@indigoai-us/hq-cli 5.345.168 → 5.345.170

package/dist/lib/daemon/run.js

@@ -22,6 +22,7 @@ import { readBotConfig } from "../bot/config.js";
 import { botsRoot } from "../bot/paths.js";
 import { CLAUDE_RUNNER_SCRIPT, CODEX_RUNNER_SCRIPT, enabledServices, planUnits } from "./catalog.js";
 import { effectiveSyncOwner, readDaemonConfig } from "./config.js";
+import { inspectSyncCoreCanary } from "./sync-core-canary.js";
 import { assertPersonalServiceSessionCapability, readRemoteControlPoolsConfig, remoteControlPoolSecretsEnv, } from "./remote-control-pools.js";
 import { loadLanesConfig } from "../lanes/config.js";
 import { daemonLanesReconcileHandler } from "../lanes/daemon-reconcile.js";
@@ -54,7 +55,7 @@ import { stageHqChildBootstrap } from "./hq-child-bootstrap-stage.js";
 import { runnerSessionName } from "./remote-control.js";
 import { adoptChild, createChildTracker, finishSuccession, handoffEligible, readProcStart, stopOrphans, successionPaths, systemdKillMode, takeSuccession, writeHandoff, } from "./succession.js";
 import { listSyncRunnerProcesses, readWatchRunnerOwnerStatus, syncHeartbeatTimeoutMs, syncRunnerNodeOptions, watchRunnerOwnerStatusPath, } from "./sync-runner.js";
-import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, } from "./supervisor.js";
+import { STOP_ESCALATION_MS, SYNC_RUNNER_PERSIST_GRACE_MS, createSupervisor, planKey, } from "./supervisor.js";
 import { userToolDirs } from "./tools.js";
 import { logOffset, readLogSince, readUnitHolds, writeUnitHolds } from "./unit-holds.js";
 import { daemonRunGuard } from "./lanes-reconcile-guard.js";
@@ -63,6 +64,19 @@ export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 export const RESTART_EXIT_CODE = 75;
 const NON_SYNC_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + 5_000;
 const SYNC_RUNNER_SHUTDOWN_CAP_MS = STOP_ESCALATION_MS + SYNC_RUNNER_PERSIST_GRACE_MS + 5_000;
+export function planUnitsWithSyncCoreInterlock(services, context, supervisor) {
+    const syncCoreCanaryRunning = supervisor?.runningPlanKey("sync-core-canary") !== undefined;
+    const transitionContext = {
+        ...context,
+        syncCoreCanaryRunning,
+        legacySyncReadyForCore: false,
+    };
+    const waiting = planUnits(services, transitionContext);
+    const legacy = waiting.find((unit) => unit.id === "sync");
+    const legacySyncReadyForCore = legacy !== undefined
+        && supervisor?.runningPlanKey("sync") === planKey(legacy, CLI_VERSION);
+    return planUnits(services, { ...transitionContext, legacySyncReadyForCore });
+}
 /** A bounded shutdown deadline that can account for sync push persistence. */
 export function createShutdownCap() {
     const startedAt = Date.now();
@@ -939,7 +953,7 @@ export async function runDaemon(opts) {
             legacy,
             appRunning: () => desktopAppRunning(platform),
         });
-        const plans = planUnits(services, {
+        const context = {
             machineType,
             platform,
             home,
@@ -964,6 +978,11 @@ export async function runDaemon(opts) {
                 return switches;
             })(),
             syncOwner,
+            syncCoreCanary: config.syncCoreCanaryError
+                ? { blockedReason: config.syncCoreCanaryError }
+                : config.syncCoreCanary
+                    ? inspectSyncCoreCanary(home, hqRoot, config.syncCoreCanary, platform)
+                    : undefined,
             desktopAppManagesSync: appManagesSync,
             syncRunnerProcesses,
             syncRunnerOwnerPid,
@@ -991,7 +1010,8 @@ export async function runDaemon(opts) {
             invalidPoolServiceSessions,
             availablePoolFrontends,
             unverifiablePoolFrontends,
-        });
+        };
+        const plans = planUnitsWithSyncCoreInterlock(services, context, supervisor);
         if (startupPlanOpen) {
             const replaceablePackageRoots = cliPackageRoot ? [cliPackageRoot] : [];
             if (hqCloud?.source === "bundled")

package/dist/lib/daemon/supervisor.d.ts

@@ -179,6 +179,7 @@ export interface Supervisor {
     stop(): Promise<void>;
     reconcile(): void;
     state(): DaemonState;
+    runningPlanKey(unitId: string): string | undefined;
     /** True while a live sync runner has reported that it is persisting pushes. */
     hasStoppingSyncRunner(): boolean;
     /** Stop supervising without signalling any child; returns the long-running units left running. */

package/dist/lib/daemon/supervisor.js

@@ -1399,6 +1399,10 @@ export function createSupervisor(deps) {
         },
         reconcile,
         state: snapshot,
+        runningPlanKey(unitId) {
+            const slot = slots.get(unitId);
+            return slot?.child ? slot.childKey : undefined;
+        },
         hasStoppingSyncRunner: () => [...liveOwners.values()].some(syncRunnerIsStopping),
         release() {
             const released = [];

package/dist/lib/daemon/sync-core-canary.d.ts

@@ -0,0 +1,9 @@
+import type { SyncCoreCanaryConfig } from "./config.js";
+export interface SyncCoreCanaryPlan {
+    binaryPath?: string;
+    vaultUid?: string;
+    canaryPath?: string;
+    blockedReason?: string;
+}
+export declare function inspectSyncCoreCanary(home: string, hqRoot: string | undefined, config: SyncCoreCanaryConfig, platform: NodeJS.Platform): SyncCoreCanaryPlan;
+//# sourceMappingURL=sync-core-canary.d.ts.map

package/dist/lib/daemon/sync-core-canary.js

@@ -0,0 +1,56 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse as parseToml } from "smol-toml";
+function blocked(config, blockedReason) {
+    return { ...config, blockedReason };
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+export function inspectSyncCoreCanary(home, hqRoot, config, platform) {
+    if (platform !== "darwin" && platform !== "linux") {
+        return blocked(config, "the sync-core canary requires macOS or Linux");
+    }
+    try {
+        if (!fs.statSync(config.binaryPath).isFile())
+            return blocked(config, "the sync-core binary is missing");
+        fs.accessSync(config.binaryPath, fs.constants.X_OK);
+    }
+    catch {
+        return blocked(config, "the sync-core binary is missing or not executable");
+    }
+    const configPath = path.join(home, ".hq", "sync-core", "config.toml");
+    let sync;
+    try {
+        sync = record(record(parseToml(fs.readFileSync(configPath, "utf8")))?.sync);
+    }
+    catch {
+        return blocked(config, `the sync-core config at ${configPath} is missing or invalid`);
+    }
+    if (sync?.engine !== "rust-test" || sync.mode !== "full") {
+        return blocked(config, "the sync-core config must select engine rust-test in full mode");
+    }
+    const vaults = sync.vaults;
+    if (!Array.isArray(vaults) || vaults.length !== 1 || vaults[0] !== config.vaultUid) {
+        return blocked(config, `the sync-core config must name exactly ${config.vaultUid}`);
+    }
+    if (!hqRoot || typeof sync.hq_root !== "string" || path.resolve(sync.hq_root) !== path.resolve(hqRoot)) {
+        return blocked(config, "the sync-core config must use the daemon's HQ folder");
+    }
+    const canaryPath = typeof sync.canary_path === "string" ? sync.canary_path.trim() : "";
+    if (!canaryPath)
+        return blocked(config, "the sync-core config must name one canary path");
+    const ownedPath = path.join(home, ".hq", "sync-core", "owned", `${config.vaultUid}.json`);
+    try {
+        const owned = record(JSON.parse(fs.readFileSync(ownedPath, "utf8")));
+        if (owned?.vault !== config.vaultUid)
+            throw new Error("mismatch");
+    }
+    catch {
+        return blocked(config, `the sync-core ownership record for ${config.vaultUid} is missing or invalid`);
+    }
+    return { ...config, canaryPath };
+}
+//# sourceMappingURL=sync-core-canary.js.map

package/dist/lib/doctor/checks/sync-health.d.ts

@@ -61,7 +61,39 @@ export interface SyncManifestUploadStatus {
     baseUsable: boolean;
     /** Local company slug for company-scoped remediation; absent for personal. */
     companySlug?: string;
+    /**
+     * Last failed pass, from hq-cloud >= 6.18.102 (`readManifestUploadStatus`,
+     * hq-cloud #1050). Fixed tokens only. Absent on older hq-cloud and after a
+     * later pass succeeded.
+     */
+    lastAttemptAt?: string;
+    consecutiveFailures?: number;
+    lastFailureReason?: string;
+    lastFailureKind?: string;
+    lastFailureStatus?: number;
 }
+/**
+ * The last failed pass for a stale scope, when hq-cloud recorded one after the
+ * last successful upload. Undefined means "no evidence a pass ran", which is
+ * the only case where "the daily audit pass is not running" is accurate.
+ */
+export declare function manifestLastFailure(entry: SyncManifestUploadStatus): {
+    reason: string;
+    status?: number;
+    attempts: number;
+    at: string;
+} | undefined;
+/**
+ * Failures a fresh `hq sync manifest` from this machine cannot clear: the
+ * upload route is not deployed (404 soft skip), the server rejected this
+ * identity, or it refused access (403). A 401 is not listed: it can be an
+ * expired token that a fresh run refreshes. Offering `--fix` for these only makes the
+ * health hook report the same row as "repair did not clear" every day.
+ */
+export declare function manifestFailureNotFixable(failure: {
+    reason: string;
+    status?: number;
+}): boolean;
 /** Injectable dependencies — defaults are the real collectors. */
 export interface SyncHealthDeps {
     /** Runner log and conflict signals; omitted in unit tests of other checks. */
@@ -116,6 +148,13 @@ export interface SyncHealthDeps {
      * since a re-upload would exit 0 without uploading.
      */
     manifestUploadsDisabled?: () => boolean;
+    /**
+     * Start time (epoch ms) of a live background `hq doctor --fix` pull for
+     * this refresh target (a company slug, or `personal`), or null. A journal
+     * whose refresh is still running is reported "refresh in progress" rather
+     * than stale (feedback cd56a501).
+     */
+    refreshInProgress?: (fixTarget: string) => number | null;
 }
 /**
  * True when `slug` is a filesystem-safe company folder name. Rejects empty
@@ -148,7 +187,6 @@ export declare function isPersonalJournalSlug(slug: string): boolean;
 export declare function journalSlugFromCheckId(checkId: string): string | null;
 /** The versions/sync check family. Registered in `createDefaultRegistry`. */
 export declare const syncHealthFamily: CheckFamily;
-/** Run every versions/sync check. A thrown check degrades to UNKNOWN. */
 export declare function checkSyncHealth(context: CheckContext, rawDeps?: SyncHealthDeps): CheckResult[];
 /** True when `a` > `b` for plain X.Y.Z versions. Non-numeric parts compare 0. */
 export declare function semverGt(a: string, b: string): boolean;

package/dist/lib/doctor/checks/sync-health.js

@@ -25,6 +25,8 @@
  */
 import { defaultSyncRuntimeResults } from "./sync-runtime.js";
 import * as fs from "node:fs";
+import { DEFAULT_OWNER_IDENTITY } from "../fix/process-identity.js";
+import { REFRESH_SPAWN_LOCK_WARN_MS, inspectRefreshSpawnLock, refreshHandoffStartedAt, } from "../fix/refresh-sync-handoff.js";
 import * as path from "node:path";
 // Namespace import, deliberately: hq-cloud is an ESM package, so a static
 // NAMED import of an export the installed version lacks is a link-time
@@ -50,6 +52,45 @@ const SYNC_FAMILY_TITLE = "Versions & sync";
 export const STALE_JOURNAL_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
 /** The offline update cache written by the check-hq-update SessionStart hook. */
 export const UPDATE_CACHE_RELPATH = path.join("workspace", ".hq-update-check", "last-check.json");
+/** Failure tokens hq-cloud stores, restricted the same way hq-cloud reads them. */
+const MANIFEST_FAILURE_TOKEN = /^[a-z][a-z0-9_]{0,39}$/;
+/**
+ * The last failed pass for a stale scope, when hq-cloud recorded one after the
+ * last successful upload. Undefined means "no evidence a pass ran", which is
+ * the only case where "the daily audit pass is not running" is accurate.
+ */
+export function manifestLastFailure(entry) {
+    const reason = entry.lastFailureReason;
+    const at = entry.lastAttemptAt;
+    if (!reason || !MANIFEST_FAILURE_TOKEN.test(reason) || !at)
+        return undefined;
+    const attempts = entry.consecutiveFailures ?? 0;
+    if (!Number.isFinite(attempts) || attempts < 1)
+        return undefined;
+    const atMs = Date.parse(at);
+    if (!Number.isFinite(atMs))
+        return undefined;
+    const uploadedMs = entry.lastUploadAt ? Date.parse(entry.lastUploadAt) : Number.NaN;
+    if (Number.isFinite(uploadedMs) && atMs <= uploadedMs)
+        return undefined;
+    const status = typeof entry.lastFailureStatus === "number" && Number.isInteger(entry.lastFailureStatus)
+        ? entry.lastFailureStatus
+        : undefined;
+    return { reason, attempts: Math.floor(attempts), at, ...(status !== undefined ? { status } : {}) };
+}
+/**
+ * Failures a fresh `hq sync manifest` from this machine cannot clear: the
+ * upload route is not deployed (404 soft skip), the server rejected this
+ * identity, or it refused access (403). A 401 is not listed: it can be an
+ * expired token that a fresh run refreshes. Offering `--fix` for these only makes the
+ * health hook report the same row as "repair did not clear" every day.
+ */
+export function manifestFailureNotFixable(failure) {
+    if (failure.reason === "soft_skip" || failure.reason === "rejected_identity")
+        return true;
+    // 401 is left fixable: an expired token is refreshed by the next run.
+    return failure.status === 403 || failure.status === 404;
+}
 /** Fill in the optional dependencies so call sites never branch on undefined. */
 function withDefaults(deps, hqRoot) {
     return {
@@ -63,6 +104,8 @@ function withDefaults(deps, hqRoot) {
         companySyncResolvable: deps.companySyncResolvable ??
             ((slug, lastSync) => !companyRecordedNotResolved(hqRoot, slug, deps.now().getTime(), lastSync)),
         manifestUploadsDisabled: deps.manifestUploadsDisabled ?? (() => manifestUploadsDisabled()),
+        refreshInProgress: deps.refreshInProgress ??
+            ((fixTarget) => refreshHandoffStartedAt(hqRoot, fixTarget, deps.now().getTime())),
     };
 }
 /**
@@ -294,6 +337,36 @@ export const syncHealthFamily = {
     run: (context) => Promise.resolve(checkSyncHealth(context)),
 };
 /** Run every versions/sync check. A thrown check degrades to UNKNOWN. */
+/**
+ * WARN when the `hq doctor --fix` spawn lock has been held for over
+ * {@link REFRESH_SPAWN_LOCK_WARN_MS}, naming the holder pid, so a stalled or
+ * suspended holder is visible. Report only: the lock is never removed here.
+ */
+function refreshSpawnLockResult(hqRoot, nowMs) {
+    let lock;
+    try {
+        lock = inspectRefreshSpawnLock(hqRoot, nowMs, DEFAULT_OWNER_IDENTITY);
+    }
+    catch {
+        return [];
+    }
+    if (!lock || lock.heldMs === null || lock.heldMs <= REFRESH_SPAWN_LOCK_WARN_MS)
+        return [];
+    // Left by a claimer that has exited: nothing to stop, and the next
+    // `hq doctor --fix` releases it.
+    if (lock.ownerGone)
+        return [];
+    const minutes = Math.floor(lock.heldMs / 60_000);
+    return [
+        {
+            status: "WARN",
+            checkId: "sync.refresh.spawn-lock",
+            reasonCode: "refresh-lock-held",
+            message: `The hq doctor --fix refresh lock has been held for ${minutes} minutes by process ${lock.pid}. No new journal refresh can start until it is released.`,
+            remediation: `If process ${lock.pid} is stuck or suspended, resume or stop it; the lock is released when it exits.`,
+        },
+    ];
+}
 export function checkSyncHealth(context, rawDeps = DEFAULT_DEPS) {
     const deps = withDefaults(rawDeps, context.hqRoot);
     try {
@@ -301,6 +374,7 @@ export function checkSyncHealth(context, rawDeps = DEFAULT_DEPS) {
             ...versionResults(context, deps),
             ...updateAvailabilityResult(context, deps),
             ...journalAndManifestResults(deps),
+            ...refreshSpawnLockResult(context.hqRoot, deps.now().getTime()),
             ...deps.runtime(deps.now()),
         ];
     }
@@ -528,7 +602,7 @@ function journalResults(deps, journals) {
         if (entry.slug === PERSONAL_SCOPE_SLUG) {
             results.push(leftoverPersonalJournalResult(entry));
             if (!hasPersonalVaultJournal) {
-                results.push(journalFreshnessResult(entry, PERSONAL_VAULT_SCOPE_SLUG, nowMs));
+                results.push(withRefreshInProgress(deps, journalFreshnessResult(entry, PERSONAL_VAULT_SCOPE_SLUG, nowMs), "personal"));
             }
             continue;
         }
@@ -570,10 +644,40 @@ function journalResults(deps, journals) {
             results.push(notOnThisMachineResult(entry, checkId));
             continue;
         }
-        results.push(freshness);
+        results.push(withRefreshInProgress(deps, freshness, isPersonalJournalSlug(entry.slug) ? "personal" : entry.slug));
     }
     return results;
 }
+/**
+ * A stale or never-synced journal whose `hq doctor --fix` pull is still
+ * running in the background is UNTESTED "refresh in progress", not WARN.
+ * The pull records lastSync only when it finishes, so until then the journal
+ * looks stale even though the repair is under way. Once the process is gone
+ * the record no longer counts and the WARN comes back, so a pull that died is
+ * retried by the next `--fix`.
+ */
+function withRefreshInProgress(deps, result, fixTarget) {
+    if (result.status !== "WARN")
+        return result;
+    if (result.reasonCode !== "stale-threshold" && result.reasonCode !== "never-synced")
+        return result;
+    let startedAtMs;
+    try {
+        startedAtMs = deps.refreshInProgress(fixTarget);
+    }
+    catch {
+        return result;
+    }
+    if (startedAtMs === null)
+        return result;
+    return {
+        status: "UNTESTED",
+        checkId: result.checkId,
+        reasonCode: "refresh-in-progress",
+        ...(result.target ? { target: result.target } : {}),
+        message: `${result.message} hq doctor --fix is refreshing it in the background (started ${new Date(startedAtMs).toISOString()}); it passes when that pull finishes.`,
+    };
+}
 function companySyncResolvable(deps, slug, lastSync) {
     try {
         return deps.companySyncResolvable(slug, lastSync);
@@ -717,7 +821,21 @@ function manifestResults(deps, journals) {
                 }
             }
             const command = `hq sync manifest${scope ? ` --scope ${scope}` : ""}`;
-            const message = `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt}) — the daily audit pass is not running.`;
+            const failure = manifestLastFailure(entry);
+            const age = `Scope '${entry.scopeKey}' last uploaded a sync manifest ${days} day${days === 1 ? "" : "s"} ago (${entry.lastUploadAt})`;
+            // A pass that ran and failed is not "not running": name the stored reason.
+            const message = failure
+                ? `${age}. The last pass (${failure.at}) failed with ${failure.reason}${failure.status !== undefined ? ` (HTTP ${failure.status})` : ""}, ${failure.attempts} failed pass${failure.attempts === 1 ? "" : "es"} in a row.`
+                : `${age} — the daily audit pass is not running.`;
+            if (failure && manifestFailureNotFixable(failure)) {
+                return {
+                    status: "WARN",
+                    checkId,
+                    reasonCode: "manifest-upload-rejected",
+                    message,
+                    remediation: `--fix cannot clear this from this machine. Check you are signed in to the right HQ account (/hq-whoami), then run \`${command}\` and read its error.`,
+                };
+            }
             // With the kill switch set the upload exits 0 and sends nothing, so the
             // row carries no `--fix` target and names the switch instead.
             if (deps.manifestUploadsDisabled()) {

package/dist/lib/doctor/fix/apply.d.ts

@@ -42,6 +42,8 @@ import type { CheckResult, DoctorStatus } from "../types.js";
 import { type GateProfile } from "../hook-gate-profiles.js";
 import { type FixClass } from "./remediation.js";
 import { type RemovePs1ShimsResult } from "../../windows/ps1-shims.js";
+import { processStartTime } from "./process-identity.js";
+import { type HarvestedRefreshRun, type OrphanPull, type RefreshOwnerIdentity } from "./refresh-sync-handoff.js";
 import { type RefreshSyncOutcome } from "./refresh-sync-outcome.js";
 /** The tree subtrees whose uncommitted changes block a `--fix` run. */
 export declare const HOOK_CONFIG_DIRS: readonly [".claude", ".codex", ".grok"];
@@ -155,8 +157,13 @@ export interface RefreshManifestTarget {
 }
 /** Outcome of one {@link ApplyFixesOptions.refreshManifest} call. */
 export interface RefreshManifestResult {
-    /** Whether the upload command exited 0. The re-check is the real verdict. */
+    /**
+     * Whether the upload command exited 0 and, when it printed a `--json`
+     * outcome, that outcome was `uploaded`. The re-check is the real verdict.
+     */
     ok: boolean;
+    /** The `hq sync manifest --json` status token, when the pass did not upload. */
+    passStatus?: string;
     /** One-line summary. */
     message: string;
     /**
@@ -290,17 +297,69 @@ export declare function unresolvedSyncChecks(findings: readonly CheckResult[], a
 /**
  * Default `refresh-sync` repair: a bounded, pull-only, keep-conflicts
  * `hq sync pull --company <slug>` (or `--personal`) against the tree
- * `--fix` is repairing. Never a push, never interactive. A timeout or
- * non-zero exit is reported rather than thrown so later plans still run.
+ * `--fix` is repairing. Never a push, never interactive. A non-zero exit is
+ * reported rather than thrown so later plans still run.
+ *
+ * A pull still running after {@link REFRESH_SYNC_TIMEOUT_MS} is NOT killed
+ * (feedback cd56a501). A pull writes `lastSync` only when its pass finishes,
+ * so killing it at the deadline left a large vault, or a pull queued behind
+ * the sync runner's lock, stale on every run. It is left running detached and
+ * recorded in refresh-sync-handoff.ts; the journal check reports it as
+ * "refresh in progress" until it finishes.
+ */
+export declare function defaultRefreshSync(target: RefreshSyncTarget, deps?: RefreshSyncSpawnDeps): Promise<RefreshSyncResult>;
+/** Map a finished supervised pull to a {@link RefreshSyncResult}. */
+export declare function harvestedRefreshSyncResult(harvested: HarvestedRefreshRun): RefreshSyncResult;
+export { processStartTime };
+/**
+ * Kill an orphaned --fix pull past its cap, but only when the pid still names
+ * that pull: its process start time must match the one recorded when it
+ * started. A reused pid has a different start time and is left alone. On
+ * Windows no start time is recorded, so nothing is killed there.
+ */
+export declare function killOrphanPullIfSame(orphan: OrphanPull, _nowMs: number, probe?: (pid: number) => string | null): void;
+/** Test seams for {@link defaultRefreshSync}. */
+export interface RefreshSyncSpawnDeps {
+    command?: string;
+    args?: string[];
+    timeoutMs?: number;
+    maxBackgroundMs?: number;
+    nowMs?: () => number;
+    /** Directory holding hq-cloud's operation-lock files. */
+    locksDir?: string;
+    /** Process start-time probe for the spawn lock. */
+    identity?: RefreshOwnerIdentity;
+}
+/**
+ * How long a `--fix` pull waits for the operation lock. Unchanged from before
+ * the hand-off: a background pull must never queue on the lock longer than a
+ * foreground one did.
  */
-export declare function defaultRefreshSync(target: RefreshSyncTarget): Promise<RefreshSyncResult>;
+export declare const REFRESH_SYNC_LOCK_TIMEOUT_SEC = 30;
 /**
  * Default `refresh-manifest` repair: a bounded `hq sync manifest --scope <s>`
- * against the tree `--fix` is repairing. Exit 0 also covers throttled,
- * disabled, and skipped passes, so the post-fix re-check decides whether the
- * row cleared. A timeout or non-zero exit is reported, not thrown.
+ * against the tree `--fix` is repairing, with `--json` so a pass that exits 0
+ * without uploading (soft_skipped, throttled, disabled, locked,
+ * resend_full_scheduled) is reported as not uploaded. A `resend_full` answer
+ * is retried once with `--full`. The post-fix re-check still decides whether
+ * the row cleared. A timeout or non-zero exit is reported, not thrown.
  */
 export declare function defaultRefreshManifest(target: RefreshManifestTarget): Promise<RefreshManifestResult>;
+type ManifestSpawnResult = Pick<SpawnSyncReturns<string>, "error" | "status" | "signal"> & Partial<Pick<SpawnSyncReturns<string>, "stdout" | "stderr">>;
+/**
+ * Run one upload and, when the server answered `resend_full` (it dropped or
+ * refused the delta base), run it once more with `--full`. Without the retry
+ * the scope stays stale until the next day's --fix run, and the health hook
+ * reports it as unrepaired in between (feedback_84d7a862).
+ */
+export declare function refreshManifestWithRetry(scope: string, run: (full: boolean, json: boolean) => ManifestSpawnResult): RefreshManifestResult;
+/** Commander's rejection of `--json` by a binary that predates it. */
+export declare function manifestJsonUnsupported(result: ManifestSpawnResult): boolean;
+/**
+ * The status token from the `hq sync manifest --json` line, or undefined when
+ * the output has none (an older binary, or a pass that printed only a summary).
+ */
+export declare function manifestPassStatus(stdout: string | undefined): string | undefined;
 /**
  * Map one `hq sync manifest` spawn result to a {@link RefreshManifestResult}.
  * A spawn killed by the timeout has a null status, so it is reported as a
@@ -349,5 +408,4 @@ export declare function addHookIdToGateProfiles(source: string, hookId: string,
  * non-object `hooks` value — it is replaced rather than trusted.
  */
 export declare function registerHookInSettings(settings: unknown, event: string, command: string): Record<string, unknown>;
-export {};
 //# sourceMappingURL=apply.d.ts.map