@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/doctor/json-output.js

@@ -34,7 +34,7 @@ export function buildDoctorJson(input) {
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
-            results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds));
+            results.push(toJsonResult(run.family.id, result));
         }
     }
     return {
@@ -43,21 +43,16 @@ export function buildDoctorJson(input) {
         hqRoot: input.hqRoot,
         summary: summarize(input.families),
         exitCode: computeExitCode(input.families),
-        ...(input.scope && input.scope.length > 0 ? { scope: [...input.scope] } : {}),
         results,
     };
 }
 /** Convert one {@link CheckResult} into its JSON form, omitting empty optionals. */
-function toJsonResult(familyId, result, clientHealthReasonCodesEnabledCheckIds) {
+function toJsonResult(familyId, result) {
     const remediation = deriveRemediation(result);
     return {
         status: result.status,
         family: familyId,
         checkId: result.checkId,
-        ...(result.reasonCode !== undefined ? { reasonCode: result.reasonCode } : {}),
-        ...(clientHealthReasonCodesEnabledCheckIds?.has(result.checkId)
-            ? { clientHealthReasonCodesEnabled: true }
-            : {}),
         ...(result.target !== undefined ? { target: result.target } : {}),
         message: result.message,
         ...(result.remediation !== undefined

package/dist/lib/doctor/platform.d.ts

@@ -126,8 +126,24 @@ export declare function claudeCodeFlagEvidence(env: NodeJS.ProcessEnv): Platform
  * `com.googlecode.iterm2`), so this fires only under a real desktop host.
  */
 export declare function bundleIdEvidence(env: NodeJS.ProcessEnv): PlatformEvidence | null;
+/**
+ * Codex runtime environment variables, kept in parity with the canonical shell
+ * detector `core/scripts/lib/detect-codex.sh`. Presence of any is a strong Codex
+ * signal. One evidence entry is produced per variable found so a single Codex
+ * signal can be tested in isolation.
+ */
+export declare const CODEX_ENV_VARS: readonly ["CODEX_SANDBOX", "CODEX_SESSION_ID", "CODEX_EXECUTION_ID", "CODEX_AGENT_ID", "CODEX_THREAD_ID", "CODEX_SHELL", "CODEX_CI", "CODEX_INTERNAL_ORIGINATOR_OVERRIDE", "OPENAI_CODEX"];
 /** Every Codex environment signal present in `env`, one entry per variable. */
 export declare function codexEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
+/**
+ * Grok runtime environment variables. Restricted to variables the Grok host
+ * exports into the session (a session id, its workspace root) — HQ's own Grok
+ * *launcher* variables (`GROK_BIN`, `GROK_CONFIG`, `XAI_API_KEY`, …) are
+ * excluded on purpose: those can be set inside a Claude or Codex session that is
+ * merely preparing to launch Grok, and treating them as "we are running under
+ * Grok" would be a false positive.
+ */
+export declare const GROK_ENV_VARS: readonly ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
@@ -141,6 +157,10 @@ export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidenc
  * on its environment signals instead, and this function does not guess it.
  */
 export declare function ancestryEvidence(ancestors: AncestorProcess[]): PlatformEvidence[];
+/** The one command this module ever launches to read process ancestry. */
+export declare const PS_COMMAND = "ps";
+/** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
+export declare const PS_ARGS: readonly ["-Ao", "pid=,ppid=,comm="];
 /**
  * Low-level process-table provider: runs a command and returns its stdout, or
  * `null` on failure. This is the single seam through which any process is
@@ -166,6 +186,12 @@ export interface ReadAncestryOptions {
  * environment signals rather than throwing.
  */
 export declare function readProcessAncestry(options?: ReadAncestryOptions): AncestorProcess[];
+/**
+ * Collect the environment signals, in a stable order: entrypoint, the Claude
+ * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
+ * separately (and lazily) by {@link detectPlatform}.
+ */
+export declare function collectEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
  * Collect every signal from an environment and an explicit ancestor chain, in a
  * stable order: environment signals first, then process ancestry. Exposed for

package/dist/lib/doctor/platform.js

@@ -150,7 +150,7 @@ function looksLikeClaudeDesktopBundle(id) {
  * signal. One evidence entry is produced per variable found so a single Codex
  * signal can be tested in isolation.
  */
-const CODEX_ENV_VARS = [
+export const CODEX_ENV_VARS = [
     "CODEX_SANDBOX",
     "CODEX_SESSION_ID",
     "CODEX_EXECUTION_ID",
@@ -185,7 +185,7 @@ export function codexEnvEvidence(env) {
  * merely preparing to launch Grok, and treating them as "we are running under
  * Grok" would be a false positive.
  */
-const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
+export const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export function grokEnvEvidence(env) {
     const found = [];
@@ -249,9 +249,9 @@ const DEFAULT_MAX_HOPS = 20;
 /** Wall-clock bound for the single `ps` snapshot, keeping startup fast. */
 const PS_TIMEOUT_MS = 250;
 /** The one command this module ever launches to read process ancestry. */
-const PS_COMMAND = "ps";
+export const PS_COMMAND = "ps";
 /** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
-const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
+export const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
 /**
  * Read this process's ancestor chain (nearest parent first) by taking one `ps`
  * snapshot of the process table and walking parent pointers upward. A single
@@ -330,7 +330,7 @@ function defaultPsSpawner(command, args) {
  * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
  * separately (and lazily) by {@link detectPlatform}.
  */
-function collectEnvEvidence(env) {
+export function collectEnvEvidence(env) {
     const evidence = [];
     const entrypoint = entrypointEvidence(env);
     if (entrypoint)

package/dist/lib/doctor/registry.d.ts

@@ -27,20 +27,6 @@ export declare class DoctorRegistry {
     families(): CheckFamily[];
     /** Whether a family with this id is registered. */
     has(id: string): boolean;
-    /** The registered family ids, in registration order. */
-    ids(): string[];
-    /**
-     * A registry holding only the named families, still in REGISTRATION order —
-     * the caller's argument order is a selection, not a reordering, so a scoped
-     * report reads the same way as a full one.
-     *
-     * Unknown ids are returned rather than ignored: running zero checks and
-     * reporting success would describe a tree nothing looked at.
-     */
-    select(ids: readonly string[]): {
-        registry: DoctorRegistry;
-        unknown: string[];
-    };
     /** Run every family in order and collect grouped results. */
     run(context: CheckContext): Promise<FamilyRun[]>;
 }

package/dist/lib/doctor/registry.js

@@ -22,8 +22,6 @@ import { runtimeHealthFamily } from "./checks/runtime-health.js";
 import { integrationsFamily } from "./checks/integrations.js";
 import { syncHealthFamily } from "./checks/sync-health.js";
 import { workContextFamily } from "./checks/work-context.js";
-import { botsFamily } from "./checks/bots.js";
-import { scaffoldCliFloorFamily } from "./checks/scaffold-cli-floor.js";
 import { fixtureCoverageFamily } from "./fixtures/discover.js";
 import { checkClaudeWiring } from "./checks/claude-wiring.js";
 /**
@@ -45,28 +43,6 @@ export class DoctorRegistry {
     has(id) {
         return this.familiesById.has(id);
     }
-    /** The registered family ids, in registration order. */
-    ids() {
-        return [...this.familiesById.keys()];
-    }
-    /**
-     * A registry holding only the named families, still in REGISTRATION order —
-     * the caller's argument order is a selection, not a reordering, so a scoped
-     * report reads the same way as a full one.
-     *
-     * Unknown ids are returned rather than ignored: running zero checks and
-     * reporting success would describe a tree nothing looked at.
-     */
-    select(ids) {
-        const wanted = new Set(ids);
-        const unknown = [...wanted].filter((id) => !this.familiesById.has(id));
-        const registry = new DoctorRegistry();
-        for (const family of this.families()) {
-            if (wanted.has(family.id))
-                registry.register(family);
-        }
-        return { registry, unknown };
-    }
     /** Run every family in order and collect grouped results. */
     async run(context) {
         const runs = [];
@@ -149,7 +125,6 @@ function runClaudeSettingsCheck(context) {
         ];
     }
     const count = countHookRegistrations(parsed);
-    const missingRequiredEvents = missingRequiredCommandHookEvents(parsed);
     return [
         {
             status: "PASS",
@@ -157,17 +132,6 @@ function runClaudeSettingsCheck(context) {
             target: settingsPath,
             message: `.claude/settings.json is present and valid (${count} hook registration${count === 1 ? "" : "s"}).`,
         },
-        {
-            status: missingRequiredEvents.length === 0 ? "PASS" : "FAIL",
-            checkId: "hooks.settings-required-command-hooks",
-            target: settingsPath,
-            message: missingRequiredEvents.length === 0
-                ? ".claude/settings.json registers command hooks for SessionStart and PreToolUse."
-                : `.claude/settings.json has no command hook for ${missingRequiredEvents.join(" or ")}.`,
-            remediation: missingRequiredEvents.length === 0
-                ? undefined
-                : "Restore the canonical hook registrations, e.g. `hq rescue -y --paths .claude`.",
-        },
         // US-004+: the settings file is present and valid, so the full Claude wiring
         // checks (script existence and executability, orphaned scripts, three-profile
         // membership, unquoted $CLAUDE_PROJECT_DIR, and core/hooks/<Event>/ executable
@@ -198,37 +162,6 @@ function countHookRegistrations(settings) {
     }
     return count;
 }
-/** The lifecycle events whose command hooks make the settings file operational. */
-const REQUIRED_COMMAND_HOOK_EVENTS = ["SessionStart", "PreToolUse"];
-/**
- * Return each required lifecycle event that has no command hook with a non-empty
- * command string. This deliberately mirrors check-hq-hooks.sh's jq predicate.
- */
-function missingRequiredCommandHookEvents(settings) {
-    return REQUIRED_COMMAND_HOOK_EVENTS.filter((event) => !hasCommandHook(settings, event));
-}
-function hasCommandHook(settings, event) {
-    if (!settings || typeof settings !== "object")
-        return false;
-    const hooks = settings.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return false;
-    const eventEntries = hooks[event];
-    if (!Array.isArray(eventEntries))
-        return false;
-    return eventEntries.some((entry) => {
-        if (!entry || typeof entry !== "object")
-            return false;
-        const commandHooks = entry.hooks;
-        if (!Array.isArray(commandHooks))
-            return false;
-        return commandHooks.some((hook) => !!hook &&
-            typeof hook === "object" &&
-            hook.type === "command" &&
-            typeof hook.command === "string" &&
-            hook.command.length > 0);
-    });
-}
 /**
  * Build a registry pre-loaded with the default families. Hooks is the first
  * family; later families are registered here as they are implemented, each
@@ -237,7 +170,6 @@ function hasCommandHook(settings, event) {
 export function createDefaultRegistry() {
     const registry = new DoctorRegistry();
     registry.register(hooksFamily);
-    registry.register(scaffoldCliFloorFamily);
     // Fixture coverage (US-007): reports UNTESTED for every registered hook with
     // no fixture and prints the tested/total coverage line. A separate family so
     // it needs no change to the hooks tier, per the registry's extensibility
@@ -259,9 +191,6 @@ export function createDefaultRegistry() {
     // Work context (US-007A): session state files, outbox depth/quarantine,
     // and default-company mode. Local-only reads under ~/.hq/work-context.
     registry.register(workContextFamily);
-    // Local bots: inbox/heartbeat reachability and a LaunchAgent whose hq
-    // path survived an HQ toolchain move. Local-only reads.
-    registry.register(botsFamily);
     return registry;
 }
 //# sourceMappingURL=registry.js.map

package/dist/lib/doctor/report.js

@@ -103,7 +103,7 @@ export function renderText(options) {
     const pad = " ".repeat(STATUS_LABEL_WIDTH);
     const lines = [];
     lines.push(`hq doctor — HQ root: ${hqRoot}`);
-    lines.push(`Agent platform: ${platform.id}`);
+    lines.push(`Platform: ${platform.id}`);
     for (const run of families) {
         lines.push("");
         lines.push(`${run.family.title} (${run.family.id})`);

package/dist/lib/doctor/types.d.ts

@@ -18,9 +18,6 @@ export declare const DOCTOR_STATUSES: readonly ["PASS", "FAIL", "WARN", "UNTESTE
  * the type system rejects any other string at every call site.
  */
 export type DoctorStatus = (typeof DOCTOR_STATUSES)[number];
-/** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export declare const SYNC_REASON_CODES: readonly ["core-version-unavailable", "core-update-available", "no-local-tree", "never-synced", "invalid-last-sync", "stale-threshold", "manifest-unavailable", "manifest-state-unavailable", "no-manifest-scopes", "never-uploaded", "invalid-upload-time", "unresolved-company-uid", "realtime-lag-stuck", "receiver-permission-denied", "runner-restart-loop", "device-limit-backoff", "repeated-conflicts"];
-export type SyncReasonCode = (typeof SYNC_REASON_CODES)[number];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export declare function isDoctorStatus(value: unknown): value is DoctorStatus;
 /** A single per-item result produced by a check family. */
@@ -29,8 +26,6 @@ export interface CheckResult {
     status: DoctorStatus;
     /** Stable machine id for this item, e.g. `hooks.settings-present`. */
     checkId: string;
-    /** Closed diagnostic enum; never contains paths, company slugs, or prose. */
-    reasonCode?: SyncReasonCode;
     /** What was inspected — a path, hook id, etc. Optional. */
     target?: string;
     /** Human-readable one-line explanation of the result. */

package/dist/lib/doctor/types.js

@@ -21,26 +21,6 @@ export const DOCTOR_STATUSES = [
     "UNKNOWN",
     "KNOWN-DEFECT",
 ];
-/** Stable, privacy-safe diagnostics emitted by the sync health family. */
-export const SYNC_REASON_CODES = [
-    "core-version-unavailable",
-    "core-update-available",
-    "no-local-tree",
-    "never-synced",
-    "invalid-last-sync",
-    "stale-threshold",
-    "manifest-unavailable",
-    "manifest-state-unavailable",
-    "no-manifest-scopes",
-    "never-uploaded",
-    "invalid-upload-time",
-    "unresolved-company-uid",
-    "realtime-lag-stuck",
-    "receiver-permission-denied",
-    "runner-restart-loop",
-    "device-limit-backoff",
-    "repeated-conflicts",
-];
 /** Runtime type guard: true only for a member of the fixed vocabulary. */
 export function isDoctorStatus(value) {
     return (typeof value === "string" &&

package/dist/lib/flag-registry-worker.js

@@ -2,24 +2,13 @@
 import { parentPort, workerData } from "node:worker_threads";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { createFlagClient } from "@indigoai-us/hq-flags-client";
-const data = workerData;
-const endpoint = data.endpoint;
-const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
-const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const endpoint = workerData.endpoint;
 async function refresh() {
     if (!parentPort || typeof endpoint !== "string" || endpoint.trim() === "")
         return;
     try {
-        const companyUid = typeof data.companyUid === "string" && COMPANY_UID_RE.test(data.companyUid)
-            ? data.companyUid
-            : undefined;
-        const companyIdentifiers = Array.isArray(data.companyIdentifiers)
-            ? data.companyIdentifiers.filter((value) => typeof value === "string" && COMPANY_SLUG_RE.test(value))
-            : [];
         const client = createFlagClient({
             endpoint,
-            ...(companyUid ? { companyUid } : {}),
-            ...(companyIdentifiers.length ? { companyIdentifiers } : {}),
             getToken: () => loadCachedTokens()?.idToken ?? "",
             refreshIntervalMs: 0,
             onError: () => { },

package/dist/lib/flag-registry.d.ts

@@ -6,11 +6,9 @@
  * keep a short-lived, offline CLI alive until the client's network deadline.
  */
 import { type WorkerOptions } from "node:worker_threads";
-import { createFlagClient, type FlagClient, type FlagLookupOptions, type FlagSnapshot } from "@indigoai-us/hq-flags-client";
-type FlagRegistrySentry = Pick<typeof import("@sentry/node"), "captureException" | "withScope">;
-export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
-export type { ProcessFlagCompanyContext } from "./process-flag-company-context.js";
-export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
+import { type FlagClient, type FlagLookupOptions } from "@indigoai-us/hq-flags-client";
+/** Dedicated endpoint configuration; this is intentionally not HQ_PRO_API_URL. */
+export declare const FLAG_REGISTRY_ENDPOINT_ENV = "HQ_FLAGS_API_URL";
 /** The synchronous capability that command gate call sites need. */
 export type FlagReader = Pick<FlagClient, "isEnabled">;
 interface WorkerLike {
@@ -20,19 +18,8 @@ interface WorkerLike {
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
-    createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
-    sentry?: FlagRegistrySentry;
-    /** Test seam for exercising the no-source fail-open path. */
-    workerSource?: string;
-    captureWorkerFailure?: (error: Error, tags: Record<string, string>) => void;
+    createWorker?: (filename: URL, options: WorkerOptions) => WorkerLike;
 }
-export interface CompanyFlagGateDependencies {
-    endpoint?: string;
-    requestTimeoutMs?: number;
-    createClient?: typeof createFlagClient;
-}
-/** Create the same snapshot-backed reader used by process gates. */
-export declare function createProcessSnapshotReader(companyIdentifiers: string[], getSnapshot?: () => FlagSnapshot | null, env?: NodeJS.ProcessEnv): FlagReader;
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -48,17 +35,10 @@ export declare function kickFlagRegistryReadiness(dependencies?: FlagRegistryDep
  * `isEnabled` itself is synchronous and snapshot-only; any reader failure
  * falls through to the exact legacy predicate owned by the caller.
  */
-export declare function resolveFlagGate(reader: FlagReader | null | undefined, flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, env?: NodeJS.ProcessEnv): boolean;
-/** Resolve one explicit company's flag without relying on process-wide binding. */
-export declare function resolveCompanyFlagGate(companyUid: string, idToken: string, flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean, dependencies?: CompanyFlagGateDependencies): Promise<boolean>;
+export declare function resolveFlagGate(reader: FlagReader | null | undefined, flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean): boolean;
 /** Resolve a process gate against the shared snapshot reader, when configured. */
 export declare function resolveProcessFlagGate(flagKey: string, lookup: FlagLookupOptions, legacyFallback: () => boolean): boolean;
-/**
- * The registry snapshot held by this process, or null when none has arrived
- * (no endpoint configured, offline, or still fetching). Callers that must
- * distinguish "unreachable" from "off" read this instead of a gate.
- */
-export declare function currentFlagSnapshot(): FlagSnapshot | null;
 /** Test-only reset for process-global readiness state. */
 export declare function _resetFlagRegistryForTests(): void;
+export {};
 //# sourceMappingURL=flag-registry.d.ts.map

package/dist/lib/flag-registry.js

@@ -6,48 +6,24 @@
  * keep a short-lived, offline CLI alive until the client's network deadline.
  */
 import { Worker } from "node:worker_threads";
-import { createFlagClient, isFlagSnapshot, readLocalOverride, resolveFlag, } from "@indigoai-us/hq-flags-client";
-import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
-import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
-import { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
-import { writeFlagSnapshotFile } from "./flag-snapshot-file.js";
-function captureFlagRegistryException(error, tags, sentry) {
-    if (!sentry)
-        return;
-    sentry.captureException(error, { tags });
-}
-export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
-export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
-const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
-function normalizedCompanyUid(value) {
-    const candidate = value?.trim() ?? "";
-    return COMPANY_UID_RE.test(candidate) ? candidate : undefined;
-}
+import { isFlagSnapshot, resolveFlag, } from "@indigoai-us/hq-flags-client";
+/** Dedicated endpoint configuration; this is intentionally not HQ_PRO_API_URL. */
+export const FLAG_REGISTRY_ENDPOINT_ENV = "HQ_FLAGS_API_URL";
 let heldSnapshot = null;
 let processReader = null;
-function processLocalOverride(flagKey, env = process.env) {
-    return readLocalOverride(flagKey, env);
-}
-function localOverrideOrFallback(flagKey, legacyFallback, env = process.env) {
-    return processLocalOverride(flagKey, env) ?? legacyFallback();
-}
-/** Create the same snapshot-backed reader used by process gates. */
-export function createProcessSnapshotReader(companyIdentifiers, getSnapshot = () => heldSnapshot, env = process.env) {
+function processSnapshotReader() {
     return {
         isEnabled(flagKey, lookup = {}) {
             return resolveFlag({
                 flagKey,
-                env,
-                snapshot: getSnapshot(),
-                companyIdentifiers,
+                env: process.env,
+                snapshot: heldSnapshot,
+                companyIdentifiers: [],
                 lookup,
             }).value;
         },
     };
 }
-function processSnapshotReader(companyIdentifiers) {
-    return createProcessSnapshotReader(companyIdentifiers);
-}
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -60,61 +36,15 @@ function processSnapshotReader(companyIdentifiers) {
 export function kickFlagRegistryReadiness(dependencies = {}) {
     if (processReader)
         return processReader;
-    const endpoint = resolveFlagRegistryEndpoint(dependencies.endpoint, process.env);
-    const company = resolveProcessFlagCompanyContext();
-    const sentry = dependencies.sentry;
-    const companyUid = company.companyUid;
-    const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
-    processReader = processSnapshotReader(companyIdentifiers);
+    const endpoint = (dependencies.endpoint ?? process.env[FLAG_REGISTRY_ENDPOINT_ENV] ?? "").trim();
+    if (!endpoint)
+        return null;
+    processReader = processSnapshotReader();
     try {
-        const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
-        if (embeddedSource.length === 0) {
-            (dependencies.captureWorkerFailure ?? ((error, tags) => {
-                captureFlagRegistryException(error, tags, sentry);
-            }))(new Error("Self-contained flag-registry worker source is unavailable"), {
-                component: "flag-registry-worker-startup",
-                worker: "flag-registry",
-                flag_worker_failure: "embedded_source_unavailable",
-            });
-            return processReader;
-        }
-        // This source is embedded at build time, so it remains available while an
-        // updater replaces the installed package tree.
-        const workerOptions = {
-            workerData: {
-                endpoint,
-                ...(companyUid ? { companyUid } : {}),
-                ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
-            },
-            eval: true,
-        };
-        // The SDK's child-process integration captures every Worker error unless
-        // its process-wide captureWorkerErrors option is disabled. Scope only this
-        // worker so the reporting boundary can classify its startup errors without
-        // changing capture for unrelated workers.
-        const createWorker = dependencies.createWorker ??
-            ((filename, options) => new Worker(filename, options));
-        const worker = sentry
-            ? sentry.withScope((scope) => {
-                scope.setTag("worker", "flag-registry");
-                return createWorker(embeddedSource, workerOptions);
-            })
-            : createWorker(embeddedSource, workerOptions);
+        const worker = (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(new URL("./flag-registry-worker.js", import.meta.url), { workerData: { endpoint } });
         worker.on("message", (value) => {
-            if (isFlagSnapshot(value)) {
+            if (isFlagSnapshot(value))
                 heldSnapshot = value;
-                if (companyUid) {
-                    try {
-                        writeFlagSnapshotFile(companyUid, value.flags);
-                    }
-                    catch (error) {
-                        captureFlagRegistryException(error instanceof Error ? error : new Error(String(error)), {
-                            component: "flag-snapshot-cache-write",
-                            company_uid_present: "true",
-                        }, sentry);
-                    }
-                }
-            }
         });
         // A failed background refresh must stay invisible to an offline CLI.
         worker.on("error", () => { });
@@ -133,67 +63,20 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
  * `isEnabled` itself is synchronous and snapshot-only; any reader failure
  * falls through to the exact legacy predicate owned by the caller.
  */
-export function resolveFlagGate(reader, flagKey, lookup, legacyFallback, env = process.env) {
+export function resolveFlagGate(reader, flagKey, lookup, legacyFallback) {
     if (!reader)
-        return localOverrideOrFallback(flagKey, legacyFallback, env);
+        return legacyFallback();
     try {
         return reader.isEnabled(flagKey, lookup);
     }
     catch {
-        return localOverrideOrFallback(flagKey, legacyFallback, env);
-    }
-}
-/** Resolve one explicit company's flag without relying on process-wide binding. */
-export async function resolveCompanyFlagGate(companyUid, idToken, flagKey, lookup, legacyFallback, dependencies = {}) {
-    const localOverride = processLocalOverride(flagKey);
-    if (localOverride !== null)
-        return localOverride;
-    const targetCompanyUid = normalizedCompanyUid(companyUid);
-    if (!targetCompanyUid || idToken.trim() === "") {
-        return localOverrideOrFallback(flagKey, legacyFallback);
-    }
-    let client;
-    try {
-        client = (dependencies.createClient ?? createFlagClient)({
-            endpoint: resolveFlagRegistryEndpoint(dependencies.endpoint, process.env),
-            getToken: () => idToken,
-            companyUid: targetCompanyUid,
-            refreshIntervalMs: 0,
-            requestTimeoutMs: dependencies.requestTimeoutMs ?? 1_200,
-            onError: (error) => {
-                const errorClass = error instanceof Error ? error.name : "unknown";
-                console.error(`hq: Could not resolve a company flag (${errorClass}); using its fallback.`);
-            },
-        });
-        await client.ready();
-        return resolveFlagGate(client, flagKey, lookup, legacyFallback);
-    }
-    catch (error) {
-        const errorClass = error instanceof Error ? error.name : "unknown";
-        console.error(`hq: Could not resolve a company flag (${errorClass}); using its fallback.`);
-        return localOverrideOrFallback(flagKey, legacyFallback);
-    }
-    finally {
-        client?.close();
+        return legacyFallback();
     }
 }
 /** Resolve a process gate against the shared snapshot reader, when configured. */
 export function resolveProcessFlagGate(flagKey, lookup, legacyFallback) {
-    // The endpoint refresh is deliberately asynchronous. Until a validated
-    // snapshot arrives, preserve each caller's exact legacy fallback.
-    if (!processReader || !heldSnapshot) {
-        return localOverrideOrFallback(flagKey, legacyFallback);
-    }
     return resolveFlagGate(processReader, flagKey, lookup, legacyFallback);
 }
-/**
- * The registry snapshot held by this process, or null when none has arrived
- * (no endpoint configured, offline, or still fetching). Callers that must
- * distinguish "unreachable" from "off" read this instead of a gate.
- */
-export function currentFlagSnapshot() {
-    return heldSnapshot;
-}
 /** Test-only reset for process-global readiness state. */
 export function _resetFlagRegistryForTests() {
     heldSnapshot = null;

package/dist/lib/index-render/companies.d.ts

@@ -1,6 +1,3 @@
 import { RenderContext, RenderResult } from "./shared.js";
-export declare class CompanyIndexUserError extends Error {
-    constructor(message: string);
-}
-export declare function renderCompanies(context: RenderContext, args?: string[]): RenderResult;
+export declare function renderCompanies(context: RenderContext): RenderResult;
 //# sourceMappingURL=companies.d.ts.map