@indigoai-us/hq-cli 5.345.152 → 5.345.154

package/dist/lib/decisions/fixtures/us001.d.ts

@@ -0,0 +1,137 @@
+/** Producer-service fixtures verified against hq-pro PR #5060 at 7c234efa (in-memory service output; handler wrappers). */
+import type { Decision } from "../client.js";
+export declare const openDecision: Decision;
+export declare const decisionFixtures: {
+    create: {
+        decision: Decision;
+    };
+    list: {
+        decisions: Decision[];
+    };
+    answer: {
+        decision: {
+            state: string;
+            updatedAt: string;
+            answer: {
+                choiceId: string;
+                by: string;
+                at: string;
+                source: string;
+            };
+            id: string;
+            askerPrincipal: string;
+            companyUid: string;
+            audience: {
+                kind: "person";
+                personUid: string;
+            } | {
+                kind: "company_admins";
+            };
+            statement: string;
+            options: import("../client.js").DecisionOption[];
+            context: {
+                links: string[];
+                brief: string;
+                commitmentId: string | null;
+            };
+            talkThreadId: string | null;
+            createdAt: string;
+            expiresAt: string;
+        };
+    };
+    talk: {
+        decision: {
+            state: string;
+            updatedAt: string;
+            talkThreadId: null;
+            id: string;
+            askerPrincipal: string;
+            companyUid: string;
+            audience: {
+                kind: "person";
+                personUid: string;
+            } | {
+                kind: "company_admins";
+            };
+            statement: string;
+            options: import("../client.js").DecisionOption[];
+            context: {
+                links: string[];
+                brief: string;
+                commitmentId: string | null;
+            };
+            answer: {
+                choiceId: string;
+                by: string;
+                at: string;
+                source: "tap" | "thread" | "desktop";
+            } | null;
+            createdAt: string;
+            expiresAt: string;
+        };
+    };
+    withdraw: {
+        decision: {
+            state: string;
+            updatedAt: string;
+            id: string;
+            askerPrincipal: string;
+            companyUid: string;
+            audience: {
+                kind: "person";
+                personUid: string;
+            } | {
+                kind: "company_admins";
+            };
+            statement: string;
+            options: import("../client.js").DecisionOption[];
+            context: {
+                links: string[];
+                brief: string;
+                commitmentId: string | null;
+            };
+            answer: {
+                choiceId: string;
+                by: string;
+                at: string;
+                source: "tap" | "thread" | "desktop";
+            } | null;
+            talkThreadId: string | null;
+            createdAt: string;
+            expiresAt: string;
+        };
+    };
+    expired: {
+        decision: {
+            state: string;
+            updatedAt: string;
+            id: string;
+            askerPrincipal: string;
+            companyUid: string;
+            audience: {
+                kind: "person";
+                personUid: string;
+            } | {
+                kind: "company_admins";
+            };
+            statement: string;
+            options: import("../client.js").DecisionOption[];
+            context: {
+                links: string[];
+                brief: string;
+                commitmentId: string | null;
+            };
+            answer: {
+                choiceId: string;
+                by: string;
+                at: string;
+                source: "tap" | "thread" | "desktop";
+            } | null;
+            talkThreadId: string | null;
+            createdAt: string;
+            expiresAt: string;
+        };
+    };
+};
+export declare const decisionRoutes: string[][];
+//# sourceMappingURL=us001.d.ts.map

package/dist/lib/decisions/fixtures/us001.js

@@ -0,0 +1,21 @@
+export const openDecision = {
+    id: "f3ccdf93-9b7e-4564-a3ad-566067900aee", companyUid: "cmp_indigo", askerPrincipal: "agt_personal", audience: { kind: "person", personUid: "prs_owner" },
+    statement: "Release the update?",
+    options: [{ id: "A", label: "Release", recommended: true }, { id: "B", label: "Wait", recommended: false }],
+    context: { links: ["https://example.com/review"], brief: "Checks passed", commitmentId: "cm_1" },
+    state: "open", answer: null, talkThreadId: null,
+    createdAt: "2026-10-18T02:00:00.000Z", expiresAt: "2026-10-19T02:00:00.000Z", updatedAt: "2026-10-18T02:00:00.000Z",
+};
+export const decisionFixtures = {
+    create: { decision: openDecision },
+    list: { decisions: [openDecision] },
+    answer: { decision: { ...openDecision, state: "answered", updatedAt: "2026-10-18T03:00:00.000Z", answer: { choiceId: "A", by: "prs_owner", at: "2026-10-18T03:00:00.000Z", source: "desktop" } } },
+    talk: { decision: { ...openDecision, state: "talking", updatedAt: "2026-10-18T03:00:00.000Z", talkThreadId: null } },
+    withdraw: { decision: { ...openDecision, state: "withdrawn", updatedAt: "2026-10-18T03:00:00.000Z" } },
+    expired: { decision: { ...openDecision, state: "expired", updatedAt: "2026-10-19T03:00:00.000Z" } },
+};
+export const decisionRoutes = [
+    ["POST", "/v1/decisions"], ["GET", "/v1/decisions"],
+    ["POST", "/v1/decisions/{id}/answer"], ["POST", "/v1/decisions/{id}/talk"], ["POST", "/v1/decisions/{id}/withdraw"],
+];
+//# sourceMappingURL=us001.js.map

package/dist/lib/decisions/import-lanes.d.ts

@@ -0,0 +1,16 @@
+import { type QuestionBody } from "../lanes/questions.js";
+import type { QuestionRecord } from "../lanes/types.js";
+import { DecisionsClient, type AskDecision } from "./client.js";
+export declare function legacyDecisionInput(record: QuestionRecord, body: QuestionBody, audience: string): AskDecision | undefined;
+export interface ImportCounts {
+    imported: number;
+    alreadyImported: number;
+    skipped: number;
+    skippedQuestions: Array<{
+        id: string;
+        reason: string;
+    }>;
+}
+/** Read legacy inputs only. Receipts live separately; legacy lane commands keep their storage. */
+export declare function importLaneQuestions(root: string, audience: string, client: Pick<DecisionsClient, "ask" | "list">): Promise<ImportCounts>;
+//# sourceMappingURL=import-lanes.d.ts.map

package/dist/lib/decisions/import-lanes.js

@@ -0,0 +1,152 @@
+import { decisionExpiry } from "./expiry.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { createHash } from "node:crypto";
+import { listQuestionIds, readQuestion, questionRecordPath, withLaneRecordFileLock } from "../lanes/store.js";
+import { questionBodyAbsPath, sha256Text } from "../lanes/questions.js";
+import { DecisionError } from "./client.js";
+import { importedQuestionMarker } from "../lanes/imported-question.js";
+export function legacyDecisionInput(record, body, audience) {
+    // Answered/closed/routed questions require contracts beyond release 1.
+    if (!record.company?.uid || !/^cmp_[A-Za-z0-9]+$/.test(record.company.uid) || record.status !== "pending" || record.hop > 1 || record.answer || record.answer_history?.length ||
+        record.routing_history.at(-1)?.audience.kind !== "user" ||
+        record.routing_history.at(-1)?.audience.id !== audience ||
+        record.routing_history.some(entry => entry.reason === "escalated") || body.notes || body.loop_stall ||
+        !Array.isArray(body.options) || body.options.length < 2 ||
+        body.options.some(option => typeof option !== "string" || !option.trim()) ||
+        new Set(body.options).size !== body.options.length ||
+        typeof body.question !== "string" || !body.question.trim() || typeof body.context !== "string" ||
+        (body.recommended !== undefined && !body.options.includes(body.recommended)))
+        return undefined;
+    return {
+        companyUid: record.company.uid, expiresAt: decisionExpiry(),
+        audience: { kind: "person", personUid: audience }, statement: body.question,
+        options: body.options.map((label, index) => ({ id: String(index + 1), label, recommended: label === body.recommended })),
+        context: { links: [], commitmentId: null, brief: `${body.context}\n\nImported lane question ${record.question_id}`.trim() },
+    };
+}
+/** Read legacy inputs only. Receipts live separately; legacy lane commands keep their storage. */
+export async function importLaneQuestions(root, audience, client) {
+    const journalDir = path.join(root, "workspace", "decisions", "imports", audience);
+    if (!/^prs_[A-Za-z0-9_-]+$/.test(audience))
+        throw new DecisionError("invalid_audience", "Expected person uid");
+    fs.mkdirSync(journalDir, { recursive: true });
+    const lockPath = path.join(journalDir, "import.lock");
+    let lock;
+    try {
+        lock = fs.openSync(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        throw new DecisionError("import_locked", `An import owns ${lockPath}. Read the PID in that file and verify it is no longer running before deleting only import.lock, then rerun import-lanes. Keep receipts and legacy-read-only markers; they prevent duplicate decisions.`);
+    }
+    fs.writeFileSync(lock, String(process.pid));
+    const counts = { imported: 0, alreadyImported: 0, skipped: 0, skippedQuestions: [] };
+    const skip = (id, reason) => { counts.skipped++; counts.skippedQuestions.push({ id, reason }); };
+    try {
+        for (const id of listQuestionIds(root)) {
+            const record = readQuestion(root, id);
+            const target = record.routing_history.at(-1)?.audience;
+            if (target?.kind === "user" && target.id !== audience) {
+                skip(id, "addressed_to_other_user");
+                continue;
+            }
+            const bodyPath = questionBodyAbsPath(root, record);
+            let serialized;
+            try {
+                serialized = fs.readFileSync(bodyPath, "utf8");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                skip(id, "body_unavailable");
+                continue;
+            }
+            if (record.body.digest && sha256Text(serialized) !== record.body.digest) {
+                skip(id, "body_digest_mismatch");
+                continue;
+            }
+            let body;
+            try {
+                body = JSON.parse(serialized);
+            }
+            catch {
+                skip(id, "body_invalid");
+                continue;
+            }
+            if (!body || typeof body !== "object") {
+                skip(id, "body_invalid");
+                continue;
+            }
+            if (!record.company?.uid || !/^cmp_[A-Za-z0-9]+$/.test(record.company.uid)) {
+                skip(id, "company_unavailable");
+                continue;
+            }
+            const input = legacyDecisionInput(record, body, audience);
+            if (!input) {
+                skip(id, "advanced_or_closed_question");
+                continue;
+            }
+            const key = createHash("sha256").update(id).digest("hex");
+            const receiptPath = path.join(journalDir, `${key}.json`);
+            const digest = sha256Text(JSON.stringify({ ...input, expiresAt: undefined }));
+            const receipt = fs.existsSync(receiptPath) ? JSON.parse(fs.readFileSync(receiptPath, "utf8")) : undefined;
+            if (receipt) {
+                if (receipt.sourceDigest !== digest) {
+                    skip(id, "source_changed_after_import");
+                    continue;
+                }
+                // Upgrade receipts written before the read-only marker was introduced.
+                withLaneRecordFileLock(questionRecordPath(root, id), () => {
+                    const markerPath = importedQuestionMarker(root, id);
+                    fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+                    if (!fs.existsSync(markerPath))
+                        fs.writeFileSync(markerPath, JSON.stringify({ audience, receiptPath }), { flag: "wx", mode: 0o600 });
+                });
+                if (receipt.state === "imported" && receipt.decisionId) {
+                    counts.alreadyImported++;
+                    continue;
+                }
+                // A crash or lost POST response is ambiguous. Reconcile, never blindly POST again.
+                const matches = (await client.list()).filter(decision => decision.companyUid === input.companyUid && decision.audience.kind === "person" && decision.audience.personUid === audience && decision.context.brief === input.context.brief && decision.statement === input.statement && JSON.stringify(decision.options) === JSON.stringify(input.options));
+                if (matches.length !== 1)
+                    throw new DecisionError("import_outcome_unknown", `Question ${id} has an unresolved create; inspect the server before retrying. Receipt: ${receiptPath}`);
+                fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "imported", decisionId: matches[0].id }), { mode: 0o600 });
+                counts.alreadyImported++;
+                continue;
+            }
+            // Persist intent before POST, so even interruption cannot cause an automatic duplicate.
+            const markerPath = importedQuestionMarker(root, id);
+            const fenced = withLaneRecordFileLock(questionRecordPath(root, id), () => {
+                const current = readQuestion(root, id);
+                if (current.version !== record.version || fs.readFileSync(bodyPath, "utf8") !== serialized)
+                    return false;
+                fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+                try {
+                    fs.writeFileSync(markerPath, JSON.stringify({ audience, receiptPath }), { flag: "wx", mode: 0o600 });
+                }
+                catch (error) {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                    throw new DecisionError("import_outcome_unknown", `Question ${id} already has a read-only transfer marker; inspect its receipt before retrying`);
+                }
+                fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "pending" }), { flag: "wx", mode: 0o600 });
+                return true;
+            });
+            if (!fenced) {
+                skip(id, "source_changed_during_import");
+                continue;
+            }
+            const decision = await client.ask(input);
+            fs.writeFileSync(receiptPath, JSON.stringify({ sourceDigest: digest, state: "imported", decisionId: decision.id }), { mode: 0o600 });
+            counts.imported++;
+        }
+        return counts;
+    }
+    finally {
+        fs.closeSync(lock);
+        fs.unlinkSync(lockPath);
+    }
+}
+//# sourceMappingURL=import-lanes.js.map

package/dist/lib/decisions/principal.d.ts

@@ -0,0 +1,11 @@
+import { type AgentRecord } from "../bot/api.js";
+export declare const ASK_POLICY = "assistant-bound-conductor-release-1-conductor-only";
+/** Session parsing adapted from hq-cli PR 1993; a session reference grants no authority. */
+export declare function desktopSessionRef(env: NodeJS.ProcessEnv): string | undefined;
+/** US-007 seam. No lease authority exists in release 1; env flags never grant it. */
+export declare function hasConductorLease(_session: string | undefined): Promise<boolean>;
+export declare function assertPersonalLocalBot(uid: string, agent: AgentRecord): string;
+export declare function askAudience(token: string): Promise<string>;
+/** Import creates decisions, so the same server-enforced bot gate applies. */
+export declare const importAudience: typeof askAudience;
+//# sourceMappingURL=principal.d.ts.map

package/dist/lib/decisions/principal.js

@@ -0,0 +1,52 @@
+import { resolveCallerUid, vaultApiFetch } from "../../utils/vault-api.js";
+import { BotApi, BotApiError } from "../bot/api.js";
+import { normalizeSessionIdentity } from "../mesh/live/session-identity.js";
+import { DecisionError } from "./client.js";
+export const ASK_POLICY = "assistant-bound-conductor-release-1-conductor-only";
+/** Session parsing adapted from hq-cli PR 1993; a session reference grants no authority. */
+export function desktopSessionRef(env) {
+    try {
+        const identity = normalizeSessionIdentity({ env });
+        const provider = identity.source.startsWith("CODEX") ? "codex"
+            : identity.source.startsWith("CLAUDE") ? "claude"
+                : env.HQ_SESSION_PROVIDER?.trim() || (env.CODEX_THREAD_ID || env.CODEX_SESSION_ID ? "codex" : "claude");
+        if (!/^[a-z][a-z0-9_-]*$/.test(provider) || !/^[A-Za-z0-9._-]{1,128}$/.test(identity.sessionId) || [".", ".."].includes(identity.sessionId))
+            return undefined;
+        return `session:${provider}:${identity.sessionId}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** US-007 seam. No lease authority exists in release 1; env flags never grant it. */
+export async function hasConductorLease(_session) { return false; }
+export function assertPersonalLocalBot(uid, agent) {
+    if (agent.uid !== uid || agent.computeMode !== "local" || agent.botKind !== "personal" || !agent.ownerUid?.startsWith("prs_")) {
+        throw new DecisionError("asker_not_allowed", `${ASK_POLICY} requires the owner's personal local bot principal`);
+    }
+    return agent.ownerUid;
+}
+export async function askAudience(token) {
+    const caller = await resolveCallerUid(token);
+    if (caller.kind === "agent") {
+        try {
+            const agent = await new BotApi({
+                token: async () => token,
+                fetchImpl: options => vaultApiFetch({ ...options, signal: AbortSignal.timeout(15_000) }),
+            }).getAgent(caller.uid);
+            return assertPersonalLocalBot(caller.uid, agent);
+        }
+        catch (error) {
+            if (error instanceof BotApiError && [403, 404].includes(error.status)) {
+                throw new DecisionError("asker_not_allowed", `${ASK_POLICY} requires a verified personal local bot principal`);
+            }
+            throw error;
+        }
+    }
+    if (await hasConductorLease(desktopSessionRef(process.env)))
+        return caller.uid;
+    throw new DecisionError("asker_not_allowed", `${ASK_POLICY} allows only the personal local bot; desktop conductor leases await US-007`);
+}
+/** Import creates decisions, so the same server-enforced bot gate applies. */
+export const importAudience = askAudience;
+//# sourceMappingURL=principal.js.map

package/dist/lib/doctor/checks/claude-wiring.d.ts

@@ -3,8 +3,8 @@
  *
  * "Wiring" is everything short of firing the hook: is every registration backed
  * by a script that exists and is executable, is every script on disk actually
- * registered, is every gated hook id a member of all three `hook-gate.sh`
- * profiles, and does any command word-split its own script path. A hook can be
+ * registered, is every gated hook id a member of each `hook-gate.sh` profile
+ * at or above its declared tier, and does any command word-split its own script path. A hook can be
  * present, correct, and completely dead — this check catches the ways that
  * happens without a single error surfacing to the user.
  *

package/dist/lib/doctor/checks/claude-wiring.js

@@ -3,8 +3,8 @@
  *
  * "Wiring" is everything short of firing the hook: is every registration backed
  * by a script that exists and is executable, is every script on disk actually
- * registered, is every gated hook id a member of all three `hook-gate.sh`
- * profiles, and does any command word-split its own script path. A hook can be
+ * registered, is every gated hook id a member of each `hook-gate.sh` profile
+ * at or above its declared tier, and does any command word-split its own script path. A hook can be
  * present, correct, and completely dead — this check catches the ways that
  * happens without a single error surfacing to the user.
  *
@@ -23,7 +23,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { GATE_PROFILES, gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
+import { GATE_PROFILES, activeGateProfile, gateMembership, parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-profiles.js";
 import { modeIsExecutable } from "../shared.js";
 import { countStrayGateEntries } from "../stray-gate-entries.js";
 /** Common id prefix for every result this check family emits. */
@@ -163,7 +163,11 @@ export function checkClaudeWiring(context) {
             remediation: `Add ${file} to .claude/hooks/hook-registry.json with the right event and matcher, or delete it.`,
         });
     }
-    // --- AC4: every gated hook id is in ALL THREE profiles -----------------------
+    // --- AC4: every gated hook id is in each profile its tier requires ---------
+    // Profiles are nested tiers (minimal within standard within strict). A hook
+    // absent from a profile BELOW its lowest listed one is excluded on purpose
+    // and passes. A required profile missing the hook fails only when it is the
+    // active runtime profile; otherwise the hook still runs, so it warns.
     const gatedIds = new Set();
     for (const { scan } of scans) {
         if (scan.gatedHookId)
@@ -181,27 +185,34 @@ export function checkClaudeWiring(context) {
         }
         else {
             const profiles = parseHookGateProfiles(gateSource);
+            const active = activeGateProfile(context.hookProfile ?? process.env.HQ_HOOK_PROFILE);
             for (const id of [...gatedIds].sort()) {
-                const { present, missing } = gateMembership(id, profiles);
+                const { present } = gateMembership(id, profiles);
+                const missing = requiredMissingProfiles(id, profiles);
                 if (missing.length === 0) {
                     results.push({
                         status: "PASS",
                         checkId: `${CLAUDE_WIRING_PREFIX}.gate-profiles`,
                         target: id,
-                        message: `Gated hook ${id} is allowlisted in all three hook-gate.sh profiles.`,
+                        message: `Gated hook ${id} is allowlisted in every hook-gate.sh profile from ${present[0]} up.`,
                     });
                     continue;
                 }
                 const missingList = formatProfiles(missing);
                 const presentDesc = present.length > 0 ? formatProfiles(present) : "no profile";
+                const inActive = missing.includes(active);
+                const plural = missing.length === 1 ? "" : "s";
                 results.push({
-                    status: "FAIL",
+                    status: inActive ? "FAIL" : "WARN",
                     checkId: `${CLAUDE_WIRING_PREFIX}.gate-profiles`,
                     target: id,
                     message: `Gated hook ${id} is missing from the ${missingList} hook-gate.sh ` +
-                        `profile${missing.length === 1 ? "" : "s"} (present in ${presentDesc}); ` +
-                        `it silently no-ops under ${missing.length === 1 ? "that profile" : "those profiles"}.`,
-                    remediation: `Add ${id} to the ${missingList} allowlist${missing.length === 1 ? "" : "s"} in .claude/hooks/hook-gate.sh.`,
+                        `profile${plural} (present in ${presentDesc}); ` +
+                        (inActive
+                            ? `it does not run under the active ${active} profile.`
+                            : `it runs under the active ${active} profile but would not run under ${missing.length === 1 ? "that profile" : "those profiles"}.`),
+                    remediation: `Run \`hq doctor --fix\`, or add ${id} to the ${missingList} ` +
+                        `allowlist${plural} in .claude/hooks/hook-gate.sh.`,
                 });
             }
         }

package/dist/lib/doctor/checks/work-context.js

@@ -13,7 +13,7 @@ import { workContextRoot, workContextSessionsDir } from "../../work-context/path
 import { countDistinctHeldEvents, countJsonlLines, deadLetterNonEmpty, } from "../../mesh/live/spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../../mesh/live/paths.js";
 import { collectDaemonDoctor, formatDaemonDoctor, } from "../../mesh/live/daemon/doctor.js";
-import { workSessionDenialReason } from "../../mesh/denial-codes.js";
+import { WORK_TRACKING_OFF_DENIAL_CODES, workSessionDenialReason, } from "../../mesh/denial-codes.js";
 export const WORK_CONTEXT_FAMILY_ID = "work-context";
 export const WORK_CONTEXT_FAMILY_TITLE = "Work context";
 const DEFAULT_DEPS = {
@@ -98,7 +98,12 @@ function runChecks(deps) {
     ]
         .filter(Boolean)
         .join(" ");
-    const quarantineDenialReason = showQuarantineReason
+    // A refusal because work tracking is off for the company is shown whether
+    // or not the detail flag is on: without it doctor only shows a count and the
+    // user is left guessing at auth (Shepherd issue 2726).
+    const workTrackingOff = stats.quarantined > 0 &&
+        WORK_TRACKING_OFF_DENIAL_CODES.includes(stats.lastQuarantineServerCode ?? "");
+    const quarantineDenialReason = showQuarantineReason || workTrackingOff
         ? workSessionDenialReason(stats.lastQuarantineServerCode)
         : undefined;
     results.push({

package/dist/lib/doctor/fix/apply.d.ts

@@ -190,8 +190,9 @@ export interface AppliedFixBackup {
 export declare const MAX_FIX_PASSES = 3;
 /**
  * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget;
- * pulls go first and uploads take any slot left.
+ * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
+ * When both kinds are pending and no upload has run yet, one slot is held for
+ * a manifest upload so stale journals cannot starve every manifest.
  */
 export declare const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
 /** The outcome of an {@link applyFixes} run. */

package/dist/lib/doctor/fix/apply.js

@@ -40,7 +40,7 @@ import * as path from "node:path";
 import { isPersonalJournalSlug } from "../checks/sync-health.js";
 import { createDefaultRegistry } from "../registry.js";
 import { flattenFamilies } from "../report.js";
-import { gateMembership, parseHookGateProfiles, } from "../hook-gate-profiles.js";
+import { parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-profiles.js";
 import { createBackup } from "./backup.js";
 import { removeStrayGateEntries } from "../stray-gate-entries.js";
 import { deriveRemediation } from "./remediation.js";
@@ -48,7 +48,7 @@ import { botDir } from "../../bot/paths.js";
 import { readBotConfig } from "../../bot/config.js";
 import { buildBotDaemonPaths, installedDaemonHqBinary, repairBotDaemonIfStale, rewriteBotDaemonNodePath, } from "../../bot/daemon.js";
 import { classifyRefreshSyncOutcome, } from "./refresh-sync-outcome.js";
-import { readRefreshSyncProgress, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
+import { readRefreshManifestCursor, readRefreshSyncProgress, writeRefreshManifestCursor, writeRefreshSyncCursor, writeRefreshSyncLastRun, } from "./refresh-sync-progress.js";
 import { clientHealthShowManualOnlyEnabled } from "../client-health-reason-codes-flag.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export const HOOK_CONFIG_DIRS = [".claude", ".codex", ".grok"];
@@ -58,8 +58,9 @@ export const REFRESH_SYNC_TIMEOUT_MS = 90_000;
 export const MAX_FIX_PASSES = 3;
 /**
  * Two 90s network repairs leave 120s for startup and check overhead under the
- * hook's 300s ceiling. Journal pulls and manifest uploads share this budget;
- * pulls go first and uploads take any slot left.
+ * hook's 300s ceiling. Journal pulls and manifest uploads share this budget.
+ * When both kinds are pending and no upload has run yet, one slot is held for
+ * a manifest upload so stale journals cannot starve every manifest.
  */
 export const MAX_REFRESH_SYNC_PLANS_PER_RUN = 2;
 function rotateRefreshSyncPlans(plans, afterSlug) {
@@ -148,6 +149,7 @@ export async function applyFixes(options) {
     let lastAttemptedRefreshSyncSlug = readRefreshSyncProgress(hqRoot)?.lastAttemptedSlug ?? null;
     let refreshSyncAppliedThisRun = 0;
     let refreshManifestAppliedThisRun = 0;
+    let lastAttemptedRefreshManifestScope = readRefreshManifestCursor(hqRoot);
     const appliedKeys = new Set();
     const planned = [];
     const backups = [];
@@ -175,21 +177,20 @@ export async function applyFixes(options) {
             keysThisPass.add(key);
             plans.push(plan);
         }
+        const networkSlotsLeft = Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun - refreshManifestAppliedThisRun);
+        // Both kinds start after the company attempted last, so a scope that
+        // never clears cannot hold the front of the line on every run.
+        const manifestCandidates = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-manifest"), lastAttemptedRefreshManifestScope);
+        // Hold one slot for an upload until one has run this invocation.
+        const manifestReserve = manifestCandidates.length > 0 && refreshManifestAppliedThisRun === 0 ? 1 : 0;
         const seenRefreshTargets = new Set();
         const refreshPlans = rotateRefreshSyncPlans(plans.filter((plan) => plan.fixClass === "refresh-sync"), lastAttemptedRefreshSyncSlug).filter((plan) => {
             if (seenRefreshTargets.has(plan.target))
                 return false;
             seenRefreshTargets.add(plan.target);
             return true;
-        }).slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN - refreshSyncAppliedThisRun));
-        // Manifest uploads take whatever network budget the pulls left.
-        const manifestPlans = plans
-            .filter((plan) => plan.fixClass === "refresh-manifest")
-            .sort((a, b) => (a.target < b.target ? -1 : a.target > b.target ? 1 : 0))
-            .slice(0, Math.max(0, MAX_REFRESH_SYNC_PLANS_PER_RUN -
-            refreshSyncAppliedThisRun -
-            refreshManifestAppliedThisRun -
-            refreshPlans.length));
+        }).slice(0, Math.max(0, networkSlotsLeft - manifestReserve));
+        const manifestPlans = manifestCandidates.slice(0, networkSlotsLeft - refreshPlans.length);
         return [
             ...plans.filter((plan) => plan.fixClass !== "refresh-sync" && plan.fixClass !== "refresh-manifest"),
             ...refreshPlans,
@@ -255,8 +256,11 @@ export async function applyFixes(options) {
                 lastAttemptedRefreshSyncSlug = plan.target;
                 refreshSyncAppliedThisRun += 1;
             }
-            if (plan.fixClass === "refresh-manifest")
+            if (plan.fixClass === "refresh-manifest") {
+                writeRefreshManifestCursor(hqRoot, plan.target);
+                lastAttemptedRefreshManifestScope = plan.target;
                 refreshManifestAppliedThisRun += 1;
+            }
             appliedKeys.add(JSON.stringify([plan.checkId, plan.target]));
             planned.push({ plan, pass });
             await plan.apply();
@@ -761,7 +765,7 @@ function planGateProfile(hqRoot, result, rem) {
     catch {
         return null;
     }
-    const missing = gateMembership(hookId, parseHookGateProfiles(source)).missing;
+    const missing = requiredMissingProfiles(hookId, parseHookGateProfiles(source));
     if (missing.length === 0)
         return null;
     const relpath = toRelpath(hqRoot, gatePath);

package/dist/lib/doctor/fix/refresh-sync-progress.d.ts

@@ -19,6 +19,20 @@ export interface RefreshSyncProgress {
     lastRunAtMs?: number;
 }
 export declare function readRefreshSyncProgress(hqRoot: string): RefreshSyncProgress | null;
+/**
+ * `--fix` manifest-upload cursor. Kept in its own file so the refresh-sync
+ * progress format, which doctor JSON reads, does not change. Written before
+ * each upload, like the pull cursor, so the next run starts after the last
+ * company attempted and one failing company cannot hold the front of the line.
+ */
+export declare const REFRESH_MANIFEST_PROGRESS_RELATIVE_PATH: string;
+export interface RefreshManifestProgress {
+    version: 1;
+    lastAttemptedScope: string;
+}
+/** The last manifest scope `--fix` attempted, or null when absent or unreadable. */
+export declare function readRefreshManifestCursor(hqRoot: string): string | null;
+export declare function writeRefreshManifestCursor(hqRoot: string, scope: string): void;
 /** Persist the resume cursor without claiming this run finished. */
 export declare function writeRefreshSyncCursor(hqRoot: string, slug: string): void;
 /** Record the check ids this completed `--fix` pass actually tried to refresh. */