@indigoai-us/hq-cli 5.345.151 → 5.345.153

package/dist/lib/decisions/import-lanes.js

@@ -0,0 +1,152 @@
+import { decisionExpiry } from "./expiry.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { createHash } from "node:crypto";
+import { listQuestionIds, readQuestion, questionRecordPath, withLaneRecordFileLock } from "../lanes/store.js";
+import { questionBodyAbsPath, sha256Text } from "../lanes/questions.js";
+import { DecisionError } from "./client.js";
+import { importedQuestionMarker } from "../lanes/imported-question.js";
+export function legacyDecisionInput(record, body, audience) {
+    // Answered/closed/routed questions require contracts beyond release 1.
+    if (!record.company?.uid || !/^cmp_[A-Za-z0-9]+$/.test(record.company.uid) || record.status !== "pending" || record.hop > 1 || record.answer || record.answer_history?.length ||
+        record.routing_history.at(-1)?.audience.kind !== "user" ||
+        record.routing_history.at(-1)?.audience.id !== audience ||
+        record.routing_history.some(entry => entry.reason === "escalated") || body.notes || body.loop_stall ||
+        !Array.isArray(body.options) || body.options.length < 2 ||
+        body.options.some(option => typeof option !== "string" || !option.trim()) ||
+        new Set(body.options).size !== body.options.length ||
+        typeof body.question !== "string" || !body.question.trim() || typeof body.context !== "string" ||
+        (body.recommended !== undefined && !body.options.includes(body.recommended)))
+        return undefined;
+    return {
+        companyUid: record.company.uid, expiresAt: decisionExpiry(),
+        audience: { kind: "person", personUid: audience }, statement: body.question,
+        options: body.options.map((label, index) => ({ id: String(index + 1), label, recommended: label === body.recommended })),
+        context: { links: [], commitmentId: null, brief: `${body.context}\n\nImported lane question ${record.question_id}`.trim() },
+    };
+}
+/** Read legacy inputs only. Receipts live separately; legacy lane commands keep their storage. */
+export async function importLaneQuestions(root, audience, client) {
+    const journalDir = path.join(root, "workspace", "decisions", "imports", audience);
+    if (!/^prs_[A-Za-z0-9_-]+$/.test(audience))
+        throw new DecisionError("invalid_audience", "Expected person uid");
+    fs.mkdirSync(journalDir, { recursive: true });
+    const lockPath = path.join(journalDir, "import.lock");
+    let lock;
+    try {
+        lock = fs.openSync(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        throw new DecisionError("import_locked", `An import owns ${lockPath}. Read the PID in that file and verify it is no longer running before deleting only import.lock, then rerun import-lanes. Keep receipts and legacy-read-only markers; they prevent duplicate decisions.`);
+    }
+    fs.writeFileSync(lock, String(process.pid));
+    const counts = { imported: 0, alreadyImported: 0, skipped: 0, skippedQuestions: [] };
+    const skip = (id, reason) => { counts.skipped++; counts.skippedQuestions.push({ id, reason }); };
+    try {
+        for (const id of listQuestionIds(root)) {
+            const record = readQuestion(root, id);
+            const target = record.routing_history.at(-1)?.audience;
+            if (target?.kind === "user" && target.id !== audience) {
+                skip(id, "addressed_to_other_user");
+                continue;
+            }
+            const bodyPath = questionBodyAbsPath(root, record);
+            let serialized;
+            try {
+                serialized = fs.readFileSync(bodyPath, "utf8");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                skip(id, "body_unavailable");
+                continue;
+            }
+            if (record.body.digest && sha256Text(serialized) !== record.body.digest) {
+                skip(id, "body_digest_mismatch");
+                continue;
+            }
+            let body;
+            try {
+                body = JSON.parse(serialized);
+            }
+            catch {
+                skip(id, "body_invalid");
+                continue;
+            }
+            if (!body || typeof body !== "object") {
+                skip(id, "body_invalid");
+                continue;
+            }
+            if (!record.company?.uid || !/^cmp_[A-Za-z0-9]+$/.test(record.company.uid)) {
+                skip(id, "company_unavailable");
+                continue;
+            }
+            const input = legacyDecisionInput(record, body, audience);
+            if (!input) {
+                skip(id, "advanced_or_closed_question");
+                continue;
+            }
+            const key = createHash("sha256").update(id).digest("hex");
+            const receiptPath = path.join(journalDir, `${key}.json`);
+            const digest = sha256Text(JSON.stringify({ ...input, expiresAt: undefined }));
+            const receipt = fs.existsSync(receiptPath) ? JSON.parse(fs.readFileSync(receiptPath, "utf8")) : undefined;
+            if (receipt) {
+                if (receipt.sourceDigest !== digest) {
+                    skip(id, "source_changed_after_import");
+                    continue;
+                }
+                // Upgrade receipts written before the read-only marker was introduced.
+                withLaneRecordFileLock(questionRecordPath(root, id), () => {
+                    const markerPath = importedQuestionMarker(root, id);
+                    fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+                    if (!fs.existsSync(markerPath))
+                        fs.writeFileSync(markerPath, JSON.stringify({ audience, receiptPath }), { flag: "wx", mode: 0o600 });
+                });
+                if (receipt.state === "imported" && receipt.decisionId) {
+                    counts.alreadyImported++;
+                    continue;
+                }
+                // A crash or lost POST response is ambiguous. Reconcile, never blindly POST again.
+                const matches = (await client.list()).filter(decision => decision.companyUid === input.companyUid && decision.audience.kind === "person" && decision.audience.personUid === audience && decision.context.brief === input.context.brief && decision.statement === input.statement && JSON.stringify(decision.options) === JSON.stringify(input.options));
+                if (matches.length !== 1)
+                    throw new DecisionError("import_outcome_unknown", `Question ${id} has an unresolved create; inspect the server before retrying. Receipt: ${receiptPath}`);
+                fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "imported", decisionId: matches[0].id }), { mode: 0o600 });
+                counts.alreadyImported++;
+                continue;
+            }
+            // Persist intent before POST, so even interruption cannot cause an automatic duplicate.
+            const markerPath = importedQuestionMarker(root, id);
+            const fenced = withLaneRecordFileLock(questionRecordPath(root, id), () => {
+                const current = readQuestion(root, id);
+                if (current.version !== record.version || fs.readFileSync(bodyPath, "utf8") !== serialized)
+                    return false;
+                fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+                try {
+                    fs.writeFileSync(markerPath, JSON.stringify({ audience, receiptPath }), { flag: "wx", mode: 0o600 });
+                }
+                catch (error) {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                    throw new DecisionError("import_outcome_unknown", `Question ${id} already has a read-only transfer marker; inspect its receipt before retrying`);
+                }
+                fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "pending" }), { flag: "wx", mode: 0o600 });
+                return true;
+            });
+            if (!fenced) {
+                skip(id, "source_changed_during_import");
+                continue;
+            }
+            const decision = await client.ask(input);
+            fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "imported", decisionId: decision.id }), { mode: 0o600 });
+            counts.imported++;
+        }
+        return counts;
+    }
+    finally {
+        fs.closeSync(lock);
+        fs.unlinkSync(lockPath);
+    }
+}
+//# sourceMappingURL=import-lanes.js.map

package/dist/lib/decisions/principal.d.ts

@@ -0,0 +1,11 @@
+import { type AgentRecord } from "../bot/api.js";
+export declare const ASK_POLICY = "assistant-bound-conductor-release-1-conductor-only";
+/** Session parsing adapted from hq-cli PR 1993; a session reference grants no authority. */
+export declare function desktopSessionRef(env: NodeJS.ProcessEnv): string | undefined;
+/** US-007 seam. No lease authority exists in release 1; env flags never grant it. */
+export declare function hasConductorLease(_session: string | undefined): Promise<boolean>;
+export declare function assertPersonalLocalBot(uid: string, agent: AgentRecord): string;
+export declare function askAudience(token: string): Promise<string>;
+/** Import creates decisions, so the same server-enforced bot gate applies. */
+export declare const importAudience: typeof askAudience;
+//# sourceMappingURL=principal.d.ts.map

package/dist/lib/decisions/principal.js

@@ -0,0 +1,52 @@
+import { resolveCallerUid, vaultApiFetch } from "../../utils/vault-api.js";
+import { BotApi, BotApiError } from "../bot/api.js";
+import { normalizeSessionIdentity } from "../mesh/live/session-identity.js";
+import { DecisionError } from "./client.js";
+export const ASK_POLICY = "assistant-bound-conductor-release-1-conductor-only";
+/** Session parsing adapted from hq-cli PR 1993; a session reference grants no authority. */
+export function desktopSessionRef(env) {
+    try {
+        const identity = normalizeSessionIdentity({ env });
+        const provider = identity.source.startsWith("CODEX") ? "codex"
+            : identity.source.startsWith("CLAUDE") ? "claude"
+                : env.HQ_SESSION_PROVIDER?.trim() || (env.CODEX_THREAD_ID || env.CODEX_SESSION_ID ? "codex" : "claude");
+        if (!/^[a-z][a-z0-9_-]*$/.test(provider) || !/^[A-Za-z0-9._-]{1,128}$/.test(identity.sessionId) || [".", ".."].includes(identity.sessionId))
+            return undefined;
+        return `session:${provider}:${identity.sessionId}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** US-007 seam. No lease authority exists in release 1; env flags never grant it. */
+export async function hasConductorLease(_session) { return false; }
+export function assertPersonalLocalBot(uid, agent) {
+    if (agent.uid !== uid || agent.computeMode !== "local" || agent.botKind !== "personal" || !agent.ownerUid?.startsWith("prs_")) {
+        throw new DecisionError("asker_not_allowed", `${ASK_POLICY} requires the owner's personal local bot principal`);
+    }
+    return agent.ownerUid;
+}
+export async function askAudience(token) {
+    const caller = await resolveCallerUid(token);
+    if (caller.kind === "agent") {
+        try {
+            const agent = await new BotApi({
+                token: async () => token,
+                fetchImpl: options => vaultApiFetch({ ...options, signal: AbortSignal.timeout(15_000) }),
+            }).getAgent(caller.uid);
+            return assertPersonalLocalBot(caller.uid, agent);
+        }
+        catch (error) {
+            if (error instanceof BotApiError && [403, 404].includes(error.status)) {
+                throw new DecisionError("asker_not_allowed", `${ASK_POLICY} requires a verified personal local bot principal`);
+            }
+            throw error;
+        }
+    }
+    if (await hasConductorLease(desktopSessionRef(process.env)))
+        return caller.uid;
+    throw new DecisionError("asker_not_allowed", `${ASK_POLICY} allows only the personal local bot; desktop conductor leases await US-007`);
+}
+/** Import creates decisions, so the same server-enforced bot gate applies. */
+export const importAudience = askAudience;
+//# sourceMappingURL=principal.js.map

package/dist/lib/doctor/checks/claude-wiring.d.ts

@@ -3,8 +3,8 @@
  *
  * "Wiring" is everything short of firing the hook: is every registration backed
  * by a script that exists and is executable, is every script on disk actually
- * registered, is every gated hook id a member of all three `hook-gate.sh`
- * profiles, and does any command word-split its own script path. A hook can be
+ * registered, is every gated hook id a member of each `hook-gate.sh` profile
+ * at or above its declared tier, and does any command word-split its own script path. A hook can be
  * present, correct, and completely dead — this check catches the ways that
  * happens without a single error surfacing to the user.
  *

package/dist/lib/doctor/checks/claude-wiring.js

@@ -3,8 +3,8 @@
  *
  * "Wiring" is everything short of firing the hook: is every registration backed
  * by a script that exists and is executable, is every script on disk actually
- * registered, is every gated hook id a member of all three `hook-gate.sh`
- * profiles, and does any command word-split its own script path. A hook can be
+ * registered, is every gated hook id a member of each `hook-gate.sh` profile
+ * at or above its declared tier, and does any command word-split its own script path. A hook can be
  * present, correct, and completely dead — this check catches the ways that
  * happens without a single error surfacing to the user.
  *
@@ -23,7 +23,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { GATE_PROFILES, gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
+import { GATE_PROFILES, activeGateProfile, gateMembership, parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-profiles.js";
 import { modeIsExecutable } from "../shared.js";
 import { countStrayGateEntries } from "../stray-gate-entries.js";
 /** Common id prefix for every result this check family emits. */
@@ -163,7 +163,11 @@ export function checkClaudeWiring(context) {
             remediation: `Add ${file} to .claude/hooks/hook-registry.json with the right event and matcher, or delete it.`,
         });
     }
-    // --- AC4: every gated hook id is in ALL THREE profiles -----------------------
+    // --- AC4: every gated hook id is in each profile its tier requires ---------
+    // Profiles are nested tiers (minimal within standard within strict). A hook
+    // absent from a profile BELOW its lowest listed one is excluded on purpose
+    // and passes. A required profile missing the hook fails only when it is the
+    // active runtime profile; otherwise the hook still runs, so it warns.
     const gatedIds = new Set();
     for (const { scan } of scans) {
         if (scan.gatedHookId)
@@ -181,27 +185,34 @@ export function checkClaudeWiring(context) {
         }
         else {
             const profiles = parseHookGateProfiles(gateSource);
+            const active = activeGateProfile(context.hookProfile ?? process.env.HQ_HOOK_PROFILE);
             for (const id of [...gatedIds].sort()) {
-                const { present, missing } = gateMembership(id, profiles);
+                const { present } = gateMembership(id, profiles);
+                const missing = requiredMissingProfiles(id, profiles);
                 if (missing.length === 0) {
                     results.push({
                         status: "PASS",
                         checkId: `${CLAUDE_WIRING_PREFIX}.gate-profiles`,
                         target: id,
-                        message: `Gated hook ${id} is allowlisted in all three hook-gate.sh profiles.`,
+                        message: `Gated hook ${id} is allowlisted in every hook-gate.sh profile from ${present[0]} up.`,
                     });
                     continue;
                 }
                 const missingList = formatProfiles(missing);
                 const presentDesc = present.length > 0 ? formatProfiles(present) : "no profile";
+                const inActive = missing.includes(active);
+                const plural = missing.length === 1 ? "" : "s";
                 results.push({
-                    status: "FAIL",
+                    status: inActive ? "FAIL" : "WARN",
                     checkId: `${CLAUDE_WIRING_PREFIX}.gate-profiles`,
                     target: id,
                     message: `Gated hook ${id} is missing from the ${missingList} hook-gate.sh ` +
-                        `profile${missing.length === 1 ? "" : "s"} (present in ${presentDesc}); ` +
-                        `it silently no-ops under ${missing.length === 1 ? "that profile" : "those profiles"}.`,
-                    remediation: `Add ${id} to the ${missingList} allowlist${missing.length === 1 ? "" : "s"} in .claude/hooks/hook-gate.sh.`,
+                        `profile${plural} (present in ${presentDesc}); ` +
+                        (inActive
+                            ? `it does not run under the active ${active} profile.`
+                            : `it runs under the active ${active} profile but would not run under ${missing.length === 1 ? "that profile" : "those profiles"}.`),
+                    remediation: `Run \`hq doctor --fix\`, or add ${id} to the ${missingList} ` +
+                        `allowlist${plural} in .claude/hooks/hook-gate.sh.`,
                 });
             }
         }

package/dist/lib/doctor/checks/work-context.js

@@ -13,7 +13,7 @@ import { workContextRoot, workContextSessionsDir } from "../../work-context/path
 import { countDistinctHeldEvents, countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../../mesh/live/paths.js";
 import { collectDaemonDoctor, formatDaemonDoctor, } from "../../mesh/live/daemon/doctor.js";
-import { workSessionDenialReason } from "../../mesh/denial-codes.js";
+import { WORK_TRACKING_OFF_DENIAL_CODES, workSessionDenialReason, } from "../../mesh/denial-codes.js";
 export const WORK_CONTEXT_FAMILY_ID = "work-context";
 export const WORK_CONTEXT_FAMILY_TITLE = "Work context";
 const DEFAULT_DEPS = {
@@ -98,7 +98,12 @@ function runChecks(deps) {
     ]
         .filter(Boolean)
         .join(" ");
-    const quarantineDenialReason = showQuarantineReason
+    // A refusal because work tracking is off for the company is shown whether
+    // or not the detail flag is on: without it doctor only shows a count and the
+    // user is left guessing at auth (Shepherd issue 2726).
+    const workTrackingOff = stats.quarantined > 0 &&
+        WORK_TRACKING_OFF_DENIAL_CODES.includes(stats.lastQuarantineServerCode ?? "");
+    const quarantineDenialReason = showQuarantineReason || workTrackingOff
         ? workSessionDenialReason(stats.lastQuarantineServerCode)
         : undefined;
     results.push({

package/dist/lib/doctor/fix/apply.d.ts

@@ -190,8 +190,9 @@ export interface AppliedFixBackup {
 export declare const MAX_FIX_PASSES = 3;
 /**
  * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget;
- * pulls go first and uploads take any slot left.
+ * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
+ * When both kinds are pending and no upload has run yet, one slot is held for
+ * a manifest upload so stale journals cannot starve every manifest.
  */
 export declare const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
 /** The outcome of an {@link applyFixes} run. */

package/dist/lib/doctor/fix/apply.js

@@ -40,7 +40,7 @@ import * as path from "node:path";
 import { isPersonalJournalSlug } from "../checks/sync-health.js";
 import { createDefaultRegistry } from "../registry.js";
 import { flattenFamilies } from "../report.js";
-import { gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
+import { parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-profiles.js";
 import { createBackup } from "./backup.js";
 import { removeStrayGateEntries } from "../stray-gate-entries.js";
 import { deriveRemediation } from "./remediation.js";
@@ -48,7 +48,7 @@ import { botDir } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { buildBotDaemonPaths, installedDaemonHqBinary, repairBotDaemonIfStale, rewriteBotDaemonNodePath, } from "../../bot/daemon.js";
 import { classifyRefreshSyncOutcome, } from "./refresh-sync-outcome.js";
-import { readRefreshSyncProgress, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
+import { readRefreshManifestCursor, readRefreshSyncProgress, writeRefreshManifestCursor, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
 import { clientHealthShowManualOnlyEnabled } from "../client-health-reason-codes-flag.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export const HOOK_CONFIG_DIRS = [".claude", ".codex", ".grok"];
@@ -58,8 +58,9 @@ export const REFRESH_SYNC_TIMEOUT_MS = 90_000;
 export const MAX_FIX_PASSES = 3;
 /**
  * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget;
- * pulls go first and uploads take any slot left.
+ * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
+ * When both kinds are pending and no upload has run yet, one slot is held for
+ * a manifest upload so stale journals cannot starve every manifest.
  */
 export const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
 function rotateRefreshSyncPlans(plans, afterSlug) {
@@ -148,6 +149,7 @@ export async function applyFixes(options) {
     let lastAttemptedRefreshSyncSlug = readRefreshSyncProgress(hqRoot)?.lastAttemptedSlug ?? null;
     let refreshSyncAppliedThisRun = 0;
     let refreshManifestAppliedThisRun = 0;
+    let lastAttemptedRefreshManifestScope = readRefreshManifestCursor(hqRoot);
     const appliedKeys = new Set();
     const planned = [];
     const backups = [];
@@ -175,21 +177,20 @@ export async function applyFixes(options) {
             keysThisPass.add(key);
             plans.push(plan);
         }
+        const networkSlotsLeft = Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun - refreshManifestAppliedThisRun);
+        // Both kinds start after the company attempted last, so a scope that
+        // never clears cannot hold the front of the line on every run.
+        const manifestCandidates = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-manifest"), lastAttemptedRefreshManifestScope);
+        // Hold one slot for an upload until one has run this invocation.
+        const manifestReserve = manifestCandidates.length > 0 && refreshManifestAppliedThisRun === 0 ? 1 : 0;
         const seenRefreshTargets = new Set();
         const refreshPlans = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).filter((plan) => {
             if (seenRefreshTargets.has(plan.target))
                 return false;
             seenRefreshTargets.add(plan.target);
             return true;
-        }).slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun));
-        // Manifest uploads take whatever network budget the pulls left.
-        const manifestPlans = plans
-            .filter((plan) => plan.fixClass === "refresh-manifest")
-            .sort((a, b) => (a.target < b.target ? -1 : a.target > b.target ? 1 : 0))
-            .slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN -
-            refreshSyncAppliedThisRun -
-            refreshManifestAppliedThisRun -
-            refreshPlans.length));
+        }).slice(0, Math.max(0, networkSlotsLeft - manifestReserve));
+        const manifestPlans = manifestCandidates.slice(0, networkSlotsLeft - refreshPlans.length);
         return [
             ...plans.filter((plan) => plan.fixClass !== "refresh-sync" && plan.fixClass !== "refresh-manifest"),
             ...refreshPlans,
@@ -255,8 +256,11 @@ export async function applyFixes(options) {
                 lastAttemptedRefreshSyncSlug = plan.target;
                 refreshSyncAppliedThisRun += 1;
             }
-            if (plan.fixClass === "refresh-manifest")
+            if (plan.fixClass === "refresh-manifest") {
+                writeRefreshManifestCursor(hqRoot, plan.target);
+                lastAttemptedRefreshManifestScope = plan.target;
                 refreshManifestAppliedThisRun += 1;
+            }
             appliedKeys.add(JSON.stringify([plan.checkId, plan.target]));
             planned.push({ plan, pass });
             await plan.apply();
@@ -761,7 +765,7 @@ function planGateProfile(hqRoot, result, rem) {
     catch {
         return null;
     }
-    const missing = gateMembership(hookId, parseHookGateProfiles(source)).missing;
+    const missing = requiredMissingProfiles(hookId, parseHookGateProfiles(source));
     if (missing.length === 0)
         return null;
     const relpath = toRelpath(hqRoot, gatePath);

package/dist/lib/doctor/fix/refresh-sync-progress.d.ts

@@ -19,6 +19,20 @@ export interface RefreshSyncProgress {
     lastRunAtMs?: number;
 }
 export declare function readRefreshSyncProgress(hqRoot: string): RefreshSyncProgress | null;
+/**
+ * `--fix` manifest-upload cursor. Kept in its own file so the refresh-sync
+ * progress format, which doctor JSON reads, does not change. Written before
+ * each upload, like the pull cursor, so the next run starts after the last
+ * company attempted and one failing company cannot hold the front of the line.
+ */
+export declare const REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH: string;
+export interface RefreshManifestProgress {
+    version: 1;
+    lastAttemptedScope: string;
+}
+/** The last manifest scope `--fix` attempted, or null when absent or unreadable. */
+export declare function readRefreshManifestCursor(hqRoot: string): string | null;
+export declare function writeRefreshManifestCursor(hqRoot: string, scope: string): void;
 /** Persist the resume cursor without claiming this run finished. */
 export declare function writeRefreshSyncCursor(hqRoot: string, slug: string): void;
 /** Record the check ids this completed `--fix` pass actually tried to refresh. */

package/dist/lib/doctor/fix/refresh-sync-progress.js

@@ -49,13 +49,41 @@ export function readRefreshSyncProgress(hqRoot) {
     }
     return record;
 }
-function writeProgressFile(hqRoot, progress) {
-    const target = progressPath(hqRoot);
+function writeProgressFile(hqRoot, progress, relativePath = REFRESH_SYNC_PROGRESS_RELATIVE_PATH) {
+    const target = path.join(hqRoot, relativePath);
     fs.mkdirSync(path.dirname(target), { recursive: true });
     const temporaryPath = `${target}.${process.pid}.tmp`;
     fs.writeFileSync(temporaryPath, `${JSON.stringify(progress)}\n`, { mode: 0o600 });
     fs.renameSync(temporaryPath, target);
 }
+/**
+ * `--fix` manifest-upload cursor. Kept in its own file so the refresh-sync
+ * progress format, which doctor JSON reads, does not change. Written before
+ * each upload, like the pull cursor, so the next run starts after the last
+ * company attempted and one failing company cannot hold the front of the line.
+ */
+export const REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH = path.join("workspace", "doctor", "refresh-manifest-progress.json");
+/** The last manifest scope `--fix` attempted, or null when absent or unreadable. */
+export function readRefreshManifestCursor(hqRoot) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(path.join(hqRoot, REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH), "utf8"));
+    }
+    catch {
+        // The cursor only orders retries. A missing or damaged file restarts the
+        // rotation from the first scope instead of failing the repair run.
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const record = parsed;
+    if (record.version !== 1 || typeof record.lastAttemptedScope !== "string")
+        return null;
+    return record.lastAttemptedScope;
+}
+export function writeRefreshManifestCursor(hqRoot, scope) {
+    writeProgressFile(hqRoot, { version: 1, lastAttemptedScope: scope }, REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH);
+}
 /** Persist the resume cursor without claiming this run finished. */
 export function writeRefreshSyncCursor(hqRoot, slug) {
     const existing = readRefreshSyncProgress(hqRoot);

package/dist/lib/doctor/fix/remediation.js

@@ -87,8 +87,10 @@ export function deriveRemediation(result) {
             command: `chmod +x "${chmodPath}"`,
         };
     }
-    // gate-profile — a gated hook id present in some but not all three profiles.
-    if (checkId.endsWith(".gate-profiles") && result.status === "FAIL" && target) {
+    // gate-profile — a gated hook id missing from a profile its tier requires.
+    if (checkId.endsWith(".gate-profiles") &&
+        (result.status === "FAIL" || result.status === "WARN") &&
+        target) {
         return {
             autoFixable: true,
             fixClass: "gate-profile",

package/dist/lib/doctor/hook-gate-profiles.d.ts

@@ -52,4 +52,23 @@ export declare function parseHookGateProfiles(source: string): HookGateProfiles;
  * profile allowlists key on the hook id, not the script filename.
  */
 export declare function gateMembership(hookId: string, profiles: HookGateProfiles): GateMembership;
+/**
+ * The profiles `hookId` is REQUIRED in but missing from.
+ *
+ * The shipped gate declares the profiles as nested tiers: minimal is
+ * "critical safety hooks only", standard is "all minimal + ...", strict is
+ * "all standard + ...". A hook's lowest listed profile is its declared tier,
+ * and it must be listed in every profile from that tier up. Absence from a
+ * LOWER profile is an intentional exclusion, not a defect (feedback 299: a
+ * standard hook absent from minimal is by design). The tier is capped at
+ * standard, so an id listed only in strict is still required in standard. An
+ * id listed in no profile is required everywhere.
+ */
+export declare function requiredMissingProfiles(hookId: string, profiles: HookGateProfiles): GateProfile[];
+/**
+ * Resolve the runtime gate profile the way hook-gate.sh does:
+ * `HQ_HOOK_PROFILE`, default `standard`. An unrecognised value falls back to
+ * `standard` here (the gate itself errors on it).
+ */
+export declare function activeGateProfile(value?: string | null): GateProfile;
 //# sourceMappingURL=hook-gate-profiles.d.ts.map

package/dist/lib/doctor/hook-gate-profiles.js

@@ -104,4 +104,38 @@ function profileFunctionBody(source, profile) {
     const close = rest.search(/\n\s*\}/);
     return close >= 0 ? rest.slice(0, close) : rest;
 }
+/**
+ * The profiles `hookId` is REQUIRED in but missing from.
+ *
+ * The shipped gate declares the profiles as nested tiers: minimal is
+ * "critical safety hooks only", standard is "all minimal + ...", strict is
+ * "all standard + ...". A hook's lowest listed profile is its declared tier,
+ * and it must be listed in every profile from that tier up. Absence from a
+ * LOWER profile is an intentional exclusion, not a defect (feedback 299: a
+ * standard hook absent from minimal is by design). The tier is capped at
+ * standard, so an id listed only in strict is still required in standard. An
+ * id listed in no profile is required everywhere.
+ */
+export function requiredMissingProfiles(hookId, profiles) {
+    const { present, missing } = gateMembership(hookId, profiles);
+    if (present.length === 0)
+        return missing;
+    // The inferred tier is capped at standard, the default runtime profile. The
+    // strict list is reserved for future hooks and currently equals standard, so
+    // a strict-only id is a missed allowlist edit, not a strict tier: it never
+    // runs under the default profile and must still be required in standard.
+    const lowest = Math.min(GATE_PROFILES.indexOf(present[0]), GATE_PROFILES.indexOf("standard"));
+    return missing.filter((p) => GATE_PROFILES.indexOf(p) >= lowest);
+}
+/**
+ * Resolve the runtime gate profile the way hook-gate.sh does:
+ * `HQ_HOOK_PROFILE`, default `standard`. An unrecognised value falls back to
+ * `standard` here (the gate itself errors on it).
+ */
+export function activeGateProfile(value) {
+    const v = (value ?? "").trim();
+    return GATE_PROFILES.includes(v)
+        ? v
+        : "standard";
+}
 //# sourceMappingURL=hook-gate-profiles.js.map

package/dist/lib/doctor/types.d.ts

@@ -79,6 +79,11 @@ export interface CheckContext {
     company?: string;
     /** Internal test seam; production `hq doctor` always enables integrations. */
     integrations?: boolean;
+    /**
+     * The runtime hook-gate profile (minimal|standard|strict) to judge gate
+     * membership against. Absent reads `HQ_HOOK_PROFILE`, default `standard`.
+     */
+    hookProfile?: string;
 }
 /**
  * A check family: an id, a human title, and an async `run` returning per-item

package/dist/lib/install/provider-wrappers.js

@@ -94,7 +94,11 @@ function wrapperSource(provider) {
         'log_file="$log_dir/provider-auth.log"',
         'tmp=$(mktemp -d "${TMPDIR:-/tmp}/hq-provider.XXXXXX") || exit 1',
         'trap \'rm -rf "$tmp"\' EXIT HUP INT TERM',
-        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; else auth_status=124; fi`,
+        // macOS ships no timeout(1), so the perl alarm fallback runs there. When the
+        // alarm fires the shell itself reports "Alarm clock: 14 perl ..." on its own
+        // stderr (the command's 2>&1 does not cover it); the brace group's 2>/dev/null
+        // keeps that report off the user's terminal. The exit status (142) is unchanged.
+        `if command -v timeout >/dev/null 2>&1; then timeout 5 "$real" ${statusArgs} >"$tmp/status" 2>&1; auth_status=$?; elif command -v perl >/dev/null 2>&1; then { perl -e 'alarm 5; exec @ARGV' "$real" ${statusArgs} >"$tmp/status" 2>&1; } 2>/dev/null; auth_status=$?; else auth_status=124; fi`,
         'case "$auth_status" in 124|142) : >"$tmp/status-timeout" ;; esac',
         'if [ "$auth_status" -ne 0 ]; then cat "$tmp/status" >>"$log_file" 2>/dev/null || :; fi',
         `if [ ! -e "$tmp/status-timeout" ] && grep -Eiq '${authFailure}' "$tmp/status"; then`,

package/dist/lib/lanes/autopilot.js

@@ -1265,7 +1265,10 @@ export async function runLeadAutopilotPass(input) {
     for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
             lockFd = fs.openSync(lockPath, "wx", 0o600);
-            fs.writeFileSync(lockFd, `${process.pid}\n${input.now.toISOString()}\n${processStartIdentity(process.pid) ?? ""}\n`, "utf8");
+            // The created-at stamp is compared with Date.now() by reclaimStaleLock
+            // (the only liveness check where /proc is absent, e.g. macOS), so it must
+            // be wall-clock time, not the caller's injected logical `now`.
+            fs.writeFileSync(lockFd, `${process.pid}\n${new Date().toISOString()}\n${processStartIdentity(process.pid) ?? ""}\n`, "utf8");
             break;
         }
         catch (error) {

package/dist/lib/lanes/imported-question.d.ts

@@ -0,0 +1,5 @@
+export declare function importedQuestionMarker(root: string, id: string): string;
+/** A pending transfer is also read-only: its remote POST may already have succeeded. */
+export declare function assertQuestionNotImported(root: string, id: string): void;
+export declare function isQuestionImported(root: string, id: string): boolean;
+//# sourceMappingURL=imported-question.d.ts.map