@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/doctor/checks/runtime-health.d.ts

@@ -28,6 +28,16 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 /** The id of the AI-runtime-health family. */
 export declare const RUNTIMES_FAMILY_ID = "runtimes";
+/** Common id prefix for every result this family emits. */
+export declare const RUNTIMES_PREFIX = "runtimes";
+/**
+ * The deterministic one-line probe prompt. Health is proven by a round-trip
+ * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
+ * that answers with anything at all still passes.
+ */
+export declare const PROBE_PROMPT = "Reply with exactly: OK";
+/** How long each live probe may run before it is killed and marked UNKNOWN. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 120000;
 /** One AI runtime the doctor knows how to find and probe. */
 export interface RuntimeSpec {
     /** Stable key used in check ids, e.g. `runtimes.codex.binary`. */
@@ -66,14 +76,10 @@ export interface ProbeOutcome {
 export interface RuntimeHealthDeps {
     /** Resolve an executable against PATH; null when not found. */
     resolveBinary?: (binary: string) => string | null;
-    /** Check whether a Windows command shim exists next to its resolved binary. */
-    fileExists?: (file: string) => boolean;
     /** Execute one probe. The default spawns from the OS temp dir. */
     execProbe?: (file: string, args: string[], timeoutMs: number) => Promise<ProbeOutcome>;
     /** Per-probe timeout. Default {@link DEFAULT_PROBE_TIMEOUT_MS}. */
     probeTimeoutMs?: number;
-    /** Runtime platform override for the spawn plan (normally process.platform). */
-    platform?: NodeJS.Platform;
 }
 /**
  * The AI-runtime-health check family entry. Presence checks always run; the
@@ -84,4 +90,11 @@ export interface RuntimeHealthDeps {
 export declare function checkRuntimeHealth(context: CheckContext, deps?: RuntimeHealthDeps): Promise<CheckResult[]>;
 /** The registered family object. */
 export declare const runtimeHealthFamily: CheckFamily;
+/**
+ * Resolve an executable name against PATH with a pure filesystem scan — no
+ * process is spawned, keeping the doctor's default run a function of on-disk
+ * shape. First PATH entry containing an executable regular file wins, which is
+ * exactly the copy a shell would run.
+ */
+export declare function resolveOnPath(binary: string): string | null;
 //# sourceMappingURL=runtime-health.d.ts.map

package/dist/lib/doctor/checks/runtime-health.js

@@ -29,19 +29,18 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { planCommandSpawn } from "../../../utils/windows-spawn.js";
 /** The id of the AI-runtime-health family. */
 export const RUNTIMES_FAMILY_ID = "runtimes";
 /** Common id prefix for every result this family emits. */
-const RUNTIMES_PREFIX = "runtimes";
+export const RUNTIMES_PREFIX = "runtimes";
 /**
  * The deterministic one-line probe prompt. Health is proven by a round-trip
  * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
  * that answers with anything at all still passes.
  */
-const PROBE_PROMPT = "Reply with exactly: OK";
+export const PROBE_PROMPT = "Reply with exactly: OK";
 /** How long each live probe may run before it is killed and marked UNKNOWN. */
-const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
+export const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
 /**
  * The three runtimes HQ wires hooks for. Codex runs its probe under its own
  * read-only sandbox and outside-a-repo mode so the probe can never write; the
@@ -102,8 +101,7 @@ export async function checkRuntimeHealth(context, deps = {}) {
 async function runRuntimeChecks(context, deps) {
     const resolved = {
         resolveBinary: deps.resolveBinary ?? resolveOnPath,
-        execProbe: deps.execProbe ??
-            ((file, args, timeoutMs) => defaultExecProbe(file, args, timeoutMs, deps.platform ?? process.platform, deps.fileExists ?? fs.existsSync)),
+        execProbe: deps.execProbe ?? defaultExecProbe,
         timeoutMs: deps.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,
         live: context.liveRuntimes === true,
     };
@@ -243,7 +241,7 @@ export const runtimeHealthFamily = {
  * shape. First PATH entry containing an executable regular file wins, which is
  * exactly the copy a shell would run.
  */
-function resolveOnPath(binary) {
+export function resolveOnPath(binary) {
     const pathVar = process.env.PATH ?? "";
     for (const dir of pathVar.split(path.delimiter)) {
         if (!dir)
@@ -270,22 +268,11 @@ function resolveOnPath(binary) {
  * CLI that reads piped stdin in non-TTY mode — blocks forever on a pipe that
  * never reaches EOF, which turns every probe into a timeout.
  */
-function defaultExecProbe(file, args, timeoutMs, platform, fileExists) {
+function defaultExecProbe(file, args, timeoutMs) {
     return new Promise((resolve) => {
-        const cmdSibling = `${file}.cmd`;
-        const command = platform === "win32" &&
-            !/\.(?:cmd|bat|exe|com)$/i.test(file) &&
-            fileExists(cmdSibling)
-            ? cmdSibling
-            : file;
-        const plan = planCommandSpawn(command, args, platform);
-        const child = spawn(plan.cmd, plan.args, {
+        const child = spawn(file, args, {
             cwd: os.tmpdir(),
             stdio: ["ignore", "pipe", "pipe"],
-            shell: plan.shell,
-            ...(plan.windowsVerbatimArguments === undefined
-                ? {}
-                : { windowsVerbatimArguments: plan.windowsVerbatimArguments }),
         });
         const cap = 1024 * 1024;
         let stdout = "";

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -64,8 +64,6 @@ export interface SyncManifestUploadStatus {
 }
 /** Injectable dependencies — defaults are the real collectors. */
 export interface SyncHealthDeps {
-    /** Runner log and conflict signals; omitted in unit tests of other checks. */
-    runtime?: (now: Date) => CheckResult[];
     versions: (hqRoot: string) => SyncVersionInfo;
     journals: () => readonly SyncJournalSummary[];
     now: () => Date;
@@ -93,26 +91,7 @@ export interface SyncHealthDeps {
      * scope that is fine.
      */
     unresolvedScopes?: (journals: readonly SyncJournalSummary[]) => readonly string[];
-    /**
-     * Whether a company slug has a local `companies/<slug>` directory in the HQ
-     * tree. Leftover journal shards for companies this machine does not keep
-     * locally are NA, not WARN — a journal without a tree is not a corroborated
-     * unhealthy-sync signal, and `hq doctor --fix` has nothing local to refresh.
-     */
-    localCompanyExists?: (slug: string) => boolean;
 }
-/**
- * True when `slug` is a filesystem-safe company folder name. Rejects empty
- * values, path separators, and `..` so a journal slug cannot be used to probe
- * outside `companies/`.
- */
-export declare function isSafeCompanySlug(slug: string): boolean;
-/** True when `hqRoot/companies/<slug>` exists as a directory. Never throws. */
-export declare function defaultLocalCompanyExists(hqRoot: string, slug: string): boolean;
-/** True when this journal slug names a company rather than the personal tree. */
-export declare function isCompanyJournalSlug(slug: string): boolean;
-/** Company slug from a `sync.journal.<slug>` check id, or null if not one. */
-export declare function journalSlugFromCheckId(checkId: string): string | null;
 /** The versions/sync check family. Registered in `createDefaultRegistry`. */
 export declare const syncHealthFamily: CheckFamily;
 /** Run every versions/sync check. A thrown check degrades to UNKNOWN. */

package/dist/lib/doctor/checks/sync-health.js

@@ -23,7 +23,6 @@
  * Every dependency is injectable so the family is unit-testable without an HQ
  * tree, a state dir, or the wall clock.
  */
-import { defaultSyncRuntimeResults } from "./sync-runtime.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 // Namespace import, deliberately: hq-cloud is an ESM package, so a static
@@ -48,36 +47,14 @@ export const STALE_JOURNAL_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
 /** The offline update cache written by the check-hq-update SessionStart hook. */
 export const UPDATE_CACHE_RELPATH = path.join("workspace", ".hq-update-check", "last-check.json");
 /** Fill in the optional dependencies so call sites never branch on undefined. */
-function withDefaults(deps, hqRoot) {
+function withDefaults(deps) {
     return {
         ...deps,
-        runtime: deps.runtime ?? (() => []),
         manifestStatuses: deps.manifestStatuses ?? defaultManifestStatuses,
         manifestAvailable: deps.manifestAvailable ?? (() => loadManifestExports() !== null),
         unresolvedScopes: deps.unresolvedScopes ?? defaultUnresolvedScopes,
-        localCompanyExists: deps.localCompanyExists ??
-            ((slug) => defaultLocalCompanyExists(hqRoot, slug)),
     };
 }
-/**
- * True when `slug` is a filesystem-safe company folder name. Rejects empty
- * values, path separators, and `..` so a journal slug cannot be used to probe
- * outside `companies/`.
- */
-export function isSafeCompanySlug(slug) {
-    return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(slug);
-}
-/** True when `hqRoot/companies/<slug>` exists as a directory. Never throws. */
-export function defaultLocalCompanyExists(hqRoot, slug) {
-    if (!isSafeCompanySlug(slug))
-        return false;
-    try {
-        return fs.statSync(path.join(hqRoot, "companies", slug)).isDirectory();
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Company journal shards are unresolvable by the default collector: the
  * snapshot store keys company scopes by `companyUid`, which `listJournals()`
@@ -120,7 +97,6 @@ const DEFAULT_DEPS = {
     journals: () => hqCloud.listJournals(),
     now: () => new Date(),
     manifestStatuses: defaultManifestStatuses,
-    runtime: defaultSyncRuntimeResults,
 };
 /**
  * Map the machine's journal shards onto the manifest scopes hq-cloud keys its
@@ -170,15 +146,6 @@ const NON_COMPANY_JOURNAL_SLUGS = new Set([
     PERSONAL_SCOPE_SLUG,
     PERSONAL_VAULT_SCOPE_SLUG,
 ]);
-/** True when this journal slug names a company rather than the personal tree. */
-export function isCompanyJournalSlug(slug) {
-    return !NON_COMPANY_JOURNAL_SLUGS.has(slug);
-}
-/** Company slug from a `sync.journal.<slug>` check id, or null if not one. */
-export function journalSlugFromCheckId(checkId) {
-    const match = /^sync\.journal\.(.+)$/.exec(checkId);
-    return match ? match[1] : null;
-}
 /** The versions/sync check family. Registered in `createDefaultRegistry`. */
 export const syncHealthFamily = {
     id: SYNC_FAMILY_ID,
@@ -187,13 +154,12 @@ export const syncHealthFamily = {
 };
 /** Run every versions/sync check. A thrown check degrades to UNKNOWN. */
 export function checkSyncHealth(context, rawDeps = DEFAULT_DEPS) {
-    const deps = withDefaults(rawDeps, context.hqRoot);
+    const deps = withDefaults(rawDeps);
     try {
         return [
             ...versionResults(context, deps),
             ...updateAvailabilityResult(context, deps),
             ...journalAndManifestResults(deps),
-            ...deps.runtime(deps.now()),
         ];
     }
     catch (error) {
@@ -227,7 +193,6 @@ function versionResults(context, deps) {
         results.push({
             status: "WARN",
             checkId: "sync.versions.core",
-            reasonCode: "core-version-unavailable",
             target: path.join(context.hqRoot, "core", "core.yaml"),
             message: "hq-core version could not be read from core/core.yaml — the scaffold may be missing or pre-v12.",
             remediation: "Run /update-hq to (re)install the hq-core scaffold.",
@@ -287,7 +252,6 @@ function updateAvailabilityResult(context, deps) {
             {
                 status: "WARN",
                 checkId: "sync.update.core",
-                reasonCode: "core-update-available",
                 message: `hq-core update available: local v${core}, latest v${latest}.`,
                 remediation: "Run /update-hq in a fresh session to upgrade.",
             },
@@ -361,35 +325,10 @@ function journalResults(deps, journals) {
     return journals.map((entry) => {
         const lastSync = entry.journal?.lastSync;
         const checkId = `sync.journal.${entry.slug}`;
-        // A company journal without a local tree is leftover membership state,
-        // not a live sync target. WARN would make `hq doctor --fix` look like it
-        // failed to repair something it was never going to touch (US-015 health
-        // hook files remaining FAIL/WARN after the safe repair pass).
-        if (isCompanyJournalSlug(entry.slug)) {
-            let local;
-            try {
-                local = deps.localCompanyExists(entry.slug);
-            }
-            catch {
-                // Existence probe failed: fall through to the staleness check rather
-                // than hiding a possibly-live company behind NA.
-                local = true;
-            }
-            if (!local) {
-                return {
-                    status: "NA",
-                    checkId,
-                    reasonCode: "no-local-tree",
-                    target: entry.path,
-                    message: `Sync journal '${entry.slug}' is unused on this machine — there is no companies/${entry.slug} directory, so this journal is not a live sync target.`,
-                };
-            }
-        }
         if (typeof lastSync !== "string" || lastSync.length === 0) {
             return {
                 status: "WARN",
                 checkId,
-                reasonCode: "never-synced",
                 target: entry.path,
                 message: `Sync journal '${entry.slug}' exists but has never recorded a successful sync.`,
                 remediation: "Run /hq-sync (or `hq sync`) to complete a first sync.",
@@ -400,7 +339,6 @@ function journalResults(deps, journals) {
             return {
                 status: "UNKNOWN",
                 checkId,
-                reasonCode: "invalid-last-sync",
                 target: entry.path,
                 message: `Sync journal '${entry.slug}' has an unparseable lastSync (${lastSync}).`,
             };
@@ -411,7 +349,6 @@ function journalResults(deps, journals) {
             return {
                 status: "WARN",
                 checkId,
-                reasonCode: "stale-threshold",
                 target: entry.path,
                 message: `Sync journal '${entry.slug}' is stale: last successful sync ${days} day${days === 1 ? "" : "s"} ago (${lastSync}).`,
                 remediation: "Run /hq-sync (or `hq sync`) and check the sync runner.",
@@ -453,7 +390,6 @@ function manifestResults(deps, journals) {
             {
                 status: "NA",
                 checkId: "sync.manifest",
-                reasonCode: "manifest-unavailable",
                 message: `${MANIFEST_UNAVAILABLE_REASON} — upgrade hq-cloud to audit manifest uploads.`,
             },
         ];
@@ -467,7 +403,6 @@ function manifestResults(deps, journals) {
             {
                 status: "UNKNOWN",
                 checkId: "sync.manifest",
-                reasonCode: "manifest-state-unavailable",
                 message: `Manifest upload state could not be read: ${error instanceof Error ? error.message : String(error)}`,
                 remediation: "Check that the HQ state directory is readable, then re-run `hq doctor`.",
             },
@@ -481,7 +416,6 @@ function manifestResults(deps, journals) {
             {
                 status: "NA",
                 checkId: "sync.manifest",
-                reasonCode: "no-manifest-scopes",
                 message: "No manifest-auditable sync scopes on this machine — nothing to reconcile.",
             },
         ];
@@ -493,7 +427,6 @@ function manifestResults(deps, journals) {
             return {
                 status: "UNTESTED",
                 checkId,
-                reasonCode: "never-uploaded",
                 message: `Scope '${entry.scopeKey}' has never uploaded a sync manifest — expected until the first pass runs.`,
                 remediation: "Run `hq sync manifest` to upload one now.",
             };
@@ -503,7 +436,6 @@ function manifestResults(deps, journals) {
             return {
                 status: "UNKNOWN",
                 checkId,
-                reasonCode: "invalid-upload-time",
                 message: `Scope '${entry.scopeKey}' has an unparseable last manifest upload time (${entry.lastUploadAt}).`,
             };
         }
@@ -516,7 +448,6 @@ function manifestResults(deps, journals) {
             return {
                 status: "WARN",
                 checkId,
-                reasonCode: "stale-threshold",
                 message: `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt}) — the daily audit pass is not running.`,
                 remediation: "Run `hq sync manifest` and check HQ_SYNC_MANIFEST_DISABLED and the sync runner.",
             };
@@ -548,7 +479,6 @@ function unresolvedResults(deps, journals) {
     return slugs.map((slug) => ({
         status: "UNTESTED",
         checkId: `sync.manifest.unresolved.${slug}`,
-        reasonCode: "unresolved-company-uid",
         message: `Company scope '${slug}' has a sync journal but its companyUid could not be resolved locally — its manifest uploads were not checked.`,
         remediation: `Run \`hq sync manifest --scope ${slug}\` to audit it explicitly.`,
     }));

package/dist/lib/doctor/checks/work-context.js

@@ -6,11 +6,10 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { readDeviceConfig, } from "../../work-context/config.js";
+import { readDeviceConfig, getDefaultCompany, } from "../../work-context/config.js";
 import { outboxStats, listOutboxOperations } from "../../work-context/outbox.js";
-import { outboxQuarantineStatusEnabled } from "../../work-context/outbox-quarantine-status-flag.js";
 import { workContextRoot, workContextSessionsDir } from "../../work-context/paths.js";
-import { countDistinctHeldEvents, countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
+import { countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../../mesh/live/paths.js";
 import { collectDaemonDoctor, formatDaemonDoctor, } from "../../mesh/live/daemon/doctor.js";
 export const WORK_CONTEXT_FAMILY_ID = "work-context";
@@ -88,21 +87,16 @@ function runChecks(deps) {
         target: path.join(root, "outbox"),
         message: `Outbox queued depth=${stats.depth} (acked=${stats.acked}).`,
     });
-    const showQuarantineReason = stats.quarantined > 0 && outboxQuarantineStatusEnabled();
     results.push({
         status: stats.quarantined > 0 ? "WARN" : "PASS",
         checkId: "work-context.outbox-quarantined",
         target: path.join(root, "outbox"),
-        message: `Outbox quarantined count=${stats.quarantined}${showQuarantineReason
-            ? ` (last reason=${stats.lastQuarantineReason ?? "unknown"})`
-            : ""}.`,
+        message: `Outbox quarantined count=${stats.quarantined}.`,
     });
     // Default-company mode + migration capability (US-017B)
     try {
         const cfg = readDeviceConfig({ root });
-        const def = cfg.defaultCompany?.enabled && cfg.defaultCompany.slug
-            ? cfg.defaultCompany
-            : null;
+        const def = getDefaultCompany({ root });
         const mode = def?.enabled
             ? `enabled slug=${def.slug}`
             : "disabled (dark / unset)";
@@ -139,7 +133,7 @@ function runChecks(deps) {
     const heldPath = workMeshHeldPath(meshRoot);
     const deadLetterPath = workMeshDeadLetterPath(meshRoot);
     const spoolDepth = countJsonlLines(spoolPath);
-    const heldDepth = countDistinctHeldEvents(heldPath);
+    const heldDepth = countJsonlLines(heldPath);
     results.push({
         status: "PASS",
         checkId: "work-context.spool-depth",
@@ -184,7 +178,7 @@ function formatMigrationCapabilityCheck(cap, root) {
             status: "WARN",
             checkId: "work-context.migration-capability",
             target,
-            message: `Migration capability: offline at ${cap.checkedAt}; selected-company membership is still verified when setting a default.`,
+            message: `Migration capability: offline at ${cap.checkedAt}; default-company stays locked.`,
         };
     }
     const falseCount = cap.companies.filter((c) => !c.migration).length;

package/dist/lib/doctor/compat.d.ts

@@ -31,6 +31,22 @@ import type { DoctorJsonDocument } from "./json-output.js";
 export declare const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export declare const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
+/** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
+export declare const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
+/** The runtime-probe result id: whether hooks actually fired (the ledger). */
+export declare const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
+/**
+ * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
+ * load* scope — the subset of the hooks family the wrapper is allowed to fail
+ * on. Deliberately narrow: it covers a missing/invalid settings file, an
+ * unquoted `$CLAUDE_PROJECT_DIR` that word-splits on a spaced root, and a hook
+ * command that runs a script which is not on disk — and nothing else. The many
+ * richer doctor findings (executable bits, orphaned scripts, three-profile
+ * membership, Codex/Grok parity, fixture coverage) are intentionally OUT of
+ * scope, so the wrapper stays byte-for-byte compatible with callers that only
+ * ever cared whether the hook configuration could load.
+ */
+export declare const CHECK_HQ_HOOKS_SETTINGS_SCOPE: readonly string[];
 /**
  * Whether hook dispatch was observed this session. Mirrors the wrapper's
  * `HQ runtime enforcement: …` line. `NOT CHECKED` is the default when

package/dist/lib/doctor/compat.js

@@ -31,9 +31,9 @@ export const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
 /** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
-const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
+export const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
 /** The runtime-probe result id: whether hooks actually fired (the ledger). */
-const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
+export const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
 /**
  * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
  * load* scope — the subset of the hooks family the wrapper is allowed to fail
@@ -45,9 +45,8 @@ const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
  * scope, so the wrapper stays byte-for-byte compatible with callers that only
  * ever cared whether the hook configuration could load.
  */
-const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
+export const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
     "hooks.settings-present",
-    "hooks.settings-required-command-hooks",
     "hooks.settings-valid-json",
     "hooks.claude.settings-local-valid-json",
     "hooks.claude.unquoted-project-dir",

package/dist/lib/doctor/deep/effects.js

@@ -36,7 +36,6 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { isRecord } from "../shared.js";
 /**
  * Parse a fixture case's `effects:` field into a list of {@link
  * EffectExpectation}. Returns the list, or an error string naming what was
@@ -224,4 +223,7 @@ function hashFile(abs) {
         return null;
     }
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=effects.js.map

package/dist/lib/doctor/deep/executor.d.ts

@@ -55,7 +55,7 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 10000;
  */
 export declare const SANDBOX_COPY_RELPATHS: readonly string[];
 /** One gate execution's inputs. */
-interface GateRunInput {
+export interface GateRunInput {
     /** Absolute path to the sandboxed `hook-gate.sh`. */
     gatePath: string;
     /** Absolute path to the sandboxed hook script the gate delegates to. */
@@ -72,7 +72,7 @@ interface GateRunInput {
     timeoutMs: number;
 }
 /** One gate execution's observed outcome. */
-interface GateRunResult {
+export interface GateRunResult {
     /** True when the execution exceeded {@link GateRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Gate exit code, or null when it did not exit normally (timeout/signal). */
@@ -81,7 +81,14 @@ interface GateRunResult {
     stderr: string;
 }
 /** Executes one gate invocation. Injectable so the aggregation is unit-testable. */
-type GateRunner = (input: GateRunInput) => GateRunResult;
+export type GateRunner = (input: GateRunInput) => GateRunResult;
+/**
+ * The real runner: spawn `bash hook-gate.sh <id> <script>` with the payload on
+ * stdin, `HQ_HOOK_PROFILE` set, and a hard timeout. A timeout is detected by the
+ * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
+ * a hook cannot ignore the bound.
+ */
+export declare const defaultGateRunner: GateRunner;
 /** Options for {@link runDeepGuardTests}. All are injectable for testing. */
 export interface DeepTestOptions {
     /** Per-case time bound. Default: {@link DEFAULT_PER_CASE_TIMEOUT_MS}. */
@@ -102,5 +109,4 @@ export declare function cleanupAllDeepSandboxes(): void;
  * an empty list — creating no sandbox — when there is nothing to run.
  */
 export declare function runDeepGuardTests(context: CheckContext, options?: DeepTestOptions): Promise<CheckResult[]>;
-export {};
 //# sourceMappingURL=executor.d.ts.map

package/dist/lib/doctor/deep/executor.js

@@ -74,7 +74,7 @@ export const SANDBOX_COPY_RELPATHS = [
  * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
  * a hook cannot ignore the bound.
  */
-const defaultGateRunner = (input) => {
+export const defaultGateRunner = (input) => {
     const result = spawnSync("bash", [input.gatePath, input.hookId, input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,

package/dist/lib/doctor/deep/parity.d.ts

@@ -46,6 +46,14 @@ import { type PlatformId } from "../payload-shapes.js";
 export declare const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export declare const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
+/** Default per-case, per-platform time bound. */
+export declare const DEFAULT_PARITY_TIMEOUT_MS = 10000;
+/** The gate profile the replay runs each hook under. Strict is the broadest
+ * allowlist, so profile gating never suppresses the hook whose LOGIC is being
+ * compared across platforms — profile-specific behaviour is US-008's concern. */
+export declare const PARITY_GATE_PROFILE = "strict";
+/** The session id stamped onto every replay payload. */
+export declare const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 /** One platform replay's inputs. */
 export interface PlatformRunInput {
     /** Which platform's adapter path to exercise. */
@@ -77,7 +85,27 @@ export interface PlatformRunOutput {
 /** Executes one platform replay. Injectable so the comparison is unit-testable. */
 export type PlatformRunner = (input: PlatformRunInput) => PlatformRunOutput;
 /** The real runner set, keyed by platform. */
-type PlatformRunners = Record<PlatformId, PlatformRunner>;
+export type PlatformRunners = Record<PlatformId, PlatformRunner>;
+/** The real Claude runner: the canonical script through the Claude gate. */
+export declare const defaultClaudeRunner: PlatformRunner;
+/** The real Codex runner: the duplicated mirror through the Codex gate. */
+export declare const defaultCodexRunner: PlatformRunner;
+/**
+ * The real Grok runner. Grok shares the canonical `.claude/hooks/` scripts with
+ * Claude — it has no mirror of its own — and its adapter's whole job is to read
+ * the camelCase payload, map the tool alias back to canonical, build the Claude
+ * JSON, and pipe it to the same `hook-gate.sh`. We reproduce that routing here
+ * (via {@link toGrokPayload} + {@link grokToSnakePayload}) rather than spawn the
+ * adapter directly, for two reasons: the live adapter runs a whole tool
+ * *sequence* where the replay needs one isolated hook, and its user-global
+ * bridge cannot be simulated from a project-local run (US-005 keeps bridge
+ * presence a wiring check). The Grok block protocol still applies — the gate's
+ * non-zero exit is what the adapter would translate into a stdout `deny`
+ * ({@link interpretGrokBlock} in verdictFor recognises both).
+ */
+export declare const defaultGrokRunner: PlatformRunner;
+/** The default real runner set wired to each platform's real adapter path. */
+export declare const defaultPlatformRunners: PlatformRunners;
 /** Options for {@link runParityReplay}. All injectable for testing. */
 export interface ParityOptions {
     /** Per-case, per-platform time bound. Default: {@link DEFAULT_PARITY_TIMEOUT_MS}. */
@@ -98,5 +126,4 @@ export declare function cleanupAllParitySandboxes(): void;
  * empty list — creating no sandbox — when there is nothing to replay.
  */
 export declare function runParityReplay(context: CheckContext, options?: ParityOptions): Promise<CheckResult[]>;
-export {};
 //# sourceMappingURL=parity.d.ts.map

package/dist/lib/doctor/deep/parity.js

@@ -52,13 +52,13 @@ export const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
 /** Default per-case, per-platform time bound. */
-const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
+export const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
 /** The gate profile the replay runs each hook under. Strict is the broadest
  * allowlist, so profile gating never suppresses the hook whose LOGIC is being
  * compared across platforms — profile-specific behaviour is US-008's concern. */
-const PARITY_GATE_PROFILE = "strict";
+export const PARITY_GATE_PROFILE = "strict";
 /** The session id stamped onto every replay payload. */
-const PARITY_SESSION_ID = "hq-doctor-parity-replay";
+export const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 function spawnWithStdin(command, args, stdin, input) {
     const result = spawnSync(command, args, {
         input: stdin,
@@ -96,12 +96,12 @@ function runThroughGate(input, platformDir, payload) {
     return { ...spawned };
 }
 /** The real Claude runner: the canonical script through the Claude gate. */
-const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
+export const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
 /** The real Codex runner: the duplicated mirror through the Codex gate. */
-const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
+export const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
@@ -118,7 +118,7 @@ const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.strin
  * non-zero exit is what the adapter would translate into a stdout `deny`
  * ({@link interpretGrokBlock} in verdictFor recognises both).
  */
-const defaultGrokRunner = (input) => {
+export const defaultGrokRunner = (input) => {
     const grokPayload = toGrokPayload(input.testCase, {
         cwd: input.sandbox,
         sessionId: PARITY_SESSION_ID,
@@ -127,7 +127,7 @@ const defaultGrokRunner = (input) => {
     return runThroughGate(input, ".claude", JSON.stringify(snake));
 };
 /** The default real runner set wired to each platform's real adapter path. */
-const defaultPlatformRunners = {
+export const defaultPlatformRunners = {
     claude: defaultClaudeRunner,
     codex: defaultCodexRunner,
     grok: defaultGrokRunner,