@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/core-checkpoint-stop-gate-native.js

@@ -0,0 +1,725 @@
+/** Native fast-route implementation of checkpoint-stop-gate.sh. */
+import * as childProcess from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const CHECKPOINT_STOP_GATE_ASSET = "core/scripts/checkpoint-stop-gate.sh";
+const expectedFsMiss = (error) => {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "ELOOP";
+};
+const defaults = () => ({
+    env: process.env,
+    now: () => new Date(),
+    readFile: (filePath) => fs.readFileSync(filePath, "utf8"),
+    exists: (filePath) => fs.existsSync(filePath),
+    isFile: (filePath) => { try {
+        return fs.statSync(filePath).isFile();
+    }
+    catch (e) {
+        if (expectedFsMiss(e))
+            return false;
+        throw e;
+    } },
+    isDirectory: (filePath) => { try {
+        return fs.statSync(filePath).isDirectory();
+    }
+    catch (e) {
+        if (expectedFsMiss(e))
+            return false;
+        throw e;
+    } },
+    canRead: (filePath) => { try {
+        fs.accessSync(filePath, fs.constants.R_OK);
+        return true;
+    }
+    catch (e) {
+        if (expectedFsMiss(e))
+            return false;
+        throw e;
+    } },
+    canWrite: (filePath) => { try {
+        fs.accessSync(filePath, fs.constants.W_OK);
+        return true;
+    }
+    catch (e) {
+        if (expectedFsMiss(e))
+            return false;
+        throw e;
+    } },
+    mtimeSeconds: (filePath) => Math.floor(fs.statSync(filePath).mtimeMs / 1000),
+    mkdir: (directory) => fs.mkdirSync(directory, { recursive: true }),
+    writeFile: (filePath, contents, mode) => fs.writeFileSync(filePath, contents, mode === undefined ? undefined : { mode }),
+    appendFile: (filePath, contents) => fs.appendFileSync(filePath, contents),
+    rename: (from, to) => fs.renameSync(from, to),
+    remove: (filePath) => { try {
+        fs.rmSync(filePath, { recursive: true, force: true });
+    }
+    catch (e) {
+        if (!expectedFsMiss(e))
+            throw e;
+    } },
+    touch: (filePath) => {
+        const now = new Date();
+        try {
+            fs.utimesSync(filePath, now, now);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            fs.writeFileSync(filePath, "", { mode: 0o666 });
+        }
+    },
+    makeTempPath: () => path.join(os.tmpdir(), `tmp.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`),
+    commandExists: (name, env) => {
+        for (const entry of (env?.PATH ?? process.env.PATH ?? "").split(path.delimiter)) {
+            if (!entry)
+                continue;
+            const candidate = path.join(entry, name);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                return true;
+            }
+            catch { /* try the next PATH entry */ }
+        }
+        return false;
+    },
+    spawnHqDetached: (args, env) => {
+        const child = childProcess.spawn("hq", args, { detached: true, stdio: "ignore", env: env ?? process.env });
+        child.unref();
+    },
+});
+function toShellString(value) {
+    if (value === undefined || value === null)
+        return "";
+    if (typeof value === "object")
+        return JSON.stringify(value);
+    return String(value);
+}
+function parseJson(text) {
+    return JSON.parse(text);
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function trimShell(value) {
+    return value.replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, "");
+}
+function jsonString(value) { return JSON.stringify(value); }
+function readIfReadable(filePath, deps) {
+    if (!deps.canRead(filePath))
+        return undefined;
+    try {
+        return deps.readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (expectedFsMiss(error))
+            return undefined;
+        throw error;
+    }
+}
+function readJsonFile(filePath, deps) {
+    const text = readIfReadable(filePath, deps);
+    if (text === undefined)
+        return undefined;
+    try {
+        return parseJson(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function timestamp(deps) {
+    return deps.now().toISOString().slice(0, 19) + "Z";
+}
+function safeSessionKey(raw, fallbackPid) {
+    // `tr -c` operates on bytes, so each byte of a multibyte character becomes `_`.
+    let value = [...Buffer.from(raw, "utf8")].map((byte) => byte >= 48 && byte <= 57 || byte >= 65 && byte <= 90 || byte >= 97 && byte <= 122 ||
+        byte === 46 || byte === 95 || byte === 45 ? String.fromCharCode(byte) : "_").join("");
+    value = value.replace(/^_/, "").replace(/_$/, "");
+    if (!value)
+        value = `session-${fallbackPid}`;
+    return value.slice(0, 96);
+}
+function boundCompany(root, sessionId, deps) {
+    if (!sessionId)
+        return "";
+    const sessionDir = path.join(root, "workspace", "sessions", sessionId);
+    const capability = readJsonFile(path.join(sessionDir, "scope-capability.json"), deps);
+    const capValue = toShellString(record(capability).company_slug);
+    if (capValue)
+        return capValue;
+    const meta = readIfReadable(path.join(sessionDir, "meta.yaml"), deps);
+    if (meta === undefined)
+        return "";
+    for (const line of meta.split("\n")) {
+        const first = line.match(/^\s*(\S+)/)?.[1] ?? "";
+        if (first !== "company_slug:")
+            continue;
+        return line.replace(/^[^:]+:[\t ]*/, "").replace(/^"|"$/g, "");
+    }
+    return "";
+}
+function gateCallerEmail(deps, home) {
+    if (deps.env.HQ_CHECKPOINT_CALLER_EMAIL)
+        return deps.env.HQ_CHECKPOINT_CALLER_EMAIL;
+    const tokenFile = deps.env.HQ_COGNITO_TOKENS_FILE ?? (home ? path.join(home, ".hq", "cognito-tokens.json") : "");
+    if (!tokenFile)
+        return "";
+    const tokens = record(readJsonFile(tokenFile, deps));
+    for (const key of ["idToken", "accessToken"]) {
+        const token = typeof tokens[key] === "string" ? tokens[key] : "";
+        const segment = token.split(".")[1] ?? "";
+        if (!segment)
+            continue;
+        try {
+            const payload = record(parseJson(Buffer.from(segment.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")));
+            const email = toShellString(payload["custom:delegatedEmail"] ?? payload.email);
+            if (/^.+@.+$/.test(email))
+                return email;
+        }
+        catch { /* malformed or opaque local token cache is fail-open */ }
+    }
+    return "";
+}
+function checkpointGateSwitch(key, root, deps) {
+    let raw = trimShell(deps.env[key] ?? "");
+    if (!raw) {
+        for (const file of [
+            path.join(root, ".claude", "settings.local.json"),
+            path.join(root, ".claude", "settings.json"),
+        ]) {
+            const docText = readIfReadable(file, deps);
+            if (docText === undefined)
+                continue;
+            let parsed;
+            try {
+                parsed = parseJson(docText);
+            }
+            catch {
+                continue;
+            }
+            const env = record(record(parsed).env);
+            if (!Object.prototype.hasOwnProperty.call(env, key))
+                continue;
+            const value = env[key];
+            if (typeof value !== "string" && typeof value !== "boolean" && typeof value !== "number") {
+                return { value: "", diagnostic: `checkpoint-stop-gate: ignoring ${key} in ${file} (not a value it can read; expected a string such as "0" or "1")\n` };
+            }
+            raw = trimShell(String(value));
+            if (raw)
+                break;
+            return { value: "", diagnostic: `checkpoint-stop-gate: ignoring ${key} in ${file} (not a value it can read; expected a string such as "0" or "1")\n` };
+        }
+    }
+    if (!raw)
+        return { value: "", diagnostic: "" };
+    const normalized = raw.toLowerCase();
+    if (["0", "false", "off", "no"].includes(normalized))
+        return { value: "0", diagnostic: "" };
+    if (["1", "true", "on", "yes"].includes(normalized))
+        return { value: "1", diagnostic: "" };
+    return {
+        value: "",
+        diagnostic: `checkpoint-stop-gate: ignoring ${key}=${raw} (expected 0/1, false/true, off/on or no/yes)\n`,
+    };
+}
+function companyGateOff(root, sessionId, home, deps) {
+    const company = boundCompany(root, sessionId, deps);
+    if (!company || company === "personal" || /[^a-z0-9-]/.test(company) || !home)
+        return false;
+    const directory = path.join(home, ".hq", "cache", "checkpoint-gate");
+    const cache = path.join(directory, `${company}.json`);
+    const refreshStamp = path.join(directory, `${company}.refresh`);
+    const parsed = record(readJsonFile(cache, deps));
+    const enabled = parsed.checkpointGateEnabled;
+    const value = enabled === false ? "off" : enabled === true ? "on" : "";
+    const fetchedRaw = parsed.fetched_at;
+    const fetched = typeof fetchedRaw === "number" && Number.isFinite(fetchedRaw) ? Math.floor(fetchedRaw) : 0;
+    const now = Math.floor(deps.now().getTime() / 1000);
+    if (now - fetched > 600 && deps.commandExists("hq", deps.env)) {
+        let stampMtime = 0;
+        try {
+            stampMtime = deps.mtimeSeconds(refreshStamp);
+        }
+        catch {
+            stampMtime = 0;
+        }
+        if (now - stampMtime > 600) {
+            try {
+                deps.mkdir(directory);
+                deps.touch(refreshStamp);
+                deps.spawnHqDetached(["core", "checkpoint-gate-setting", "--refresh", "--company", company]);
+            }
+            catch { /* cache refresh is best-effort and never gates this Stop */ }
+        }
+    }
+    return value === "off";
+}
+function payloadReplyEvidence(value) {
+    const obj = record(value);
+    if (!Object.prototype.hasOwnProperty.call(obj, "last_assistant_message"))
+        return { state: "absent", chars: 0 };
+    const message = obj.last_assistant_message;
+    if (typeof message === "string")
+        return { state: "present", chars: Array.from(message.replace(/\s+/g, "")).length };
+    if (Array.isArray(message)) {
+        const joined = message.map((item) => toShellString(record(item).text)).join("");
+        return { state: "present", chars: Array.from(joined.replace(/\s+/g, "")).length };
+    }
+    return { state: "invalid", chars: 0 };
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function nonWhitespaceLength(value) { return Array.from(value.replace(/\s+/g, "")).length; }
+function codexCommand(payload) {
+    const name = toShellString(payload.name);
+    const input = payload.input;
+    if (name === "exec" && typeof input === "string") {
+        const match = input.match(/tools\.exec_command\((\{.*\})\);/s);
+        if (match) {
+            try {
+                const args = JSON.parse(match[1]);
+                const command = toShellString(record(args).cmd);
+                if (command)
+                    return command;
+            }
+            catch { /* shell filter falls back to a JS object literal probe */ }
+            const cmdMatch = input.match(/(?:^|[,{}])\s*cmd\s*:\s*("(?:\\.|[^"\\])*")/s);
+            if (cmdMatch) {
+                try {
+                    return JSON.parse(cmdMatch[1]);
+                }
+                catch {
+                    return "";
+                }
+            }
+        }
+        return "";
+    }
+    if (name === "exec_command" || name === "Bash") {
+        if (isRecord(input))
+            return toShellString(input.cmd ?? input.command);
+        if (typeof input === "string") {
+            try {
+                const parsed = JSON.parse(input);
+                return toShellString(record(parsed).cmd ?? record(parsed).command);
+            }
+            catch {
+                return input;
+            }
+        }
+        if (typeof payload.arguments === "string") {
+            try {
+                const parsed = JSON.parse(payload.arguments);
+                return toShellString(record(parsed).cmd ?? record(parsed).command);
+            }
+            catch {
+                return "";
+            }
+        }
+    }
+    return "";
+}
+const CHECKPOINT_COMMAND = /(^\s*|[;&|()]\s*|\n\s*)(?:(?:command|exec)\s+)?(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s;&|()]*)\s+)*(?:(?:command|exec|env)\s+)?("[^"]*[/\\]hq"|[^\s;&|()]*[/\\]hq|hq)\s+core\s+checkpoint(\s|$)/;
+const PURE_CHECKPOINT = /^\s*(?:(?:command|exec)\s+)?(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s;&|()]*)\s+)*(?:(?:command|exec|env)\s+)?(?:"[^"]*[/\\]hq"|[^\s;&|()]*[/\\]hq|hq)(?<tail>\s+core\s+checkpoint(?:\s+[^;&|\n]*)?)$/;
+function stripQuoted(command) {
+    return command
+        .replace(/"(?:\\.|[^"\\])*"/g, "")
+        .replace(/'[^']*'/g, "");
+}
+function isCheckpointCommand(command) { return CHECKPOINT_COMMAND.test(command); }
+function isPureCheckpoint(command) {
+    const match = command.match(PURE_CHECKPOINT);
+    if (!match?.groups?.tail)
+        return false;
+    const normalized = command.replace(/(?:"[^"]*[/\\]hq"|[^\s;&|()]*[/\\]hq|hq)(?=\s+core\s+checkpoint)/, "hq");
+    const stripped = stripQuoted(normalized);
+    return /^\s*(?:(?:command|exec)\s+)?(?:env\s+)?(?:[A-Za-z_][A-Za-z0-9_]*=(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s;&|()]*)\s+)*(?:(?:command|exec|env)\s+)?hq\s+core\s+checkpoint([\s][^;&|\n]*)?$/.test(stripped);
+}
+function checkpointFlag(command, flag) {
+    return stripQuoted(command).split(/\s+/).includes(flag);
+}
+function parseTranscript(contents) {
+    const allLines = contents.split("\n");
+    const lines = allLines.slice(Math.max(0, allLines.length - 400));
+    const rows = [];
+    for (const raw of lines) {
+        if (!raw)
+            continue;
+        const value = JSON.parse(raw);
+        if (!isRecord(value))
+            throw new Error("invalid transcript row");
+        rows.push({ raw, entry: value });
+    }
+    const isUser = (entry) => {
+        if (entry.type === "user") {
+            const content = record(entry.message).content;
+            return typeof content === "string" || Array.isArray(content) && content.some((item) => record(item).type === "text");
+        }
+        const payload = record(entry.payload);
+        return entry.type === "response_item" && payload.type === "message" && payload.role === "user" &&
+            Array.isArray(payload.content) && payload.content.some((item) => record(item).type === "input_text");
+    };
+    const userIndexes = rows.flatMap((row, index) => isUser(row.entry) ? [index] : []);
+    if (!userIndexes.length)
+        throw new Error("no real user entry");
+    const userIndex = userIndexes[userIndexes.length - 1];
+    const genuine = userIndexes.filter((index) => {
+        const entry = rows[index].entry;
+        return !(entry.type === "user" && typeof record(entry.message).content === "string" &&
+            record(entry.message).content.startsWith("Stop hook feedback:"));
+    });
+    const genuineIndex = genuine.length ? genuine[genuine.length - 1] : userIndexes[0];
+    const events = [];
+    rows.forEach(({ entry }, row) => {
+        if (row <= genuineIndex)
+            return;
+        if (entry.type === "assistant") {
+            const content = record(entry.message).content;
+            if (!Array.isArray(content))
+                return;
+            for (const itemValue of content) {
+                const item = record(itemValue);
+                if (item.type === "tool_use") {
+                    events.push({ row, kind: "tool", runtime: "claude", id: toShellString(item.id), name: toShellString(item.name), command: toShellString(record(item.input).command) });
+                }
+                else if (item.type === "text") {
+                    events.push({ row, kind: "text", chars: nonWhitespaceLength(toShellString(item.text)) });
+                }
+            }
+        }
+        else if (entry.type === "response_item") {
+            const payload = record(entry.payload);
+            if (payload.type === "custom_tool_call" || payload.type === "function_call") {
+                events.push({ row, kind: "tool", runtime: "codex", id: toShellString(payload.call_id ?? payload.id), name: toShellString(payload.name), command: codexCommand(payload) });
+            }
+            else if (payload.type === "message" && payload.role === "assistant" && Array.isArray(payload.content)) {
+                const text = payload.content.map((item) => toShellString(record(item).text)).join("");
+                events.push({ row, kind: "text", chars: nonWhitespaceLength(text) });
+            }
+        }
+    });
+    const segment = events.filter((event) => event.row > userIndex);
+    const tools = events.filter((event) => event.kind === "tool");
+    const lastTool = tools.at(-1);
+    const segmentToolIndex = segment.reduce((found, event, index) => event.kind === "tool" ? index : found, -1);
+    const segmentReplyChars = segment.slice(segmentToolIndex + 1).reduce((sum, event) => sum + (event.kind === "text" ? event.chars : 0), 0);
+    const lastWorkIndex = events.reduce((found, event, index) => event.kind === "tool" && !isCheckpointCommand(event.command) ? index : found, -1);
+    const replyChars = events.slice(lastWorkIndex + 1).reduce((sum, event) => sum + (event.kind === "text" ? event.chars : 0), 0);
+    const workTools = tools.filter((tool) => !isCheckpointCommand(tool.command));
+    const lastResultError = rows.some(({ entry }) => {
+        if (entry.type !== "user" || !Array.isArray(record(entry.message).content))
+            return false;
+        return record(entry.message).content.some((itemValue) => {
+            const item = record(itemValue);
+            return item.type === "tool_result" && item.tool_use_id === lastTool?.id && item.is_error === true;
+        });
+    });
+    if (tools.length > 0 && lastTool && isCheckpointCommand(lastTool.command)) {
+        if (lastTool.runtime === "claude" && !lastResultError) {
+            const pure = isPureCheckpoint(lastTool.command);
+            const replyRequired = !pure || (!checkpointFlag(lastTool.command, "--gate-probe") &&
+                (!checkpointFlag(lastTool.command, "--idle") || workTools.length > 0));
+            return { kind: "checkpoint", toolId: lastTool.id, replyChars, replyRequired };
+        }
+        if (lastTool.runtime === "codex")
+            return { kind: "stamp" };
+        return segmentReplyChars > 0 ? { kind: "replied" } : { kind: "unreplied" };
+    }
+    if (workTools.length === 0)
+        return { kind: "idle" };
+    return segmentReplyChars > 0 ? { kind: "replied" } : { kind: "unreplied" };
+}
+function countFile(filePath, deps) {
+    const text = readIfReadable(filePath, deps) ?? "";
+    const value = text.replace(/[\r\n]/g, "");
+    return /^\d+$/.test(value) ? Number(value) : 0;
+}
+function atomicStateWrite(filePath, value, deps) {
+    const temp = `${filePath}.${process.pid}`;
+    try {
+        deps.writeFile(temp, value, 0o600);
+        deps.rename(temp, filePath);
+    }
+    catch (error) {
+        try {
+            deps.remove(temp);
+        }
+        catch { /* shell ignores cleanup failure */ }
+        throw error;
+    }
+}
+function incrementBlockCount(filePath, count, deps) {
+    atomicStateWrite(filePath, String(count + 1), deps);
+}
+function block(reason) {
+    return { code: 0, stdout: `${JSON.stringify({ decision: "block", reason })}\n`, stderr: "" };
+}
+const COMPANY_SCOPE_REASON = (root, sessionId) => `This session has not declared its scope, and a scope is required before the turn can end. Decide where this work belongs, then bind the session and finish the turn with your user-facing reply as the final text after the command output:\n\n  bash ${root}/core/scripts/hq-session.sh --session-id ${sessionId} set company_slug <company-slug>\n\nUse a real tenant slug from companies/manifest.yaml — the company this session is actually working in, never an invented one. If this session does no company-scoped work, bind it to the reserved personal scope instead:\n\n  bash ${root}/core/scripts/hq-session.sh --session-id ${sessionId} set company_slug personal\n\nAn operator can also disable this requirement for the run by exporting HQ_CHECKPOINT_GATE=0, or for every runtime by putting "env": {"HQ_CHECKPOINT_GATE": "0"} in .claude/settings.json.`;
+const REPLY_REASON = "Checkpoint recorded — but the turn cannot end yet: the user has not received a reply this turn. The checkpoint payload went to a background maintenance agent; the user sees NONE of it, and nothing you have written since your last real action reads as a reply to them. Deliver your complete reply to the user now, as ordinary text: every result, finding, link, decision, and anything awaiting their input, in plain language. Do not run another checkpoint and do not call any other tool — end the turn with text only.";
+const MISSING_CHECKPOINT_REASON = (sessionId) => {
+    const flags = `  hq core checkpoint --session-id ${sessionId} --trigger stop-gate --summary "<what changed, in one line>" [--file <path>] [--decision "<choice and why>"] [--learning "<reusable rule>"] [--next "<outstanding step>"]\n\nOnly --summary is required, and the repeatable flags are what the sibling uses to enrich the record, distil policies and update the indexes — a bare summary gives it almost nothing to work with. Write them as machine record, not prose for the user, and pass each one that genuinely applies:\n  --file      every path you created or modified this turn\n  --decision  a choice you made that a reader would otherwise have to reverse-engineer\n  --learning  a rule that changes how someone acts next time, not a restatement of what just happened\n  --next      work that is genuinely still outstanding\nOmit a flag rather than padding it: an empty or invented learning is worse than none.\n\nIf this turn only read or inspected things and changed no state, the correct call instead is:\n\n  hq core checkpoint --session-id ${sessionId} --idle`;
+    return `This turn changed something, so it needs an end-of-turn checkpoint. Two different audiences are involved — do not conflate them:\n\n1. THE USER reads your normal chat reply. You have not sent one yet this turn — everything you owe them (results, links, answers, status, decisions) must go into it. The checkpoint is invisible to them and does NOT count as having replied.\n2. THE SIBLING (a background maintenance agent) reads the checkpoint payload. It never sees your chat reply, so anything it needs must go into the flags.\n\nORDER: run the checkpoint FIRST, then deliver your complete user-facing reply as the FINAL text of the turn — final-position text is the one placement every host renders in full. Every link, URL, instruction, command, and decision the user needs must appear in that final message. The gate enforces this: a turn that ends without a user-facing reply is blocked until the reply is delivered.\n\n${flags}`;
+};
+/** In-process command body with injectable filesystem, clock, PATH, and hq process. */
+export function executeCheckpointStopGate(input, context, overrides = {}) {
+    const deps = { ...defaults(), ...overrides };
+    const env = deps.env;
+    const home = env.HOME ?? "";
+    const selfRoot = context.hqRoot || context.cwd;
+    const root = env.CLAUDE_PROJECT_DIR || env.HQ_ROOT || selfRoot || (home ? path.join(home, "Documents", "HQ") : "");
+    const companyGateRoot = env.HQ_ROOT || env.CLAUDE_PROJECT_DIR || selfRoot;
+    let payload;
+    try {
+        payload = record(parseJson(input || "{}"));
+    }
+    catch {
+        return { code: 0, stdout: "", stderr: "" };
+    }
+    const evidence = payloadReplyEvidence(payload);
+    // The shell's jq-backed input_fields assignment exits successfully before
+    // any state work when jq is unavailable. Keep that early-exit ordering even
+    // though the native parser does not otherwise need jq.
+    if (!deps.commandExists("jq", env))
+        return { code: 0, stdout: "", stderr: "" };
+    const transcriptPath = toShellString(payload.transcript_path);
+    const sessionId = toShellString(payload.session_id);
+    if (env.HQ_CHECKPOINT_SIBLING === "1")
+        return { code: 0, stdout: "", stderr: "" };
+    const setting = checkpointGateSwitch("HQ_CHECKPOINT_GATE", root, deps);
+    let stderr = setting.diagnostic;
+    const gateSwitch = setting.value;
+    const domains = env.HQ_CHECKPOINT_SCOPE_GATE_DOMAINS ?? "";
+    if (gateSwitch !== "0" && domains && sessionId) {
+        const email = gateCallerEmail(deps, home).toLowerCase();
+        const matched = email && domains.split(",").some((domain) => {
+            const normalized = domain.replace(/\s/g, "").toLowerCase();
+            return !!normalized && email.endsWith(`@${normalized}`);
+        });
+        if (matched) {
+            const company = boundCompany(companyGateRoot, sessionId, deps);
+            const bound = company === "personal" || !!company && deps.isDirectory(path.join(companyGateRoot, "companies", company));
+            if (!bound)
+                return { code: 0, stdout: block(COMPANY_SCOPE_REASON(companyGateRoot, sessionId)).stdout, stderr };
+        }
+    }
+    if (!gateSwitch && companyGateOff(companyGateRoot, sessionId, home, deps))
+        return { code: 0, stdout: "", stderr };
+    const runtime = env.HQ_CHECKPOINT_RUNTIME || "claude";
+    let enforce;
+    if (gateSwitch === "0")
+        return { code: 0, stdout: "", stderr };
+    if (gateSwitch === "1")
+        enforce = true;
+    else if (runtime === "claude")
+        enforce = true;
+    else if (runtime === "codex")
+        enforce = false;
+    else
+        return { code: 0, stdout: "", stderr };
+    const stateDir = path.join(root, "workspace", "orchestrator", "hook-state");
+    try {
+        deps.mkdir(stateDir);
+    }
+    catch {
+        // hook-lib.sh runs `mkdir -p ... 2>/dev/null || true`; the directory and
+        // write checks below determine whether this invocation can continue.
+    }
+    if (!deps.isDirectory(stateDir) || !deps.canWrite(stateDir))
+        return { code: 0, stdout: "", stderr };
+    const eligibilityFile = path.join(stateDir, `checkpoint-gate-eligible-${runtime}`);
+    const refreshEligibility = () => {
+        if (deps.commandExists("hq", env))
+            deps.spawnHqDetached(["core", "checkpoint", "--gate-probe"], { ...env, HQ_CHECKPOINT_RUNTIME: runtime });
+    };
+    if (runtime === "codex" && !enforce) {
+        if (!deps.exists(eligibilityFile)) {
+            try {
+                refreshEligibility();
+            }
+            catch { /* fail open */ }
+            return { code: 0, stdout: "", stderr };
+        }
+        if (!deps.canRead(eligibilityFile))
+            return { code: 0, stdout: "", stderr };
+        const eligibility = (readIfReadable(eligibilityFile, deps) ?? "").replace(/[\r\n]/g, "");
+        if (eligibility === "0")
+            return { code: 0, stdout: "", stderr };
+        if (eligibility !== "1")
+            return { code: 0, stdout: "", stderr };
+        let mtime;
+        try {
+            mtime = deps.mtimeSeconds(eligibilityFile);
+        }
+        catch {
+            return { code: 0, stdout: "", stderr };
+        }
+        const now = Math.floor(deps.now().getTime() / 1000);
+        if (now - mtime > 86400) {
+            try {
+                refreshEligibility();
+            }
+            catch { /* fail open */ }
+        }
+        enforce = true;
+    }
+    if (!deps.commandExists("hq", env) || !transcriptPath || !deps.isFile(transcriptPath) || !deps.canRead(transcriptPath) || !sessionId) {
+        return { code: 0, stdout: "", stderr };
+    }
+    const safeKey = safeSessionKey(sessionId, process.ppid);
+    if (!safeKey)
+        return { code: 0, stdout: "", stderr };
+    const ambiguityLog = path.join(stateDir, "checkpoint-stop-gate-ambiguity.log");
+    const logAmbiguity = (reason) => {
+        try {
+            deps.appendFile(ambiguityLog, `${timestamp(deps)}\t${safeKey}\treply-evidence-ambiguous\t${reason}\n`);
+        }
+        catch { /* shell ignores failed diagnostics */ }
+    };
+    const transcript = readIfReadable(transcriptPath, deps);
+    if (transcript === undefined)
+        return { code: 0, stdout: "", stderr };
+    let verdict;
+    try {
+        verdict = parseTranscript(transcript);
+    }
+    catch {
+        logAmbiguity("transcript-parse-failed");
+        return { code: 0, stdout: "", stderr };
+    }
+    let satisfied = "0";
+    let replied = verdict.kind === "replied" ? 1 : 0;
+    let toolId = "";
+    let replyChars = 0;
+    let replyRequired = "";
+    if (verdict.kind === "checkpoint") {
+        satisfied = "1";
+        toolId = verdict.toolId;
+        replyChars = verdict.replyChars;
+        replyRequired = verdict.replyRequired ? "1" : "0";
+    }
+    else if (verdict.kind === "stamp")
+        satisfied = "stamp";
+    else if (verdict.kind === "idle")
+        satisfied = "idle";
+    if (evidence.state === "present" && runtime === "claude") {
+        if (satisfied === "1")
+            replyChars = Math.max(replyChars, evidence.chars);
+        else if (satisfied === "0" && evidence.chars > 0)
+            replied = 1;
+    }
+    let ambiguous = false;
+    if ((evidence.state === "absent" || evidence.state === "invalid") && runtime === "claude" && replyChars === 0) {
+        if (satisfied === "1" && replyRequired === "1")
+            ambiguous = true;
+        else if (satisfied === "0") {
+            ambiguous = true;
+            replied = 1;
+        }
+    }
+    if (ambiguous)
+        logAmbiguity(`payload=${evidence.state};transcript-reply-chars=${replyChars}`);
+    if (satisfied === "stamp") {
+        satisfied = "0";
+        const stampFile = path.join(stateDir, `checkpoint-cli-last-${safeKey}`);
+        const stampText = readIfReadable(stampFile, deps);
+        if (stampText !== undefined) {
+            const stampValue = stampText.replace(/[\r\n]/g, "");
+            const now = Math.floor(deps.now().getTime() / 1000);
+            if (/^\d+$/.test(stampValue)) {
+                const age = now - Number(stampValue);
+                if (age >= 0 && age <= 120)
+                    satisfied = "1";
+            }
+        }
+    }
+    const blockCountFile = path.join(stateDir, `checkpoint-block-count-${safeKey}`);
+    const blockCount = countFile(blockCountFile, deps);
+    const bump = () => incrementBlockCount(blockCountFile, blockCount, deps);
+    if (satisfied === "1" || satisfied === "idle") {
+        if (runtime === "codex") {
+            try {
+                deps.remove(path.join(stateDir, `codex-checkpoint-reprompt-${safeKey}`));
+            }
+            catch { /* best effort */ }
+        }
+        if (satisfied === "1" && runtime === "claude" && replyRequired === "1" && toolId && !ambiguous) {
+            const minimumRaw = env.HQ_CHECKPOINT_REPLY_MIN || "1";
+            const minimum = /^\d+$/.test(minimumRaw) ? Number.parseInt(minimumRaw, 10) : 1;
+            if (minimum > 0 && replyChars < minimum && blockCount < 3) {
+                const nudgeFile = path.join(stateDir, `checkpoint-reply-nudge-${safeKey}`);
+                const previous = readIfReadable(nudgeFile, deps) ?? "";
+                if (previous !== toolId) {
+                    try {
+                        atomicStateWrite(nudgeFile, toolId, deps);
+                        bump();
+                    }
+                    catch {
+                        try {
+                            deps.remove(`${nudgeFile}.${process.pid}`);
+                        }
+                        catch { /* ignored by the shell */ }
+                    }
+                    if (readIfReadable(nudgeFile, deps) === toolId)
+                        return { code: 0, stdout: block(REPLY_REASON).stdout, stderr };
+                }
+            }
+        }
+        try {
+            deps.remove(blockCountFile);
+        }
+        catch { /* allow path is fail-open */ }
+        return { code: 0, stdout: "", stderr };
+    }
+    if (replied === 1) {
+        try {
+            deps.spawnHqDetached([
+                "core", "checkpoint", "--session-id", sessionId, "--trigger", "stop-gate-auto",
+                "--transcript", transcriptPath, "--summary", "turn ended with its user-facing reply already delivered",
+            ]);
+        }
+        catch { /* an automatic checkpoint is best-effort */ }
+        try {
+            deps.remove(blockCountFile);
+        }
+        catch { /* fail-open */ }
+        return { code: 0, stdout: "", stderr };
+    }
+    if (blockCount >= 3)
+        return { code: 0, stdout: "", stderr };
+    try {
+        bump();
+    }
+    catch {
+        return { code: 0, stdout: "", stderr };
+    }
+    let reason = MISSING_CHECKPOINT_REASON(sessionId);
+    if (runtime === "codex") {
+        const repromptFile = path.join(stateDir, `codex-checkpoint-reprompt-${safeKey}`);
+        try {
+            atomicStateWrite(repromptFile, reason, deps);
+            reason = "Hook re-prompted Codex";
+        }
+        catch {
+            try {
+                deps.remove(`${repromptFile}.${process.pid}`);
+            }
+            catch { /* shell ignores cleanup */ }
+        }
+    }
+    return { code: 0, stdout: block(reason).stdout, stderr };
+}
+/** Signature consumed by the lightweight fast-core dispatcher. */
+export async function runCheckpointStopGateFast(_argv, stdin, cwd, hqRoot) {
+    const result = executeCheckpointStopGate(stdin, { cwd, hqRoot });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-checkpoint-stop-gate-native.js.map