@indigoai-us/hq-cli 5.345.147 → 5.345.149

package/dist/lib/daemon/lock.js

@@ -53,6 +53,11 @@ export function processCommandLine(pid, deps = defaultCommandLineDeps()) {
  * The pid is alive and is an `hq daemon run`. After a reboot the pid in an old
  * lock file often belongs to an unrelated program; that must not keep the
  * daemon from starting.
+ *
+ * An unreadable command line counts as the daemon here, so a second daemon is
+ * never started next to one HQ cannot inspect. Never use this to decide a
+ * kill: use `verifyDaemonForKill`, which treats an unreadable command line as
+ * "not the daemon".
  */
 export function isDaemonProcess(pid, deps = { alive: (p) => isProcessAlive(p), commandLine: (p) => processCommandLine(p) }) {
     if (!deps.alive(pid))
@@ -60,6 +65,50 @@ export function isDaemonProcess(pid, deps = { alive: (p) => isProcessAlive(p), c
     const cmd = deps.commandLine(pid);
     return cmd === null || /\bdaemon\s+run\b/.test(cmd);
 }
+/**
+ * PowerShell that prints a Windows process's creation time (UTC, ISO 8601) on
+ * the first line and its command line on the rest, or nothing when no process
+ * has that id. It uses only a cmdlet and DateTime methods, so it also runs in
+ * Constrained Language Mode. `-ErrorAction Stop` makes a WMI failure exit
+ * non-zero, so it reads as "could not read", never as "no such process".
+ */
+export function windowsProcessIdentityScript(pid) {
+    return (`$p = Get-CimInstance Win32_Process -Filter "ProcessId=${Math.trunc(pid)}" -ErrorAction Stop; ` +
+        "if ($p) { $p.CreationDate.ToUniversalTime().ToString('o'); [string]$p.CommandLine }");
+}
+/** Seconds a daemon's creation time may follow its lock's ts (whole-second rounding and clock skew). */
+const LOCK_TS_SLACK_SECONDS = 2;
+/**
+ * Decide whether the Windows process in `owner` may be killed as the HQ
+ * daemon. Run this immediately before the kill. It is the daemon only when the
+ * process exists, its command line is readable and is `hq daemon run`, and it
+ * was created no later than the lock was written. A process created after the
+ * lock took over a pid the old daemon left behind. Anything that cannot be
+ * read is "unverified", and the caller must not kill.
+ */
+export function verifyDaemonForKill(owner, run) {
+    const encoded = Buffer.from(windowsProcessIdentityScript(owner.pid), "utf16le").toString("base64");
+    const r = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded]);
+    if (r.status !== 0)
+        return { verdict: "unverified", reason: "HQ could not read the process" };
+    const lines = r.stdout.split(/\r?\n/).map((l) => l.trim());
+    while (lines.length > 0 && lines[lines.length - 1] === "")
+        lines.pop();
+    if (lines.length === 0)
+        return { verdict: "gone" };
+    const commandLine = lines.slice(1).join(" ").trim();
+    if (!commandLine)
+        return { verdict: "unverified", reason: "HQ could not read its command line" };
+    if (!/\bdaemon\s+run\b/.test(commandLine))
+        return { verdict: "unverified", reason: "it is not hq daemon run" };
+    const created = Date.parse(lines[0]);
+    if (!Number.isFinite(created))
+        return { verdict: "unverified", reason: "HQ could not read its start time" };
+    if (Math.floor(created / 1000) > owner.ts + LOCK_TS_SLACK_SECONDS) {
+        return { verdict: "unverified", reason: "it started after the daemon lock was written, so it is a different process" };
+    }
+    return { verdict: "daemon" };
+}
 function claimTakeover(claim, pid, now) {
     for (let attempt = 0; attempt < 2; attempt++) {
         try {
@@ -130,9 +179,13 @@ export function releaseDaemonLock(lockPath, pid = process.pid) {
     if (owner?.pid === pid)
         fs.rmSync(lockPath, { force: true });
 }
+/** The live supervisor's lock record (pid and start time), or null when none is running. */
+export function liveDaemonLock(lockPath, alive = isDaemonProcess) {
+    const owner = readPidLock(lockPath);
+    return owner && alive(owner.pid) ? owner : null;
+}
 /** The live supervisor's pid, or null when none is running. */
 export function runningDaemonPid(lockPath, alive = isDaemonProcess) {
-    const owner = readPidLock(lockPath);
-    return owner && alive(owner.pid) ? owner.pid : null;
+    return liveDaemonLock(lockPath, alive)?.pid ?? null;
 }
 //# sourceMappingURL=lock.js.map

package/dist/lib/db/local.d.ts

@@ -4,9 +4,9 @@
  * File lives at ~/.hq/db/{company}/vault.db with WAL journal mode.
  * Never returns or logs remote connection strings.
  */
-import Database from "better-sqlite3";
+import type BetterSqlite3 from "better-sqlite3";
 import { type LocalDbPathEnv } from "./paths.js";
-export type LocalDb = Database.Database;
+export type LocalDb = BetterSqlite3.Database;
 export interface OpenLocalDbOptions extends LocalDbPathEnv {
     /** When true, do not create the file if missing (throws). Default false. */
     readonly?: boolean;

package/dist/lib/db/local.js

@@ -5,7 +5,7 @@
  * Never returns or logs remote connection strings.
  */
 import fs from "node:fs";
-import Database from "better-sqlite3";
+import { loadBetterSqlite3 } from "./sqlite-binding.js";
 import { ensureLocalDbDir, resolveLocalDbPath, } from "./paths.js";
 const MIGRATIONS_TABLE = "hq_schema_migrations";
 /**
@@ -33,7 +33,7 @@ export function openLocalDb(companySlug, opts) {
         }
         ensureLocalDbDir(companySlug, opts);
     }
-    const db = new Database(dbPath);
+    const db = new (loadBetterSqlite3())(dbPath);
     // WAL for concurrent readers; safe for agent/CLI workloads.
     db.pragma("journal_mode = WAL");
     db.pragma("foreign_keys = ON");

package/dist/lib/db/sql.js

@@ -5,7 +5,7 @@
  * resolved company slug from HQ session/flags. Path overrides that open
  * another company's DB are denied unless an explicit dangerous flag is set.
  */
-import Database from "better-sqlite3";
+import { loadBetterSqlite3 } from "./sqlite-binding.js";
 import { openLocalDb } from "./local.js";
 import { normalizeCompanySlugForLocalDb, resolveLocalDbPath, } from "./paths.js";
 const WRITE_PATTERN = /^\s*(INSERT|UPDATE|DELETE|REPLACE|CREATE|DROP|ALTER|TRUNCATE|REINDEX|VACUUM|BEGIN|COMMIT|ROLLBACK)\b/i;
@@ -49,7 +49,7 @@ export function resolveSqlDbPath(opts) {
     return opts.dbPathOverride;
 }
 function openByPath(dbPath) {
-    const db = new Database(dbPath);
+    const db = new (loadBetterSqlite3())(dbPath);
     db.pragma("journal_mode = WAL");
     db.pragma("foreign_keys = ON");
     return db;

package/dist/lib/db/sqlite-binding.d.ts

@@ -0,0 +1,22 @@
+import type BetterSqlite3 from "better-sqlite3";
+import { type SpawnPlan } from "../../utils/windows-spawn.js";
+export type BetterSqlite3Constructor = typeof BetterSqlite3;
+export declare class SqliteBindingError extends Error {
+    constructor(cause?: unknown);
+}
+export interface LoadBetterSqlite3Options {
+    importDatabase?: () => BetterSqlite3Constructor;
+    /** Return true when the native binary is ready to load again. */
+    repair?: () => boolean;
+}
+export declare function resetSqliteBindingForTests(): void;
+export declare function clearBetterSqlite3RequireCache(): void;
+/**
+ * A `.js` bin runs under this Node. A `.cmd` shim goes through the escaped
+ * cmd.exe plan, so a profile path with spaces or `&` stays one argument.
+ */
+export declare function planRepairToolSpawn(cmd: string, args: readonly string[], env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SpawnPlan;
+/** Download or build better-sqlite3's native binary inside its own package directory. */
+export declare function repairBetterSqlite3(): boolean;
+export declare function loadBetterSqlite3(options?: LoadBetterSqlite3Options): BetterSqlite3Constructor;
+//# sourceMappingURL=sqlite-binding.d.ts.map

package/dist/lib/db/sqlite-binding.js

@@ -0,0 +1,168 @@
+/**
+ * Load better-sqlite3 without requiring the user to approve npm scripts.
+ * npm 11 skips dependency install scripts, so the prebuilt binary is often
+ * missing after `npm install -g`. Try a one-shot prebuild download from the
+ * installed package, then surface the exact allow-scripts command.
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { planResolvedCommandSpawn } from "../../utils/windows-spawn.js";
+const require = createRequire(import.meta.url);
+export class SqliteBindingError extends Error {
+    constructor(cause) {
+        super("better-sqlite3 did not load. npm 11.16 and later skip its install script unless scripts are allowed, so the prebuilt binary was not downloaded. " +
+            "HQ tried to download the prebuild and it still failed. " +
+            "Fix: npm install -g @indigoai-us/hq-cli --allow-scripts=better-sqlite3");
+        this.name = "SqliteBindingError";
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+let cached;
+let failed;
+let defaultRepairAttempted = false;
+export function resetSqliteBindingForTests() {
+    cached = undefined;
+    failed = undefined;
+    defaultRepairAttempted = false;
+}
+function isNativeBindingError(error) {
+    const record = error;
+    const text = error instanceof Error ? `${record?.code ?? ""} ${error.message}` : String(error);
+    return /better_sqlite3\.node|could not locate the bindings file|NODE_MODULE_VERSION|was compiled against a different node|not a valid win32 application|dlopen|ERR_DLOPEN_FAILED|MODULE_NOT_FOUND/i.test(text);
+}
+export function clearBetterSqlite3RequireCache() {
+    for (const id of Object.keys(require.cache)) {
+        if (id.includes(`${path.sep}better-sqlite3${path.sep}`))
+            delete require.cache[id];
+    }
+}
+function defaultImport() {
+    return require("better-sqlite3");
+}
+function resolveTool(dir, tool) {
+    const names = process.platform === "win32" ? [`${tool}.cmd`, `${tool}.exe`, tool] : [tool];
+    const bins = [path.join(path.dirname(dir), ".bin"), path.join(dir, "node_modules", ".bin")];
+    for (const bin of bins) {
+        for (const name of names) {
+            const candidate = path.join(bin, name);
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+    }
+    try {
+        const localRequire = createRequire(path.join(dir, "package.json"));
+        const pkgJson = localRequire.resolve(`${tool}/package.json`);
+        const pkg = JSON.parse(fs.readFileSync(pkgJson, "utf8"));
+        const rel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.[tool];
+        if (typeof rel === "string")
+            return path.join(path.dirname(pkgJson), rel);
+    }
+    catch {
+        // The tool is not installed next to better-sqlite3.
+    }
+    return null;
+}
+/**
+ * A `.js` bin runs under this Node. A `.cmd` shim goes through the escaped
+ * cmd.exe plan, so a profile path with spaces or `&` stays one argument.
+ */
+export function planRepairToolSpawn(cmd, args, env = process.env, platform = process.platform) {
+    if (cmd.endsWith(".js"))
+        return { cmd: process.execPath, args: [cmd, ...args], shell: false };
+    return planResolvedCommandSpawn(cmd, args, env, platform);
+}
+function runTool(cmd, args, cwd) {
+    const plan = planRepairToolSpawn(cmd, args);
+    spawnSync(plan.cmd, plan.args, {
+        cwd,
+        timeout: 60_000,
+        windowsHide: true,
+        stdio: "ignore",
+        shell: plan.shell,
+        ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
+}
+/** Download or build better-sqlite3's native binary inside its own package directory. */
+export function repairBetterSqlite3() {
+    let dir;
+    try {
+        dir = path.dirname(require.resolve("better-sqlite3/package.json"));
+    }
+    catch {
+        return false;
+    }
+    const artifact = path.join(dir, "build", "Release", "better_sqlite3.node");
+    if (fs.existsSync(artifact))
+        return true;
+    const prebuild = resolveTool(dir, "prebuild-install");
+    if (prebuild)
+        runTool(prebuild, [], dir);
+    if (fs.existsSync(artifact))
+        return true;
+    const nodeGyp = resolveTool(dir, "node-gyp");
+    if (nodeGyp)
+        runTool(nodeGyp, ["rebuild", "--release"], dir);
+    return fs.existsSync(artifact);
+}
+function attemptRepair(options) {
+    if (options.repair) {
+        try {
+            return options.repair();
+        }
+        catch {
+            return false;
+        }
+    }
+    if (defaultRepairAttempted)
+        return false;
+    defaultRepairAttempted = true;
+    try {
+        return repairBetterSqlite3();
+    }
+    catch {
+        return false;
+    }
+}
+export function loadBetterSqlite3(options = {}) {
+    const injected = options.importDatabase !== undefined;
+    if (!injected && cached)
+        return cached;
+    if (!injected && failed)
+        throw failed;
+    const importDatabase = options.importDatabase ?? defaultImport;
+    const load = () => {
+        const ctor = importDatabase();
+        if (!injected)
+            cached = ctor;
+        return ctor;
+    };
+    try {
+        return load();
+    }
+    catch (error) {
+        if (!isNativeBindingError(error))
+            throw error;
+        const repaired = attemptRepair(options);
+        if (!repaired) {
+            const wrapped = new SqliteBindingError(error);
+            if (!injected)
+                failed = wrapped;
+            throw wrapped;
+        }
+        if (!injected)
+            clearBetterSqlite3RequireCache();
+        try {
+            return load();
+        }
+        catch (retryError) {
+            const wrapped = new SqliteBindingError(retryError);
+            if (!injected)
+                failed = wrapped;
+            throw wrapped;
+        }
+    }
+}
+//# sourceMappingURL=sqlite-binding.js.map

package/dist/lib/doctor/__testing__/run-doctor.js

@@ -3,6 +3,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { runDoctor as runDoctorCommand, } from "../../../commands/doctor.js";
 import { createAnywhereFamily } from "../checks/anywhere.js";
+import { createTempHomesFamily } from "../checks/temp-homes.js";
 import { createDefaultRegistry } from "../registry.js";
 /**
  * Run doctor tests against synthetic state. The production registry normally
@@ -45,6 +46,9 @@ export async function runDoctorForTest(options = {}) {
             // Command tests exercise doctor rendering and exit behavior offline. The
             // real person preference is covered in the anywhere-family tests.
             registry.register(createAnywhereFamily({ personSettingReader: async () => false }));
+            // The temp-homes family walks the machine's real temp folders; scan
+            // none here. Its behaviour is covered with fake trees in its own tests.
+            registry.register(createTempHomesFamily({ roots: [] }));
         }
         return await runDoctorCommand({ ...options, registry, integrations: false });
     }

package/dist/lib/doctor/checks/anywhere.d.ts

@@ -17,6 +17,7 @@ export declare const REMEDIATION: {
     readonly repairCodexSkills: "hq uninstall --global --runtime codex && hq install --global --runtime codex";
     readonly daemonInstall: "hq daemon install";
     readonly daemonRestart: "hq daemon restart --daemon";
+    readonly daemonStatus: "hq daemon status";
     readonly link: "hq link <repo-dir> <company>";
 };
 interface DaemonServiceState {
@@ -45,10 +46,24 @@ export interface AnywhereDeps {
     /** The hq-cli version installed on this machine. Default: this CLI's version. */
     cliVersion?: string;
     serviceState?: () => DaemonServiceState;
+    /** Is an hqd process alive? Default: the daemon lock names a live hqd pid. */
+    daemonRunning?: () => boolean;
+    /** Transport to report when health throws. Production uses the platform default. */
+    unreachableTransport?: "windows_named_pipe" | "unix_socket";
     now?: () => Date;
 }
+export interface PipeConnectFailure {
+    code?: string;
+    detail?: string;
+}
 export declare function createAnywhereFamily(deps?: AnywhereDeps): CheckFamily;
 export declare const anywhereFamily: CheckFamily;
+/**
+ * What to say when the Windows named pipe cannot be used. The old wording
+ * guessed an ACL refusal whenever any process looked like a daemon. This
+ * reports the connect error that was actually observed.
+ */
+export declare function windowsNamedPipeUnreachableMessage(socketPath: string, daemonRunning: boolean, failure?: PipeConnectFailure): string;
 export declare function defaultServiceState(home: string, options?: DaemonServiceProbeOptions): DaemonServiceState;
 export {};
 //# sourceMappingURL=anywhere.d.ts.map

package/dist/lib/doctor/checks/anywhere.js

@@ -23,8 +23,10 @@ import { daemonPresenceLabel, heartbeatFile, readHeartbeat } from "../../daemon/
 import { DAEMON_LAUNCHD_LABEL, DAEMON_SYSTEMD_UNIT, DAEMON_WINDOWS_TASK } from "../../daemon/install.js";
 import { hostedDaemonRunning } from "../../daemon/handoff.js";
 import { daemonPaths } from "../../daemon/paths.js";
+import { runningDaemonPid } from "../../daemon/lock.js";
 import { hqdSocketPath } from "../../daemon/protocol.js";
 import { readRegistry, registryDir, registryFile } from "../../registry/registry.js";
+import { skillCopySource } from "../../../utils/safe-link.js";
 import { anywhereRuntimeEnabled } from "../../../commands/anywhere-runtime-flag.js";
 import { readHqAnywherePersonSetting } from "../../anywhere-person-setting.js";
 const ANYWHERE_FAMILY_ID = "anywhere";
@@ -35,6 +37,7 @@ export const REMEDIATION = {
     repairCodexSkills: "hq uninstall --global --runtime codex && hq install --global --runtime codex",
     daemonInstall: "hq daemon install",
     daemonRestart: "hq daemon restart --daemon",
+    daemonStatus: "hq daemon status",
     link: "hq link <repo-dir> <company>",
 };
 export function createAnywhereFamily(deps = {}) {
@@ -60,6 +63,7 @@ async function runAnywhereChecks(context, deps = {}) {
         : result(personSetting ? "PASS" : "WARN", "person-setting", `HQ Anywhere person setting is ${personSetting ? "on" : "off"}`);
     let health;
     let healthUnsupported = false;
+    let connectFailure;
     try {
         if (deps.health) {
             health = await deps.health(cwd);
@@ -104,12 +108,14 @@ async function runAnywhereChecks(context, deps = {}) {
                 };
                 healthUnsupported = true;
             }
-            catch {
-                health = unreachableHealth(socketPath);
+            catch (inner) {
+                health = unreachableHealth(socketPath, deps.unreachableTransport);
+                connectFailure = connectFailureFrom(inner);
             }
         }
         else {
-            health = unreachableHealth(socketPath);
+            health = unreachableHealth(socketPath, deps.unreachableTransport);
+            connectFailure = connectFailureFrom(error);
         }
     }
     const claude = claudeTargets(home);
@@ -118,7 +124,12 @@ async function runAnywhereChecks(context, deps = {}) {
     const serviceState = runtimeEnabled && installed
         ? (deps.serviceState ?? (() => defaultServiceState(home)))()
         : undefined;
-    const healthCheck = runtimeHealthCheck(health, healthUnsupported, serviceState);
+    // A missing Windows pipe usually means hqd never started; only blame the
+    // pipe ACL when a daemon process is actually alive.
+    const daemonRunning = health.reachable
+        ? true
+        : (deps.daemonRunning ?? (() => runningDaemonPid(daemonPaths(home, env).lockPath) !== null))();
+    const healthCheck = runtimeHealthCheck(health, healthUnsupported, serviceState, daemonRunning, connectFailure);
     if (!runtimeEnabled)
         return [healthCheck, settingCheck];
     const remoteModes = [
@@ -169,17 +180,67 @@ async function runAnywhereChecks(context, deps = {}) {
         out.push(checkSkillLinks("codex", codex.skillsDir, REMEDIATION.installCodex, REMEDIATION.repairCodexSkills));
     return out;
 }
-function unreachableHealth(socketPath) {
+function unreachableHealth(socketPath, transport) {
     return {
         reachable: false,
         version: null,
         uptimeMs: null,
         flag: { enabled: null, lastSuccessfulReadAgeMs: null, heldThroughReadError: false },
         resolution: { scope: "unknown", company: null, fallbackReason: null },
-        socket: { path: socketPath, transport: process.platform === "win32" ? "windows_named_pipe" : "unix_socket", mode: null, ownerMatchesUser: null, userOnly: null },
+        socket: {
+            path: socketPath,
+            transport: transport ?? (process.platform === "win32" ? "windows_named_pipe" : "unix_socket"),
+            mode: null,
+            ownerMatchesUser: null,
+            userOnly: null,
+        },
     };
 }
-function runtimeHealthCheck(health, healthUnsupported = false, serviceState) {
+function connectFailureFrom(error) {
+    if (error instanceof HqdClientError)
+        return { code: error.code, detail: error.message };
+    if (error instanceof Error) {
+        const code = error.code;
+        return { code: typeof code === "string" ? code : undefined, detail: error.message };
+    }
+    return { detail: String(error) };
+}
+function failureSuffix(failure) {
+    if (!failure)
+        return "";
+    const parts = [failure.code, failure.detail].filter((part) => Boolean(part && part.trim()));
+    return parts.length === 0 ? "" : ` (${parts.join(": ")})`;
+}
+function accessDenied(failure) {
+    const code = (failure?.code ?? "").toUpperCase();
+    if (code === "EACCES" || code === "EPERM")
+        return true;
+    return /access is denied|unsafe acl/i.test(failure?.detail ?? "");
+}
+/**
+ * What to say when the Windows named pipe cannot be used. The old wording
+ * guessed an ACL refusal whenever any process looked like a daemon. This
+ * reports the connect error that was actually observed.
+ */
+export function windowsNamedPipeUnreachableMessage(socketPath, daemonRunning, failure) {
+    const suffix = failureSuffix(failure);
+    if (!daemonRunning) {
+        return `hqd is not running, so its named pipe ${socketPath} does not exist${suffix}. Run ${REMEDIATION.daemonStatus} to see why it has not started.`;
+    }
+    if (accessDenied(failure)) {
+        return `hqd is running but access to named pipe ${socketPath} was denied${suffix}. The pipe ACL does not allow this user. Run ${REMEDIATION.daemonRestart} to recreate the pipe.`;
+    }
+    const code = (failure?.code ?? "").toUpperCase();
+    if (code === "ENOENT") {
+        return `hqd is running but named pipe ${socketPath} does not exist${suffix}. Run ${REMEDIATION.daemonRestart} to recreate the pipe.`;
+    }
+    if (code === "ETIMEDOUT") {
+        return `hqd is running but did not answer on named pipe ${socketPath}${suffix}. Run ${REMEDIATION.daemonStatus}, then ${REMEDIATION.daemonRestart}.`;
+    }
+    const observed = suffix || " (observed)";
+    return `hqd is not reachable on ${socketPath}${observed}. HQ did not see an access-denied error, so this is not a named-pipe ACL refusal. Run ${REMEDIATION.daemonStatus} to see why, then ${REMEDIATION.daemonRestart}.`;
+}
+function runtimeHealthCheck(health, healthUnsupported = false, serviceState, daemonRunning = true, failure) {
     const { flag, resolution, socket } = health;
     const age = flag.lastSuccessfulReadAgeMs === null
         ? "unknown"
@@ -195,8 +256,9 @@ function runtimeHealthCheck(health, healthUnsupported = false, serviceState) {
     const socketSecurity = socket.transport === "windows_named_pipe"
         ? "Windows named pipe (mode and owner are not reported)"
         : `mode ${socket.mode ?? "unknown"}; owner matches current user: ${socket.ownerMatchesUser === null ? "unknown" : socket.ownerMatchesUser ? "yes" : "no"}; user-only: ${socket.userOnly === null ? "unknown" : socket.userOnly ? "yes" : "no"}`;
+    const pipeWithoutDaemon = socket.transport === "windows_named_pipe" && !daemonRunning;
     const unreachableMessage = socket.transport === "windows_named_pipe"
-        ? `hqd is not reachable on ${socket.path}; secure Windows named-pipe setup may have refused an unsafe ACL`
+        ? windowsNamedPipeUnreachableMessage(socket.path, daemonRunning, failure)
         : `hqd is not reachable on ${socket.path}; version, uptime, flag state, and cwd binding are unavailable`;
     const socketNotUserOnly = health.reachable && socket.transport === "unix_socket" && (socket.userOnly !== true || socket.ownerMatchesUser !== true);
     const warningNotes = [
@@ -207,7 +269,8 @@ function runtimeHealthCheck(health, healthUnsupported = false, serviceState) {
         ? `hqd reachable; version ${health.version ?? "unknown"}; uptime ${health.uptimeMs === null ? "unknown" : `${new Intl.NumberFormat("en-US").format(health.uptimeMs)} ms`}; runtime flag ${flagLabel}; last successful flag read ${age} ago; held through read error: ${flag.heldThroughReadError ? "yes" : "no"}; cwd binding ${binding}; socket ${socket.path}; ${socketSecurity}${warningNotes.length ? `; ${warningNotes.join("; ")}` : ""}`
         : unreachableMessage;
     const remediation = !health.reachable && serviceState
-        ? serviceState.installed ? REMEDIATION.daemonRestart : REMEDIATION.daemonInstall
+        ? !serviceState.installed ? REMEDIATION.daemonInstall
+            : pipeWithoutDaemon ? REMEDIATION.daemonStatus : REMEDIATION.daemonRestart
         : healthUnsupported || socketNotUserOnly ? REMEDIATION.daemonRestart : undefined;
     return {
         status: health.reachable && warningNotes.length === 0 ? "PASS" : "WARN",
@@ -336,12 +399,15 @@ function checkSkillLinks(runtime, dir, fix, repair = fix) {
         return result("WARN", id, `${dir} does not exist`, fix, dir);
     }
     const links = names.filter((n) => fs.lstatSync(path.join(dir, n)).isSymbolicLink());
-    if (links.length === 0)
+    // Windows falls back to marked copies when it refuses both link types.
+    const copies = names.filter((n) => skillCopySource(path.join(dir, n)) !== null);
+    if (links.length === 0 && copies.length === 0)
         return result("WARN", id, `no hq-* skill links in ${dir}`, fix, dir);
     const broken = links.filter((n) => !fs.existsSync(path.join(dir, n)));
     if (broken.length > 0)
         return result("FAIL", id, `${broken.length} broken skill links in ${dir}: ${broken.slice(0, 5).join(", ")}`, repair, dir);
-    return result("PASS", id, `${links.length} hq-* skill links in ${dir} resolve`, undefined, dir);
+    const copied = copies.length > 0 ? ` (${copies.length} more are copies that do not follow HQ skill updates)` : "";
+    return result("PASS", id, `${links.length} hq-* skill links in ${dir} resolve${copied}`, undefined, dir);
 }
 export function defaultServiceState(home, options = {}) {
     const platform = options.platform ?? process.platform;

package/dist/lib/doctor/checks/cli-path.d.ts

@@ -0,0 +1,12 @@
+import { type ShimPathCheck } from "../../windows/user-path.js";
+import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
+export declare const CLI_PATH_FAMILY_ID = "cli-path";
+export declare const CLI_PATH_CHECK_ID = "cli-path.npm-shim-on-path";
+/**
+ * Windows: is the folder holding the npm `hq.cmd` shim on the PATH a new
+ * terminal gets? This check only reads. The CLI adds the folder to HKCU Path
+ * on startup; the warning is the fallback when that add did not stick.
+ */
+export declare const cliPathFamily: CheckFamily;
+export declare function checkCliPath(_context: CheckContext, check?: () => ShimPathCheck | null): CheckResult[];
+//# sourceMappingURL=cli-path.d.ts.map

package/dist/lib/doctor/checks/cli-path.js

@@ -0,0 +1,46 @@
+import { checkShimOnPath, pathFixCommand, shimPathWarning } from "../../windows/user-path.js";
+export const CLI_PATH_FAMILY_ID = "cli-path";
+export const CLI_PATH_CHECK_ID = "cli-path.npm-shim-on-path";
+/**
+ * Windows: is the folder holding the npm `hq.cmd` shim on the PATH a new
+ * terminal gets? This check only reads. The CLI adds the folder to HKCU Path
+ * on startup; the warning is the fallback when that add did not stick.
+ */
+export const cliPathFamily = {
+    id: CLI_PATH_FAMILY_ID,
+    title: "hq command on PATH",
+    run: (context) => Promise.resolve(checkCliPath(context)),
+};
+export function checkCliPath(_context, check = () => checkShimOnPath()) {
+    const result = check();
+    if (!result) {
+        return [
+            {
+                status: "NA",
+                checkId: CLI_PATH_CHECK_ID,
+                message: "Not a Windows npm global install, so there is no hq.cmd shim folder to check.",
+            },
+        ];
+    }
+    if (result.onPath) {
+        return [
+            {
+                status: "PASS",
+                checkId: CLI_PATH_CHECK_ID,
+                target: result.shimDir,
+                message: `The hq command folder ${result.shimDir} is on your Windows PATH.`,
+            },
+        ];
+    }
+    return [
+        {
+            status: "WARN",
+            checkId: CLI_PATH_CHECK_ID,
+            target: result.shimDir,
+            message: shimPathWarning(result)[0],
+            details: { source: result.source },
+            remediation: `In PowerShell, then open a new terminal: ${pathFixCommand(result.shimDir)}`,
+        },
+    ];
+}
+//# sourceMappingURL=cli-path.js.map

package/dist/lib/doctor/checks/hook-engine.d.ts

@@ -0,0 +1,4 @@
+import type { CheckFamily, CheckResult } from '../types.js';
+export declare function checkHookEngine(): CheckResult;
+export declare const hookEngineFamily: CheckFamily;
+//# sourceMappingURL=hook-engine.d.ts.map

package/dist/lib/doctor/checks/hook-engine.js

@@ -0,0 +1,17 @@
+import { launcherEnabled } from '../../hook-engine/registration.js';
+import { findHookEngine, hookEngineRequired, pinnedHookEngineMatches, HOOK_ENGINE_REPAIR, HOOK_ENGINE_REPAIR_PIN } from '../../hook-engine/resolve.js';
+export function checkHookEngine() {
+    const required = hookEngineRequired();
+    const fallback = required ? 'Native engine is required; repair before running hooks.' : 'Existing bash hooks remain active.';
+    try {
+        const engine = findHookEngine();
+        if (engine && pinnedHookEngineMatches(engine))
+            return { checkId: 'hooks.native-engine', status: 'PASS', target: engine.pinned, message: `Native hook engine ${engine.version} installed at its version-pinned path. Launcher flag: ${launcherEnabled() ? 'on (run hq reindex to reconcile settings)' : 'off (bash registration)'}.` };
+        return { checkId: 'hooks.native-engine', status: required ? 'FAIL' : 'WARN', message: `Native hook engine is missing or damaged. ${fallback}`, remediation: engine ? `Close HQ sessions, then run ${HOOK_ENGINE_REPAIR_PIN}` : HOOK_ENGINE_REPAIR };
+    }
+    catch (error) {
+        return { checkId: 'hooks.native-engine', status: required ? 'FAIL' : 'WARN', message: `Native hook engine unavailable: ${error.message}. ${fallback}`, remediation: HOOK_ENGINE_REPAIR };
+    }
+}
+export const hookEngineFamily = { id: 'hook-engine', title: 'Native hook engine', run: async () => [checkHookEngine()] };
+//# sourceMappingURL=hook-engine.js.map

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -100,6 +100,13 @@ export interface SyncHealthDeps {
      * unhealthy-sync signal, and `hq doctor --fix` has nothing local to refresh.
      */
     localCompanyExists?: (slug: string) => boolean;
+    /**
+     * Whether HQ_SYNC_MANIFEST_DISABLED turns manifest uploads off on this
+     * machine. Defaults to reading the environment the way `hq sync manifest`
+     * does. When true a stale row names the switch and is not auto-fixable,
+     * since a re-upload would exit 0 without uploading.
+     */
+    manifestUploadsDisabled?: () => boolean;
 }
 /**
  * True when `slug` is a filesystem-safe company folder name. Rejects empty