@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/core-utils/soft-timeout.js

@@ -110,7 +110,7 @@ export function runSoftTimeout(parsed, deps = {}) {
         // orphaned grandchild (e.g. run-project's builder) keeps running after the
         // wrapper returns. stdio inherited so the command's stdin/stdout/stderr —
         // including piped or interactive input — pass through unchanged.
-        const child = spawnFn(command[0], command.slice(1), { stdio: "inherit", detached: true, windowsHide: true });
+        const child = spawnFn(command[0], command.slice(1), { stdio: "inherit", detached: true });
         let capped = false;
         let ticks = 0;
         // Signal the child's process group when we can (detached leader), else the

package/dist/lib/core-utils/timeout-guard.d.ts

@@ -20,7 +20,7 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
-import type { FlagReader } from "../flag-registry.js";
+import { type FlagReader } from "../flag-registry.js";
 /**
  * Worst-case inner deadline (seconds) declared in a command: a `timeout` /
  * `gtimeout` prefix (matched by executable BASENAME, so `/usr/bin/timeout`
@@ -55,11 +55,11 @@ export interface TimeoutGuardDeps {
     flagReader?: FlagReader;
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): Promise<boolean>;
+export declare function isGatedUser(email: string | undefined, flagReader?: FlagReader): boolean;
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): Promise<number>;
+export declare function timeoutGuardCommand(stdin: string, deps?: TimeoutGuardDeps): number;
 //# sourceMappingURL=timeout-guard.d.ts.map

package/dist/lib/core-utils/timeout-guard.js

@@ -20,6 +20,9 @@
  *
  * Exit codes: 0 = allow, 2 = block.
  */
+import { loadCachedTokens } from "@indigoai-us/hq-cloud";
+import { peekIdToken } from "../../utils/id-token.js";
+import { resolveFlagGate, resolveProcessFlagGate, } from "../flag-registry.js";
 // Observed Claude Code Bash-tool bounds. The tool `timeout` (ms) raises the
 // deadline up to the max; with none declared the default applies.
 const HARNESS_DEFAULT_MS = 120_000; // 2 min
@@ -150,14 +153,8 @@ supervise yourself.)
 
 Policy: hq-foreground-timeout-killed-by-harness-deadline.
 Bypass for one sanctioned foreground run: prefix HQ_ALLOW_LONG_FOREGROUND=1.`;
-async function defaultEmail() {
+function defaultEmail() {
     try {
-        // The cached identity is needed only for commands that would otherwise
-        // block. Keep hq-cloud and the JWT decoder out of the common allow path.
-        const [{ loadCachedTokens }, { peekIdToken }] = await Promise.all([
-            import("@indigoai-us/hq-cloud"),
-            import("../../utils/id-token.js"),
-        ]);
         const cached = loadCachedTokens();
         if (!cached)
             return undefined;
@@ -169,35 +166,23 @@ async function defaultEmail() {
     }
 }
 /** Whether the guard is active for this identity (rollout gate). */
-export async function isGatedUser(email, flagReader) {
+export function isGatedUser(email, flagReader) {
     const legacyFallback = () => typeof email === "string" && email.toLowerCase().endsWith(GATE_DOMAIN);
     const lookup = {
         defaultEmailDomains: ["getindigo.ai"],
         personEmail: email,
         fallback: legacyFallback(),
     };
-    if (flagReader) {
-        try {
-            return flagReader.isEnabled("cli.foreground-timeout-guard", lookup);
-        }
-        catch {
-            return legacyFallback();
-        }
-    }
-    try {
-        const { resolveProcessFlagGate } = await import("../flag-registry.js");
-        return resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
-    }
-    catch {
-        return legacyFallback();
-    }
+    return flagReader
+        ? resolveFlagGate(flagReader, "cli.foreground-timeout-guard", lookup, legacyFallback)
+        : resolveProcessFlagGate("cli.foreground-timeout-guard", lookup, legacyFallback);
 }
 /**
  * Command entry: read the PreToolUse JSON, apply the gate + short-circuits, and
  * return the exit code (0 allow / 2 block). Never throws — a parse failure or a
  * missing identity fails OPEN (allow), because a hook must not break tool calls.
  */
-export async function timeoutGuardCommand(stdin, deps = {}) {
+export function timeoutGuardCommand(stdin, deps = {}) {
     const env = deps.env ?? process.env;
     const err = deps.stderr ?? process.stderr;
     let payload;
@@ -216,15 +201,15 @@ export async function timeoutGuardCommand(stdin, deps = {}) {
         return 0;
     if (/(^|\s)HQ_ALLOW_LONG_FOREGROUND=1(\s|$)/.test(command))
         return 0;
+    // Rollout gate: only act for @getindigo.ai identities.
+    const getEmail = deps.getEmail ?? defaultEmail;
+    if (!isGatedUser(getEmail(), deps.flagReader))
+        return 0;
     const runInBackground = ti.run_in_background === true;
     const toolTimeoutMs = typeof ti.timeout === "number" ? ti.timeout : undefined;
     const verdict = evaluateTimeoutGuard({ command, toolTimeoutMs, runInBackground });
     if (!verdict.block)
         return 0;
-    // Rollout gate: only act for @getindigo.ai identities.
-    const getEmail = deps.getEmail ?? defaultEmail;
-    if (!await isGatedUser(await getEmail(), deps.flagReader))
-        return 0;
     err.write(`${BLOCK_MESSAGE(verdict.reason ?? "declared timeout exceeds the harness ceiling")}\n`);
     return 2;
 }

package/dist/lib/core-utils/token-usage-report.js

@@ -120,7 +120,7 @@ function comparison(projectDirs, before, after, minHours, json, stdout) {
 /** Print token usage totals from Claude session JSONL files. */
 export function tokenUsageReport(args = [], options = {}) {
     const { stdout, stderr } = ioFor(options);
-    let lastDays = 7, since = "", json = false, before = "", after = "", minHours = 0, projectDir = options.projectDir, projectDirSeen = false;
+    let lastDays = 7, since = "", json = false, before = "", after = "", minHours = 0;
     for (let index = 0; index < args.length;) {
         const arg = args[index];
         if (arg === "--last") {
@@ -149,22 +149,8 @@ export function tokenUsageReport(args = [], options = {}) {
             minHours = Number.parseFloat(args[index + 1] ?? "");
             index += 2;
         }
-        else if (arg === "--project-dir") {
-            const value = args[index + 1];
-            if (!value || value.startsWith("--")) {
-                line(stderr, "--project-dir requires a path");
-                return 1;
-            }
-            if (projectDirSeen) {
-                line(stderr, "--project-dir may be specified only once");
-                return 1;
-            }
-            projectDir = value;
-            projectDirSeen = true;
-            index += 2;
-        }
         else if (arg === "-h" || arg === "--help") {
-            stdout("token-usage-report.sh — Daily effective-token totals + top burners from Claude Code session JSONLs.\nUsage:\n  scripts/token-usage-report.sh                # last 7 days, table\n  scripts/token-usage-report.sh --last 14      # last 14 days\n  scripts/token-usage-report.sh --since 2026-05-01\n  scripts/token-usage-report.sh --json         # machine-readable\n  scripts/token-usage-report.sh --project-dir <path> # use one Claude activity folder\nEffective tokens weighting (matches weekly rate-limit volume):\n  input + 5×output + 1.25×cache_creation + 0.1×cache_read\n--- Compare-windows mode (US-011) ---\nFormat: --before YYYY-MM-DD:YYYY-MM-DD --after YYYY-MM-DD:YYYY-MM-DD\n");
+            stdout("token-usage-report.sh — Daily effective-token totals + top burners from Claude Code session JSONLs.\nUsage:\n  scripts/token-usage-report.sh                # last 7 days, table\n  scripts/token-usage-report.sh --last 14      # last 14 days\n  scripts/token-usage-report.sh --since 2026-05-01\n  scripts/token-usage-report.sh --json         # machine-readable\nEffective tokens weighting (matches weekly rate-limit volume):\n  input + 5×output + 1.25×cache_creation + 0.1×cache_read\n--- Compare-windows mode (US-011) ---\nFormat: --before YYYY-MM-DD:YYYY-MM-DD --after YYYY-MM-DD:YYYY-MM-DD\n");
             return 0;
         }
         else {
@@ -172,7 +158,7 @@ export function tokenUsageReport(args = [], options = {}) {
             return 1;
         }
     }
-    const projectDirs = resolveProjectDirs({ ...options, projectDir }).filter((dir) => fs.existsSync(dir) && fs.statSync(dir).isDirectory());
+    const projectDirs = resolveProjectDirs(options).filter((dir) => fs.existsSync(dir) && fs.statSync(dir).isDirectory());
     if (before && after) {
         comparison(projectDirs, before, after, minHours, json, stdout);
         return 0;

package/dist/lib/db/control-plane.js

@@ -1,8 +1,4 @@
 import { planGateErrorFromPayload } from "../../utils/plan-gate-error.js";
-// Provision may allocate remote resources, so allow two minutes and never retry.
-const DB_PROVISION_TIMEOUT_MS = 120_000;
-// Status is a read-only probe; 15 seconds is longer than its normal response time.
-const DB_STATUS_TIMEOUT_MS = 15_000;
 function assertNoPostgresUrl(label, text) {
     if (/postgres:\/\//i.test(text) || /postgresql:\/\//i.test(text)) {
         throw new Error(`${label}: control plane returned a connection string (refusing to surface)`);
@@ -26,7 +22,6 @@ export class ControlPlaneDbClient {
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(input),
-            signal: AbortSignal.timeout(DB_PROVISION_TIMEOUT_MS),
         });
         const text = await res.text();
         assertNoPostgresUrl("provision", text);
@@ -58,7 +53,6 @@ export class ControlPlaneDbClient {
         const res = await this.fetchImpl(url, {
             method: "GET",
             headers: { Authorization: `Bearer ${token}` },
-            signal: AbortSignal.timeout(DB_STATUS_TIMEOUT_MS),
         });
         const text = await res.text();
         assertNoPostgresUrl("status", text);

package/dist/lib/db/local.d.ts

@@ -23,6 +23,11 @@ export interface LocalDbStatus {
     /** Fingerprint of path for logs that prefer not to echo full home paths. */
     pathFingerprint: string;
 }
+/**
+ * Short non-reversible fingerprint of a path (for status display).
+ * Not a secret — just avoids dumping full home paths when preferred.
+ */
+export declare function fingerprintPath(filePath: string): string;
 /**
  * Open (and create if missing) the company local vault DB with WAL mode.
  * Idempotent: reopening an existing file does not recreate or wipe it.

package/dist/lib/db/local.js

@@ -12,7 +12,7 @@ const MIGRATIONS_TABLE = "hq_schema_migrations";
  * Short non-reversible fingerprint of a path (for status display).
  * Not a secret — just avoids dumping full home paths when preferred.
  */
-function fingerprintPath(filePath) {
+export function fingerprintPath(filePath) {
     let h = 2166136261;
     for (let i = 0; i < filePath.length; i++) {
         h ^= filePath.charCodeAt(i);

package/dist/lib/db/migrate.d.ts

@@ -5,7 +5,9 @@
  *   companies/{company}/db/migrations/*.sql
  * Applied versions are recorded in hq_schema_migrations inside the local DB.
  */
+import type { LocalDb } from "./local.js";
 import type { LocalDbPathEnv } from "./paths.js";
+export declare const MIGRATIONS_TABLE = "hq_schema_migrations";
 export interface MigrateOptions extends LocalDbPathEnv {
     company: string;
     /**
@@ -22,6 +24,16 @@ export interface MigrateResult {
     head: string | null;
 }
 export declare function resolveMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * Ensure migrations directory exists (creates empty dir on first migrate).
+ */
+export declare function ensureMigrationsDir(hqRoot: string, companySlug: string): string;
+/**
+ * List pending migration files in lexical/version order (filename sort).
+ */
+export declare function listMigrationFiles(migrationsDir: string): string[];
+export declare function ensureMigrationsLedger(db: LocalDb): void;
+export declare function listAppliedVersions(db: LocalDb): Set<string>;
 /**
  * Apply pending migrations. On failure, does not mark the failed file applied.
  */

package/dist/lib/db/migrate.js

@@ -9,7 +9,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { openLocalDb, readMigrationHead } from "./local.js";
 import { normalizeCompanySlugForLocalDb } from "./paths.js";
-const MIGRATIONS_TABLE = "hq_schema_migrations";
+export const MIGRATIONS_TABLE = "hq_schema_migrations";
 export function resolveMigrationsDir(hqRoot, companySlug) {
     const slug = normalizeCompanySlugForLocalDb(companySlug);
     return path.join(hqRoot, "companies", slug, "db", "migrations");
@@ -17,7 +17,7 @@ export function resolveMigrationsDir(hqRoot, companySlug) {
 /**
  * Ensure migrations directory exists (creates empty dir on first migrate).
  */
-function ensureMigrationsDir(hqRoot, companySlug) {
+export function ensureMigrationsDir(hqRoot, companySlug) {
     const dir = resolveMigrationsDir(hqRoot, companySlug);
     fs.mkdirSync(dir, { recursive: true });
     return dir;
@@ -25,7 +25,7 @@ function ensureMigrationsDir(hqRoot, companySlug) {
 /**
  * List pending migration files in lexical/version order (filename sort).
  */
-function listMigrationFiles(migrationsDir) {
+export function listMigrationFiles(migrationsDir) {
     if (!fs.existsSync(migrationsDir))
         return [];
     return fs
@@ -33,7 +33,7 @@ function listMigrationFiles(migrationsDir) {
         .filter((f) => f.endsWith(".sql"))
         .sort((a, b) => a.localeCompare(b, "en"));
 }
-function ensureMigrationsLedger(db) {
+export function ensureMigrationsLedger(db) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS ${MIGRATIONS_TABLE} (
       version TEXT PRIMARY KEY NOT NULL,
@@ -41,7 +41,7 @@ function ensureMigrationsLedger(db) {
     );
   `);
 }
-function listAppliedVersions(db) {
+export function listAppliedVersions(db) {
     ensureMigrationsLedger(db);
     const rows = db
         .prepare(`SELECT version FROM ${MIGRATIONS_TABLE} ORDER BY version`)

package/dist/lib/db/remote-sql.d.ts

@@ -1,8 +1,8 @@
 /**
- * Remote SQL helper with injected credentials and executor (US-010).
+ * Remote SQL via secrets-exec style injection (US-010).
  *
  * Connection string never appears in argv, logs, or stdout.
- * The CLI command does not currently wire this helper to a remote executor.
+ * Local remains default when --remote is absent (handled by command layer).
  */
 export interface RemoteSqlOptions {
     company: string;

package/dist/lib/db/remote-sql.js

@@ -1,8 +1,8 @@
 /**
- * Remote SQL helper with injected credentials and executor (US-010).
+ * Remote SQL via secrets-exec style injection (US-010).
  *
  * Connection string never appears in argv, logs, or stdout.
- * The CLI command does not currently wire this helper to a remote executor.
+ * Local remains default when --remote is absent (handled by command layer).
  */
 function assertNoLeak(label, value) {
     const s = typeof value === "string" ? value : JSON.stringify(value);
@@ -23,7 +23,7 @@ export async function runRemoteSql(opts) {
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : "no remote binding";
-        throw new Error(`remote SQL unavailable: ${msg}`);
+        throw new Error(`remote SQL unavailable: ${msg}. Run \`hq db provision --company ${opts.company}\` first.`);
     }
     assertNoLeak("connection config", config);
     if (!opts.execute) {

package/dist/lib/db/sql.d.ts

@@ -27,6 +27,14 @@ export interface SqlRunResult {
     changes: number;
     readonly: boolean;
 }
+export declare function stripSqlNoise(sql: string): string;
+export declare function isWriteSql(sql: string): boolean;
+/**
+ * Statements that must never run via `hq db sql`, even with --write.
+ * ATTACH/DETACH would let a company-scoped session open another company's
+ * vault.db by absolute path (category-1 isolation).
+ */
+export declare function assertSqlAllowed(sql: string): void;
 /**
  * Resolve which file path to open, enforcing company isolation by default.
  */
@@ -36,4 +44,6 @@ export declare function resolveSqlDbPath(opts: SqlRunOptions): string;
  */
 export declare function runLocalSql(opts: SqlRunOptions): SqlRunResult;
 export declare function formatSqlResult(result: SqlRunResult, format?: "jsonl" | "table"): string;
+/** Test helper: company dir for isolation assertions. */
+export declare function companyLocalDbDir(company: string, env?: LocalDbPathEnv): string;
 //# sourceMappingURL=sql.d.ts.map

package/dist/lib/db/sql.js

@@ -7,17 +7,17 @@
  */
 import Database from "better-sqlite3";
 import { openLocalDb } from "./local.js";
-import { normalizeCompanySlugForLocalDb, resolveLocalDbPath, } from "./paths.js";
+import { normalizeCompanySlugForLocalDb, resolveLocalDbDir, resolveLocalDbPath, } from "./paths.js";
 const WRITE_PATTERN = /^\s*(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER|TRUNCATE|REINDEX|VACUUM|BEGIN|COMMIT|ROLLBACK)\b/i;
 /** Always forbidden — opens other files/DBs and breaks company path isolation. */
 const FORBIDDEN_SQL_PATTERN = /\b(ATTACH|DETACH|LOAD_EXTENSION)\b/i;
-function stripSqlNoise(sql) {
+export function stripSqlNoise(sql) {
     return sql
         .replace(/^\s*--[^\n]*\n/gm, "")
         .replace(/^\s*\/\*[\s\S]*?\*\//gm, "")
         .trim();
 }
-function isWriteSql(sql) {
+export function isWriteSql(sql) {
     return WRITE_PATTERN.test(stripSqlNoise(sql));
 }
 /**
@@ -25,7 +25,7 @@ function isWriteSql(sql) {
  * ATTACH/DETACH would let a company-scoped session open another company's
  * vault.db by absolute path (category-1 isolation).
  */
-function assertSqlAllowed(sql) {
+export function assertSqlAllowed(sql) {
     const stripped = stripSqlNoise(sql);
     if (FORBIDDEN_SQL_PATTERN.test(stripped)) {
         throw new Error("ATTACH/DETACH/LOAD_EXTENSION are not allowed via hq db sql (tenant isolation); use the company-canonical local path only");
@@ -122,4 +122,8 @@ export function formatSqlResult(result, format = "jsonl") {
         .join("\n");
     return body ? `${header}\n${body}` : header;
 }
+/** Test helper: company dir for isolation assertions. */
+export function companyLocalDbDir(company, env) {
+    return resolveLocalDbDir(company, env);
+}
 //# sourceMappingURL=sql.js.map

package/dist/lib/doctor/__testing__/fake-hq-tree.d.ts

@@ -74,7 +74,7 @@ export interface FakeHookSpec {
     mode?: number;
     /** Whether the hook is registered in `.claude/settings.json`. Default: true. */
     registered?: boolean;
-    /** Events the hook registers against. Default: SessionStart and PreToolUse. */
+    /** Events the hook registers against. Default: ["PreToolUse"]. */
     events?: HookEventName[];
     /** Optional settings matcher (e.g. "Bash", "Glob"). */
     matcher?: string;

package/dist/lib/doctor/__testing__/fake-hq-tree.js

@@ -166,7 +166,7 @@ function writeHook(claudeHooksDir, codexHooksDir, hook, defaultMirror) {
     const claudeBody = hook.body ?? DEFAULT_HOOK_BODY;
     const present = hook.present !== false;
     const registered = hook.registered !== false;
-    const events = hook.events ?? ["SessionStart", "PreToolUse"];
+    const events = hook.events ?? ["PreToolUse"];
     const profiles = hook.profiles ?? [...GATE_PROFILES];
     const scriptPath = path.join(claudeHooksDir, `${hook.id}.sh`);
     let mode = null;

package/dist/lib/doctor/checks/claude-wiring.js

@@ -24,7 +24,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { GATE_PROFILES, gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
-import { countStrayGateEntries } from "../stray-gate-entries.js";
 /** Common id prefix for every result this check family emits. */
 export const CLAUDE_WIRING_PREFIX = "hooks.claude";
 /**
@@ -58,35 +57,6 @@ export function checkClaudeWiring(context) {
     else if (local.present) {
         registrations.push(...enumerateRegistrations(local.value, ".claude/settings.local.json"));
     }
-    // --- Stray matcher-less gate entries (written by old `hq doctor --fix`) -------
-    // Only on master-hook trees: there, per-hook gate entries are never shipped,
-    // so a matcher-less one can only be the doctor-generated stray. A legacy tree
-    // that still registers hooks one by one is left alone.
-    const usesMasterHook = registrations.some((reg) => /\/master-hook\.sh\b/.test(reg.command));
-    for (const [file, parsed] of usesMasterHook ? [
-        ["settings.json", base],
-        ["settings.local.json", local],
-    ] : []) {
-        if (!parsed.present || parsed.invalid)
-            continue;
-        const abs = path.join(claudeDir, file);
-        const stray = countStrayGateEntries(parsed.value);
-        results.push(stray > 0
-            ? {
-                status: "FAIL",
-                checkId: `${CLAUDE_WIRING_PREFIX}.stray-gate-registration`,
-                target: abs,
-                message: `.claude/${file} has ${stray} hook-gate registration${stray === 1 ? "" : "s"} with no matcher. ` +
-                    "They run on every tool call and can block Bash, Skill and Read. An older `hq doctor --fix` wrote them.",
-                remediation: `Remove the matcher-less hook-gate.sh entries from .claude/${file} (hq doctor --fix does this).`,
-            }
-            : {
-                status: "PASS",
-                checkId: `${CLAUDE_WIRING_PREFIX}.stray-gate-registration`,
-                target: abs,
-                message: `.claude/${file} has no stray matcher-less hook-gate registrations.`,
-            });
-    }
     const scans = registrations.map((reg) => ({
         reg,
         scan: scanHookCommand(reg.command),
@@ -146,11 +116,6 @@ export function checkClaudeWiring(context) {
         for (const rp of scan.requiredRelpaths)
             referencedBasenames.add(baseName(rp));
     }
-    // master-hook.sh dispatches the gated hooks listed in hook-registry.json, so
-    // those scripts are registered even though no settings command names them.
-    for (const script of hookRegistryScripts(path.join(hooksDir, "hook-registry.json"))) {
-        referencedBasenames.add(baseName(script));
-    }
     for (const file of listShellScripts(hooksDir)) {
         if (referencedBasenames.has(file))
             continue;
@@ -159,7 +124,7 @@ export function checkClaudeWiring(context) {
             checkId: `${CLAUDE_WIRING_PREFIX}.orphan`,
             target: path.join(hooksDir, file),
             message: `Hook script ${file} is present in .claude/hooks/ but is not registered in any settings file.`,
-            remediation: `Add ${file} to .claude/hooks/hook-registry.json with the right event and matcher, or delete it.`,
+            remediation: `Register ${file} in .claude/settings.json or delete it.`,
         });
     }
     // --- AC4: every gated hook id is in ALL THREE profiles -----------------------
@@ -269,31 +234,6 @@ export function checkClaudeWiring(context) {
  * event in a parsed settings object. Tolerant of malformed shapes — any
  * non-conforming branch contributes nothing rather than throwing.
  */
-/** Every `script` path listed in .claude/hooks/hook-registry.json (empty when absent). */
-function hookRegistryScripts(registryPath) {
-    const parsed = readJsonFile(registryPath);
-    if (!parsed.present || parsed.invalid)
-        return [];
-    const hooks = parsed.value?.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return [];
-    const out = [];
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const item of inner) {
-                const script = item?.script;
-                if (typeof script === "string" && script)
-                    out.push(script);
-            }
-        }
-    }
-    return out;
-}
 function enumerateRegistrations(settings, source) {
     const out = [];
     if (!settings || typeof settings !== "object")
@@ -460,15 +400,6 @@ function requiredFromFirstCommand(first) {
         k += 1;
     if (k >= first.length)
         return { required, gatedHookId };
-    // SessionStart can use env to set BASH_ENV before Bash itself starts.
-    // Walk through that launcher and its assignments just like the shell scanner.
-    if (baseName(first[k]) === "env") {
-        k += 1;
-        while (k < first.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(first[k]))
-            k += 1;
-        if (k >= first.length || first[k].startsWith("-"))
-            return { required, gatedHookId };
-    }
     if (INTERPRETERS.has(baseName(first[k]))) {
         k += 1;
         while (k < first.length && first[k].startsWith("-")) {

package/dist/lib/doctor/checks/codex-wiring.d.ts

@@ -41,6 +41,10 @@
  */
 import { type AllowedDivergenceLoad } from "../allowed-divergence.js";
 import type { CheckContext, CheckResult } from "../types.js";
+/** Basename of the single-adapter script the current architecture routes to. */
+export declare const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
+/** Library the adapter sources to dispatch `.claude/settings.json` live. */
+export declare const CODEX_DISPATCH_LIB_RELPATH: string;
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.

package/dist/lib/doctor/checks/codex-wiring.js

@@ -42,12 +42,11 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse as parseToml } from "smol-toml";
-import { collectCommands, fileState } from "../shared.js";
 import { ALLOWED_DIVERGENCE_RELPATH, loadAllowedDivergence, } from "../allowed-divergence.js";
 /** Basename of the single-adapter script the current architecture routes to. */
-const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
+export const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
 /** Library the adapter sources to dispatch `.claude/settings.json` live. */
-const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
+export const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.
@@ -550,11 +549,44 @@ function extractBraceBlock(source, from) {
     return source.slice(open + 1);
 }
 // --- shared low-level helpers --------------------------------------------------
+/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
+function collectCommands(parsed) {
+    const commands = [];
+    if (!parsed || typeof parsed !== "object")
+        return commands;
+    const hooks = parsed.hooks;
+    if (!hooks || typeof hooks !== "object")
+        return commands;
+    for (const entries of Object.values(hooks)) {
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            const inner = entry?.hooks;
+            if (!Array.isArray(inner))
+                continue;
+            for (const hook of inner) {
+                const command = hook?.command;
+                if (typeof command === "string")
+                    commands.push(command);
+            }
+        }
+    }
+    return commands;
+}
 function resolvePath(hqRoot, target) {
     if (!target)
         return null;
     return path.isAbsolute(target) ? target : path.resolve(hqRoot, target);
 }
+function fileState(target) {
+    try {
+        const stat = fs.statSync(target);
+        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
+    }
+    catch {
+        return { present: false, executable: false };
+    }
+}
 function filesEqual(a, b) {
     try {
         return fs.readFileSync(a).equals(fs.readFileSync(b));

package/dist/lib/doctor/checks/grok-wiring.js

@@ -22,7 +22,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { collectCommands, fileState } from "../shared.js";
 /** The command a user runs to install the user-global Grok bridge. */
 export const GROK_TRUST_REMEDIATION = "bash core/scripts/grok-trust.sh";
 /** Files that grok-trust.sh installs into `~/.grok/hooks/` for the bridge. */
@@ -150,4 +149,38 @@ function bridgeInstalled(bridgeDir) {
     }
     return false;
 }
+// --- shared low-level helpers --------------------------------------------------
+/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
+function collectCommands(parsed) {
+    const commands = [];
+    if (!parsed || typeof parsed !== "object")
+        return commands;
+    const hooks = parsed.hooks;
+    if (!hooks || typeof hooks !== "object")
+        return commands;
+    for (const entries of Object.values(hooks)) {
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            const inner = entry?.hooks;
+            if (!Array.isArray(inner))
+                continue;
+            for (const hook of inner) {
+                const command = hook?.command;
+                if (typeof command === "string")
+                    commands.push(command);
+            }
+        }
+    }
+    return commands;
+}
+function fileState(target) {
+    try {
+        const stat = fs.statSync(target);
+        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
+    }
+    catch {
+        return { present: false, executable: false };
+    }
+}
 //# sourceMappingURL=grok-wiring.js.map

package/dist/lib/doctor/checks/integrations.js

@@ -11,7 +11,6 @@ import { ensureCognitoIdToken } from "../../../utils/cognito-session.js";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { isCompanySelectionError } from "../../../utils/company-selection-error.js";
 import { getCompanyUid } from "../../../utils/vault-api.js";
-import { redactUrlsInText } from "../../../utils/redact-url.js";
 import { fetchConnections, IntegrationsCliError } from "../../../commands/integrations-core.js";
 import { classifyConnection } from "../../integrations/health.js";
 /**
@@ -27,16 +26,6 @@ export const INTEGRATIONS_PREFIX = "integrations";
  * becoming a false connection failure. An unreadable inventory remains UNKNOWN.
  */
 export async function checkIntegrations(context, deps = {}) {
-    const results = await checkIntegrationsUnredacted(context, deps);
-    return results.map((result) => ({
-        ...result,
-        message: redactUrlsInText(result.message),
-        ...(result.remediation !== undefined
-            ? { remediation: redactUrlsInText(result.remediation) }
-            : {}),
-    }));
-}
-async function checkIntegrationsUnredacted(context, deps) {
     if (context.integrations === false) {
         return [{
                 status: "NA",