@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/lib/doctor/checks/bots.js

@@ -0,0 +1,189 @@
+/**
+ * Local-bot doctor family: a running bot that cannot poll its inbox or
+ * heartbeat still looked healthy (`hq bot status` said online, `hq doctor`
+ * had no bot check). Offline, from ~/.hq/bots and installed LaunchAgents.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { botsRoot, botDir, launchdLabel } from "../../bot/paths.js";
+import { readBotConfig } from "../../bot/config.js";
+import { isPidAlive, readBotStatus } from "../../bot/status.js";
+import { nodeBinaryProblem } from "../../node-binary.js";
+export const BOTS_FAMILY_ID = "bots";
+export const BOTS_FAMILY_TITLE = "Local bots";
+const DEFAULT_DEPS = {
+    home: () => os.homedir(),
+    root: (home) => botsRoot(home ?? os.homedir()),
+};
+export const botsFamily = {
+    id: BOTS_FAMILY_ID,
+    title: BOTS_FAMILY_TITLE,
+    run: (context) => Promise.resolve(checkBots(context)),
+};
+export function checkBots(_context, deps = DEFAULT_DEPS) {
+    try {
+        return runChecks(deps);
+    }
+    catch (error) {
+        return [
+            {
+                status: "UNKNOWN",
+                checkId: "bots.error",
+                message: `local bot checks could not run: ${error.message}`,
+            },
+        ];
+    }
+}
+function launchdPlistArgs(plist) {
+    const block = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
+    if (!block)
+        return [];
+    return [...block[1].matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+}
+function launchdPlistHqBinary(plist) {
+    return launchdPlistArgs(plist)[1] ?? null;
+}
+function runChecks(deps) {
+    const home = deps.home();
+    const root = deps.root(home);
+    if (!fs.existsSync(root)) {
+        return [
+            {
+                status: "NA",
+                checkId: "bots.none",
+                message: "No local bots on this computer.",
+            },
+        ];
+    }
+    const names = fs
+        .readdirSync(root, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && readBotConfig(path.join(root, d.name)) !== null)
+        .map((d) => d.name)
+        .sort();
+    if (names.length === 0) {
+        return [
+            {
+                status: "NA",
+                checkId: "bots.none",
+                message: "No local bots on this computer.",
+            },
+        ];
+    }
+    const results = [];
+    for (const name of names) {
+        const dir = botDir(name, root);
+        const config = readBotConfig(dir);
+        if (!config)
+            continue;
+        const status = readBotStatus(dir);
+        const alive = !!status && status.state === "running" && isPidAlive(status.pid);
+        if (alive && status.lastHeartbeatOk === false) {
+            const heartbeatMessage = status.lastHeartbeatReason === "identity_mismatch"
+                ? `${name} heartbeat stopped: identity mismatch (configured agent ${status.lastHeartbeatConfiguredAgentUid ?? config.agentUid}; token agent ${status.lastHeartbeatTokenAgentUid ?? "unknown"}).`
+                : `${name} is running but cannot heartbeat to HQ${status.lastHeartbeatError ? ` (${status.lastHeartbeatError})` : ""}.`;
+            results.push({
+                status: "FAIL",
+                checkId: `bots.${name}.heartbeat`,
+                target: dir,
+                message: heartbeatMessage,
+                remediation: `hq bot logs ${name}`,
+            });
+        }
+        else if (alive) {
+            results.push({
+                status: "PASS",
+                checkId: `bots.${name}.heartbeat`,
+                target: dir,
+                message: `${name} last heartbeat succeeded.`,
+            });
+        }
+        if (alive && status.lastInboxPollOk === false) {
+            results.push({
+                status: "FAIL",
+                checkId: `bots.${name}.inbox`,
+                target: dir,
+                message: `${name} is running but cannot receive messages${status.lastInboxError ? ` (${status.lastInboxError})` : ""}.`,
+                remediation: `hq bot logs ${name}`,
+            });
+        }
+        else if (alive) {
+            results.push({
+                status: "PASS",
+                checkId: `bots.${name}.inbox`,
+                target: dir,
+                message: `${name} last inbox poll succeeded.`,
+            });
+        }
+        const plistPath = path.join(home, "Library", "LaunchAgents", `${launchdLabel(name)}.plist`);
+        if (fs.existsSync(plistPath)) {
+            let hqPath;
+            let nodePath;
+            try {
+                const text = fs.readFileSync(plistPath, "utf8");
+                hqPath = launchdPlistHqBinary(text);
+                nodePath = launchdPlistArgs(text)[0] ?? null;
+            }
+            catch {
+                hqPath = null;
+                nodePath = null;
+            }
+            // The node the startup agent runs. A versioned Homebrew/nvm path
+            // (…/Cellar/node/26.0.0/bin/node) is deleted by the next upgrade, and
+            // launchd cannot start the bot after that.
+            const nodeProblem = nodePath ? nodeBinaryProblem(nodePath, deps.nodeIo ? { io: deps.nodeIo } : {}) : null;
+            if (nodePath && nodeProblem === "missing") {
+                results.push({
+                    status: "FAIL",
+                    checkId: `bots.${name}.daemon-node`,
+                    target: name,
+                    message: `${name} startup agent runs a node binary that no longer exists (${nodePath}); launchd cannot start it.`,
+                    remediation: `hq bot start ${name}`,
+                });
+            }
+            else if (nodePath && nodeProblem === "versioned") {
+                results.push({
+                    status: "WARN",
+                    checkId: `bots.${name}.daemon-node`,
+                    target: name,
+                    message: `${name} startup agent runs node from a versioned folder (${nodePath}) that the next node upgrade deletes.`,
+                    remediation: `hq bot start ${name}`,
+                });
+            }
+            else if (nodePath) {
+                results.push({
+                    status: "PASS",
+                    checkId: `bots.${name}.daemon-node`,
+                    target: name,
+                    message: `${name} startup agent node path is upgrade-safe.`,
+                });
+            }
+            if (hqPath && !fs.existsSync(hqPath)) {
+                results.push({
+                    status: "FAIL",
+                    checkId: `bots.${name}.daemon-binary`,
+                    target: hqPath,
+                    message: `${name} startup agent points at a missing hq binary.`,
+                    remediation: `hq bot daemon install ${name}`,
+                });
+            }
+            else if (hqPath) {
+                results.push({
+                    status: "PASS",
+                    checkId: `bots.${name}.daemon-binary`,
+                    target: hqPath,
+                    message: `${name} startup agent hq binary is present.`,
+                });
+            }
+        }
+    }
+    if (results.length === 0) {
+        results.push({
+            status: "NA",
+            checkId: "bots.idle",
+            message: `${names.length} local bot(s) are installed and not running.`,
+        });
+    }
+    return results;
+}
+//# sourceMappingURL=bots.js.map

package/dist/lib/doctor/checks/claude-wiring.js

@@ -24,6 +24,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { GATE_PROFILES, gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
+import { countStrayGateEntries } from "../stray-gate-entries.js";
 /** Common id prefix for every result this check family emits. */
 export const CLAUDE_WIRING_PREFIX = "hooks.claude";
 /**
@@ -57,6 +58,35 @@ export function checkClaudeWiring(context) {
     else if (local.present) {
         registrations.push(...enumerateRegistrations(local.value, ".claude/settings.local.json"));
     }
+    // --- Stray matcher-less gate entries (written by old `hq doctor --fix`) -------
+    // Only on master-hook trees: there, per-hook gate entries are never shipped,
+    // so a matcher-less one can only be the doctor-generated stray. A legacy tree
+    // that still registers hooks one by one is left alone.
+    const usesMasterHook = registrations.some((reg) => /\/master-hook\.sh\b/.test(reg.command));
+    for (const [file, parsed] of usesMasterHook ? [
+        ["settings.json", base],
+        ["settings.local.json", local],
+    ] : []) {
+        if (!parsed.present || parsed.invalid)
+            continue;
+        const abs = path.join(claudeDir, file);
+        const stray = countStrayGateEntries(parsed.value);
+        results.push(stray > 0
+            ? {
+                status: "FAIL",
+                checkId: `${CLAUDE_WIRING_PREFIX}.stray-gate-registration`,
+                target: abs,
+                message: `.claude/${file} has ${stray} hook-gate registration${stray === 1 ? "" : "s"} with no matcher. ` +
+                    "They run on every tool call and can block Bash, Skill and Read. An older `hq doctor --fix` wrote them.",
+                remediation: `Remove the matcher-less hook-gate.sh entries from .claude/${file} (hq doctor --fix does this).`,
+            }
+            : {
+                status: "PASS",
+                checkId: `${CLAUDE_WIRING_PREFIX}.stray-gate-registration`,
+                target: abs,
+                message: `.claude/${file} has no stray matcher-less hook-gate registrations.`,
+            });
+    }
     const scans = registrations.map((reg) => ({
         reg,
         scan: scanHookCommand(reg.command),
@@ -116,6 +146,11 @@ export function checkClaudeWiring(context) {
         for (const rp of scan.requiredRelpaths)
             referencedBasenames.add(baseName(rp));
     }
+    // master-hook.sh dispatches the gated hooks listed in hook-registry.json, so
+    // those scripts are registered even though no settings command names them.
+    for (const script of hookRegistryScripts(path.join(hooksDir, "hook-registry.json"))) {
+        referencedBasenames.add(baseName(script));
+    }
     for (const file of listShellScripts(hooksDir)) {
         if (referencedBasenames.has(file))
             continue;
@@ -124,7 +159,7 @@ export function checkClaudeWiring(context) {
             checkId: `${CLAUDE_WIRING_PREFIX}.orphan`,
             target: path.join(hooksDir, file),
             message: `Hook script ${file} is present in .claude/hooks/ but is not registered in any settings file.`,
-            remediation: `Register ${file} in .claude/settings.json or delete it.`,
+            remediation: `Add ${file} to .claude/hooks/hook-registry.json with the right event and matcher, or delete it.`,
         });
     }
     // --- AC4: every gated hook id is in ALL THREE profiles -----------------------
@@ -234,6 +269,31 @@ export function checkClaudeWiring(context) {
  * event in a parsed settings object. Tolerant of malformed shapes — any
  * non-conforming branch contributes nothing rather than throwing.
  */
+/** Every `script` path listed in .claude/hooks/hook-registry.json (empty when absent). */
+function hookRegistryScripts(registryPath) {
+    const parsed = readJsonFile(registryPath);
+    if (!parsed.present || parsed.invalid)
+        return [];
+    const hooks = parsed.value?.hooks;
+    if (!hooks || typeof hooks !== "object")
+        return [];
+    const out = [];
+    for (const entries of Object.values(hooks)) {
+        if (!Array.isArray(entries))
+            continue;
+        for (const entry of entries) {
+            const inner = entry?.hooks;
+            if (!Array.isArray(inner))
+                continue;
+            for (const item of inner) {
+                const script = item?.script;
+                if (typeof script === "string" && script)
+                    out.push(script);
+            }
+        }
+    }
+    return out;
+}
 function enumerateRegistrations(settings, source) {
     const out = [];
     if (!settings || typeof settings !== "object")
@@ -400,6 +460,15 @@ function requiredFromFirstCommand(first) {
         k += 1;
     if (k >= first.length)
         return { required, gatedHookId };
+    // SessionStart can use env to set BASH_ENV before Bash itself starts.
+    // Walk through that launcher and its assignments just like the shell scanner.
+    if (baseName(first[k]) === "env") {
+        k += 1;
+        while (k < first.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(first[k]))
+            k += 1;
+        if (k >= first.length || first[k].startsWith("-"))
+            return { required, gatedHookId };
+    }
     if (INTERPRETERS.has(baseName(first[k]))) {
         k += 1;
         while (k < first.length && first[k].startsWith("-")) {

package/dist/lib/doctor/checks/codex-wiring.d.ts

@@ -41,10 +41,6 @@
  */
 import { type AllowedDivergenceLoad } from "../allowed-divergence.js";
 import type { CheckContext, CheckResult } from "../types.js";
-/** Basename of the single-adapter script the current architecture routes to. */
-export declare const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
-/** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export declare const CODEX_DISPATCH_LIB_RELPATH: string;
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.

package/dist/lib/doctor/checks/codex-wiring.js

@@ -42,11 +42,12 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse as parseToml } from "smol-toml";
+import { collectCommands, fileState } from "../shared.js";
 import { ALLOWED_DIVERGENCE_RELPATH, loadAllowedDivergence, } from "../allowed-divergence.js";
 /** Basename of the single-adapter script the current architecture routes to. */
-export const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
+const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
 /** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
+const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.
@@ -549,44 +550,11 @@ function extractBraceBlock(source, from) {
     return source.slice(open + 1);
 }
 // --- shared low-level helpers --------------------------------------------------
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-function collectCommands(parsed) {
-    const commands = [];
-    if (!parsed || typeof parsed !== "object")
-        return commands;
-    const hooks = parsed.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return commands;
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const hook of inner) {
-                const command = hook?.command;
-                if (typeof command === "string")
-                    commands.push(command);
-            }
-        }
-    }
-    return commands;
-}
 function resolvePath(hqRoot, target) {
     if (!target)
         return null;
     return path.isAbsolute(target) ? target : path.resolve(hqRoot, target);
 }
-function fileState(target) {
-    try {
-        const stat = fs.statSync(target);
-        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
-    }
-    catch {
-        return { present: false, executable: false };
-    }
-}
 function filesEqual(a, b) {
     try {
         return fs.readFileSync(a).equals(fs.readFileSync(b));

package/dist/lib/doctor/checks/grok-wiring.js

@@ -22,6 +22,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { collectCommands, fileState } from "../shared.js";
 /** The command a user runs to install the user-global Grok bridge. */
 export const GROK_TRUST_REMEDIATION = "bash core/scripts/grok-trust.sh";
 /** Files that grok-trust.sh installs into `~/.grok/hooks/` for the bridge. */
@@ -149,38 +150,4 @@ function bridgeInstalled(bridgeDir) {
     }
     return false;
 }
-// --- shared low-level helpers --------------------------------------------------
-/** Collect every `command` string from a `{hooks:{Event:[{hooks:[…]}]}}` doc. */
-function collectCommands(parsed) {
-    const commands = [];
-    if (!parsed || typeof parsed !== "object")
-        return commands;
-    const hooks = parsed.hooks;
-    if (!hooks || typeof hooks !== "object")
-        return commands;
-    for (const entries of Object.values(hooks)) {
-        if (!Array.isArray(entries))
-            continue;
-        for (const entry of entries) {
-            const inner = entry?.hooks;
-            if (!Array.isArray(inner))
-                continue;
-            for (const hook of inner) {
-                const command = hook?.command;
-                if (typeof command === "string")
-                    commands.push(command);
-            }
-        }
-    }
-    return commands;
-}
-function fileState(target) {
-    try {
-        const stat = fs.statSync(target);
-        return { present: stat.isFile(), executable: (stat.mode & 0o111) !== 0 };
-    }
-    catch {
-        return { present: false, executable: false };
-    }
-}
 //# sourceMappingURL=grok-wiring.js.map

package/dist/lib/doctor/checks/integrations.js

@@ -11,6 +11,7 @@ import { ensureCognitoIdToken } from "../../../utils/cognito-session.js";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { isCompanySelectionError } from "../../../utils/company-selection-error.js";
 import { getCompanyUid } from "../../../utils/vault-api.js";
+import { redactUrlsInText } from "../../../utils/redact-url.js";
 import { fetchConnections, IntegrationsCliError } from "../../../commands/integrations-core.js";
 import { classifyConnection } from "../../integrations/health.js";
 /**
@@ -26,6 +27,16 @@ export const INTEGRATIONS_PREFIX = "integrations";
  * becoming a false connection failure. An unreadable inventory remains UNKNOWN.
  */
 export async function checkIntegrations(context, deps = {}) {
+    const results = await checkIntegrationsUnredacted(context, deps);
+    return results.map((result) => ({
+        ...result,
+        message: redactUrlsInText(result.message),
+        ...(result.remediation !== undefined
+            ? { remediation: redactUrlsInText(result.remediation) }
+            : {}),
+    }));
+}
+async function checkIntegrationsUnredacted(context, deps) {
     if (context.integrations === false) {
         return [{
                 status: "NA",

package/dist/lib/doctor/checks/runtime-health.d.ts

@@ -28,16 +28,6 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 /** The id of the AI-runtime-health family. */
 export declare const RUNTIMES_FAMILY_ID = "runtimes";
-/** Common id prefix for every result this family emits. */
-export declare const RUNTIMES_PREFIX = "runtimes";
-/**
- * The deterministic one-line probe prompt. Health is proven by a round-trip
- * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
- * that answers with anything at all still passes.
- */
-export declare const PROBE_PROMPT = "Reply with exactly: OK";
-/** How long each live probe may run before it is killed and marked UNKNOWN. */
-export declare const DEFAULT_PROBE_TIMEOUT_MS = 120000;
 /** One AI runtime the doctor knows how to find and probe. */
 export interface RuntimeSpec {
     /** Stable key used in check ids, e.g. `runtimes.codex.binary`. */
@@ -76,10 +66,14 @@ export interface ProbeOutcome {
 export interface RuntimeHealthDeps {
     /** Resolve an executable against PATH; null when not found. */
     resolveBinary?: (binary: string) => string | null;
+    /** Check whether a Windows command shim exists next to its resolved binary. */
+    fileExists?: (file: string) => boolean;
     /** Execute one probe. The default spawns from the OS temp dir. */
     execProbe?: (file: string, args: string[], timeoutMs: number) => Promise<ProbeOutcome>;
     /** Per-probe timeout. Default {@link DEFAULT_PROBE_TIMEOUT_MS}. */
     probeTimeoutMs?: number;
+    /** Runtime platform override for the spawn plan (normally process.platform). */
+    platform?: NodeJS.Platform;
 }
 /**
  * The AI-runtime-health check family entry. Presence checks always run; the
@@ -90,11 +84,4 @@ export interface RuntimeHealthDeps {
 export declare function checkRuntimeHealth(context: CheckContext, deps?: RuntimeHealthDeps): Promise<CheckResult[]>;
 /** The registered family object. */
 export declare const runtimeHealthFamily: CheckFamily;
-/**
- * Resolve an executable name against PATH with a pure filesystem scan — no
- * process is spawned, keeping the doctor's default run a function of on-disk
- * shape. First PATH entry containing an executable regular file wins, which is
- * exactly the copy a shell would run.
- */
-export declare function resolveOnPath(binary: string): string | null;
 //# sourceMappingURL=runtime-health.d.ts.map

package/dist/lib/doctor/checks/runtime-health.js

@@ -29,18 +29,19 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { planCommandSpawn } from "../../../utils/windows-spawn.js";
 /** The id of the AI-runtime-health family. */
 export const RUNTIMES_FAMILY_ID = "runtimes";
 /** Common id prefix for every result this family emits. */
-export const RUNTIMES_PREFIX = "runtimes";
+const RUNTIMES_PREFIX = "runtimes";
 /**
  * The deterministic one-line probe prompt. Health is proven by a round-trip
  * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
  * that answers with anything at all still passes.
  */
-export const PROBE_PROMPT = "Reply with exactly: OK";
+const PROBE_PROMPT = "Reply with exactly: OK";
 /** How long each live probe may run before it is killed and marked UNKNOWN. */
-export const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
+const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
 /**
  * The three runtimes HQ wires hooks for. Codex runs its probe under its own
  * read-only sandbox and outside-a-repo mode so the probe can never write; the
@@ -101,7 +102,8 @@ export async function checkRuntimeHealth(context, deps = {}) {
 async function runRuntimeChecks(context, deps) {
     const resolved = {
         resolveBinary: deps.resolveBinary ?? resolveOnPath,
-        execProbe: deps.execProbe ?? defaultExecProbe,
+        execProbe: deps.execProbe ??
+            ((file, args, timeoutMs) => defaultExecProbe(file, args, timeoutMs, deps.platform ?? process.platform, deps.fileExists ?? fs.existsSync)),
         timeoutMs: deps.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,
         live: context.liveRuntimes === true,
     };
@@ -241,7 +243,7 @@ export const runtimeHealthFamily = {
  * shape. First PATH entry containing an executable regular file wins, which is
  * exactly the copy a shell would run.
  */
-export function resolveOnPath(binary) {
+function resolveOnPath(binary) {
     const pathVar = process.env.PATH ?? "";
     for (const dir of pathVar.split(path.delimiter)) {
         if (!dir)
@@ -268,11 +270,22 @@ export function resolveOnPath(binary) {
  * CLI that reads piped stdin in non-TTY mode — blocks forever on a pipe that
  * never reaches EOF, which turns every probe into a timeout.
  */
-function defaultExecProbe(file, args, timeoutMs) {
+function defaultExecProbe(file, args, timeoutMs, platform, fileExists) {
     return new Promise((resolve) => {
-        const child = spawn(file, args, {
+        const cmdSibling = `${file}.cmd`;
+        const command = platform === "win32" &&
+            !/\.(?:cmd|bat|exe|com)$/i.test(file) &&
+            fileExists(cmdSibling)
+            ? cmdSibling
+            : file;
+        const plan = planCommandSpawn(command, args, platform);
+        const child = spawn(plan.cmd, plan.args, {
             cwd: os.tmpdir(),
             stdio: ["ignore", "pipe", "pipe"],
+            shell: plan.shell,
+            ...(plan.windowsVerbatimArguments === undefined
+                ? {}
+                : { windowsVerbatimArguments: plan.windowsVerbatimArguments }),
         });
         const cap = 1024 * 1024;
         let stdout = "";

package/dist/lib/doctor/checks/scaffold-cli-floor.d.ts

@@ -0,0 +1,6 @@
+import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
+export declare const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
+export declare const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
+export declare const scaffoldCliFloorFamily: CheckFamily;
+export declare function checkScaffoldCliFloor(context: CheckContext): CheckResult[];
+//# sourceMappingURL=scaffold-cli-floor.d.ts.map

package/dist/lib/doctor/checks/scaffold-cli-floor.js

@@ -0,0 +1,73 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+import { CLI_VERSION } from "../../../cli-version.js";
+import { compareScaffoldCliFloor } from "../../scaffold-cli-floor.js";
+export const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
+const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
+export const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
+export const scaffoldCliFloorFamily = {
+    id: SCAFFOLD_CLI_FLOOR_FAMILY_ID,
+    title: SCAFFOLD_CLI_FLOOR_FAMILY_TITLE,
+    run: (context) => Promise.resolve(checkScaffoldCliFloor(context)),
+};
+export function checkScaffoldCliFloor(context) {
+    const coreYamlPath = path.join(context.hqRoot, "core", "core.yaml");
+    if (!fs.existsSync(coreYamlPath)) {
+        return [skipped(coreYamlPath, "core/core.yaml is missing")];
+    }
+    let document;
+    try {
+        document = yaml.load(fs.readFileSync(coreYamlPath, "utf8"));
+    }
+    catch {
+        return [
+            {
+                status: "WARN",
+                checkId: SCAFFOLD_CLI_FLOOR_CHECK_ID,
+                target: coreYamlPath,
+                message: "core/core.yaml could not be parsed, so the hq-cli floor was not checked.",
+            },
+        ];
+    }
+    if (!document || typeof document !== "object" || Array.isArray(document)) {
+        if (document === undefined || document === null) {
+            return [skipped(coreYamlPath, "core/core.yaml does not declare requiresHqCli")];
+        }
+        return [
+            {
+                status: "WARN",
+                checkId: SCAFFOLD_CLI_FLOOR_CHECK_ID,
+                target: coreYamlPath,
+                message: "core/core.yaml is not a mapping, so the hq-cli floor was not checked.",
+            },
+        ];
+    }
+    const required = document.requiresHqCli;
+    const comparison = compareScaffoldCliFloor(required, CLI_VERSION);
+    if (comparison.status === "skip") {
+        return [skipped(coreYamlPath, "core/core.yaml does not declare requiresHqCli")];
+    }
+    return [
+        {
+            status: comparison.status === "pass"
+                ? "PASS"
+                : comparison.status === "fail"
+                    ? "FAIL"
+                    : "WARN",
+            checkId: SCAFFOLD_CLI_FLOOR_CHECK_ID,
+            target: coreYamlPath,
+            message: comparison.message,
+            ...(comparison.remediation ? { remediation: comparison.remediation } : {}),
+        },
+    ];
+}
+function skipped(target, reason) {
+    return {
+        status: "NA",
+        checkId: SCAFFOLD_CLI_FLOOR_CHECK_ID,
+        target,
+        message: `Skipped: ${reason}; no hq-cli floor was checked.`,
+    };
+}
+//# sourceMappingURL=scaffold-cli-floor.js.map

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -64,6 +64,8 @@ export interface SyncManifestUploadStatus {
 }
 /** Injectable dependencies — defaults are the real collectors. */
 export interface SyncHealthDeps {
+    /** Runner log and conflict signals; omitted in unit tests of other checks. */
+    runtime?: (now: Date) => CheckResult[];
     versions: (hqRoot: string) => SyncVersionInfo;
     journals: () => readonly SyncJournalSummary[];
     now: () => Date;
@@ -91,7 +93,26 @@ export interface SyncHealthDeps {
      * scope that is fine.
      */
     unresolvedScopes?: (journals: readonly SyncJournalSummary[]) => readonly string[];
+    /**
+     * Whether a company slug has a local `companies/<slug>` directory in the HQ
+     * tree. Leftover journal shards for companies this machine does not keep
+     * locally are NA, not WARN — a journal without a tree is not a corroborated
+     * unhealthy-sync signal, and `hq doctor --fix` has nothing local to refresh.
+     */
+    localCompanyExists?: (slug: string) => boolean;
 }
+/**
+ * True when `slug` is a filesystem-safe company folder name. Rejects empty
+ * values, path separators, and `..` so a journal slug cannot be used to probe
+ * outside `companies/`.
+ */
+export declare function isSafeCompanySlug(slug: string): boolean;
+/** True when `hqRoot/companies/<slug>` exists as a directory. Never throws. */
+export declare function defaultLocalCompanyExists(hqRoot: string, slug: string): boolean;
+/** True when this journal slug names a company rather than the personal tree. */
+export declare function isCompanyJournalSlug(slug: string): boolean;
+/** Company slug from a `sync.journal.<slug>` check id, or null if not one. */
+export declare function journalSlugFromCheckId(checkId: string): string | null;
 /** The versions/sync check family. Registered in `createDefaultRegistry`. */
 export declare const syncHealthFamily: CheckFamily;
 /** Run every versions/sync check. A thrown check degrades to UNKNOWN. */