@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/doctor/checks/sync-runtime.js

@@ -1,216 +0,0 @@
-/**
- * Sync runtime checks: problems visible only in the running sync runner's log
- * (realtime lag, receiver permission errors, restart loops, device-limit
- * backoff) plus the conflict counter the desktop app keeps in client health.
- *
- * Results carry only a closed reason code and counts. Log content (paths,
- * tenant ids, AWS error prose) never leaves this module.
- */
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { currentSyncLogFamily, SYNC_LOG_GENERATIONS, syncLogBasePaths, syncLogGenerationPath, } from "../../../utils/sync-log-sources.js";
-export const SYNC_RUNTIME_WINDOW_MS = 60 * 60_000;
-const LAG_SECONDS = 15 * 60;
-const LAG_MIN_RECEIPTS = 3;
-const RESTART_MIN_STARTS = 4;
-const CONFLICT_MIN_COUNT = 5;
-const LOG_TAIL_BYTES = 8 * 1024 * 1024;
-const TIMESTAMP = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z)\s/;
-const PERMISSION = /AccessDenied|not authorized to perform|\b403\b/;
-const DEVICE_LIMIT = /sync device limit exceeded|"sync_device_limit"/;
-function parseRecord(rest) {
-    const start = rest.indexOf("{");
-    if (start < 0)
-        return null;
-    try {
-        const value = JSON.parse(rest.slice(start));
-        return value !== null && typeof value === "object" && !Array.isArray(value)
-            ? value
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-function timestampFromRecord(record) {
-    if (!record)
-        return null;
-    for (const key of ["time", "timestamp", "ts"]) {
-        const value = record[key];
-        if (typeof value === "number" && Number.isFinite(value)) {
-            const millis = value < 100_000_000_000 ? value * 1000 : value;
-            if (Number.isFinite(millis))
-                return millis;
-        }
-        if (typeof value === "string") {
-            const parsed = Date.parse(value);
-            if (Number.isFinite(parsed))
-                return parsed;
-        }
-    }
-    return null;
-}
-function lineTimestamp(line) {
-    const stamp = TIMESTAMP.exec(line);
-    if (stamp) {
-        const parsed = Date.parse(stamp[1]);
-        return Number.isFinite(parsed) ? parsed : null;
-    }
-    return timestampFromRecord(parseRecord(line));
-}
-/** Classify the last hour of sync log lines into privacy-safe results. */
-export function analyzeSyncRuntimeLog(lines, options) {
-    const since = options.now - SYNC_RUNTIME_WINDOW_MS;
-    let slowReceipts = 0;
-    let denied = 0;
-    let starts = 0;
-    let deviceLimited = 0;
-    for (const line of lines) {
-        const time = lineTimestamp(line);
-        if (time === null)
-            continue;
-        if (!Number.isFinite(time) || time < since || time > options.now)
-            continue;
-        const stamp = TIMESTAMP.exec(line);
-        const rest = stamp ? line.slice(stamp[0].length) : line;
-        if (DEVICE_LIMIT.test(rest))
-            deviceLimited += 1;
-        const record = parseRecord(rest);
-        if (!record)
-            continue;
-        const event = record.event;
-        if (event === "fanout.receive") {
-            const latency = record.latencySeconds;
-            if (typeof latency === "number" && latency > LAG_SECONDS)
-                slowReceipts += 1;
-        }
-        else if (event === "receiver.start") {
-            starts += 1;
-        }
-        if ((record.type === "receiver" || record.type === "error" ||
-            (typeof event === "string" && event.startsWith("receiver."))) &&
-            PERMISSION.test(JSON.stringify(record.err ?? record.message ?? ""))) {
-            denied += 1;
-        }
-    }
-    const conflicts = options.conflictCount ?? 0;
-    const checks = [
-        { id: "realtime-lag", reasonCode: "realtime-lag-stuck", failing: slowReceipts >= LAG_MIN_RECEIPTS, count: slowReceipts, label: "incoming changes delayed over 15 minutes" },
-        { id: "receiver-permission", reasonCode: "receiver-permission-denied", failing: denied > 0, count: denied, label: "cloud permission refusals" },
-        { id: "runner-restarts", reasonCode: "runner-restart-loop", failing: starts >= RESTART_MIN_STARTS, count: starts, label: "sync runner starts" },
-        { id: "device-limit", reasonCode: "device-limit-backoff", failing: deviceLimited > 0, count: deviceLimited, label: "device-limit backoffs" },
-        { id: "conflicts", reasonCode: "repeated-conflicts", failing: conflicts >= CONFLICT_MIN_COUNT, count: conflicts, label: "unresolved conflicts" },
-    ];
-    return checks.map((check) => check.failing
-        ? {
-            status: "WARN",
-            checkId: `sync.runtime.${check.id}`,
-            reasonCode: check.reasonCode,
-            message: `${check.count} ${check.label} in the last hour.`,
-            remediation: "Run `hq sync status` and inspect the selected sync log under ~/.hq/logs/, ~/.hq/daemon/logs/, or the configured HQ_DAEMON_DIR/logs/.",
-        }
-        : {
-            status: "PASS",
-            checkId: `sync.runtime.${check.id}`,
-            message: `${check.count} ${check.label} in the last hour.`,
-        });
-}
-function readLogTail(file) {
-    const fd = fs.openSync(file, "r");
-    try {
-        const size = fs.fstatSync(fd).size;
-        const length = Math.min(size, LOG_TAIL_BYTES);
-        const buffer = Buffer.alloc(length);
-        fs.readSync(fd, buffer, 0, length, size - length);
-        return buffer.toString("utf8").split("\n");
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-function firstTimestamp(lines) {
-    for (const line of lines) {
-        const timestamp = lineTimestamp(line);
-        if (timestamp !== null)
-            return timestamp;
-    }
-    return null;
-}
-/**
- * Lines from the active log and as many rotated generations as needed to
- * cover the window. Throws when a present log cannot be read.
- */
-function readWindowLines(logFile, since, daemonLog) {
-    const generations = [];
-    for (let n = 0; n < SYNC_LOG_GENERATIONS; n += 1) {
-        const file = syncLogGenerationPath(logFile, n);
-        if (!fs.existsSync(file))
-            continue;
-        const lines = readLogTail(file);
-        const fallbackTime = daemonLog ? fs.statSync(file).mtimeMs : null;
-        const timestampedLines = fallbackTime === null
-            ? lines
-            : lines.map((line) => lineTimestamp(line) === null
-                ? `${new Date(fallbackTime).toISOString()} ${line}`
-                : line);
-        generations.unshift(timestampedLines);
-        const first = firstTimestamp(timestampedLines);
-        if (first !== null && first <= since)
-            break;
-    }
-    return generations.length > 0 ? generations.flat() : null;
-}
-function readConflictCount(file) {
-    try {
-        const value = JSON.parse(fs.readFileSync(file, "utf8"));
-        const count = value?.conflictCount;
-        return typeof count === "number" && Number.isFinite(count) ? count : 0;
-    }
-    catch {
-        return 0;
-    }
-}
-/** Read the machine's sync logs and client health file. */
-export function defaultSyncRuntimeResults(now, hqHome = path.join(os.homedir(), ".hq"), env = process.env) {
-    const options = {
-        now: now.getTime(),
-        conflictCount: readConflictCount(path.join(hqHome, "client-health.json")),
-    };
-    const paths = syncLogBasePaths(hqHome, env);
-    const familyModifiedMs = (family) => {
-        let newest = null;
-        for (let generation = 0; generation < SYNC_LOG_GENERATIONS; generation += 1) {
-            try {
-                const stat = fs.lstatSync(syncLogGenerationPath(paths[family], generation));
-                if (!stat.isFile() && !stat.isDirectory())
-                    continue;
-                newest = newest === null ? stat.mtimeMs : Math.max(newest, stat.mtimeMs);
-            }
-            catch {
-                // Missing or inaccessible generations do not make a source family newer.
-            }
-        }
-        return newest;
-    };
-    const family = currentSyncLogFamily(familyModifiedMs("desktop"), familyModifiedMs("daemon"));
-    const logFile = family === null ? paths.desktop : paths[family];
-    let lines;
-    try {
-        lines = readWindowLines(logFile, options.now - SYNC_RUNTIME_WINDOW_MS, family === "daemon");
-    }
-    catch {
-        return [
-            { status: "UNKNOWN", checkId: "sync.runtime.log", message: "The sync runner log could not be read." },
-            ...analyzeSyncRuntimeLog([], options).filter((r) => r.checkId === "sync.runtime.conflicts"),
-        ];
-    }
-    if (lines === null) {
-        return [
-            { status: "NA", checkId: "sync.runtime.log", message: "No sync runner log on this machine." },
-            ...analyzeSyncRuntimeLog([], options).filter((r) => r.checkId === "sync.runtime.conflicts"),
-        ];
-    }
-    return analyzeSyncRuntimeLog(lines, options);
-}
-//# sourceMappingURL=sync-runtime.js.map

package/dist/lib/doctor/client-health-flag-token.d.ts

@@ -1,15 +0,0 @@
-export declare const CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS = 1000;
-export declare class MissingFlagTokenError extends Error {
-    constructor();
-}
-export declare class ClientHealthFlagTokenTimeoutError extends Error {
-    constructor(timeoutMs: number);
-}
-export type ClientHealthFlagTokenProvider = (signal: AbortSignal) => string | Promise<string>;
-/**
- * Obtain a non-interactive ID token, separately bounded from the flag read.
- * ensureCognitoIdToken refreshes expired person sessions and selects machine
- * identity credentials when the current installation is a machine.
- */
-export declare function getClientHealthFlagToken(provider?: ClientHealthFlagTokenProvider, timeoutMs?: number, callerSignal?: AbortSignal): Promise<string>;
-//# sourceMappingURL=client-health-flag-token.d.ts.map

package/dist/lib/doctor/client-health-flag-token.js

@@ -1,66 +0,0 @@
-import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
-export const CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS = 1_000;
-export class MissingFlagTokenError extends Error {
-    constructor() {
-        super("No cached HQ identity token is available");
-        this.name = "MissingFlagTokenError";
-    }
-}
-export class ClientHealthFlagTokenTimeoutError extends Error {
-    constructor(timeoutMs) {
-        super(`Client-health flag token acquisition exceeded its ${timeoutMs} ms bound`);
-        this.name = "ClientHealthFlagTokenTimeoutError";
-    }
-}
-/**
- * Obtain a non-interactive ID token, separately bounded from the flag read.
- * ensureCognitoIdToken refreshes expired person sessions and selects machine
- * identity credentials when the current installation is a machine.
- */
-export async function getClientHealthFlagToken(provider, timeoutMs = CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS, callerSignal) {
-    if (callerSignal?.aborted) {
-        throw callerSignal.reason ?? new Error("Token acquisition was aborted");
-    }
-    const controller = new AbortController();
-    const signal = callerSignal ? AbortSignal.any([callerSignal, controller.signal]) : controller.signal;
-    const timeout = new ClientHealthFlagTokenTimeoutError(timeoutMs);
-    const timer = setTimeout(() => controller.abort(timeout), timeoutMs);
-    let onAbort;
-    const aborted = new Promise((_resolve, reject) => {
-        onAbort = () => reject(signal.reason ?? new Error("Token acquisition was aborted"));
-        if (signal.aborted)
-            onAbort();
-        else
-            signal.addEventListener("abort", onAbort, { once: true });
-    });
-    try {
-        const acquire = provider ?? ((requestSignal) => ensureCognitoIdToken({ interactive: false, signal: requestSignal }));
-        const acquisition = Promise.resolve().then(() => {
-            if (signal.aborted) {
-                throw signal.reason ?? new Error("Token acquisition was aborted");
-            }
-            return acquire(signal);
-        });
-        const token = await Promise.race([acquisition, aborted]);
-        if (signal.aborted) {
-            throw signal.reason ?? new Error("Token acquisition was aborted");
-        }
-        if (typeof token !== "string" || token.trim().length === 0) {
-            throw new MissingFlagTokenError();
-        }
-        return token;
-    }
-    catch (error) {
-        if (error instanceof Error &&
-            error.message.startsWith("No valid HQ session and interactive login is disabled")) {
-            throw new MissingFlagTokenError();
-        }
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-        if (onAbort)
-            signal.removeEventListener("abort", onAbort);
-    }
-}
-//# sourceMappingURL=client-health-flag-token.js.map

package/dist/lib/doctor/client-health-reason-codes-flag.d.ts

@@ -1,27 +0,0 @@
-import { type FlagClient, type FlagClientOptions } from "@indigoai-us/hq-flags-client";
-export declare const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
-export declare const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
-export declare const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
-type ClientHealthFlagClient = Pick<FlagClient, "ready" | "isEnabled" | "close">;
-export interface ClientHealthReasonCodesFlagDependencies {
-    env?: NodeJS.ProcessEnv;
-    createClient?: (options: FlagClientOptions) => ClientHealthFlagClient;
-    getToken?: FlagClientOptions["getToken"];
-    tokenTimeoutMs?: number;
-    fetch?: typeof fetch;
-    reportFailure?: (error: unknown) => void;
-}
-export interface ClientHealthReasonCodesCompany {
-    companyUid: string;
-    companySlug?: string;
-}
-/**
- * Resolve the privacy gate from hq-flags with a bounded request. Missing
- * identity, service configuration, and every lookup failure keep diagnostics
- * off so a flag outage cannot delay the doctor's health result.
- */
-export declare function clientHealthReasonCodesEnabled(dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
-/** Resolve the same default-off gate for one explicitly identified company. */
-export declare function clientHealthReasonCodesEnabledForCompany(company: ClientHealthReasonCodesCompany, dependencies?: ClientHealthReasonCodesFlagDependencies, callerSignal?: AbortSignal): Promise<boolean>;
-export {};
-//# sourceMappingURL=client-health-reason-codes-flag.d.ts.map

package/dist/lib/doctor/client-health-reason-codes-flag.js

@@ -1,106 +0,0 @@
-import { createFlagClient, } from "@indigoai-us/hq-flags-client";
-import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
-import { getClientHealthFlagToken } from "./client-health-flag-token.js";
-export const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
-export const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
-export const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
-function safeErrorClass(error) {
-    const name = error instanceof Error ? error.name : "UnknownError";
-    return /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(name) ? name : "UnknownError";
-}
-function reportFlagFailure(error) {
-    process.stderr.write(`HQ client-health reason-code flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
-}
-function combineSignals(first, second) {
-    return first ? AbortSignal.any([first, second]) : second;
-}
-/**
- * Resolve the privacy gate from hq-flags with a bounded request. Missing
- * identity, service configuration, and every lookup failure keep diagnostics
- * off so a flag outage cannot delay the doctor's health result.
- */
-export async function clientHealthReasonCodesEnabled(dependencies = {}, callerSignal) {
-    const env = dependencies.env ?? process.env;
-    const companyUid = env.HQ_COMPANY_UID?.trim() || "";
-    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
-    }
-    return clientHealthReasonCodesEnabledForCompany({
-        companyUid,
-        companySlug: env.HQ_COMPANY_SLUG?.trim() || undefined,
-    }, dependencies, callerSignal);
-}
-/** Resolve the same default-off gate for one explicitly identified company. */
-export async function clientHealthReasonCodesEnabledForCompany(company, dependencies = {}, callerSignal) {
-    const env = dependencies.env ?? process.env;
-    const endpoint = resolveFlagRegistryEndpoint(undefined, env);
-    const companyUid = company.companyUid.trim();
-    if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
-    }
-    const companySlug = company.companySlug?.trim() || "";
-    if (callerSignal?.aborted)
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
-    let client;
-    let failed = false;
-    let failureReported = false;
-    let enabled = CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
-    const reportFailureOnce = (error) => {
-        failed = true;
-        if (failureReported)
-            return;
-        failureReported = true;
-        (dependencies.reportFailure ?? reportFlagFailure)(error);
-    };
-    let token;
-    try {
-        token = await getClientHealthFlagToken(dependencies.getToken, dependencies.tokenTimeoutMs, callerSignal);
-    }
-    catch (error) {
-        if (!callerSignal?.aborted)
-            reportFailureOnce(error);
-        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
-    }
-    const deadline = AbortSignal.timeout(CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS);
-    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
-    const doFetch = dependencies.fetch ?? globalThis.fetch;
-    try {
-        client = (dependencies.createClient ?? createFlagClient)({
-            endpoint,
-            companyUid,
-            ...(companySlug && /^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(companySlug)
-                ? { companyIdentifiers: [companySlug] }
-                : {}),
-            env: {},
-            getToken: () => token,
-            fetch: (input, init) => doFetch(input, {
-                ...init,
-                signal: combineSignals(init?.signal ?? undefined, signal),
-            }),
-            refreshIntervalMs: 0,
-            requestTimeoutMs: CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS,
-            onError: reportFailureOnce,
-        });
-        await client.ready();
-        if (!failed && !signal.aborted) {
-            enabled = client.isEnabled(CLIENT_HEALTH_REASON_CODES_FLAG, {
-                fallback: CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK,
-            });
-        }
-    }
-    catch (error) {
-        reportFailureOnce(error);
-    }
-    finally {
-        try {
-            client?.close();
-        }
-        catch (error) {
-            reportFailureOnce(error);
-        }
-    }
-    return failed || signal.aborted
-        ? CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK
-        : enabled;
-}
-//# sourceMappingURL=client-health-reason-codes-flag.js.map

package/dist/lib/doctor/fix/json-output.d.ts

@@ -1,28 +0,0 @@
-import type { AppliedFix, AppliedFixBackup, ApplyFixesResult } from "./apply.js";
-export declare const DOCTOR_FIX_JSON_SCHEMA_VERSION = 1;
-export interface DoctorFixJsonResult {
-    schemaVersion: number;
-    exitCode: number;
-    refused: ApplyFixesResult["refused"] | "outside-hq-tree";
-    applied: {
-        checkId: string;
-        fixClass: AppliedFix["fixClass"];
-        pass: number;
-        postStatus: AppliedFix["postStatus"];
-    }[];
-    backups: Pick<AppliedFixBackup, "pass" | "backupDir" | "restoreCommand">[];
-    refreshSync: {
-        checkId: string;
-        outcome: NonNullable<AppliedFix["refreshSyncOutcome"]>;
-        postStatus: AppliedFix["postStatus"];
-    }[];
-}
-/** Build the intentionally narrow JSON surface for `hq doctor --fix --json`. */
-export declare function buildDoctorFixJson(input: {
-    exitCode: number;
-    refused: ApplyFixesResult["refused"] | "outside-hq-tree";
-    applied: readonly AppliedFix[];
-    backups?: readonly AppliedFixBackup[];
-}): DoctorFixJsonResult;
-export declare function renderDoctorFixJson(input: Parameters<typeof buildDoctorFixJson>[0]): string;
-//# sourceMappingURL=json-output.d.ts.map

package/dist/lib/doctor/fix/json-output.js

@@ -1,33 +0,0 @@
-export const DOCTOR_FIX_JSON_SCHEMA_VERSION = 1;
-/** Build the intentionally narrow JSON surface for `hq doctor --fix --json`. */
-export function buildDoctorFixJson(input) {
-    return {
-        schemaVersion: DOCTOR_FIX_JSON_SCHEMA_VERSION,
-        exitCode: input.exitCode,
-        refused: input.refused,
-        applied: input.applied.map(({ checkId, fixClass, pass, postStatus }) => ({
-            checkId,
-            fixClass,
-            pass,
-            postStatus,
-        })),
-        backups: (input.backups ?? []).map(({ pass, backupDir, restoreCommand }) => ({
-            pass,
-            backupDir,
-            restoreCommand,
-        })),
-        refreshSync: input.applied.flatMap((fix) => fix.fixClass === "refresh-sync" && fix.refreshSyncOutcome
-            ? [
-                {
-                    checkId: fix.checkId,
-                    outcome: fix.refreshSyncOutcome,
-                    postStatus: fix.postStatus,
-                },
-            ]
-            : []),
-    };
-}
-export function renderDoctorFixJson(input) {
-    return JSON.stringify(buildDoctorFixJson(input), null, 2) + "\n";
-}
-//# sourceMappingURL=json-output.js.map

package/dist/lib/doctor/fix/refresh-sync-outcome.d.ts

@@ -1,12 +0,0 @@
-/** Privacy-safe outcomes for a targeted refresh-sync attempt. */
-export type RefreshSyncOutcome = "pull-succeeded" | "pull-timeout" | "pull-failed:4xx" | "pull-failed:5xx" | "pull-failed:network" | "pull-failed:other";
-export interface RefreshSyncObservation {
-    errorCode?: string;
-    signal?: string | null;
-    status?: number | null;
-    stdout?: string;
-    stderr?: string;
-}
-/** Classify process/HTTP results without retaining their free-text details. */
-export declare function classifyRefreshSyncOutcome(observation: RefreshSyncObservation): RefreshSyncOutcome;
-//# sourceMappingURL=refresh-sync-outcome.d.ts.map

package/dist/lib/doctor/fix/refresh-sync-outcome.js

@@ -1,25 +0,0 @@
-/** Classify process/HTTP results without retaining their free-text details. */
-export function classifyRefreshSyncOutcome(observation) {
-    const details = String(observation.stdout ?? "") + "\n" + String(observation.stderr ?? "");
-    const errorCode = observation.errorCode ??
-        /\b(ETIMEDOUT|ETIME|EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EPIPE|ECONNABORTED)\b/.exec(details)?.[1];
-    if (errorCode === "ETIMEDOUT" ||
-        errorCode === "ETIME" ||
-        observation.signal === "SIGTERM") {
-        return "pull-timeout";
-    }
-    if (!errorCode && observation.status === 0) {
-        return "pull-succeeded";
-    }
-    const httpStatus = /(?:HTTP(?:\/\d(?:\.\d)?)?\s+|status(?:\s+code)?\s*[=: ]\s*)([45]\d\d)\b/i.exec(details)?.[1] ?? "";
-    if (httpStatus.startsWith("4"))
-        return "pull-failed:4xx";
-    if (httpStatus.startsWith("5"))
-        return "pull-failed:5xx";
-    if (errorCode &&
-        /^(?:EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EPIPE|ECONNABORTED)$/.test(errorCode)) {
-        return "pull-failed:network";
-    }
-    return "pull-failed:other";
-}
-//# sourceMappingURL=refresh-sync-outcome.js.map

package/dist/lib/doctor/shared.d.ts

@@ -1,8 +0,0 @@
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-export declare function collectCommands(parsed: unknown): string[];
-export declare function fileState(target: string): {
-    present: boolean;
-    executable: boolean;
-};
-export declare function isRecord(value: unknown): value is Record<string, unknown>;
-//# sourceMappingURL=shared.d.ts.map

package/dist/lib/doctor/shared.js

@@ -1,38 +0,0 @@
-import * as fs from "node:fs";
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-export function collectCommands(parsed) {
-    const commands = [];
-    if (!parsed || typeof parsed !== "object")
-        return commands;
-    const hooks = parsed.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return commands;
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const hook of inner) {
-                const command = hook?.command;
-                if (typeof command === "string")
-                    commands.push(command);
-            }
-        }
-    }
-    return commands;
-}
-export function fileState(target) {
-    try {
-        const stat = fs.statSync(target);
-        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
-    }
-    catch {
-        return { present: false, executable: false };
-    }
-}
-export function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//# sourceMappingURL=shared.js.map

package/dist/lib/doctor/stray-gate-entries.d.ts

@@ -1,35 +0,0 @@
-/**
- * Stray gate registrations written by an old `hq doctor --fix`.
- *
- * hq-cli v5.99.0 through v5.118.x "re-registered" every hook script that no
- * settings command named. Since HQ moved to a single master-hook.sh entry that
- * dispatches from .claude/hooks/hook-registry.json, EVERY script looked
- * unregistered, so doctor appended one PreToolUse entry per script with no
- * matcher:
- *
- *   { "hooks": [{ "type": "command", "timeout": 5,
- *       "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/hook-gate.sh\" <id> \"$CLAUDE_PROJECT_DIR/.claude/hooks/<id>.sh\"" }] }
- *
- * With no matcher Claude Code runs each of them on every tool call, so guards
- * such as block-hq-glob and protect-core block Bash, Skill and Read. An HQ
- * update later moves them from settings.json into settings.local.json as
- * "user customizations", where the release reset no longer clears them.
- *
- * Detection is deliberately exact: only an entry with no matcher, exactly one
- * hook, timeout 5, and the doctor-generated command for a matching id counts.
- * A hand-written hook is never touched.
- */
-export declare function isStrayGateEntry(entry: unknown): boolean;
-/** Count stray entries across every hook event in a parsed settings object. */
-export declare function countStrayGateEntries(settings: unknown): number;
-/**
- * Return a copy of `settings` with every stray entry removed. An event array
- * left empty is dropped, and an empty `hooks` map is dropped, so a file whose
- * only hooks were strays goes back to its original shape. Everything else,
- * including permissions and real hooks, is preserved.
- */
-export declare function removeStrayGateEntries(settings: unknown): {
-    settings: unknown;
-    removed: number;
-};
-//# sourceMappingURL=stray-gate-entries.d.ts.map