@indigoai-us/hq-cli 5.345.150 → 5.345.152

package/dist/hq-cloud-sync-runner/package.json

@@ -1 +1 @@
-{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.90","bundleSha256":"cb49486573d2d1141ee6e18d73dde825f2b7c02074560f19504e3b1daf7eeba8","formatVersion":1}
+{"name":"hq-cli-daemon-sync-runner","type":"module","version":"6.18.91","bundleSha256":"ea41f1765d5015a22304787abedc68a531393d601a349bb8bff3c5428413f3a3","formatVersion":1}

package/dist/lib/daemon/catalog.d.ts

@@ -13,6 +13,7 @@ import type { MachineType } from "./machine-type.js";
 import type { SyncOwner } from "./config.js";
 import type { RemoteControlPoolsConfig } from "./remote-control-pools.js";
 import { type SyncRunnerProcess } from "./sync-runner.js";
+import { type VaultSyncSwitches } from "../vault-sync-switches.js";
 export declare const SERVICE_NAMES: readonly ["sync", "mesh", "heartbeat", "inbox", "bots", "remote-control", "codex-remote-control", "session-host", "lanes-reconcile", "search-index", "jobs-reconcile", "updater", "housekeeping"];
 export type ServiceName = (typeof SERVICE_NAMES)[number];
 export declare function isServiceName(value: unknown): value is ServiceName;
@@ -103,6 +104,12 @@ export interface PlanContext {
     instantSyncEnabled?: boolean;
     /** Keep the local sync runner stopped until the operator resumes it. */
     syncPaused: boolean;
+    /**
+     * The desktop app's Settings > Sync switches on this computer (US-016).
+     * Off vaults are skipped by the runner; all off keeps the unit stopped.
+     * Absent means every vault is on.
+     */
+    vaultSync?: VaultSyncSwitches;
     /** Persisted/effective owner selected for this machine. */
     syncOwner: SyncOwner;
     /** A legacy desktop app or sync unit is still managing sync. */

package/dist/lib/daemon/catalog.js

@@ -10,6 +10,7 @@
  * them instead of silently dropping them.
  */
 import { SYNC_RUNNER_OWNER, syncRunnerUnleasedBlockReason } from "./sync-runner.js";
+import { vaultSkipEnv } from "../vault-sync-switches.js";
 export const SERVICE_NAMES = [
     "sync",
     "mesh",
@@ -142,7 +143,11 @@ function planService(service, ctx) {
                         SYNC_RUNNER_OWNER,
                     ],
                 },
-                env: { ...ctx.legacySyncEnv, HQ_SYNC_PASS_REQUEST_DIR: ctx.syncPassRequestsDir },
+                env: {
+                    ...ctx.legacySyncEnv,
+                    ...(ctx.vaultSync ? vaultSkipEnv(ctx.vaultSync) : {}),
+                    HQ_SYNC_PASS_REQUEST_DIR: ctx.syncPassRequestsDir,
+                },
                 heartbeatTimeoutMs: ctx.syncHeartbeatTimeoutMs,
             });
             let ownerBlock;
@@ -160,6 +165,10 @@ function planService(service, ctx) {
             }
             unit.blocked = firstBlock([
                 [ctx.syncPaused, "sync is paused (run `hq daemon sync resume`)"],
+                [
+                    ctx.vaultSync?.allOff === true,
+                    "cloud sync is off for every vault on this computer (turn it back on in HQ Settings > Sync)",
+                ],
                 [!ctx.hqRoot, NO_HQ_ROOT],
                 [!ctx.signedIn, NOT_SIGNED_IN],
                 [!!ownerBlock, ownerBlock ?? ""],

package/dist/lib/daemon/run.js

@@ -32,6 +32,7 @@ import { DAEMON_CHILD_BOOTSTRAP_HANDOFF_WATCH_FLAG, DAEMON_LANES_RECONCILE_FILE_
 import { createLanesReconcileWatcher } from "./lanes-reconcile-watcher.js";
 import { findLegacyUnits, legacyMeshUnitsToRetire, legacyOwnerLookup } from "./legacy.js";
 import { readLegacySyncEnv } from "./legacy-sync-env.js";
+import { readVaultSyncSwitches, unreadableSwitchesWarning } from "../vault-sync-switches.js";
 import { acquireDaemonLock, isProcessAlive, processCommandLine, releaseDaemonLock } from "./lock.js";
 import { retireLegacyMeshUnits } from "./migrate.js";
 import { daemonDir as meshDaemonDir, daemonPidPath as meshDaemonPidPath } from "../mesh/live/daemon/paths.js";
@@ -581,6 +582,8 @@ export async function runDaemon(opts) {
         finishSuccession(succession, tracker.records(), log);
     /** Service processes this daemon spawned, so a handoff can let go of them. */
     const spawned = new Set();
+    /** Last unreadable-settings warning logged, so it is logged once per change. */
+    let lastVaultSyncWarning;
     const updatable = cliSelfUpdatable();
     const hostName = os.hostname().split(".")[0] || "hq-host";
     let legacyCache = null;
@@ -949,6 +952,16 @@ export async function runDaemon(opts) {
             signedIn: isSignedIn,
             kitConfigured: fs.existsSync(agentKitPaths(home, env).kitConfigPath),
             syncPaused: config.syncPaused === true,
+            vaultSync: (() => {
+                const switches = readVaultSyncSwitches(home);
+                // Log once per change, not every reconcile.
+                if (switches.unreadable !== lastVaultSyncWarning) {
+                    if (switches.unreadable)
+                        log("warn", unreadableSwitchesWarning(switches.unreadable));
+                    lastVaultSyncWarning = switches.unreadable;
+                }
+                return switches;
+            })(),
             syncOwner,
             desktopAppManagesSync: appManagesSync,
             syncRunnerProcesses,

package/dist/lib/lanes/links.js

@@ -267,28 +267,44 @@ function hookMessage(root, pointer) {
         throw new LaneLinkError("link_pointer_invalid", "Child link pointer has no child name");
     return { inbox: queueDir(root, pointer.link, pointer.name), role: "child", child: pointer.name };
 }
+// Same markers as core's conduct-lanes-link-deliver.sh. A parent session id
+// alone is not one: resumed, forked, or launcher-spawned Grok roots carry it,
+// and Grok marks its real children with subagent_type.
+function isChildHookPayload(payload) {
+    const nonEmpty = (...keys) => keys.some((key) => typeof payload[key] === "string" && payload[key].length > 0);
+    if (["agent_id", "agentId"].some((key) => payload[key] !== undefined && payload[key] !== null && payload[key] !== ""))
+        return true;
+    if (nonEmpty("parent_thread_id", "parentThreadId", "agent_transcript_path", "agentTranscriptPath", "subagent_type", "subagentType"))
+        return true;
+    const transcript = payload.transcript_path ?? payload.transcriptPath;
+    return typeof transcript === "string" && /[/\\]subagents[/\\][^/\\]+\.jsonl$/.test(transcript);
+}
 export async function runLaneLink(subcommand, options) {
     const now = options.now ?? (() => new Date());
     const env = options.env ?? process.env;
     const root = options.hqRoot;
     let sid = "";
+    let childContext = false;
     if (subcommand === "_deliver") {
-        sid = (() => {
-            let payload = {};
-            try {
-                payload = JSON.parse(options.input ?? "{}");
-            }
-            catch { /* malformed hooks are inert */ }
-            const value = payload.session_id ?? payload.sessionId;
-            return typeof value === "string" && safeId(value) ? value : "";
-        })();
+        let payload = {};
+        try {
+            const parsed = JSON.parse(options.input ?? "{}");
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                payload = parsed;
+        }
+        catch { /* malformed hooks are inert */ }
+        const value = payload.session_id ?? payload.sessionId;
+        sid = typeof value === "string" && safeId(value) ? value : "";
+        childContext = isChildHookPayload(payload);
     }
     const requireSid = () => sid || (sid = resolveLinkSessionId(root, options.sessionId, env));
     const links = rootDir(root);
     if (subcommand === "_deliver") {
-        if (!sid || !["PostToolUse", "Stop", "SubagentStop"].includes(options.event ?? ""))
+        // Subagent hook events carry the parent's session_id. Delivering there would
+        // drain the root's queue into the subagent, so leave the message queued.
+        if (!sid || childContext || !["PostToolUse", "Stop"].includes(options.event ?? ""))
             return {};
-        if (["Stop", "SubagentStop"].includes(options.event ?? "") && env.HQ_STOP_DECISION_DELIVERABLE === "0")
+        if (options.event === "Stop" && env.HQ_STOP_DECISION_DELIVERABLE === "0")
             return {};
         const pointer = readPointer(root, sid);
         if (!pointer)

package/dist/lib/vault-sync-switches.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The HQ app's Settings > Sync switches on this computer (usage-only-pricing
+ * US-016), read from the desktop settings file (`menubar.json` in the HQ state
+ * directory):
+ *
+ * - `cloudPaused: true` turns sync off for every vault;
+ * - `personalSyncEnabled: false` turns the personal vault off;
+ * - `workspaceSyncEnabled: { "<slug>": false }` turns one company vault off.
+ *
+ * Dependency-free on purpose (node:fs/os/path only): the `hq daemon` planner
+ * reads it every reconcile.
+ *
+ * A missing file, a missing key, or a value of the wrong type means on, so
+ * CLI-only installs and agent boxes keep syncing. A file that exists but
+ * cannot be read or parsed also means on, and is reported through
+ * `unreadable` so callers can warn instead of turning sync back on silently.
+ */
+export interface VaultSyncSwitches {
+    /** "Turn off all cloud sync" is on. */
+    allOff: boolean;
+    /** The personal vault's switch is off. */
+    personalOff: boolean;
+    /** Lowercased slugs of company vaults whose switch is off. */
+    offCompanies: ReadonlySet<string>;
+    /**
+     * Set when the settings file exists but could not be read or parsed. Every
+     * switch then reads as on; callers should warn.
+     */
+    unreadable?: string;
+}
+export declare function vaultSyncSettingsPath(home?: string): string;
+/** Read every switch. Never throws. */
+export declare function readVaultSyncSwitches(home?: string): VaultSyncSwitches;
+/** The warning printed when the settings file is unreadable. */
+export declare function unreadableSwitchesWarning(reason: string): string;
+/**
+ * Environment for an hq-cloud sync runner so it skips off vaults
+ * (`HQ_SYNC_SKIP_COMPANIES`, `HQ_SYNC_SKIP_PERSONAL`). Empty when all are on.
+ */
+export declare function vaultSkipEnv(switches: VaultSyncSwitches): Record<string, string>;
+//# sourceMappingURL=vault-sync-switches.d.ts.map

package/dist/lib/vault-sync-switches.js

@@ -0,0 +1,86 @@
+/**
+ * The HQ app's Settings > Sync switches on this computer (usage-only-pricing
+ * US-016), read from the desktop settings file (`menubar.json` in the HQ state
+ * directory):
+ *
+ * - `cloudPaused: true` turns sync off for every vault;
+ * - `personalSyncEnabled: false` turns the personal vault off;
+ * - `workspaceSyncEnabled: { "<slug>": false }` turns one company vault off.
+ *
+ * Dependency-free on purpose (node:fs/os/path only): the `hq daemon` planner
+ * reads it every reconcile.
+ *
+ * A missing file, a missing key, or a value of the wrong type means on, so
+ * CLI-only installs and agent boxes keep syncing. A file that exists but
+ * cannot be read or parsed also means on, and is reported through
+ * `unreadable` so callers can warn instead of turning sync back on silently.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export function vaultSyncSettingsPath(home = os.homedir()) {
+    return path.join(home, ".hq", "menubar.json");
+}
+function allOn(unreadable) {
+    return {
+        allOff: false,
+        personalOff: false,
+        offCompanies: new Set(),
+        ...(unreadable ? { unreadable } : {}),
+    };
+}
+/** Read every switch. Never throws. */
+export function readVaultSyncSwitches(home = os.homedir()) {
+    const file = vaultSyncSettingsPath(home);
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return allOn();
+        return allOn(`could not read ${file}`);
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return allOn(`${file} is not valid JSON`);
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return allOn(`${file} is not a JSON object`);
+    }
+    const prefs = raw;
+    const offCompanies = new Set();
+    const map = prefs.workspaceSyncEnabled;
+    if (typeof map === "object" && map !== null && !Array.isArray(map)) {
+        for (const [slug, enabled] of Object.entries(map)) {
+            if (enabled === false && slug.trim())
+                offCompanies.add(slug.trim().toLowerCase());
+        }
+    }
+    return {
+        allOff: prefs.cloudPaused === true,
+        personalOff: prefs.personalSyncEnabled === false,
+        offCompanies,
+    };
+}
+/** The warning printed when the settings file is unreadable. */
+export function unreadableSwitchesWarning(reason) {
+    return `Warning: ${reason}, so HQ cannot tell which vaults have sync turned off on this computer. Every vault will sync. Fix or remove the file, or set the switches again in HQ Settings > Sync.`;
+}
+/**
+ * Environment for an hq-cloud sync runner so it skips off vaults
+ * (`HQ_SYNC_SKIP_COMPANIES`, `HQ_SYNC_SKIP_PERSONAL`). Empty when all are on.
+ */
+export function vaultSkipEnv(switches) {
+    const env = {};
+    if (switches.offCompanies.size > 0) {
+        env.HQ_SYNC_SKIP_COMPANIES = [...switches.offCompanies].sort().join(",");
+    }
+    if (switches.personalOff)
+        env.HQ_SYNC_SKIP_PERSONAL = "1";
+    return env;
+}
+//# sourceMappingURL=vault-sync-switches.js.map

package/dist/utils/hook-trust.d.ts

@@ -26,6 +26,20 @@ export interface HookTrustDependencies {
      * our read and our commit — which no other seam can reach.
      */
     readConfigText?: (file: string) => string;
+    /**
+     * Reads the HQ `.codex` hook files exactly as the installed core release
+     * ships them. Used only by the post-rescue re-trust; see
+     * {@link retrustCodexHooksAfterRescue}.
+     */
+    loadShippedCodexHooks?: (hqRoot: string) => Promise<ShippedCodexHookFiles>;
+}
+/**
+ * The text of the hook files in core's `.codex/` layer at the release a rescue
+ * installed. A file the release does not ship is left out.
+ */
+export interface ShippedCodexHookFiles {
+    'config.toml'?: string;
+    'hooks.json'?: string;
 }
 /** Per-call knobs the `hq reindex` orchestration passes down. */
 export interface HookTrustOptions {
@@ -62,6 +76,19 @@ export declare function planCodexLaunch(executable: string, args: readonly strin
 export declare function createCodexAppServerClient(cwd: string, executable?: string, args?: string[]): Promise<CodexRpcClient>;
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
 export declare function trustCodexProjectHooks(hqRoot: string, deps?: HookTrustDependencies): Promise<RuntimeHookTrustResult>;
+/**
+ * Re-trust the Codex hooks HQ core ships after `hq rescue` re-lays core.
+ *
+ * Codex trusts a hook by the hash of its current command, so an update that
+ * changes a hook command leaves Codex skipping it as untrusted until the next
+ * trust pass. Rescue runs that pass itself, for core-shipped hooks only: a
+ * hook in `<hqRoot>/.codex/` is trusted only when its entry matches the
+ * shipped copy of its file (see {@link coreShippedHooks}), so a hand-added
+ * entry is never trusted. Unlike `hq reindex`, rescue does not re-enable a
+ * shipped hook the user turned off. Already trusted hooks are left as they
+ * are, and a machine without Codex is skipped without starting anything.
+ */
+export declare function retrustCodexHooksAfterRescue(hqRoot: string, deps?: HookTrustDependencies, codexInstalled?: () => boolean): Promise<RuntimeHookTrustResult>;
 /**
  * Trust the user-scope hooks `hq install --global --runtime codex` registered
  * in ~/.codex/hooks.json, named by their Codex keys (`<file>:<event>:<group>:<hook>`).

package/dist/utils/hook-trust.js

@@ -3,12 +3,14 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as readline from 'node:readline';
+import { parse as parseToml } from 'smol-toml';
 // `~/.claude.json` is Claude Code's live user-global state file, so the write
 // reuses the hardened MCP-registration primitives (advisory lock held across
 // read->merge->write, backup before the first byte, temp+fsync+rename commit)
 // rather than a bare readFile/writeFile pair.
 import { acquireLock, atomicReplace, backupConfig, realpathOrSelf, releaseLock, restoreFromBackup, } from '../commands/mcp-registration.js';
 import { findExecutableOnPath } from './resolve-executable.js';
+import { loadShippedCodexHookFiles } from './shipped-codex-hooks.js';
 import { planResolvedCommandSpawn } from './windows-spawn.js';
 /**
  * The home directory every runtime's config is resolved under.
@@ -84,6 +86,98 @@ function hqProjectHooks(hqRoot, hooks) {
         !hook.isManaged &&
         isWithin(path.resolve(hook.sourcePath), codexLayer));
 }
+/** Codex's snake_case spelling of a hook event name (`PreToolUse` -> `pre_tool_use`). */
+function snakeEvent(event) {
+    return event.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+}
+/** Stable JSON for comparing two parsed hook entries regardless of key order. */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const object = asObject(value);
+    if (object) {
+        return `{${Object.keys(object)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+/**
+ * Every hook entry in a Codex hooks file (TOML or JSON), keyed by the
+ * `<snake_event>:<group>:<hook>` suffix Codex appends to the file path to form
+ * a hook key. Unparseable text yields undefined.
+ */
+function codexHookEntries(text, toml) {
+    const entries = new Map();
+    let doc;
+    try {
+        doc = toml ? parseToml(text) : JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const hooks = asObject(asObject(doc)?.hooks);
+    for (const [event, groups] of Object.entries(hooks ?? {})) {
+        if (!Array.isArray(groups))
+            continue;
+        groups.forEach((group, g) => {
+            const handlers = asObject(group)?.hooks;
+            if (!Array.isArray(handlers))
+                return;
+            handlers.forEach((handler, h) => {
+                entries.set(`${snakeEvent(event)}:${g}:${h}`, canonicalJson(handler));
+            });
+        });
+    }
+    return entries;
+}
+/**
+ * The HQ project hooks that ship in core: those whose entry in
+ * `<hqRoot>/.codex/config.toml` or `.codex/hooks.json` is identical, at the
+ * same position, to the entry in the shipped copy of that file. A hand-added
+ * entry, or a shipped entry the user edited, matches nothing and is left out.
+ * When an HQ hook comes from a file the release does not ship, or whose
+ * shipped copy does not parse, nothing can be compared and the pass fails.
+ */
+function coreShippedHooks(hqRoot, hooks, shipped) {
+    const codexLayer = path.resolve(hqRoot, '.codex');
+    const local = new Map();
+    const selected = [];
+    for (const hook of hqProjectHooks(hqRoot, hooks)) {
+        const sourcePath = path.resolve(hook.sourcePath);
+        const file = path.relative(codexLayer, sourcePath);
+        if (file !== 'config.toml' && file !== 'hooks.json')
+            continue;
+        const prefix = `${hook.sourcePath}:`;
+        if (!hook.key.startsWith(prefix))
+            continue;
+        const toml = file.endsWith('.toml');
+        const shippedText = shipped[file];
+        if (shippedText === undefined)
+            return { fail: `the installed core release does not ship .codex/${file}` };
+        const theirs = codexHookEntries(shippedText, toml);
+        if (!theirs)
+            return { fail: `the shipped .codex/${file} is not valid ${toml ? 'TOML' : 'JSON'}` };
+        let mine = local.get(file);
+        if (!mine) {
+            let text;
+            try {
+                text = fs.readFileSync(sourcePath, 'utf8');
+            }
+            catch {
+                text = undefined;
+            }
+            mine = (text === undefined ? undefined : codexHookEntries(text, toml)) ?? new Map();
+            local.set(file, mine);
+        }
+        const position = hook.key.slice(prefix.length);
+        const entry = mine.get(position);
+        if (entry !== undefined && entry === theirs.get(position))
+            selected.push(hook);
+    }
+    return selected.length === 0 ? { skip: 'no core-shipped HQ hooks discovered' } : { hooks: selected };
+}
 /**
  * How to launch Codex. npm installs Codex on Windows as a `codex.cmd` shim,
  * which `spawn('codex')` cannot find (ENOENT) and Node refuses to run without a
@@ -203,6 +297,7 @@ export async function createCodexAppServerClient(cwd, executable = 'codex', args
 const DEFAULT_DEPS = {
     createCodexClient: createCodexAppServerClient,
     homeDir: defaultHomeDir,
+    loadShippedCodexHooks: (hqRoot) => loadShippedCodexHookFiles(hqRoot),
 };
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
 export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
@@ -216,6 +311,46 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
             : { hooks: projectHooks };
     });
 }
+/** Whether a Codex CLI is on PATH (PATHEXT-expanded on Windows). */
+function codexOnPath() {
+    return findExecutableOnPath('codex') !== undefined;
+}
+/**
+ * Re-trust the Codex hooks HQ core ships after `hq rescue` re-lays core.
+ *
+ * Codex trusts a hook by the hash of its current command, so an update that
+ * changes a hook command leaves Codex skipping it as untrusted until the next
+ * trust pass. Rescue runs that pass itself, for core-shipped hooks only: a
+ * hook in `<hqRoot>/.codex/` is trusted only when its entry matches the
+ * shipped copy of its file (see {@link coreShippedHooks}), so a hand-added
+ * entry is never trusted. Unlike `hq reindex`, rescue does not re-enable a
+ * shipped hook the user turned off. Already trusted hooks are left as they
+ * are, and a machine without Codex is skipped without starting anything.
+ */
+export async function retrustCodexHooksAfterRescue(hqRoot, deps = DEFAULT_DEPS, codexInstalled = codexOnPath) {
+    if (!codexInstalled()) {
+        return { runtime: 'codex', status: 'skipped', trusted: 0, reason: 'Codex CLI not installed' };
+    }
+    if (!fs.existsSync(path.join(hqRoot, '.codex'))) {
+        return { runtime: 'codex', status: 'skipped', trusted: 0, reason: 'project .codex layer absent' };
+    }
+    if (!deps.loadShippedCodexHooks) {
+        return { runtime: 'codex', status: 'failed', trusted: 0, reason: 'no source for the shipped Codex hooks' };
+    }
+    let shipped;
+    try {
+        shipped = await deps.loadShippedCodexHooks(hqRoot);
+    }
+    catch (error) {
+        return {
+            runtime: 'codex',
+            status: 'failed',
+            trusted: 0,
+            reason: `could not read the shipped Codex hooks: ${errorMessage(error)}`,
+        };
+    }
+    return trustCodexHooks(hqRoot, deps, (hooks) => coreShippedHooks(hqRoot, hooks, shipped), { enableDisabled: false });
+}
 /**
  * Trust the user-scope hooks `hq install --global --runtime codex` registered
  * in ~/.codex/hooks.json, named by their Codex keys (`<file>:<event>:<group>:<hook>`).
@@ -234,8 +369,12 @@ export async function trustCodexUserHooks(cwd, keys, deps = DEFAULT_DEPS) {
         return { hooks: keys.map((key) => byKey.get(key)) };
     });
 }
-/** List hooks for `cwd`, trust and enable the selected ones, then verify. */
-async function trustCodexHooks(cwd, deps, select) {
+/**
+ * List hooks for `cwd`, trust the selected ones, then verify. By default a
+ * selected hook the user disabled is also re-enabled; `enableDisabled: false`
+ * keeps each hook's enabled state as it is.
+ */
+async function trustCodexHooks(cwd, deps, select, { enableDisabled = true } = {}) {
     let client;
     try {
         client = await deps.createCodexClient(cwd);
@@ -256,17 +395,20 @@ async function trustCodexHooks(cwd, deps, select) {
             return { runtime: 'codex', status: 'failed', trusted: 0, reason: selection.fail };
         }
         const selected = selection.hooks;
-        // Converge every selected HQ hook to trusted AND enabled. A hook that is
-        // already trusted but was toggled off would otherwise silently stay
-        // disabled forever; reindex and install are the convergence points.
-        const pending = selected.filter((hook) => hook.trustStatus === 'untrusted' || hook.trustStatus === 'modified' || !hook.enabled);
+        // Converge every selected HQ hook to trusted AND (unless the caller opted
+        // out) enabled. A hook that is already trusted but was toggled off would
+        // otherwise silently stay disabled forever; reindex and install are the
+        // convergence points. Rescue opts out and only refreshes trust.
+        const pending = selected.filter((hook) => hook.trustStatus === 'untrusted' ||
+            hook.trustStatus === 'modified' ||
+            (enableDisabled && !hook.enabled));
         if (pending.length === 0) {
             return { runtime: 'codex', status: 'unchanged', trusted: 0 };
         }
         const state = Object.fromEntries(pending.map((hook) => [
             hook.key,
             {
-                enabled: true,
+                enabled: enableDisabled ? true : hook.enabled,
                 trusted_hash: hook.currentHash,
             },
         ]));
@@ -279,7 +421,7 @@ async function trustCodexHooks(cwd, deps, select) {
         const stillPending = pending
             .filter((hook) => {
             const after = verifiedByKey.get(hook.key);
-            return after?.trustStatus !== 'trusted' || after.enabled !== true;
+            return after?.trustStatus !== 'trusted' || after.enabled !== (enableDisabled || hook.enabled);
         })
             .map((hook) => hook.key);
         if (verified.errors.length > 0 || stillPending.length > 0) {

package/dist/utils/shipped-codex-hooks.d.ts

@@ -0,0 +1,17 @@
+import type { ShippedCodexHookFiles } from './hook-trust.js';
+/** The only repos rescue installs core from: the default and `--staging`. */
+export declare const PROD_SOURCE = "indigoai-us/hq-core";
+export declare const STAGING_SOURCE = "indigoai-us/hq-core-staging";
+/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
+export declare function resolveGhToken(): string | undefined;
+/**
+ * The upstream repo and commit the last rescue installed, from `core/core.yaml`.
+ * Only the HQ core repos are accepted.
+ */
+export declare function readCoreSyncStamp(hqRoot: string): {
+    source: string;
+    sha: string;
+};
+/** The shipped `.codex/config.toml` and `.codex/hooks.json` for this HQ root's installed core. */
+export declare function loadShippedCodexHookFiles(hqRoot: string, token?: string | undefined, fetchImpl?: typeof fetch): Promise<ShippedCodexHookFiles>;
+//# sourceMappingURL=shipped-codex-hooks.d.ts.map

package/dist/utils/shipped-codex-hooks.js

@@ -0,0 +1,86 @@
+/**
+ * Reads the Codex hook files HQ core ships, at the exact commit a rescue
+ * installed, so the post-rescue re-trust can tell core-shipped hook entries
+ * from ones a user added by hand.
+ *
+ * The commit comes from the sync stamp rescue writes to `core/core.yaml`
+ * (`replaced_from_source.source` + `last_sync_sha`); the files come from the
+ * GitHub contents API for that repo and commit.
+ */
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+/** The only repos rescue installs core from: the default and `--staging`. */
+export const PROD_SOURCE = 'indigoai-us/hq-core';
+export const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
+const CORE_SOURCES = [PROD_SOURCE, STAGING_SOURCE];
+/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
+export function resolveGhToken() {
+    try {
+        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+        if (res.status === 0) {
+            const tok = res.stdout.trim();
+            if (tok)
+                return tok;
+        }
+    }
+    catch {
+        // gh not installed — fall through to env.
+    }
+    return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
+}
+/**
+ * The upstream repo and commit the last rescue installed, from `core/core.yaml`.
+ * Only the HQ core repos are accepted.
+ */
+export function readCoreSyncStamp(hqRoot) {
+    const file = path.join(hqRoot, 'core', 'core.yaml');
+    const doc = yaml.load(fs.readFileSync(file, 'utf8'));
+    const stamp = doc?.replaced_from_source;
+    const source = stamp?.source;
+    const sha = stamp?.last_sync_sha;
+    if (typeof source !== 'string' || !/^[\w.-]+\/[\w.-]+$/.test(source)) {
+        throw new Error('core/core.yaml has no replaced_from_source.source repo');
+    }
+    // Anyone who can edit core.yaml could otherwise point the comparison (and
+    // the GitHub token) at a repo of their own and make a foreign hook "shipped".
+    if (!CORE_SOURCES.includes(source)) {
+        throw new Error(`core/core.yaml names ${source}, which is not an HQ core repo (${CORE_SOURCES.join(' or ')})`);
+    }
+    if (typeof sha !== 'string' || !/^[0-9a-f]{40}$/.test(sha)) {
+        throw new Error('core/core.yaml has no replaced_from_source.last_sync_sha commit');
+    }
+    return { source, sha };
+}
+// Same bound as rescue's own GitHub requests.
+const GITHUB_REQUEST_TIMEOUT_MS = 30_000;
+/** One file's raw text at `sha`, or undefined when the commit has no such file. */
+async function fetchRawFile(repo, sha, file, token, fetchImpl) {
+    const headers = {
+        Accept: 'application/vnd.github.raw',
+        'User-Agent': 'hq-cli-rescue',
+        'X-GitHub-Api-Version': '2022-11-28',
+    };
+    if (token)
+        headers.Authorization = `Bearer ${token}`;
+    const url = `https://api.github.com/repos/${repo}/contents/${file}?ref=${sha}`;
+    const response = await fetchImpl(url, { headers, signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) });
+    if (response.status === 404)
+        return undefined;
+    if (!response.ok)
+        throw new Error(`GitHub contents ${file}@${sha.slice(0, 12)} for ${repo}: HTTP ${response.status}`);
+    return response.text();
+}
+/** The shipped `.codex/config.toml` and `.codex/hooks.json` for this HQ root's installed core. */
+export async function loadShippedCodexHookFiles(hqRoot, token = resolveGhToken(), fetchImpl = fetch) {
+    const { source, sha } = readCoreSyncStamp(hqRoot);
+    const shipped = {};
+    for (const name of ['config.toml', 'hooks.json']) {
+        const text = await fetchRawFile(source, sha, `.codex/${name}`, token, fetchImpl);
+        if (text !== undefined)
+            shipped[name] = text;
+    }
+    return shipped;
+}
+//# sourceMappingURL=shipped-codex-hooks.js.map