@indigoai-us/hq-cli 5.345.147 → 5.345.149

package/dist/commands/library-add.js

@@ -28,7 +28,7 @@ import http from "node:http";
 import https from "node:https";
 import path from "node:path";
 import { Readable } from "node:stream";
-import { formatCloudAssetBlock, formatCloudPlaceholder, parseCloudPlaceholder, } from "@indigoai-us/hq-cloud";
+import { formatCloudAssetBlock, formatCloudPlaceholder, isCoveredByAny, parseCloudPlaceholder, resolvePullScope, } from "@indigoai-us/hq-cloud";
 import { PLACEHOLDER_SUFFIX, companyOffloadKey, containedPath, durablePlaceholderFs, renderPointer, resolvePlaceholder, } from "./storage-offload.js";
 import { formatPlanGateError, formatUpgradeRefusal, planGateErrorFromResponse, } from "../utils/plan-gate-error.js";
 /** Metadata key hq-pro binds to `checksumSha256` (sync's content hash). */
@@ -321,7 +321,74 @@ export async function runLibraryAdd(inputs, options, deps) {
                 .catch((err) => ({ status: "failed", note: err.message }));
         }
     }
-    return { company: slug, items };
+    const written = items.flatMap((item) => (item.ok && item.placeholderPath ? [item.placeholderPath] : []));
+    if (written.length === 0)
+        return { company: slug, items };
+    const syncScope = await ensureLibraryInSyncScope(company, dirRel, written, deps);
+    return { company: slug, items, ...(syncScope ? { syncScope } : {}) };
+}
+const LIBRARY_FOLDER = "library/";
+/**
+ * A `shared` or `custom` sync pushes only paths inside the membership's
+ * prefix set (explicit grants plus pins), so a placeholder written outside it
+ * never reaches the vault. Pin it with `hq files get`'s pin writer: the
+ * default library folder as a whole, and for any other `--to` folder only the
+ * written placeholders, so the rest of that folder stays out of sync.
+ */
+export async function ensureLibraryInSyncScope(company, dirRel, placeholderPaths, deps) {
+    if (!deps.syncScope || !deps.addPin)
+        return undefined;
+    const companyRel = (rel) => rel.split("/").slice(2).join("/");
+    const isLibrary = `${companyRel(dirRel)}/` === LIBRARY_FOLDER;
+    const targets = isLibrary ? [LIBRARY_FOLDER] : placeholderPaths.map(companyRel);
+    const command = isLibrary ? `hq files get ${LIBRARY_FOLDER} --company ${company.slug}` : undefined;
+    let scope;
+    try {
+        scope = await deps.syncScope(company);
+    }
+    catch (err) {
+        return {
+            status: "not-pinned",
+            pins: targets,
+            ...(command ? { command } : {}),
+            reason: `could not read your sync scope: ${err.message}`,
+        };
+    }
+    const missing = scope.syncMode === "all" ? [] : targets.filter((t) => !isCoveredByAny(t, scope.prefixSet ?? []));
+    if (missing.length === 0)
+        return { status: "in-scope", pins: [] };
+    try {
+        for (const target of missing)
+            deps.addPin(deps.hqRoot, company.slug, target);
+    }
+    catch (err) {
+        return {
+            status: "not-pinned",
+            pins: missing,
+            ...(command ? { command } : {}),
+            reason: `could not write the pin: ${err.message}`,
+        };
+    }
+    return { status: "pinned", pins: missing };
+}
+/**
+ * {@link resolvePullScope} answers `all` when any call fails. Report the
+ * failure instead, so a failed lookup is not mistaken for full sync.
+ */
+export async function resolveLibrarySyncScope(client, company, hqRoot) {
+    let failure;
+    const watch = (call) => call.catch((err) => {
+        failure ??= err;
+        throw err;
+    });
+    const scope = await resolvePullScope({
+        listMyMemberships: () => watch(client.listMyMemberships()),
+        getMembershipSyncConfig: (id) => watch(client.getMembershipSyncConfig(id)),
+        listMyExplicitGrants: (uid) => watch(client.listMyExplicitGrants(uid)),
+    }, company.uid, company.slug, hqRoot);
+    if (failure !== undefined)
+        throw failure instanceof Error ? failure : new Error(String(failure));
+    return scope;
 }
 async function writeAssetPlaceholder(p, options, deps, dirAbs) {
     const ts = offloadTimestamp(deps.now());

package/dist/commands/library.js

@@ -35,7 +35,7 @@ import { findHqRoot } from "../utils/manifest.js";
 import { networkTransportErrorCode } from "../utils/network-transport-error.js";
 import { resolveVaultCredentialForCapability } from "../utils/resolve-vault-credential.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
-import { defaultLibraryIo, runLibraryAdd, runLibraryTag, } from "./library-add.js";
+import { defaultLibraryIo, resolveLibrarySyncScope, runLibraryAdd, runLibraryTag, } from "./library-add.js";
 import { captionAddedAsset, extractCaptionFrames, runLibraryDescribe, runLocalClaude } from "./library-caption.js";
 import { LIBRARY_LINK_DEFAULT_MINUTES, LIBRARY_LINK_MAX_MINUTES, runLibraryLink } from "./library-link.js";
 /** Mirrors hq-pro's MAX_ASSET_SEARCH_TAGS / tag length bound. */
@@ -295,8 +295,39 @@ export function formatLibraryAddResult(result) {
             return `${line}\n  ${chalk.dim(`AI caption added (${item.caption.captionedBy}).`)}`;
         return `${line}\n  ${chalk.yellow(item.caption.note ?? "Captioning skipped.")}`;
     })
+        .concat(formatLibrarySyncScope(result))
         .join("\n");
 }
+function formatLibrarySyncScope({ company, syncScope }) {
+    if (!syncScope || syncScope.status === "in-scope")
+        return [];
+    const pins = syncScope.pins.map((pin) => `${company}:${pin}`).join(", ");
+    if (syncScope.status === "pinned") {
+        return [chalk.dim(`Pinned ${pins} so sync uploads these placeholders to the company vault.`)];
+    }
+    const fix = syncScope.command
+        ? `Pin the folder with: ${syncScope.command}`
+        : `Add ${syncScope.pins.join(", ")} under "${company}" in .hq/pins.json at the HQ root.`;
+    return [
+        chalk.yellow(`Warning: sync may not upload these placeholders (${syncScope.reason}). ` +
+            `Until it does, teammates and cloud search will not see them. ${fix}`),
+    ];
+}
+/** Sync scope wiring for `hq library add`; an API key has no sync tree to check. */
+async function librarySyncScopeDeps(credential, hqRoot) {
+    if (credential.kind !== "cognito")
+        return {};
+    const [{ VaultClient }, { buildVaultConfig }, { addPin }] = await Promise.all([
+        import("@indigoai-us/hq-cloud"),
+        import("../utils/cognito-session.js"),
+        import("./files-browse.js"),
+    ]);
+    const client = new VaultClient(buildVaultConfig(credential.token));
+    return {
+        syncScope: (company) => resolveLibrarySyncScope(client, company, hqRoot),
+        addPin,
+    };
+}
 /** GET a presigned URL. Errors never echo the URL, which carries a signature. */
 async function downloadPresigned(url) {
     const res = await fetch(url);
@@ -366,9 +397,11 @@ export function registerLibraryCommand(program) {
         .option("--json", "Print machine-readable JSON")
         .action(async (sources, options) => {
         try {
-            const { token } = await resolveVaultCredentialForCapability("files:write", "library add", {
+            const credential = await resolveVaultCredentialForCapability("files:write", "library add", {
                 interactive: true,
             });
+            const { token } = credential;
+            const hqRoot = findHqRoot();
             const result = await runLibraryAdd(sources, {
                 company: options.company,
                 to: options.to,
@@ -376,11 +409,12 @@ export function registerLibraryCommand(program) {
                 title: options.title,
                 note: options.note,
             }, {
-                hqRoot: findHqRoot(),
+                hqRoot,
                 now: () => new Date(),
                 resolveCompany: (slug) => libraryCompany(token, slug),
                 presign: (body) => vaultApiFetch({ token, path: "/v1/files/presign", method: "POST", body }),
                 ...defaultLibraryIo,
+                ...(await librarySyncScopeDeps(credential, hqRoot)),
                 ...(options.caption === false
                     ? {}
                     : {

package/dist/commands/pack-install.d.ts

@@ -22,7 +22,7 @@
  *
  * Flow:
  *   1. Classify source → transport
- *   2. Fetch payload to tmpdir (npm pack | git clone | rsync)
+ *   2. Fetch payload to tmpdir (npm pack | git clone | local copy)
  *   3. Parse + validate package.yaml (10 checks from spec)
  *   4. Evaluate `conditional` predicate — skip if exits non-zero
  *   5. Confirm hooks if `contributes.hooks` non-empty (unless --allow-hooks)
@@ -438,7 +438,7 @@ export interface InstallPackOptions {
      * Route this function's human output to stderr (and silence scan-packages
      * stdout) so a caller emitting machine-readable JSON keeps stdout clean.
      * The fetch tools are already quiet/stderr-only (`npm pack --silent`,
-     * `rsync -a`, `git clone` progress -> stderr), so this is sufficient.
+     * `git clone` progress -> stderr), so this is sufficient.
      */
     quiet?: boolean;
     /**

package/dist/commands/pack-install.js

@@ -22,7 +22,7 @@
  *
  * Flow:
  *   1. Classify source → transport
- *   2. Fetch payload to tmpdir (npm pack | git clone | rsync)
+ *   2. Fetch payload to tmpdir (npm pack | git clone | local copy)
  *   3. Parse + validate package.yaml (10 checks from spec)
  *   4. Evaluate `conditional` predicate — skip if exits non-zero
  *   5. Confirm hooks if `contributes.hooks` non-empty (unless --allow-hooks)
@@ -38,7 +38,7 @@ import * as os from 'os';
 import * as path from 'path';
 import * as readline from 'readline';
 import { parseUserYaml } from '../utils/user-yaml-error.js';
-import { createHash, createPublicKey, verify as cryptoVerify, } from 'node:crypto';
+import { createHash, createPublicKey, randomBytes, verify as cryptoVerify, } from 'node:crypto';
 import { trustedMarketplaceSigningKey } from '../lib/pack-signing-keys.js';
 import { execFileSync, spawnSync } from 'child_process';
 import chalk from 'chalk';
@@ -51,6 +51,8 @@ import { codexTargets } from '../lib/install/codex-targets.js';
 import { readHqVersion, routeContribution, listInstalledPacks, mcpServerNameForContribution } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
+import { copyTree, removeTreeNoFollow } from '../utils/copy-tree.js';
+import { npmInvocation } from '../utils/npm-invocation.js';
 import { runResidentCommandWithPackageLease } from '../utils/resident-package-preload.js';
 import { getCompanyUid, vaultApiFetch, vaultApiFetchPublic, } from '../utils/vault-api.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
@@ -116,6 +118,18 @@ async function latestWithDiskCache(cacheKey, opts, refresh) {
 export const MARKETPLACE_PREFIX = 'marketplace:';
 /** Pinned source allowed to claim the reserved hq-anywhere pack name via its CLI alias. */
 export const PINNED_HQ_ANYWHERE_SOURCE = 'github:indigoai-us/hq-packages#packages/hq-pack-hq-anywhere';
+/**
+ * Windows path forms a user (or `os.tmpdir()`) hands to `hq install`: a drive
+ * path (`C:\packs\x`, `C:/packs/x`), a UNC path (`\\server\share\x`), or a
+ * backslash-relative path (`.\x`, `..\x`). None of these can be a registry
+ * slug, npm name or git URL, so they always mean the local transport.
+ */
+function isWindowsPathSource(source) {
+    return (/^[A-Za-z]:[\\/]/.test(source) ||
+        source.startsWith('\\\\') ||
+        source.startsWith('.\\') ||
+        source.startsWith('..\\'));
+}
 export function classify(source) {
     // US-006: marketplace:<slug>[@version] is recognized BEFORE the legacy
     // registry fallback and ahead of every other transport. The slug is resolved
@@ -144,7 +158,8 @@ export function classify(source) {
     if (source.startsWith('./') ||
         source.startsWith('../') ||
         source.startsWith('/') ||
-        source.startsWith('file:')) {
+        source.startsWith('file:') ||
+        isWindowsPathSource(source)) {
         return 'local';
     }
     // Fallback: bare slug — caller (dispatcher) routes those to legacy flow.
@@ -204,8 +219,10 @@ function fetchNpm(source, tmpDir, integrity) {
     // Use `npm pack` to grab the tarball without actually installing anything.
     // Capture output to get the produced filename. Arguments are passed as an
     // argv array — never interpolated into a shell string — so `source` cannot
-    // break out even if it contains metacharacters.
-    const out = execFileSync('npm', ['pack', '--silent', '--pack-destination', tmpDir, source], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'inherit'] });
+    // break out even if it contains metacharacters. On Windows npm is a .cmd
+    // shim, so npmInvocation runs npm-cli.js with node instead of a shell.
+    const npm = npmInvocation(['pack', '--silent', '--pack-destination', tmpDir, source]);
+    const out = execFileSync(npm.command, npm.args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'inherit'] });
     const tarball = out.trim().split('\n').filter(Boolean).pop();
     if (!tarball) {
         throw new Error(`npm pack produced no tarball for "${source}"`);
@@ -557,7 +574,7 @@ function fetchGit(source, tmpDir, followBranch) {
         }
         payloadDir = path.join(tmpDir, 'payload');
         fs.mkdirSync(payloadDir, { recursive: true });
-        rsyncDir(subAbs, payloadDir);
+        copyPayloadDir(subAbs, payloadDir);
     }
     else {
         // Drop .git — the pack should be file content, not a nested repo
@@ -581,24 +598,17 @@ function fetchLocal(source, tmpDir) {
     }
     const payloadDir = path.join(tmpDir, 'local');
     fs.mkdirSync(payloadDir, { recursive: true });
-    rsyncDir(abs, payloadDir);
+    copyPayloadDir(abs, payloadDir);
     return { payloadDir, resolvedSource: clean };
 }
 /**
- * Invoke rsync with an argv array (no shell). Trailing slashes on the source
- * path are preserved by passing the exact strings through execFileSync.
+ * Copy a pack source directory's contents into the payload dir, skipping VCS
+ * metadata, installed dependencies and Finder files at any depth. This is the
+ * Node equivalent of the earlier `rsync -a --exclude=...` call, so it also
+ * works on Windows, which ships no rsync. Links are copied as links.
  */
-function rsyncDir(src, dest) {
-    const srcSlashed = src.endsWith('/') ? src : `${src}/`;
-    const destSlashed = dest.endsWith('/') ? dest : `${dest}/`;
-    execFileSync('rsync', [
-        '-a',
-        '--exclude=.git',
-        '--exclude=node_modules',
-        '--exclude=.DS_Store',
-        srcSlashed,
-        destSlashed,
-    ], { stdio: 'inherit' });
+function copyPayloadDir(src, dest) {
+    copyTree(src, dest, { exclude: ['.git', 'node_modules', '.DS_Store'] });
 }
 /**
  * Ask git whether <ref> resolves as a named branch or tag on <url>. Returns
@@ -1640,33 +1650,121 @@ export function installToPackages(payloadDir, pkg, hqRoot) {
     const packagesDir = path.join(hqRoot, 'core', 'packages');
     fs.mkdirSync(packagesDir, { recursive: true });
     const destDir = path.join(packagesDir, pkg.name);
-    // SECURITY/ATOMICITY (US-020): wire atomically. rsync into a sibling staging
+    // SECURITY/ATOMICITY (US-020): wire atomically. Copy into a sibling staging
     // dir on the SAME filesystem first; only swap it into the final destination
-    // once the copy fully succeeds. A failed/partial rsync therefore never
+    // once the copy fully succeeds. A failed/partial copy therefore never
     // leaves a half-wired pack dir in place (which scan-packages.sh would then
     // wire into host paths). On any error the staging dir is rolled back.
     const stagingDir = fs.mkdtempSync(path.join(packagesDir, `.${pkg.name}.staging-`));
+    let asideDir;
+    // Set when the staging dir holds the only complete copy of the new pack and
+    // must survive the cleanup below.
+    let keepStaging = false;
     try {
-        // rsync preserves modes/symlinks; argv form — no shell.
-        const srcSlashed = payloadDir.endsWith('/') ? payloadDir : `${payloadDir}/`;
-        const stagingSlashed = stagingDir.endsWith('/') ? stagingDir : `${stagingDir}/`;
-        execFileSync('rsync', ['-a', srcSlashed, stagingSlashed], { stdio: 'inherit' });
-        // Swap into place: remove any prior install, then atomic rename. The brief
-        // window between rm and rename is unavoidable with a same-name dir, but the
-        // staged copy guarantees the NEW contents are fully present before we touch
-        // the live location.
-        if (fs.existsSync(destDir)) {
-            fs.rmSync(destDir, { recursive: true, force: true });
+        // Keeps modes, mtimes and symlinks (as links) like `rsync -a`, without
+        // spawning rsync, which Windows does not ship. `finalRoot` makes Windows
+        // junction fallbacks point into destDir, where the copy ends up after the
+        // rename below, so they do not dangle once stagingDir is gone.
+        copyTree(payloadDir, stagingDir, { finalRoot: destDir });
+        // Swap into place. The prior install is renamed aside (not deleted) first,
+        // so if the second rename fails it can be put back and the old pack stays
+        // installed. The aside name is unique and not pre-created: on Windows a
+        // rename onto an existing directory fails.
+        if (lstatOrNull(destDir)) {
+            const aside = path.join(packagesDir, `.${pkg.name}.old-${process.pid}-${Date.now()}-${randomBytes(4).toString('hex')}`);
+            fs.renameSync(destDir, aside);
+            asideDir = aside;
+        }
+        try {
+            fs.renameSync(stagingDir, destDir);
+        }
+        catch (err) {
+            if (asideDir) {
+                try {
+                    fs.renameSync(asideDir, destDir);
+                    asideDir = undefined;
+                }
+                catch (restoreErr) {
+                    // Nothing is installed at destDir now. Keep both copies so either
+                    // can be moved into place by hand.
+                    keepStaging = true;
+                    throw new Error(`Could not move the new ${pkg.name} into ${destDir} (${errorMessage(err)}), and could not restore ` +
+                        `the previous install from ${asideDir} (${errorMessage(restoreErr)}). Nothing is installed at ` +
+                        `${destDir}. The previous install is at ${asideDir} and the complete new copy is at ${stagingDir}. ` +
+                        `Move one of them to ${destDir} by hand.`, { cause: err });
+                }
+            }
+            throw err;
         }
-        fs.renameSync(stagingDir, destDir);
     }
     finally {
-        if (fs.existsSync(stagingDir)) {
-            fs.rmSync(stagingDir, { recursive: true, force: true });
+        // Cleanup must never replace the error that got us here, so failures are
+        // reported and left behind rather than thrown.
+        if (!keepStaging) {
+            try {
+                removeTreeNoFollow(stagingDir);
+            }
+            catch (cleanupErr) {
+                process.stderr.write(`warning: could not remove staging dir ${stagingDir}: ${errorMessage(cleanupErr)}\n`);
+            }
+        }
+    }
+    // The new pack is in place. Links inside the old install are removed as
+    // links, never followed, so data they point at survives a reinstall.
+    if (asideDir) {
+        try {
+            removeTreeNoFollow(asideDir);
+        }
+        catch (cleanupErr) {
+            process.stderr.write(`warning: installed ${pkg.name}, but could not remove the previous install at ${asideDir}: ` +
+                `${errorMessage(cleanupErr)}. Delete it by hand.\n`);
         }
     }
+    sweepLeftovers(packagesDir, pkg.name);
     return destDir;
 }
+/**
+ * Remove `.<name>.staging-*` and `.<name>.old-*` siblings that an earlier
+ * interrupted or failed install of the same pack left behind. Runs only after
+ * a new install is in place, so a copy kept for manual recovery is not removed
+ * while nothing else is installed. Links inside are removed as links, and a
+ * failure only warns.
+ */
+function sweepLeftovers(packagesDir, name) {
+    const prefixes = [`.${name}.staging-`, `.${name}.old-`];
+    let entries;
+    try {
+        entries = fs.readdirSync(packagesDir);
+    }
+    catch (err) {
+        process.stderr.write(`warning: could not list ${packagesDir} for leftover install folders: ${errorMessage(err)}\n`);
+        return;
+    }
+    for (const entry of entries) {
+        if (!prefixes.some((prefix) => entry.startsWith(prefix)))
+            continue;
+        const leftover = path.join(packagesDir, entry);
+        try {
+            removeTreeNoFollow(leftover);
+        }
+        catch (err) {
+            process.stderr.write(`warning: could not remove leftover install folder ${leftover}: ${errorMessage(err)}\n`);
+        }
+    }
+}
+function lstatOrNull(target) {
+    try {
+        return fs.lstatSync(target);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 /**
  * Stamp the install-time `source:` into the destination package.yaml. This is
  * the only on-disk record of which `recommended_packages[].source` produced

package/dist/commands/reindex.js

@@ -1,3 +1,5 @@
+import { reconcileHookRegistrations } from '../lib/hook-engine/reconcile.js';
+import { trustCodexUserHooks } from '../utils/hook-trust.js';
 /**
  * hq reindex — surface namespaced skills and commands, clean up retired
  * personal-overlay mirror links, capture coding-harness session logs, regenerate
@@ -775,6 +777,23 @@ export function registerReindexCommand(program) {
             // means a sync/rescue holds the shared operation lock and may be
             // rewriting .claude/settings.json right now, and this is an unlocked
             // whole-file read-modify-write.
+            // Registration reconcile is best-effort: a failure leaves the current
+            // registrations in place and must not stop the rest of reindex.
+            try {
+                // A file that failed is left as it was; the keys of files that were
+                // rewritten are still trusted so Codex keeps running their hooks.
+                const { codexUserKeys, failures } = reconcileHookRegistrations(hqRoot);
+                for (const failure of failures)
+                    console.warn(`reindex: hook registration reconcile skipped ${failure}`);
+                if (codexUserKeys.length) {
+                    const trust = await trustCodexUserHooks(hqRoot, codexUserKeys);
+                    if (trust.status === 'failed')
+                        console.warn(`reindex: Codex hook trust needs repair: ${trust.reason}`);
+                }
+            }
+            catch (error) {
+                console.warn(`reindex: hook registration reconcile skipped: ${error.message}`);
+            }
             dropProjectDefaultModeForBypassUser(hqRoot);
             await trustHqRuntimeHooks(hqRoot, undefined, {
                 rootAliases: [literalHqRoot],

package/dist/commands/sync-manifest.d.ts

@@ -42,17 +42,10 @@
  */
 import { Command } from "commander";
 import type { ManifestUploadTransport, RunManifestUploadPassOptions, RunManifestUploadPassResult } from "@indigoai-us/hq-cloud";
+import { MANIFEST_DISABLED_ENV, manifestUploadsDisabled } from "../lib/manifest-disabled.js";
 /** The server route the pass POSTs each chunk to. */
 export declare const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
-/**
- * The kill switch hq-cloud's pass honours. Restated locally (rather than
- * imported) for two reasons: it lives in the same unreleased module as the
- * manifest exports, and — more importantly — we must be able to read it
- * BEFORE deciding to do any work at all.
- */
-export declare const MANIFEST_DISABLED_ENV = "HQ_SYNC_MANIFEST_DISABLED";
-/** True when the kill switch is set to anything other than empty/0/false. */
-export declare function manifestUploadsDisabled(env?: NodeJS.ProcessEnv): boolean;
+export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export declare const PERSONAL_SCOPE = "personal";
 /**

package/dist/commands/sync-manifest.js

@@ -51,6 +51,7 @@ import chalk from "chalk";
 // at runtime and so cost nothing here.
 import { VaultClient } from "@indigoai-us/hq-cloud";
 import { MANIFEST_MIN_HQ_CLOUD_VERSION, manifestExportsAvailable, requireManifestExports, } from "../lib/hq-cloud-manifest.js";
+import { MANIFEST_DISABLED_ENV, manifestUploadsDisabled, } from "../lib/manifest-disabled.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { loadClientHealthState, persistClientHealthState, } from "../utils/client-health.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
@@ -58,21 +59,9 @@ import { readActiveCompanySlug } from "./sync-mode.js";
 // ── Constants ───────────────────────────────────────────────────────────────
 /** The server route the pass POSTs each chunk to. */
 export const MANIFEST_UPLOAD_PATH = "/v1/sync-manifest/upload";
-/**
- * The kill switch hq-cloud's pass honours. Restated locally (rather than
- * imported) for two reasons: it lives in the same unreleased module as the
- * manifest exports, and — more importantly — we must be able to read it
- * BEFORE deciding to do any work at all.
- */
-export const MANIFEST_DISABLED_ENV = "HQ_SYNC_MANIFEST_DISABLED";
-/** True when the kill switch is set to anything other than empty/0/false. */
-export function manifestUploadsDisabled(env = process.env) {
-    const raw = env[MANIFEST_DISABLED_ENV];
-    if (raw === undefined)
-        return false;
-    const value = raw.trim().toLowerCase();
-    return value !== "" && value !== "0" && value !== "false";
-}
+// The kill switch lives in a leaf module so `hq doctor` can read it without
+// loading this command. Re-exported for existing importers.
+export { MANIFEST_DISABLED_ENV, manifestUploadsDisabled };
 /** The literal `--scope` value that selects the personal (non-company) tree. */
 export const PERSONAL_SCOPE = "personal";
 // ── Pure helpers ────────────────────────────────────────────────────────────

package/dist/hook-engine-path.d.ts

@@ -0,0 +1,4 @@
+/** Dependency-free routing: this command must never load the online CLI graph. */
+export declare function hookEnginePathArgs(argv: readonly string[]): string[] | null;
+export declare function runHookEnginePath(args: readonly string[]): Promise<void>;
+//# sourceMappingURL=hook-engine-path.d.ts.map

package/dist/hook-engine-path.js

@@ -0,0 +1,43 @@
+/** Dependency-free routing: this command must never load the online CLI graph. */
+export function hookEnginePathArgs(argv) {
+    if (argv[2] !== 'core')
+        return null;
+    let i = 3;
+    if (argv[i] === '--hq-root' && argv[i + 1])
+        i += 2;
+    else if (argv[i]?.startsWith('--hq-root='))
+        i++;
+    return argv[i] === 'hook-engine-path' ? argv.slice(i + 1) : null;
+}
+export async function runHookEnginePath(args) {
+    try {
+        if (args.some(arg => !['--repair', '--help', '-h', '--for-registration'].includes(arg))) {
+            throw new Error('Usage: hq core hook-engine-path [--repair] [--for-registration]');
+        }
+        if (args.includes('--help') || args.includes('-h')) {
+            console.log('Usage: hq core hook-engine-path [--repair] [--for-registration]\nResolve and pin the installed native hook engine offline.\n--for-registration prints a path only when the launcher flag is enabled.');
+            return;
+        }
+        const { installHookEngine, hookEngineRequired, HOOK_ENGINE_REPAIR } = await import('./lib/hook-engine/resolve.js');
+        if (args.includes('--for-registration')) {
+            const { launcherEnabled } = await import('./lib/hook-engine/registration.js');
+            if (!launcherEnabled()) {
+                process.exitCode = 1;
+                return;
+            }
+        }
+        const binary = installHookEngine({ repair: args.includes('--repair') });
+        if (binary)
+            console.log(binary);
+        else {
+            console.error(`Native hook engine missing; ${hookEngineRequired() ? 'repair before running hooks' : 'existing bash hooks remain active'}. Repair: ${HOOK_ENGINE_REPAIR}`);
+            process.exitCode = 1;
+        }
+    }
+    catch (error) {
+        // Catch locally: the global rejection reporter imports main.js and Sentry.
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=hook-engine-path.js.map