@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/doctor/deep/sandbox.d.ts

@@ -46,10 +46,21 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 15000;
  * come under sandboxed execution.
  */
 export type Precondition = "git-repo" | "session-metadata" | "company-scaffold";
+/** Every precondition the default seeder knows how to provide. */
+export declare const KNOWN_PRECONDITIONS: readonly Precondition[];
+/**
+ * Tree entries copied from the live tree into every sandbox — the same curated
+ * set US-008 uses: the hook scripts and gate, the settings a hook may read, the
+ * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
+ * skipped so a partial tree still sandboxes cleanly.
+ */
+export declare const SANDBOX_SEED_RELPATHS: readonly string[];
 /** Remove every side-effect sandbox still on disk. Safe to call repeatedly. */
 export declare function cleanupAllSandboxes(): void;
 /** The sandbox roots this process is still tracking (for tests). */
 export declare function trackedSandboxRoots(): string[];
+/** Remove one sandbox and stop tracking it. Idempotent. */
+export declare function destroySandbox(root: string): void;
 /** The outcome of seeding one sandbox. */
 export interface SeedResult {
     /** Absolute, realpath'd sandbox root under the OS temp dir. */
@@ -80,7 +91,7 @@ export interface SeedOptions {
  */
 export declare function seedSandbox(hqRoot: string, opts?: SeedOptions): SeedResult;
 /** One hook execution's inputs. */
-interface HookRunInput {
+export interface HookRunInput {
     /** Absolute path to the sandboxed hook script. */
     hookScriptPath: string;
     /** The JSON payload piped to the hook's stdin. */
@@ -93,7 +104,7 @@ interface HookRunInput {
     timeoutMs: number;
 }
 /** One hook execution's observed result (exit code is diagnostic only). */
-interface HookRunResult {
+export interface HookRunResult {
     /** True when the execution exceeded {@link HookRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Exit code, or null when it did not exit normally (timeout/signal). */
@@ -102,9 +113,17 @@ interface HookRunResult {
     stderr: string;
 }
 /** Runs one hook. Injectable so the tier's aggregation is unit-testable. */
-type HookRunner = (input: HookRunInput) => HookRunResult;
+export type HookRunner = (input: HookRunInput) => HookRunResult;
+/**
+ * The real runner: fire the hook script directly with the payload on stdin, its
+ * cwd and session env pointed at the sandbox, and a hard timeout. Unlike a pure
+ * guard (US-008), a side-effecting hook is run directly rather than through the
+ * gate — its exit code is irrelevant here; what matters is the effect it leaves
+ * on the sandbox, which effects.ts reads afterwards.
+ */
+export declare const defaultHookRunner: HookRunner;
 /** One parsed side-effecting fixture case (its own shape, not the US-007 schema). */
-interface SideEffectCase {
+export interface SideEffectCase {
     name: string;
     event: string;
     tool: string;
@@ -117,13 +136,13 @@ interface SideEffectCase {
     expectedFailure?: ExpectedFailure;
 }
 /** A validated side-effecting fixture. */
-interface SideEffectFixture {
+export interface SideEffectFixture {
     hookId: string;
     relpath: string;
     cases: SideEffectCase[];
 }
 /** A side-effecting fixture that could not be parsed. */
-interface SideEffectFixtureError {
+export interface SideEffectFixtureError {
     hookId: string | null;
     relpath: string;
     message: string;
@@ -168,5 +187,4 @@ export interface SideEffectTestOptions {
  * Returns an empty list when there is nothing side-effecting to run.
  */
 export declare function runSideEffectTests(context: CheckContext, options?: SideEffectTestOptions): Promise<CheckResult[]>;
-export {};
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/lib/doctor/deep/sandbox.js

@@ -39,7 +39,6 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as yaml from "js-yaml";
-import { isRecord } from "../shared.js";
 import { classifyCaseStatus, looksLikeFixture, } from "../fixtures/schema.js";
 import { HOOK_TESTS_RELDIR, registeredHookIds } from "../fixtures/discover.js";
 import { isSideEffectingHookId } from "./classify.js";
@@ -47,7 +46,7 @@ import { captureEffectBaseline, describeEffect, defaultGitProbe, evaluateEffects
 /** Default per-case time bound. No latency target, but no case may hang. */
 export const DEFAULT_PER_CASE_TIMEOUT_MS = 15_000;
 /** Every precondition the default seeder knows how to provide. */
-const KNOWN_PRECONDITIONS = [
+export const KNOWN_PRECONDITIONS = [
     "git-repo",
     "session-metadata",
     "company-scaffold",
@@ -58,7 +57,7 @@ const KNOWN_PRECONDITIONS = [
  * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
  * skipped so a partial tree still sandboxes cleanly.
  */
-const SANDBOX_SEED_RELPATHS = [
+export const SANDBOX_SEED_RELPATHS = [
     ".claude/hooks",
     ".claude/settings.json",
     ".claude/settings.local.json",
@@ -101,7 +100,7 @@ function removeTree(root) {
     }
 }
 /** Remove one sandbox and stop tracking it. Idempotent. */
-function destroySandbox(root) {
+export function destroySandbox(root) {
     removeTree(root);
     trackedSandboxes.delete(root);
 }
@@ -199,7 +198,7 @@ function git(root, args) {
  * gate — its exit code is irrelevant here; what matters is the effect it leaves
  * on the sandbox, which effects.ts reads afterwards.
  */
-const defaultHookRunner = (input) => {
+export const defaultHookRunner = (input) => {
     const result = spawnSync("bash", [input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,
@@ -567,4 +566,7 @@ function oneLine(text) {
     const collapsed = text.replace(/\s+/g, " ").trim();
     return collapsed.length > 200 ? `${collapsed.slice(0, 197)}…` : collapsed;
 }
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //# sourceMappingURL=sandbox.js.map

package/dist/lib/doctor/fix/apply.d.ts

@@ -8,13 +8,11 @@
  *      `.claude/`, `.codex/`, or `.grok/`, `--fix` refuses and exits non-zero
  *      unless `--force`, so a repair can never be tangled up with unrelated
  *      in-flight edits to the security layer.
- *   2. Allowlist only. It repairs the classified safe classes — restore an
- *      execute bit, add a hook id to the gate profiles it is missing from,
- *      re-register a script present on disk, or pull a company whose local
- *      tree exists but whose journal is stale — and NEVER rewrites a hook body
- *      or deletes a file. Classification is owned by {@link deriveRemediation};
- *      a content-drift finding is manual-only and simply never appears in the
- *      fixable set.
+ *   2. Allowlist only. It repairs exactly three classes — restore an execute
+ *      bit, add a hook id to the gate profiles it is missing from, re-register a
+ *      script present on disk — and NEVER rewrites a hook body or deletes a file.
+ *      Classification is owned by {@link deriveRemediation}; a content-drift
+ *      finding is manual-only and simply never appears in the fixable set.
  *   3. Preview + confirmation. Every change is shown diff-style and requires
  *      confirmation, with `--yes` for non-interactive use.
  *   4. Backup first. Before any write, the affected files are copied under
@@ -28,10 +26,9 @@
  * (the command resolves it once), keeping this module decoupled from the CLI and
  * trivially testable against a fake tree.
  */
-import type { CheckResult, DoctorStatus } from "../types.js";
+import type { DoctorStatus } from "../types.js";
 import { type GateProfile } from "../hook-gate-profiles.js";
 import { type FixClass } from "./remediation.js";
-import { type RefreshSyncOutcome } from "./refresh-sync-outcome.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export declare const HOOK_CONFIG_DIRS: readonly [".claude", ".codex", ".grok"];
 /** Options for {@link applyFixes}. Everything is injectable for hermetic tests. */
@@ -59,50 +56,9 @@ export interface ApplyFixesOptions {
      * [] when clean or not a git repo. Default shells out to `git status`.
      */
     dirtyCheck?: (hqRoot: string) => string[];
-    /**
-     * Check runner used to collect findings and to re-verify after applying.
-     * Default runs the real registry. Tests inject a fake list so refresh-sync
-     * does not depend on the machine's live journal store.
-     */
-    runChecks?: (hqRoot: string) => Promise<CheckResult[]>;
-    /**
-     * Targeted pull used by the `refresh-sync` class. Default shells out to
-     * `hq sync pull --company <slug> --on-conflict keep`. Tests inject a stub
-     * so `--fix` never hits the network.
-     */
-    refreshSync?: (target: RefreshSyncTarget) => Promise<RefreshSyncResult>;
-    /**
-     * File-only rewrite used by the `bot-node-path` class. Default rewrites
-     * ~/Library/LaunchAgents/ai.getindigo.hq-bot.<name>.plist and never calls
-     * launchctl. Tests inject a stub.
-     */
-    rewriteBotNodePath?: (name: string) => {
-        from: string;
-        to: string;
-    } | null;
 }
-/** One company the `refresh-sync` class will pull. */
-export interface RefreshSyncTarget {
-    /** Company slug from the `sync.journal.<slug>` check id. */
-    slug: string;
-    /** HQ root the pull writes into. */
-    hqRoot: string;
-}
-/** Outcome of one {@link ApplyFixesOptions.refreshSync} call. */
-export interface RefreshSyncResult {
-    /** Whether the pull exited 0. */
-    ok: boolean;
-    /** Closed enum for machine-readable client-health diagnostics. */
-    outcome: RefreshSyncOutcome;
-    /** One-line summary for the post-fix report. */
-    message: string;
-}
-/** Per-company bound for the default `hq sync pull` repair. */
-export declare const REFRESH_SYNC_TIMEOUT_MS = 90000;
 /** One applied (or attempted) repair, with its post-fix re-check status. */
 export interface AppliedFix {
-    /** One-based repair pass in this `hq doctor --fix` invocation. */
-    pass: number;
     /** The check id of the finding that was repaired. */
     checkId: string;
     /** The safe class applied. */
@@ -113,27 +69,14 @@ export interface AppliedFix {
     summary: string;
     /** The status of the re-run check for this target, or null if not found. */
     postStatus: DoctorStatus | null;
-    /** Present for refresh-sync plans; contains no command output or path data. */
-    refreshSyncOutcome?: RefreshSyncOutcome;
 }
-/** Backup and restore information for one pass that wrote files. */
-export interface AppliedFixBackup {
-    /** One-based repair pass that created this backup. */
-    pass: number;
-    /** Absolute path of the backup directory. */
-    backupDir: string;
-    /** Command that restores this pass's pre-write files. */
-    restoreCommand: string;
-}
-/** A newly unlocked safe repair can be picked up for at most this many passes. */
-export declare const MAX_FIX_PASSES = 3;
 /** The outcome of an {@link applyFixes} run. */
 export interface ApplyFixesResult {
-    /** 0 on success, decline, or a clean no-op; 1 when a dirty tree is refused. */
+    /** 0 on success or a clean no-op; 1 when the run was refused. */
     exitCode: number;
     /** Whether any file was written. */
     wrote: boolean;
-    /** Why no further repairs were applied, when the run stopped early. */
+    /** Why the run wrote nothing, when it did not: refusal reason or null. */
     refused: "dirty-tree" | "declined" | null;
     /** How many findings were auto-fixable. */
     fixableCount: number;
@@ -141,8 +84,6 @@ export interface ApplyFixesResult {
     backupDir: string | null;
     /** The restore command, or null when nothing was written. */
     restoreCommand: string | null;
-    /** Every backup made, in pass order. */
-    backups: AppliedFixBackup[];
     /** The applied repairs with their post-fix status. */
     applied: AppliedFix[];
 }
@@ -153,13 +94,6 @@ export interface ApplyFixesResult {
  * assert on it.
  */
 export declare function applyFixes(options: ApplyFixesOptions): Promise<ApplyFixesResult>;
-/**
- * Default `refresh-sync` repair: a bounded, pull-only, keep-conflicts
- * `hq sync pull --company <slug>` against the tree `--fix` is repairing.
- * Never a push, never interactive. A timeout or non-zero exit is reported
- * rather than thrown so later plans still run.
- */
-export declare function defaultRefreshSync(target: RefreshSyncTarget): Promise<RefreshSyncResult>;
 /**
  * The uncommitted changes under {@link HOOK_CONFIG_DIRS}, one porcelain line
  * each. Returns [] when the tree is clean OR when `hqRoot` is not a git repo
@@ -167,11 +101,6 @@ export declare function defaultRefreshSync(target: RefreshSyncTarget): Promise<R
  * the backup still covers the write.
  */
 export declare function uncommittedHookConfigChanges(hqRoot: string): string[];
-/** Default `bot-node-path` repair against the real bot state and LaunchAgents. */
-export declare function defaultRewriteBotNodePath(name: string): {
-    from: string;
-    to: string;
-} | null;
 /**
  * Insert a new `case` arm allowlisting `hookId` (leading to `return 0`) at the
  * top of each named profile function's `case "$1" in` block. Additive: it never