@link releaseLock} (idempotent). */
 export interface ConfigLock {
     /** The lockfile path (`~/.<basename>.hqlock`). */
@@ -752,7 +746,7 @@ export declare function mergeCodexServer(name: string, def: TomlTable): (doc: Co
  */
 export declare function registerCodexServer(opts: RegisterServerOptions): RegisterSurfaceResult | RegisterSurfaceSkip;
 /** Discriminates an un-registration outcome on one surface. */
-export type UnregisterOutcome = 
+type UnregisterOutcome = 
 /** The provenance-stamped entry was found and removed (file changed). */
 'removed'
 /** The entry was already absent / never installed — a clean idempotent no-op. */

package/dist/commands/mcp-registration.js

@@ -242,10 +242,6 @@ export function isCodexInstalled(env) {
 export function claudeConfigPath(env) {
     return path.join(env.home, '.claude.json');
 }
-/** `~/.mcp.json` — the project-pinned Claude surface (a symlink on this host). */
-export function mcpJsonPath(env) {
-    return path.join(env.home, '.mcp.json');
-}
 /**
  * Built-in JSON {@link ConfigFormat} for the Claude surfaces. Pretty-prints with
  * a trailing newline; an empty doc is `{}`. Parsing the empty string is the
@@ -368,9 +364,9 @@ export function sanitizeParserMessage(message) {
 // Advisory O_EXCL lock (held across read->merge->write).
 // ---------------------------------------------------------------------------
 /** Default stale-lock timeout — a lock older than this whose PID is dead is broken. */
-export const DEFAULT_LOCK_STALE_MS = 30_000;
+const DEFAULT_LOCK_STALE_MS = 30_000;
 /** Default total time to wait for a held lock before giving up. */
-export const DEFAULT_LOCK_WAIT_MS = 10_000;
+const DEFAULT_LOCK_WAIT_MS = 10_000;
 /** The lockfile path for a target: `~/.<basename>.hqlock` (a sibling, hidden). */
 export function lockPathFor(target) {
     const dir = path.dirname(target);

package/dist/lib/core-utils/sentry-report.d.ts

@@ -18,7 +18,6 @@
 import * as Sentry from "@sentry/node";
 import type { CaptureContext, SeverityLevel } from "@sentry/node";
 export declare const DEFAULT_SENTRY_REPORT_TIMEOUT_MS = 750;
-export declare const MAX_SENTRY_REPORT_TIMEOUT_MS = 5000;
 export declare const MAX_SENTRY_REPORT_PAYLOAD_BYTES = 2048;
 export declare const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
 /**
@@ -34,11 +33,11 @@ export type HookSequenceEntry = {
     event: string;
     ms: number;
 };
-export type HookTimeoutDebugPhaseTiming = {
+type HookTimeoutDebugPhaseTiming = {
     phase: string;
     elapsed_ms: number;
 };
-export type HookTimeoutDebugContext = {
+type HookTimeoutDebugContext = {
     hook_name: string;
     hook_event: string;
     budget_ms: number;
@@ -52,9 +51,9 @@ export type HookTimeoutDebugContext = {
     spawn_ms?: number | "unavailable";
     process_count?: number | "unavailable";
 };
-export type SentryReportMetadataValue = string | number | boolean | HookSequenceEntry[] | HookTimeoutDebugContext;
+type SentryReportMetadataValue = string | number | boolean | HookSequenceEntry[] | HookTimeoutDebugContext;
 export type SentryReportMetadata = Record<string, SentryReportMetadataValue>;
-export type SentryReportEvent = {
+type SentryReportEvent = {
     type: string;
     message: string;
     fingerprint: string;
@@ -102,12 +101,6 @@ export type SentryReportResult = {
 export declare function readSentryReportStdin(stdin: AsyncIterable<Buffer | string>): Promise<string | null>;
 /** Unknown metadata is ignored before this cap is evaluated. */
 export declare function exceedsSentryReportMetadataKeyCap(keys: Iterable<string>): boolean;
-/**
- * Parse and validate the closed report schema without touching Sentry. The
- * function intentionally returns an ordinary result instead of throwing so a
- * hook can ignore the CLI exit code without creating an unhandled rejection.
- */
-export declare function parseSentryReportEvent(stdin: string): SentryReportResult;
 /**
  * Capture one validated Sentry message and wait only for the supplied bounded
  * flush budget. A zero result means the event entered the local transport and
@@ -117,4 +110,5 @@ export declare function parseSentryReportEvent(stdin: string): SentryReportResul
  * transport errors cannot echo event data back to a hook.
  */
 export declare function reportSentryEvent(stdin: string, options?: SentryReportOptions, dependencies?: SentryReportDependencies): Promise<SentryReportResult>;
+export {};
 //# sourceMappingURL=sentry-report.d.ts.map

package/dist/lib/core-utils/sentry-report.js

@@ -25,7 +25,7 @@ import { beforeSend } from "../../sentry-before-send.js";
 import { resolveLiveRoot } from "../../utils/hq-roots.js";
 import { hookTimeoutDebugContextEnabled } from "./hook-timeout-debug-context-flag.js";
 export const DEFAULT_SENTRY_REPORT_TIMEOUT_MS = 750;
-export const MAX_SENTRY_REPORT_TIMEOUT_MS = 5_000;
+const MAX_SENTRY_REPORT_TIMEOUT_MS = 5_000;
 export const MAX_SENTRY_REPORT_PAYLOAD_BYTES = 2_048;
 export const MAX_SENTRY_REPORT_METADATA_VALUE_BYTES = 256;
 const MAX_SENTRY_REPORT_TYPE_BYTES = 64;
@@ -349,7 +349,7 @@ function invalidInput() {
  * function intentionally returns an ordinary result instead of throwing so a
  * hook can ignore the CLI exit code without creating an unhandled rejection.
  */
-export function parseSentryReportEvent(stdin) {
+function parseSentryReportEvent(stdin) {
     if (byteLength(stdin) > MAX_SENTRY_REPORT_PAYLOAD_BYTES)
         return invalidInput();
     let parsed;

package/dist/lib/db/local.d.ts

@@ -23,11 +23,6 @@ export interface LocalDbStatus {
     /** Fingerprint of path for logs that prefer not to echo full home paths. */
     pathFingerprint: string;
 }
-/**
- * Short non-reversible fingerprint of a path (for status display).
- * Not a secret — just avoids dumping full home paths when preferred.
- */
-export declare function fingerprintPath(filePath: string): string;
 /**
  * Open (and create if missing) the company local vault DB with WAL mode.
  * Idempotent: reopening an existing file does not recreate or wipe it.

package/dist/lib/db/local.js

@@ -12,7 +12,7 @@ const MIGRATIONS_TABLE = "hq_schema_migrations";
  * Short non-reversible fingerprint of a path (for status display).
  * Not a secret — just avoids dumping full home paths when preferred.
  */
-export function fingerprintPath(filePath) {
+function fingerprintPath(filePath) {
     let h = 2166136261;
     for (let i = 0; i < filePath.length; i++) {
         h ^= filePath.charCodeAt(i);

package/dist/lib/db/migrate.d.ts

@@ -5,9 +5,7 @@
  *   companies/{company}/db/migrations/*.sql
  * Applied versions are recorded in hq_schema_migrations inside the local DB.
  */
-import type { LocalDb } from "./local.js";
 import type { LocalDbPathEnv } from "./paths.js";
-export declare const MIGRATIONS_TABLE = "hq_schema_migrations";
 export interface MigrateOptions extends LocalDbPathEnv {
     company: string;
     /**
@@ -24,16 +22,6 @@ export interface MigrateResult {
     head: string | null;
 }
 export declare function resolveMigrationsDir(hqRoot: string, companySlug: string): string;
-/**
- * Ensure migrations directory exists (creates empty dir on first migrate).
- */
-export declare function ensureMigrationsDir(hqRoot: string, companySlug: string): string;
-/**
- * List pending migration files in lexical/version order (filename sort).
- */
-export declare function listMigrationFiles(migrationsDir: string): string[];
-export declare function ensureMigrationsLedger(db: LocalDb): void;
-export declare function listAppliedVersions(db: LocalDb): Set<string>;
 /**
  * Apply pending migrations. On failure, does not mark the failed file applied.
  */

package/dist/lib/db/migrate.js

@@ -9,7 +9,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { openLocalDb, readMigrationHead } from "./local.js";
 import { normalizeCompanySlugForLocalDb } from "./paths.js";
-export const MIGRATIONS_TABLE = "hq_schema_migrations";
+const MIGRATIONS_TABLE = "hq_schema_migrations";
 export function resolveMigrationsDir(hqRoot, companySlug) {
     const slug = normalizeCompanySlugForLocalDb(companySlug);
     return path.join(hqRoot, "companies", slug, "db", "migrations");
@@ -17,7 +17,7 @@ export function resolveMigrationsDir(hqRoot, companySlug) {
 /**
  * Ensure migrations directory exists (creates empty dir on first migrate).
  */
-export function ensureMigrationsDir(hqRoot, companySlug) {
+function ensureMigrationsDir(hqRoot, companySlug) {
     const dir = resolveMigrationsDir(hqRoot, companySlug);
     fs.mkdirSync(dir, { recursive: true });
     return dir;
@@ -25,7 +25,7 @@ export function ensureMigrationsDir(hqRoot, companySlug) {
 /**
  * List pending migration files in lexical/version order (filename sort).
  */
-export function listMigrationFiles(migrationsDir) {
+function listMigrationFiles(migrationsDir) {
     if (!fs.existsSync(migrationsDir))
         return [];
     return fs
@@ -33,7 +33,7 @@ export function listMigrationFiles(migrationsDir) {
         .filter((f) => f.endsWith(".sql"))
         .sort((a, b) => a.localeCompare(b, "en"));
 }
-export function ensureMigrationsLedger(db) {
+function ensureMigrationsLedger(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
       version TEXT PRIMARY KEY NOT NULL,
@@ -41,7 +41,7 @@ export function ensureMigrationsLedger(db) {
     );
   `);
 }
-export function listAppliedVersions(db) {
+function listAppliedVersions(db) {
     ensureMigrationsLedger(db);
     const rows = db
         .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version`)

package/dist/lib/db/sql.d.ts

@@ -27,14 +27,6 @@ export interface SqlRunResult {
     changes: number;
     readonly: boolean;
 }
-export declare function stripSqlNoise(sql: string): string;
-export declare function isWriteSql(sql: string): boolean;
-/**
- * Statements that must never run via `hq db sql`, even with --write.
- * ATTACH/DETACH would let a company-scoped session open another company's
- * vault.db by absolute path (category-1 isolation).
- */
-export declare function assertSqlAllowed(sql: string): void;
 /**
  * Resolve which file path to open, enforcing company isolation by default.
  */
@@ -44,6 +36,4 @@ export declare function resolveSqlDbPath(opts: SqlRunOptions): string;
  */
 export declare function runLocalSql(opts: SqlRunOptions): SqlRunResult;
 export declare function formatSqlResult(result: SqlRunResult, format?: "jsonl" | "table"): string;
-/** Test helper: company dir for isolation assertions. */
-export declare function companyLocalDbDir(company: string, env?: LocalDbPathEnv): string;
 //# sourceMappingURL=sql.d.ts.map

package/dist/lib/db/sql.js

@@ -7,17 +7,17 @@
  */
 import Database from "better-sqlite3";
 import { openLocalDb } from "./local.js";
-import { normalizeCompanySlugForLocalDb, resolveLocalDbDir, resolveLocalDbPath, } from "./paths.js";
+import { normalizeCompanySlugForLocalDb, resolveLocalDbPath, } from "./paths.js";
 const WRITE_PATTERN = /^\s*(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER|TRUNCATE|REINDEX|VACUUM|BEGIN|COMMIT|ROLLBACK)\b/i;
 /** Always forbidden — opens other files/DBs and breaks company path isolation. */
 const FORBIDDEN_SQL_PATTERN = /\b(ATTACH|DETACH|LOAD_EXTENSION)\b/i;
-export function stripSqlNoise(sql) {
+function stripSqlNoise(sql) {
     return sql
         .replace(/^\s*--[^\n]*\n/gm, "")
         .replace(/^\s*\/\*[\s\S]*?\*\//gm, "")
         .trim();
 }
-export function isWriteSql(sql) {
+function isWriteSql(sql) {
     return WRITE_PATTERN.test(stripSqlNoise(sql));
 }
 /**
@@ -25,7 +25,7 @@ export function isWriteSql(sql) {
  * ATTACH/DETACH would let a company-scoped session open another company's
  * vault.db by absolute path (category-1 isolation).
  */
-export function assertSqlAllowed(sql) {
+function assertSqlAllowed(sql) {
     const stripped = stripSqlNoise(sql);
     if (FORBIDDEN_SQL_PATTERN.test(stripped)) {
         throw new Error("ATTACH/DETACH/LOAD_EXTENSION are not allowed via hq db sql (tenant isolation); use the company-canonical local path only");
@@ -122,8 +122,4 @@ export function formatSqlResult(result, format = "jsonl") {
         .join("\n");
     return body ? `${header}\n${body}` : header;
 }
-/** Test helper: company dir for isolation assertions. */
-export function companyLocalDbDir(company, env) {
-    return resolveLocalDbDir(company, env);
-}
 //# sourceMappingURL=sql.js.map

package/dist/lib/doctor/checks/codex-wiring.d.ts

@@ -41,10 +41,6 @@
  */
 import { type AllowedDivergenceLoad } from "../allowed-divergence.js";
 import type { CheckContext, CheckResult } from "../types.js";
-/** Basename of the single-adapter script the current architecture routes to. */
-export declare const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
-/** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export declare const CODEX_DISPATCH_LIB_RELPATH: string;
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.