@indigoai-us/hq-cli 5.308.0 → 5.309.1

package/dist/lib/doctor/checks/codex-wiring.js

@@ -42,11 +42,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse as parseToml } from "smol-toml";
+import { collectCommands, fileState } from "../shared.js";
 import { ALLOWED_DIVERGENCE_RELPATH, loadAllowedDivergence, } from "../allowed-divergence.js";
 /** Basename of the single-adapter script the current architecture routes to. */
-export const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
+const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
 /** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
+const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.
@@ -549,44 +550,11 @@ function extractBraceBlock(source, from) {
     return source.slice(open + 1);
 }
 // --- shared low-level helpers --------------------------------------------------
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-function collectCommands(parsed) {
-    const commands = [];
-    if (!parsed || typeof parsed !== "object")
-        return commands;
-    const hooks = parsed.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return commands;
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const hook of inner) {
-                const command = hook?.command;
-                if (typeof command === "string")
-                    commands.push(command);
-            }
-        }
-    }
-    return commands;
-}
 function resolvePath(hqRoot, target) {
     if (!target)
         return null;
     return path.isAbsolute(target) ? target : path.resolve(hqRoot, target);
 }
-function fileState(target) {
-    try {
-        const stat = fs.statSync(target);
-        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
-    }
-    catch {
-        return { present: false, executable: false };
-    }
-}
 function filesEqual(a, b) {
     try {
         return fs.readFileSync(a).equals(fs.readFileSync(b));

package/dist/lib/doctor/checks/grok-wiring.js

@@ -22,6 +22,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { collectCommands, fileState } from "../shared.js";
 /** The command a user runs to install the user-global Grok bridge. */
 export const GROK_TRUST_REMEDIATION = "bash core/scripts/grok-trust.sh";
 /** Files that grok-trust.sh installs into `~/.grok/hooks/` for the bridge. */
@@ -149,38 +150,4 @@ function bridgeInstalled(bridgeDir) {
     }
     return false;
 }
-// --- shared low-level helpers --------------------------------------------------
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-function collectCommands(parsed) {
-    const commands = [];
-    if (!parsed || typeof parsed !== "object")
-        return commands;
-    const hooks = parsed.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return commands;
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const hook of inner) {
-                const command = hook?.command;
-                if (typeof command === "string")
-                    commands.push(command);
-            }
-        }
-    }
-    return commands;
-}
-function fileState(target) {
-    try {
-        const stat = fs.statSync(target);
-        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
-    }
-    catch {
-        return { present: false, executable: false };
-    }
-}
 //# sourceMappingURL=grok-wiring.js.map

package/dist/lib/doctor/checks/runtime-health.d.ts

@@ -28,16 +28,6 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 /** The id of the AI-runtime-health family. */
 export declare const RUNTIMES_FAMILY_ID = "runtimes";
-/** Common id prefix for every result this family emits. */
-export declare const RUNTIMES_PREFIX = "runtimes";
-/**
- * The deterministic one-line probe prompt. Health is proven by a round-trip
- * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
- * that answers with anything at all still passes.
- */
-export declare const PROBE_PROMPT = "Reply with exactly: OK";
-/** How long each live probe may run before it is killed and marked UNKNOWN. */
-export declare const DEFAULT_PROBE_TIMEOUT_MS = 120000;
 /** One AI runtime the doctor knows how to find and probe. */
 export interface RuntimeSpec {
     /** Stable key used in check ids, e.g. `runtimes.codex.binary`. */
@@ -94,11 +84,4 @@ export interface RuntimeHealthDeps {
 export declare function checkRuntimeHealth(context: CheckContext, deps?: RuntimeHealthDeps): Promise<CheckResult[]>;
 /** The registered family object. */
 export declare const runtimeHealthFamily: CheckFamily;
-/**
- * Resolve an executable name against PATH with a pure filesystem scan — no
- * process is spawned, keeping the doctor's default run a function of on-disk
- * shape. First PATH entry containing an executable regular file wins, which is
- * exactly the copy a shell would run.
- */
-export declare function resolveOnPath(binary: string): string | null;
 //# sourceMappingURL=runtime-health.d.ts.map

package/dist/lib/doctor/checks/runtime-health.js

@@ -33,15 +33,15 @@ import { planCommandSpawn } from "../../../utils/windows-spawn.js";
 /** The id of the AI-runtime-health family. */
 export const RUNTIMES_FAMILY_ID = "runtimes";
 /** Common id prefix for every result this family emits. */
-export const RUNTIMES_PREFIX = "runtimes";
+const RUNTIMES_PREFIX = "runtimes";
 /**
  * The deterministic one-line probe prompt. Health is proven by a round-trip
  * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
  * that answers with anything at all still passes.
  */
-export const PROBE_PROMPT = "Reply with exactly: OK";
+const PROBE_PROMPT = "Reply with exactly: OK";
 /** How long each live probe may run before it is killed and marked UNKNOWN. */
-export const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
+const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
 /**
  * The three runtimes HQ wires hooks for. Codex runs its probe under its own
  * read-only sandbox and outside-a-repo mode so the probe can never write; the
@@ -243,7 +243,7 @@ export const runtimeHealthFamily = {
  * shape. First PATH entry containing an executable regular file wins, which is
  * exactly the copy a shell would run.
  */
-export function resolveOnPath(binary) {
+function resolveOnPath(binary) {
     const pathVar = process.env.PATH ?? "";
     for (const dir of pathVar.split(path.delimiter)) {
         if (!dir)

package/dist/lib/doctor/checks/scaffold-cli-floor.d.ts

@@ -1,6 +1,5 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 export declare const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
-export declare const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
 export declare const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
 export declare const scaffoldCliFloorFamily: CheckFamily;
 export declare function checkScaffoldCliFloor(context: CheckContext): CheckResult[];

package/dist/lib/doctor/checks/scaffold-cli-floor.js

@@ -4,7 +4,7 @@ import * as yaml from "js-yaml";
 import { CLI_VERSION } from "../../../cli-version.js";
 import { compareScaffoldCliFloor } from "../../scaffold-cli-floor.js";
 export const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
-export const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
+const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
 export const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
 export const scaffoldCliFloorFamily = {
     id: SCAFFOLD_CLI_FLOOR_FAMILY_ID,

package/dist/lib/doctor/compat.d.ts

@@ -31,22 +31,6 @@ import type { DoctorJsonDocument } from "./json-output.js";
 export declare const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export declare const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
-/** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
-export declare const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
-/** The runtime-probe result id: whether hooks actually fired (the ledger). */
-export declare const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
-/**
- * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
- * load* scope — the subset of the hooks family the wrapper is allowed to fail
- * on. Deliberately narrow: it covers a missing/invalid settings file, an
- * unquoted `$CLAUDE_PROJECT_DIR` that word-splits on a spaced root, and a hook
- * command that runs a script which is not on disk — and nothing else. The many
- * richer doctor findings (executable bits, orphaned scripts, three-profile
- * membership, Codex/Grok parity, fixture coverage) are intentionally OUT of
- * scope, so the wrapper stays byte-for-byte compatible with callers that only
- * ever cared whether the hook configuration could load.
- */
-export declare const CHECK_HQ_HOOKS_SETTINGS_SCOPE: readonly string[];
 /**
  * Whether hook dispatch was observed this session. Mirrors the wrapper's
  * `HQ runtime enforcement: …` line. `NOT CHECKED` is the default when

package/dist/lib/doctor/compat.js

@@ -31,9 +31,9 @@ export const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
 /** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
-export const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
+const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
 /** The runtime-probe result id: whether hooks actually fired (the ledger). */
-export const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
+const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
 /**
  * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
  * load* scope — the subset of the hooks family the wrapper is allowed to fail
@@ -45,7 +45,7 @@ export const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
  * scope, so the wrapper stays byte-for-byte compatible with callers that only
  * ever cared whether the hook configuration could load.
  */
-export const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
+const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
     "hooks.settings-present",
     "hooks.settings-required-command-hooks",
     "hooks.settings-valid-json",

package/dist/lib/doctor/deep/effects.js

@@ -36,6 +36,7 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { isRecord } from "../shared.js";
 /**
  * Parse a fixture case's `effects:` field into a list of {@link
  * EffectExpectation}. Returns the list, or an error string naming what was
@@ -223,7 +224,4 @@ function hashFile(abs) {
         return null;
     }
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 //# sourceMappingURL=effects.js.map

package/dist/lib/doctor/deep/sandbox.js

@@ -39,6 +39,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
+import { isRecord } from "../shared.js";
 import { classifyCaseStatus, looksLikeFixture, } from "../fixtures/schema.js";
 import { HOOK_TESTS_RELDIR, registeredHookIds } from "../fixtures/discover.js";
 import { isSideEffectingHookId } from "./classify.js";
@@ -566,7 +567,4 @@ function oneLine(text) {
     const collapsed = text.replace(/\s+/g, " ").trim();
     return collapsed.length > 200 ? `${collapsed.slice(0, 197)}…` : collapsed;
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 //# sourceMappingURL=sandbox.js.map

package/dist/lib/doctor/fixtures/schema.js

@@ -27,6 +27,7 @@
  *     module owns only the classification semantics, so both the doctor and its
  *     tests agree on what a case outcome means.
  */
+import { isRecord } from "../shared.js";
 /**
  * Every fixture schema version this build of the CLI can interpret. A fixture
  * declaring a version outside this set is reported UNKNOWN, never PASS — see
@@ -242,7 +243,4 @@ export function classifyCaseStatus(met, expectedFailure) {
         return met ? "WARN" : "KNOWN-DEFECT";
     return met ? "PASS" : "FAIL";
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 //# sourceMappingURL=schema.js.map

package/dist/lib/doctor/platform.d.ts

@@ -126,24 +126,8 @@ export declare function claudeCodeFlagEvidence(env: NodeJS.ProcessEnv): Platform
  * `com.googlecode.iterm2`), so this fires only under a real desktop host.
  */
 export declare function bundleIdEvidence(env: NodeJS.ProcessEnv): PlatformEvidence | null;
-/**
- * Codex runtime environment variables, kept in parity with the canonical shell
- * detector `core/scripts/lib/detect-codex.sh`. Presence of any is a strong Codex
- * signal. One evidence entry is produced per variable found so a single Codex
- * signal can be tested in isolation.
- */
-export declare const CODEX_ENV_VARS: readonly ["CODEX_SANDBOX", "CODEX_SESSION_ID", "CODEX_EXECUTION_ID", "CODEX_AGENT_ID", "CODEX_THREAD_ID", "CODEX_SHELL", "CODEX_CI", "CODEX_INTERNAL_ORIGINATOR_OVERRIDE", "OPENAI_CODEX"];
 /** Every Codex environment signal present in `env`, one entry per variable. */
 export declare function codexEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
-/**
- * Grok runtime environment variables. Restricted to variables the Grok host
- * exports into the session (a session id, its workspace root) — HQ's own Grok
- * *launcher* variables (`GROK_BIN`, `GROK_CONFIG`, `XAI_API_KEY`, …) are
- * excluded on purpose: those can be set inside a Claude or Codex session that is
- * merely preparing to launch Grok, and treating them as "we are running under
- * Grok" would be a false positive.
- */
-export declare const GROK_ENV_VARS: readonly ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
@@ -157,10 +141,6 @@ export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidenc
  * on its environment signals instead, and this function does not guess it.
  */
 export declare function ancestryEvidence(ancestors: AncestorProcess[]): PlatformEvidence[];
-/** The one command this module ever launches to read process ancestry. */
-export declare const PS_COMMAND = "ps";
-/** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
-export declare const PS_ARGS: readonly ["-Ao", "pid=,ppid=,comm="];
 /**
  * Low-level process-table provider: runs a command and returns its stdout, or
  * `null` on failure. This is the single seam through which any process is
@@ -186,12 +166,6 @@ export interface ReadAncestryOptions {
  * environment signals rather than throwing.
  */
 export declare function readProcessAncestry(options?: ReadAncestryOptions): AncestorProcess[];
-/**
- * Collect the environment signals, in a stable order: entrypoint, the Claude
- * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
- * separately (and lazily) by {@link detectPlatform}.
- */
-export declare function collectEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
  * Collect every signal from an environment and an explicit ancestor chain, in a
  * stable order: environment signals first, then process ancestry. Exposed for

package/dist/lib/doctor/platform.js

@@ -150,7 +150,7 @@ function looksLikeClaudeDesktopBundle(id) {
  * signal. One evidence entry is produced per variable found so a single Codex
  * signal can be tested in isolation.
  */
-export const CODEX_ENV_VARS = [
+const CODEX_ENV_VARS = [
     "CODEX_SANDBOX",
     "CODEX_SESSION_ID",
     "CODEX_EXECUTION_ID",
@@ -185,7 +185,7 @@ export function codexEnvEvidence(env) {
  * merely preparing to launch Grok, and treating them as "we are running under
  * Grok" would be a false positive.
  */
-export const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
+const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export function grokEnvEvidence(env) {
     const found = [];
@@ -249,9 +249,9 @@ const DEFAULT_MAX_HOPS = 20;
 /** Wall-clock bound for the single `ps` snapshot, keeping startup fast. */
 const PS_TIMEOUT_MS = 250;
 /** The one command this module ever launches to read process ancestry. */
-export const PS_COMMAND = "ps";
+const PS_COMMAND = "ps";
 /** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
-export const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
+const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
 /**
  * Read this process's ancestor chain (nearest parent first) by taking one `ps`
  * snapshot of the process table and walking parent pointers upward. A single
@@ -330,7 +330,7 @@ function defaultPsSpawner(command, args) {
  * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
  * separately (and lazily) by {@link detectPlatform}.
  */
-export function collectEnvEvidence(env) {
+function collectEnvEvidence(env) {
     const evidence = [];
     const entrypoint = entrypointEvidence(env);
     if (entrypoint)

package/dist/lib/doctor/shared.d.ts

@@ -0,0 +1,8 @@
+/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
+export declare function collectCommands(parsed: unknown): string[];
+export declare function fileState(target: string): {
+    present: boolean;
+    executable: boolean;
+};
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/lib/doctor/shared.js

@@ -0,0 +1,38 @@
+import * as fs from "node:fs";
+/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
+export function collectCommands(parsed) {
+    const commands = [];
+    if (!parsed || typeof parsed !== "object")
+        return commands;
+    const hooks = parsed.hooks;
+    if (!hooks || typeof hooks !== "object")
+        return commands;
+    for (const entries of Object.values(hooks)) {
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            const inner = entry?.hooks;
+            if (!Array.isArray(inner))
+                continue;
+            for (const hook of inner) {
+                const command = hook?.command;
+                if (typeof command === "string")
+                    commands.push(command);
+            }
+        }
+    }
+    return commands;
+}
+export function fileState(target) {
+    try {
+        const stat = fs.statSync(target);
+        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
+    }
+    catch {
+        return { present: false, executable: false };
+    }
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=shared.js.map