@indigoai-us/hq-cli 5.345.81 → 5.345.83

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## [Unreleased]
 
+## [5.345.83] — 2026-10-11
+- HQ-root scaffolds now package the shared runtime used by generated shell forwarders.
+- Lanes hook installation now replaces stale hq-cli drain registrations across
+  Claude settings and Codex config, including entries whose old install path no
+  longer exists. Other hooks are preserved, duplicate drains are removed, and a
+  repeat install leaves the registration file byte-identical.
+
+## [5.345.82] — 2026-10-11
+- Session-start health no longer treats an ordinary HQ Core upgrade warning
+  as an unrepaired doctor finding. `hq doctor` still shows the upgrade;
+  `--fix` still cannot apply it.
+- `hq storage status` runs the local report, the offload scan and the cloud
+  listing at the same time, and lists cloud file history by folder in parallel
+  instead of one page at a time. Cloud credentials are vended right before the
+  first listing call and vended again before they expire, so a long scan or
+  dry run no longer fails with "The provided token has expired."
+
 ## [5.345.81] — 2026-10-11
 - HQ Storage (`hq storage status|prune|offload|fetch`) is available behind the Indigo-only `hq-storage` flag and fails closed when the flag is off. Requires @indigoai-us/hq-cloud 6.18.61, whose sync skips `.hq-offload/` and supports cloud-only `.hqcloud` placeholders.
 - `hq storage status` reports local autosave history and cloud file-version usage per company, grouped by age. `hq storage prune` deletes old noncurrent cloud file versions in companies where you are an owner or admin, and never touches the current version. A version's age counts from when it was replaced, so a recent undo copy of an old file is kept. `status --json` marks each company with `can_delete`, and still shows local usage when you are signed out.

package/assets/scaffold/core/scripts/lib/forwarder.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Shared runtime for generated hq CLI forwarders.
+
+forwarder_exec() {
+  local script_name="$1" min_cli="$2" root_mode="$3" command="$4" stdin_closed="$5"
+  shift 5
+  local forwarder_library_dir="${BASH_SOURCE[0]%/*}"
+  local path_rule index value path_option path_value
+  local -a forwarded_args path_rules path_options path_values converted_values command_parts
+  forwarded_args=("$@")
+  local forwarded_arg_count=$#
+
+  if [ "$root_mode" = live-project ]; then
+    HQ_ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$SCRIPT_DIR/../.." && pwd)}}"
+  elif [ "$root_mode" = live ]; then
+    HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+  fi
+
+  if ! command -v hq >/dev/null 2>&1; then
+    printf "%s: requires the hq CLI — this script's implementation now ships with it.\n" "$script_name" >&2
+    printf 'Install it with: npm install -g @indigoai-us/hq-cli\n' >&2
+    exit 127
+  fi
+
+  [ "$forwarder_library_dir" != "${BASH_SOURCE[0]}" ] || forwarder_library_dir=.
+  if [ -f "$forwarder_library_dir/hq-cli-floor.sh" ]; then
+    # shellcheck source=lib/hq-cli-floor.sh
+    . "$forwarder_library_dir/hq-cli-floor.sh"
+    hq_cli_floor_check "$script_name" "$min_cli"
+  fi
+
+  if [ "$stdin_closed" = true ]; then
+    if ! { true 3<&0; } 2>/dev/null; then
+      export HQ_CORE_STDIN_CLOSED=1
+    fi
+  fi
+
+  if [ "$root_mode" = live ] || [ "$root_mode" = live-project ]; then
+    if command -v cygpath >/dev/null 2>&1; then
+      HQ_ROOT="$(cygpath -m "$HQ_ROOT")"
+    fi
+  fi
+
+  if command -v cygpath >/dev/null 2>&1; then
+    IFS=';' read -r -a path_rules <<< "$PATH_OPERANDS"
+    for path_rule in "${path_rules[@]}"; do
+      case "$path_rule" in
+        none) ;;
+        position:*)
+          index="${path_rule#position:}"
+          if (( index < forwarded_arg_count )); then convert_forwarded_path "$index"; fi
+          ;;
+        first-nonoption)
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in --*) ;; *) convert_forwarded_path "$index"; break ;; esac
+          done
+          ;;
+        all-nonoptions)
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in --*) ;; *) convert_forwarded_path "$index" ;; esac
+          done
+          ;;
+        options:*)
+          IFS=, read -r -a path_options <<< "${path_rule#options:}"
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            for path_option in "${path_options[@]}"; do
+              case "${forwarded_args[index]}" in
+                "$path_option")
+                  index=$((index + 1))
+                  if (( index < forwarded_arg_count )); then convert_forwarded_path "$index"; fi
+                  break
+                  ;;
+                "$path_option"=*)
+                  value="${forwarded_args[index]#*=}"
+                  case "$value" in /*) forwarded_args[index]="${path_option}=$(cygpath -m "$value")" ;; esac
+                  break
+                  ;;
+              esac
+            done
+          done
+          ;;
+        comma:*)
+          path_option="${path_rule#comma:}"
+          for ((index = 0; index < forwarded_arg_count; index++)); do
+            case "${forwarded_args[index]}" in
+              "$path_option")
+                index=$((index + 1))
+                if (( index < forwarded_arg_count )); then
+                  IFS=, read -r -a path_values <<< "${forwarded_args[index]}"
+                  converted_values=()
+                  for path_value in "${path_values[@]}"; do
+                    case "$path_value" in /*) converted_values+=("$(cygpath -m "$path_value")") ;; *) converted_values+=("$path_value") ;; esac
+                  done
+                  value="$(IFS=,; printf '%s' "${converted_values[*]}")"
+                  forwarded_args[index]="$value"
+                fi
+                break
+                ;;
+              "$path_option"=*)
+                value="${forwarded_args[index]#*=}"
+                case "$value" in
+                  /*,*|/*)
+                    IFS=, read -r -a path_values <<< "$value"
+                    converted_values=()
+                    for path_value in "${path_values[@]}"; do
+                      case "$path_value" in /*) converted_values+=("$(cygpath -m "$path_value")") ;; *) converted_values+=("$path_value") ;; esac
+                    done
+                    value="$(IFS=,; printf '%s' "${converted_values[*]}")"
+                    forwarded_args[index]="${path_option}=$value"
+                    ;;
+                esac
+                break
+                ;;
+            esac
+          done
+          ;;
+        *) printf 'unknown path_operands rule: %s\n' "$path_rule" >&2; exit 70 ;;
+      esac
+    done
+  fi
+
+  IFS=' ' read -r -a command_parts <<< "$command"
+  if [ "$root_mode" = live ] || [ "$root_mode" = live-project ]; then
+    if [ "$forwarded_arg_count" -gt 0 ]; then
+      MSYS2_ARG_CONV_EXCL='*' exec hq core --hq-root "$HQ_ROOT" "${command_parts[@]}" "${forwarded_args[@]}"
+    else
+      MSYS2_ARG_CONV_EXCL='*' exec hq core --hq-root "$HQ_ROOT" "${command_parts[@]}"
+    fi
+  elif [ "$forwarded_arg_count" -gt 0 ]; then
+    MSYS2_ARG_CONV_EXCL='*' exec hq core "${command_parts[@]}" "${forwarded_args[@]}"
+  else
+    MSYS2_ARG_CONV_EXCL='*' exec hq core "${command_parts[@]}"
+  fi
+}
+
+convert_forwarded_path() {
+  local arg_index="$1"
+  local value="${forwarded_args[$arg_index]}"
+  case "$value" in
+    /*) forwarded_args[$arg_index]="$(cygpath -m "$value")" ;;
+  esac
+}

package/dist/command-catalog.generated.d.ts

@@ -2931,6 +2931,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Only this company (must be one of yours)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--no-cache";
+            readonly description: "List cloud file history live instead of using figures from the last 15 minutes";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -3533,6 +3533,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--company <slug>",
                         "description": "Only this company (must be one of yours)",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--no-cache",
+                        "description": "List cloud file history live instead of using figures from the last 15 minutes",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []

package/dist/commands/core.js

@@ -268,6 +268,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/hq-cli-floor.sh", root: "live", summary: "Shared CLI version-floor helper sourced by generated forwarders" },
+    { asset: "core/scripts/lib/forwarder.sh", root: "live", summary: "Shared runtime sourced by generated scaffold forwarders" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
     { asset: "core/scripts/lib/work-mesh-live-hook.sh", root: "live", summary: "Work Mesh Live hook helpers sourced by rebind" },
     { asset: "core/scripts/lib/work-mesh-live-rebind.sh", root: "live", summary: "Work Mesh Live session rebind library sourced by hooks and the native rollback command" },

package/dist/commands/doctor.d.ts

@@ -59,6 +59,11 @@ export interface RunDoctorOptions {
     resolveClientHealthReasonCodesForCompany?: (companySlug: string | null) => Promise<boolean>;
     /** Resolve the separate status-report flag per company in sync results. */
     resolveClientHealthCheckStatusForCompany?: (companySlug: string | null) => Promise<boolean>;
+    /**
+     * Omit ordinary hq-core upgrade WARNs from `--json` (the SessionStart health
+     * hook). Default `--json` and text output still include them.
+     */
+    clientHealthReport?: boolean;
     /** In text mode, also print every PASS result. Default: false. */
     verbose?: boolean;
     /** In text mode, emit ANSI colour. Default: false (no escape sequences). */

package/dist/commands/doctor.js

@@ -181,6 +181,7 @@ export async function runDoctor(options = {}) {
             scope,
             clientHealthReasonCodesEnabledCheckIds,
             clientHealthCheckStatusEnabledCheckIds,
+            clientHealthReport: options.clientHealthReport === true,
         })));
     }
     else {
@@ -437,6 +438,7 @@ export function registerDoctorCommand(program) {
             only: parseOnly(opts.only),
             resolveClientHealthReasonCodesForCompany: clientHealthReasonCodesResolver,
             resolveClientHealthCheckStatusForCompany: clientHealthCheckStatusResolver,
+            clientHealthReport: opts.clientHealthReport === true,
         });
         // Set the exit code rather than calling process.exit, so the CLI's
         // normal shutdown (telemetry flush) still runs. Non-zero means either an

package/dist/commands/storage.d.ts

@@ -51,6 +51,8 @@ export interface CloudCompanyStatus {
     delete_markers: number;
     tranches: CloudTranche[];
     error?: string;
+    /** When these figures were listed (ISO). Older than now when served from the cache. */
+    listed_at?: string;
 }
 export interface StorageStatus {
     local: LocalReport;
@@ -112,7 +114,24 @@ export interface StorageDeps {
     log: (line: string) => void;
     /** Offload section for `status`. Absent in deps that only prune. */
     getOffload?: () => Promise<OffloadStatus>;
+    /** Cache of cloud status per company (see cloudStatusCache). Absent = always list. */
+    cloudCache?: CloudStatusCache;
 }
+/**
+ * Listing every version of a large vault takes minutes (about 2 for 2.4M
+ * versions, most of it parsing S3's XML), so `status` keeps each company's
+ * cloud figures for CLOUD_CACHE_TTL_MS. Only complete, successful listings are
+ * kept; a real cloud prune drops the company's entry; dry runs and real prunes
+ * always list live.
+ */
+export interface CloudStatusCache {
+    read(company: CompanyRef): CloudCompanyStatus | undefined;
+    write(company: CompanyRef, status: CloudCompanyStatus): void;
+    drop(company: CompanyRef): void;
+}
+export declare const CLOUD_CACHE_TTL_MS: number;
+/** File cache under <hq>/workspace/.storage-cache/cloud-<company uid>.json. */
+export declare function cloudStatusCache(hqRoot: string, now: () => Date, ttlMs?: number): CloudStatusCache;
 export declare function localScriptPath(hqRoot: string): string;
 /**
  * Core `drop-backups --expired` right before a real local prune; undefined
@@ -148,6 +167,16 @@ export interface VersionEntry {
  * to its own LastModified.
  */
 export declare function annotateNoncurrentSince(entries: VersionEntry[]): VersionEntry[];
+/** Folder levels split into parallel listings (`a/`, then `a/b/`). */
+export declare const LIST_SPLIT_DEPTH = 2;
+/** Listings in flight at once per bucket. */
+export declare const LIST_CONCURRENCY = 32;
+/**
+ * A printable-ASCII key strictly between `lo` and `hi` in S3's (UTF-8 byte)
+ * order, or undefined when none is found. Used to split one long listing into
+ * two that run at the same time.
+ */
+export declare function keyBetween(lo: string, hi: string): string | undefined;
 /** Plain message when S3 refuses a version delete for one company. */
 export declare function deleteDeniedMessage(slug: string): string;
 export declare function describeCloudError(err: unknown, action: "list" | "delete", slug?: string): string;
@@ -162,6 +191,7 @@ export declare function selectPrunable(versions: VersionEntry[], cutoff: Date):
 export declare function pruneCloud(company: CompanyRef, cutoff: Date, dryRun: boolean, deps: StorageDeps): Promise<CloudPruneResult>;
 export declare function runStorageStatus(opts: {
     company?: string;
+    noCache?: boolean;
 }, deps: StorageDeps): Promise<StorageStatus>;
 export declare function parseCutoff(value: string, flag: string): Date;
 export declare function runStoragePrune(opts: {
@@ -195,5 +225,25 @@ export declare const NEEDS_YES = "No terminal to confirm in. Re-run with --yes t
 export declare function confirmOnTty(message: string, input?: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }, output?: NodeJS.WritableStream): Promise<boolean>;
+/** STS credentials from one vend, with the time they stop working. */
+export interface VendedCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiresAt?: string;
+}
+/**
+ * AWS credential provider that vends fresh credentials on first use and again
+ * whenever the previous ones are within `marginMs` of expiring. Each vend calls
+ * `vend` anew, which signs in again (the CLI refreshes an expiring Cognito
+ * session there), so a cloud listing or delete that starts after a long local
+ * scan, or that itself outlasts one STS session, never sends an expired token.
+ */
+export declare function refreshingVendedCredentials(vend: () => Promise<VendedCredentials>, now?: () => number, marginMs?: number): () => Promise<{
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiration?: Date;
+}>;
 export declare function registerStorageCommand(program: Command): Command;
 //# sourceMappingURL=storage.d.ts.map

package/dist/commands/storage.js

@@ -56,6 +56,45 @@ export function canDeleteCloudHistory(company) {
     return company.role !== undefined && DELETE_ROLES.has(company.role);
 }
 export const DELETE_ROLE_REASON = "Only company owners and admins can delete cloud file history.";
+export const CLOUD_CACHE_TTL_MS = 15 * 60 * 1000;
+/** File cache under <hq>/workspace/.storage-cache/cloud-<company uid>.json. */
+export function cloudStatusCache(hqRoot, now, ttlMs = CLOUD_CACHE_TTL_MS) {
+    const dir = path.join(hqRoot, "workspace", ".storage-cache");
+    const file = (c) => path.join(dir, `cloud-${c.uid.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+    return {
+        read(c) {
+            try {
+                const raw = JSON.parse(fs.readFileSync(file(c), "utf8"));
+                const at = Date.parse(raw.listed_at ?? "");
+                const age = now().getTime() - at;
+                if (raw.uid !== c.uid || raw.available !== true || Number.isNaN(at) || age < 0 || age >= ttlMs)
+                    return undefined;
+                const { uid: _uid, ...status } = raw;
+                // Role can change between runs; it comes from the live membership.
+                return { ...status, company: c.slug, can_delete: canDeleteCloudHistory(c) };
+            }
+            catch {
+                return undefined;
+            }
+        },
+        write(c, status) {
+            if (!status.available)
+                return;
+            try {
+                fs.mkdirSync(dir, { recursive: true });
+                const tmp = `${file(c)}.tmp.${process.pid}`;
+                fs.writeFileSync(tmp, JSON.stringify({ ...status, uid: c.uid }));
+                fs.renameSync(tmp, file(c));
+            }
+            catch {
+                // A cache that cannot be written only costs the next status a listing.
+            }
+        },
+        drop(c) {
+            fs.rmSync(file(c), { force: true });
+        },
+    };
+}
 // ── Local (hq-core script) ──────────────────────────────────────────────────
 export function localScriptPath(hqRoot) {
     return path.join(hqRoot, "core", "scripts", "hq-storage.sh");
@@ -149,52 +188,195 @@ export function annotateNoncurrentSince(entries) {
 function noncurrentAge(v) {
     return v.noncurrentSince ?? v.lastModified;
 }
-async function* listAllVersions(store) {
-    let keyMarker;
-    let versionIdMarker;
-    do {
-        const page = await store.s3.send(new ListObjectVersionsCommand({
-            Bucket: store.bucket,
-            KeyMarker: keyMarker,
-            VersionIdMarker: versionIdMarker,
-        }));
-        for (const v of page.Versions ?? []) {
-            if (!v.Key || !v.VersionId)
-                continue;
-            yield {
-                key: v.Key,
-                versionId: v.VersionId,
-                isLatest: Boolean(v.IsLatest),
-                lastModified: v.LastModified ? new Date(v.LastModified) : new Date(0),
-                size: v.Size ?? 0,
-                isDeleteMarker: false,
-            };
+function toEntries(page) {
+    const out = [];
+    for (const v of page.Versions ?? []) {
+        if (!v.Key || !v.VersionId)
+            continue;
+        out.push({
+            key: v.Key,
+            versionId: v.VersionId,
+            isLatest: Boolean(v.IsLatest),
+            lastModified: v.LastModified ? new Date(v.LastModified) : new Date(0),
+            size: v.Size ?? 0,
+            isDeleteMarker: false,
+        });
+    }
+    for (const m of page.DeleteMarkers ?? []) {
+        if (!m.Key || !m.VersionId)
+            continue;
+        out.push({
+            key: m.Key,
+            versionId: m.VersionId,
+            isLatest: Boolean(m.IsLatest),
+            lastModified: m.LastModified ? new Date(m.LastModified) : new Date(0),
+            size: 0,
+            isDeleteMarker: true,
+        });
+    }
+    return out;
+}
+/** Folder levels split into parallel listings (`a/`, then `a/b/`). */
+export const LIST_SPLIT_DEPTH = 2;
+/** Listings in flight at once per bucket. */
+export const LIST_CONCURRENCY = 32;
+function utf8Compare(a, b) {
+    return Buffer.compare(Buffer.from(a), Buffer.from(b));
+}
+/**
+ * A printable-ASCII key strictly between `lo` and `hi` in S3's (UTF-8 byte)
+ * order, or undefined when none is found. Used to split one long listing into
+ * two that run at the same time.
+ */
+export function keyBetween(lo, hi) {
+    const a = Buffer.from(lo);
+    const b = Buffer.from(hi);
+    const FIRST = 0x20;
+    const LAST = 0x7e;
+    let k = 0;
+    while (k < a.length && k < b.length && a[k] === b[k])
+        k++;
+    const out = [...a.subarray(0, k)];
+    // Walk down from the first differing byte, keeping `lo`'s bytes while the
+    // gap is too small, until a byte strictly between both bounds fits.
+    for (let i = k; i < k + 8; i++) {
+        const ca = i < a.length ? a[i] : FIRST - 1;
+        const cb = i === k ? (i < b.length ? b[i] : LAST + 1) : LAST + 1;
+        const loB = Math.max(ca, FIRST - 1);
+        const hiB = Math.min(cb, LAST + 1);
+        if (hiB - loB >= 2) {
+            out.push((loB + hiB) >> 1);
+            const bytes = Buffer.from(out);
+            const mid = bytes.toString("utf8");
+            // The kept part of `lo` may end inside a multi-byte character.
+            if (!Buffer.from(mid).equals(bytes))
+                return undefined;
+            return utf8Compare(lo, mid) < 0 && utf8Compare(mid, hi) < 0 ? mid : undefined;
         }
-        for (const m of page.DeleteMarkers ?? []) {
-            if (!m.Key || !m.VersionId)
-                continue;
-            yield {
-                key: m.Key,
-                versionId: m.VersionId,
-                isLatest: Boolean(m.IsLatest),
-                lastModified: m.LastModified ? new Date(m.LastModified) : new Date(0),
-                size: 0,
-                isDeleteMarker: true,
-            };
+        if (i >= a.length || a[i] < FIRST || a[i] > LAST)
+            return undefined;
+        out.push(a[i]);
+    }
+    return undefined;
+}
+/**
+ * Every version and delete marker in the bucket. One ListObjectVersions call
+ * returns at most 1,000 entries, so a sequential walk of a vault with millions
+ * of versions takes many minutes (and outlives a 15-minute STS session). The
+ * walk runs up to LIST_CONCURRENCY listings at once:
+ *   - down to LIST_SPLIT_DEPTH levels a folder is listed with a "/" delimiter
+ *     (its own entries plus its subfolders, each queued as its own listing);
+ *   - deeper folders are listed whole, as key ranges: while listings are idle,
+ *     a long range hands its second half (split at keyBetween) to a new one;
+ *   - a vault policy can refuse a Prefix listing of one folder (private DM
+ *     folders) while allowing the plain listing the sequential walk used, so a
+ *     refused folder is listed as a key range of the plain listing instead.
+ * Ranges never overlap and every version of a key falls in exactly one, so the
+ * result is the same set as one flat listing. Any other failure fails the walk.
+ */
+async function listAllVersions(store) {
+    const all = [];
+    const queue = [{ prefix: "", depth: 0, split: LIST_SPLIT_DEPTH > 0, usePrefix: true }];
+    let active = 0;
+    let failed;
+    const runOne = async (w) => {
+        const found = [];
+        const children = [];
+        let hi = w.hi;
+        let keyMarker = w.lo ?? (w.usePrefix || !w.prefix ? undefined : w.prefix.slice(0, -1));
+        let versionIdMarker;
+        let done = false;
+        try {
+            do {
+                const page = await store.s3.send(new ListObjectVersionsCommand({
+                    Bucket: store.bucket,
+                    KeyMarker: keyMarker,
+                    VersionIdMarker: versionIdMarker,
+                    ...(w.usePrefix && w.prefix ? { Prefix: w.prefix } : {}),
+                    ...(w.split ? { Delimiter: "/" } : {}),
+                }));
+                for (const e of toEntries(page)) {
+                    if (!e.key.startsWith(w.prefix)) {
+                        // Only the plain listing returns keys outside the folder.
+                        if (utf8Compare(e.key, w.prefix) > 0)
+                            done = true;
+                        continue;
+                    }
+                    if (hi !== undefined && utf8Compare(e.key, hi) > 0) {
+                        done = true;
+                        continue;
+                    }
+                    found.push(e);
+                }
+                if (w.split) {
+                    for (const cp of page.CommonPrefixes ?? []) {
+                        if (cp.Prefix && cp.Prefix !== w.prefix) {
+                            const depth = w.depth + 1;
+                            children.push({ prefix: cp.Prefix, depth, split: depth < LIST_SPLIT_DEPTH, usePrefix: w.usePrefix });
+                        }
+                    }
+                }
+                if (page.IsTruncated && !page.NextKeyMarker) {
+                    throw new Error("File history listing was cut short (no next marker). Nothing was changed.");
+                }
+                keyMarker = page.IsTruncated && !done ? page.NextKeyMarker : undefined;
+                versionIdMarker = page.IsTruncated && !done ? page.NextVersionIdMarker : undefined;
+                // Hand the rest of a long range to an idle slot: this listing keeps
+                // keys up to `mid`, the new one starts after it.
+                if (keyMarker !== undefined && !w.split && active + queue.length < LIST_CONCURRENCY) {
+                    const end = hi ?? `${w.prefix}\x7f`;
+                    const mid = keyBetween(keyMarker, end);
+                    if (mid !== undefined && mid.startsWith(w.prefix)) {
+                        queue.push({ ...w, lo: mid, hi });
+                        hi = mid;
+                        pump();
+                    }
+                }
+            } while (keyMarker !== undefined && failed === undefined);
         }
-        if (page.IsTruncated && !page.NextKeyMarker) {
-            throw new Error("File history listing was cut short (no next marker). Nothing was changed.");
+        catch (err) {
+            if (!w.usePrefix || !isAccessDenied(err))
+                throw err;
+            // Refused for this folder: list it again from the plain listing. Nothing
+            // from the refused attempt is kept, so nothing counts twice.
+            // Same key range as this attempt (a split-off rest is already queued).
+            queue.push({ ...w, split: false, usePrefix: false, hi });
+            return;
         }
-        keyMarker = page.IsTruncated ? page.NextKeyMarker : undefined;
-        versionIdMarker = page.IsTruncated ? page.NextVersionIdMarker : undefined;
-    } while (keyMarker !== undefined);
+        for (const e of found)
+            all.push(e);
+        for (const c of children)
+            queue.push(c);
+    };
+    let finish;
+    const finished = new Promise((resolve) => (finish = resolve));
+    function pump() {
+        if (failed === undefined) {
+            while (active < LIST_CONCURRENCY && queue.length > 0) {
+                const next = queue.shift();
+                active += 1;
+                runOne(next)
+                    .catch((err) => {
+                    failed ??= err;
+                })
+                    .finally(() => {
+                    active -= 1;
+                    pump();
+                });
+            }
+        }
+        if (active === 0 && (queue.length === 0 || failed !== undefined))
+            finish();
+    }
+    pump();
+    await finished;
+    if (failed !== undefined)
+        throw failed;
+    return all;
 }
 /** Every version and delete marker in the bucket, with `noncurrentSince` set. */
 async function listVersions(store) {
-    const all = [];
-    for await (const v of listAllVersions(store))
-        all.push(v);
-    return annotateNoncurrentSince(all);
+    return annotateNoncurrentSince(await listAllVersions(store));
 }
 function emptyTranches() {
     return TRANCHES.map((t) => ({ id: t.id, label: t.label, count: 0, bytes: 0 }));
@@ -264,7 +446,7 @@ export async function getCloudStatus(company, deps) {
             error: describeCloudError(err, "list"),
         };
     }
-    return status;
+    return { ...status, listed_at: now.toISOString() };
 }
 /**
  * Versions eligible for prune: noncurrent content versions and noncurrent
@@ -345,29 +527,42 @@ export async function pruneCloud(company, cutoff, dryRun, deps) {
 // ── Orchestrators ───────────────────────────────────────────────────────────
 export async function runStorageStatus(opts, deps) {
     // Read-only: no backup drop, no gc. Pending backup bytes come from report.
-    const local = await getLocalReport(deps);
-    const offload = deps.getOffload ? await deps.getOffload().catch(offloadUnavailable) : undefined;
-    let memberships;
-    try {
-        memberships = await deps.listCompanies();
-    }
-    catch (err) {
-        // Local sections still report when cloud is unreachable (signed out, API key).
-        return {
-            local,
-            cloud: [],
-            cloud_error: err instanceof Error ? err.message : String(err),
-            ...(offload ? { offload } : {}),
-            generated_at: deps.now().toISOString(),
+    // The local report, the offload scan and the cloud listing are independent,
+    // so they run at the same time: status takes as long as the slowest one.
+    const localP = getLocalReport(deps);
+    const offloadP = deps.getOffload ? deps.getOffload().catch(offloadUnavailable) : Promise.resolve(undefined);
+    const cloudP = (async () => {
+        let memberships;
+        try {
+            memberships = await deps.listCompanies();
+        }
+        catch (err) {
+            // Local sections still report when cloud is unreachable (signed out, API key).
+            return { cloud: [], cloud_error: err instanceof Error ? err.message : String(err) };
+        }
+        const companies = selectCompanies(memberships, opts.company);
+        const cached = async (c) => {
+            const hit = opts.noCache ? undefined : deps.cloudCache?.read(c);
+            if (hit)
+                return hit;
+            const fresh = await getCloudStatus(c, deps);
+            deps.cloudCache?.write(c, fresh);
+            return fresh;
         };
-    }
-    const companies = selectCompanies(memberships, opts.company);
-    const cloud = [];
-    for (const c of companies)
-        cloud.push(await getCloudStatus(c, deps));
+        return { cloud: await Promise.all(companies.map(cached)) };
+    })();
+    // Settle all three before returning, so no scan is left running behind a throw.
+    const [localR, offloadR, cloudR] = await Promise.allSettled([localP, offloadP, cloudP]);
+    for (const r of [localR, cloudR])
+        if (r.status === "rejected")
+            throw r.reason;
+    const local = localR.value;
+    const offload = offloadR.status === "fulfilled" ? offloadR.value : undefined;
+    const { cloud, cloud_error } = cloudR.value;
     return {
         local,
         cloud,
+        ...(cloud_error !== undefined ? { cloud_error } : {}),
         ...(offload ? { offload } : {}),
         generated_at: deps.now().toISOString(),
     };
@@ -422,8 +617,12 @@ export async function runStoragePrune(opts, deps) {
     }
     const cloud = [];
     if (cloudCutoff) {
-        for (const c of companies)
+        for (const c of companies) {
+            // A real prune changes the figures: the next status lists live.
+            if (!opts.dryRun)
+                deps.cloudCache?.drop(c);
             cloud.push(await pruneCloud(c, cloudCutoff, opts.dryRun, deps));
+        }
         for (const c of skipped) {
             cloud.push({
                 company: c.slug,
@@ -774,10 +973,43 @@ async function buildOffloadDeps() {
         },
     };
 }
+/**
+ * AWS credential provider that vends fresh credentials on first use and again
+ * whenever the previous ones are within `marginMs` of expiring. Each vend calls
+ * `vend` anew, which signs in again (the CLI refreshes an expiring Cognito
+ * session there), so a cloud listing or delete that starts after a long local
+ * scan, or that itself outlasts one STS session, never sends an expired token.
+ */
+export function refreshingVendedCredentials(vend, now = Date.now, marginMs = 5 * 60 * 1000) {
+    let cached;
+    let pending;
+    return async () => {
+        if (cached && cached.expiration && cached.expiration.getTime() - now() > marginMs)
+            return cached;
+        pending ??= vend()
+            .then((c) => {
+            const t = c.expiresAt ? Date.parse(c.expiresAt) : NaN;
+            cached = {
+                accessKeyId: c.accessKeyId,
+                secretAccessKey: c.secretAccessKey,
+                sessionToken: c.sessionToken,
+                // Unknown expiry: treat as already due so the next call vends again.
+                expiration: new Date(Number.isNaN(t) ? now() : t),
+            };
+            return cached;
+        })
+            .finally(() => {
+            pending = undefined;
+        });
+        return pending;
+    };
+}
 async function buildDeps() {
-    // Sign-in is lazy so `status` can still report local sections when signed out.
-    let session;
-    const signedIn = () => (session ??= signedInVault());
+    // Sign-in is lazy so `status` can still report local sections when signed out,
+    // and it is resolved again for every cloud call (never once at the start): the
+    // local scan before the cloud listing can outlast a session token, and
+    // resolveVaultCredential refreshes an expiring Cognito session.
+    const signedIn = () => signedInVault();
     const offloadDeps = await buildOffloadDeps();
     return {
         getOffload: () => getOffloadStatus(offloadDeps, {
@@ -786,6 +1018,7 @@ async function buildDeps() {
         }),
         hqRoot: findHqRoot(),
         now: () => new Date(),
+        cloudCache: cloudStatusCache(findHqRoot(), () => new Date()),
         runScript: defaultRunScript,
         confirm: (message) => confirmOnTty(message),
         log: (line) => console.log(line),
@@ -799,10 +1032,16 @@ async function buildDeps() {
         },
         openCompany: async (company) => {
             const { vault } = await signedIn();
-            const vend = await vault.sts.vend({ companyUid: company.uid });
             const entity = await vault.entity.get(company.uid);
             const bucket = entity.bucketName ?? `hq-vault-cmp-${company.slug}`;
-            const s3 = new S3Client({ region: DEFAULT_COGNITO.region, credentials: vend.credentials });
+            // Credentials are vended right before the first S3 call and re-vended
+            // (with a freshly refreshed sign-in) before they expire.
+            const credentials = refreshingVendedCredentials(async () => {
+                const { vault: fresh } = await signedIn();
+                const vend = await fresh.sts.vend({ companyUid: company.uid });
+                return { ...vend.credentials, expiresAt: vend.expiresAt };
+            });
+            const s3 = new S3Client({ region: DEFAULT_COGNITO.region, credentials });
             return { bucket, s3 };
         },
     };
@@ -817,9 +1056,10 @@ export function registerStorageCommand(program) {
         .description("Show local autosave history and cloud file history sizes")
         .option("--json", "Print JSON")
         .option("--company <slug>", "Only this company (must be one of yours)")
+        .option("--no-cache", "List cloud file history live instead of using figures from the last 15 minutes")
         .action(async (opts) => {
         try {
-            const status = await runStorageStatus({ company: opts.company }, await buildDeps());
+            const status = await runStorageStatus({ company: opts.company, noCache: opts.cache === false }, await buildDeps());
             console.log(opts.json ? JSON.stringify(status, null, 2) : formatStorageStatus(status));
         }
         catch (err) {

package/dist/lib/doctor/fix/remediation.js

@@ -119,6 +119,16 @@ export function deriveRemediation(result) {
             command: remediation ?? `hq bot start ${target}`,
         };
     }
+    // Available hq-core upgrade. WARN is intentional in `hq doctor` and is
+    // not a broken sync; --fix has no mechanical repair for it.
+    if (checkId === "sync.update.core") {
+        return {
+            autoFixable: false,
+            fixClass: null,
+            action: "Ordinary hq-core upgrade, not a failed repair. hq doctor --fix will leave this WARN in place. Run /update-hq in a fresh session.",
+            command: "",
+        };
+    }
     // refresh-sync — a company journal that is stale or never-synced, or a
     // live personal / personal-vault journal. Leftover shards are NA at the
     // check layer, so they never reach this classifier. A SessionStart

package/dist/lib/doctor/json-output.d.ts

@@ -104,7 +104,23 @@ export interface BuildDoctorJsonInput {
     clientHealthReasonCodesEnabledCheckIds?: ReadonlySet<string>;
     /** Check ids whose own company enabled per-check status reporting in hq-flags. */
     clientHealthCheckStatusEnabledCheckIds?: ReadonlySet<string>;
+    /**
+     * JSON consumed by the SessionStart health hook (`--client-health-report`).
+     * Ordinary hq-core upgrade WARNs stay in human `hq doctor` output and in
+     * default `--json`, but they are omitted here: `--fix` cannot apply a
+     * release, and older hooks treated the leftover WARN as an unrepaired
+     * failure.
+     */
+    clientHealthReport?: boolean;
 }
+/**
+ * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
+ * FAIL stays visible: that is a broken local core, not "a newer release exists".
+ */
+export declare function isOrdinaryCoreUpdateWarn(result: {
+    checkId: string;
+    status: DoctorStatus;
+}): boolean;
 /** Assemble the machine-readable document from a completed run. */
 export declare function buildDoctorJson(input: BuildDoctorJsonInput): DoctorJsonDocument;
 /** Serialise the document as pretty-printed JSON with a trailing newline. */

package/dist/lib/doctor/json-output.js

@@ -29,11 +29,21 @@ import { deriveRemediation } from "./fix/remediation.js";
  * was passed, so a consumer can see what `--fix` would do without invoking it.
  */
 export const DOCTOR_JSON_SCHEMA_VERSION = 2;
+/**
+ * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
+ * FAIL stays visible: that is a broken local core, not "a newer release exists".
+ */
+export function isOrdinaryCoreUpdateWarn(result) {
+    return result.checkId === "sync.update.core" && result.status === "WARN";
+}
 /** Assemble the machine-readable document from a completed run. */
 export function buildDoctorJson(input) {
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
+            if (input.clientHealthReport === true && isOrdinaryCoreUpdateWarn(result)) {
+                continue;
+            }
             results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds, input.clientHealthCheckStatusEnabledCheckIds));
         }
     }

package/dist/lib/lanes/hooks-install.js

@@ -149,9 +149,18 @@ function isInstalledDrainEntry(entryPath) {
  * Both paths target the same hq-cli drain entry, so recognize an installed
  * package entry alongside the exact entry belonging to this CLI invocation.
  */
-function drainCommandsMatch(candidate, expected) {
-    if (candidate === expected)
-        return true;
+function drainCommandsMatch(candidate, expected, requireInstalledPaths = false) {
+    if (candidate === expected) {
+        if (!requireInstalledPaths)
+            return true;
+        const withoutProviderEnv = candidate.startsWith("HQ_LANE_PROVIDER=grok ")
+            ? candidate.slice("HQ_LANE_PROVIDER=grok ".length)
+            : candidate;
+        const currentArgv = parseShellQuotedArguments(withoutProviderEnv);
+        return currentArgv !== null && currentArgv.length === 2 &&
+            path.parse(currentArgv[0]).name.toLowerCase() === "node" &&
+            fs.existsSync(currentArgv[0]) && fs.existsSync(currentArgv[1]);
+    }
     const withoutProviderEnv = candidate.startsWith("HQ_LANE_PROVIDER=grok ")
         ? candidate.slice("HQ_LANE_PROVIDER=grok ".length)
         : candidate;
@@ -162,9 +171,9 @@ function drainCommandsMatch(candidate, expected) {
         return false;
     if (!isInstalledDrainEntry(argv[1]))
         return false;
-    return fs.existsSync(argv[0]) && fs.existsSync(argv[1]);
+    return !requireInstalledPaths || (fs.existsSync(argv[0]) && fs.existsSync(argv[1]));
 }
-function groupsContainDrainCommand(groups, expected) {
+function groupsContainDrainCommand(groups, expected, requireInstalledPaths = false) {
     if (!Array.isArray(groups))
         return false;
     return groups.some((group) => {
@@ -173,29 +182,51 @@ function groupsContainDrainCommand(groups, expected) {
         return group.hooks.some((hook) => isPlainObject(hook) &&
             hook.type === "command" &&
             typeof hook.command === "string" &&
-            drainCommandsMatch(hook.command, expected));
+            drainCommandsMatch(hook.command, expected, requireInstalledPaths));
     });
 }
-function tomlHasDrainCommand(parsed, expected) {
+function tomlHasDrainCommand(parsed, expected, requireInstalledPaths = false) {
     const hooks = isPlainObject(parsed.hooks) ? parsed.hooks : null;
     return hooks !== null &&
-        ["PreToolUse", "PostToolUse", "Stop"].every((event) => groupsContainDrainCommand(hooks[event], expected));
+        ["PreToolUse", "PostToolUse", "Stop"].every((event) => groupsContainDrainCommand(hooks[event], expected, requireInstalledPaths));
 }
-function removeCommandFromGroups(groups, command) {
+function removeDrainCommandsFromGroups(groups, expected, legacyCommand) {
     let changed = false;
+    let keptCurrent = false;
     const next = groups.flatMap((group) => {
         if (!isPlainObject(group) || !Array.isArray(group.hooks))
             return [group];
-        const hooks = group.hooks.filter((hook) => !(isPlainObject(hook) &&
-            hook.type === "command" &&
-            hook.command === command));
+        const hooks = group.hooks.filter((hook) => {
+            if (!isPlainObject(hook) || hook.type !== "command" || typeof hook.command !== "string")
+                return true;
+            const isCurrent = hook.command === expected;
+            const isDrain = isCurrent || drainCommandsMatch(hook.command, expected) || hook.command === legacyCommand;
+            if (isCurrent && !keptCurrent) {
+                keptCurrent = true;
+                return true;
+            }
+            if (isDrain)
+                changed = true;
+            return !isDrain;
+        });
         if (hooks.length === group.hooks.length)
             return [group];
-        changed = true;
         return hooks.length === 0 ? [] : [{ ...group, hooks }];
     });
     return { groups: next, changed };
 }
+function groupHasExactlyOneCommand(groups, command) {
+    let count = 0;
+    for (const group of groups) {
+        if (!isPlainObject(group) || !Array.isArray(group.hooks))
+            continue;
+        for (const hook of group.hooks) {
+            if (isPlainObject(hook) && hook.type === "command" && hook.command === command)
+                count += 1;
+        }
+    }
+    return count === 1;
+}
 export function renderDrainHookJson(shPath, provider = "grok") {
     const command = drainHookCommand(shPath, provider);
     const registration = {
@@ -237,21 +268,18 @@ export function mergeClaudeSettingsHook(existingText, command, settingsPath, leg
         }
         eventGroups.set(event, groups);
     }
-    const pre = eventGroups.get("PreToolUse");
-    if (!Array.isArray(pre)) {
-        throw new LanesError("settings_unparseable", `${settingsPath} has a non-array "hooks.PreToolUse"; refusing to rewrite it`, { path: settingsPath });
-    }
-    const migration = legacyCommand && legacyCommand !== command
-        ? removeCommandFromGroups(pre, legacyCommand)
-        : { groups: pre, changed: false };
-    const allRegistered = events.every((event) => groupsContainCommand(eventGroups.get(event), command));
-    if (allRegistered && !migration.changed) {
+    const cleanups = new Map(events.map((event) => [
+        event,
+        removeDrainCommandsFromGroups(eventGroups.get(event), command, legacyCommand),
+    ]));
+    if (events.every((event) => groupHasExactlyOneCommand(cleanups.get(event).groups, command) &&
+        !cleanups.get(event).changed)) {
         return { text: existingText ?? "", changed: false };
     }
     const nextHooks = { ...hooks };
     for (const event of events) {
-        const groups = event === "PreToolUse" ? migration.groups : eventGroups.get(event);
-        nextHooks[event] = groupsContainCommand(groups, command) ? groups : [
+        const groups = cleanups.get(event).groups;
+        nextHooks[event] = groupHasExactlyOneCommand(groups, command) ? groups : [
             ...groups,
             { hooks: [{ type: "command", command, timeout: DRAIN_HOOK_TIMEOUT_SECONDS }] },
         ];
@@ -405,6 +433,145 @@ function parseTomlOrThrow(text, configPath, stage) {
     }
     return parsed;
 }
+function renderTomlInline(value) {
+    if (typeof value === "string")
+        return tomlBasicString(value);
+    if (typeof value === "boolean" || typeof value === "number")
+        return String(value);
+    if (Array.isArray(value))
+        return `[${value.map(renderTomlInline).join(", ")}]`;
+    if (isPlainObject(value)) {
+        const fields = Object.entries(value).map(([key, entry]) => `${JSON.stringify(key)} = ${renderTomlInline(entry)}`);
+        return `{ ${fields.join(", ")} }`;
+    }
+    throw new LanesError("config_toml_migration_failed", "Could not safely render an inline Codex hook while removing stale lane drains");
+}
+function isDrainHookValue(hook, expected, legacyCommand) {
+    return isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string" &&
+        (drainCommandsMatch(hook.command, expected) || hook.command === legacyCommand);
+}
+function removeStaleCodexDrainHooks(text, parsed, expected, legacyCommand, configPath) {
+    const hooks = isPlainObject(parsed.hooks) ? parsed.hooks : {};
+    const lines = text.split("\n");
+    const spans = [];
+    let changed = false;
+    for (const event of ["PreToolUse", "PostToolUse", "Stop"]) {
+        const groups = Array.isArray(hooks[event]) ? hooks[event] : [];
+        const parentIndexes = lines.flatMap((line, index) => {
+            const header = tomlHeader(line);
+            return header?.array && header.path === `hooks.${event}` ? [index] : [];
+        });
+        if (parentIndexes.length !== groups.length) {
+            throw new LanesError("config_toml_migration_failed", `Could not safely map ${event} drain hooks in ${configPath}; refusing to add a second drain`, { path: configPath, event, groups: groups.length, headers: parentIndexes.length });
+        }
+        let keptCurrent = false;
+        for (let groupIndex = 0; groupIndex < parentIndexes.length; groupIndex += 1) {
+            const start = parentIndexes[groupIndex];
+            let end = start + 1;
+            for (; end < lines.length; end += 1) {
+                const header = tomlHeader(lines[end]);
+                if (!header)
+                    continue;
+                if (header.array && header.path === `hooks.${event}`)
+                    break;
+                if (header.path.startsWith(`hooks.${event}.`))
+                    continue;
+                break;
+            }
+            const hookHeaders = lines.flatMap((line, index) => {
+                if (index <= start || index >= end)
+                    return [];
+                const header = tomlHeader(line);
+                return header?.array && header.path === `hooks.${event}.hooks` ? [index] : [];
+            });
+            const group = groups[groupIndex];
+            const groupHooks = isPlainObject(group) && Array.isArray(group.hooks) ? group.hooks : [];
+            if (hookHeaders.length !== groupHooks.length) {
+                const keptInlineHooks = [];
+                let inlineNeedsEdit = false;
+                for (const hook of groupHooks) {
+                    const command = isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string"
+                        ? hook.command
+                        : undefined;
+                    if (!command) {
+                        keptInlineHooks.push(hook);
+                        continue;
+                    }
+                    const current = command === expected;
+                    const drain = isDrainHookValue(hook, expected, legacyCommand);
+                    if (!drain || (current && !keptCurrent)) {
+                        if (current)
+                            keptCurrent = true;
+                        keptInlineHooks.push(hook);
+                    }
+                    else {
+                        inlineNeedsEdit = true;
+                    }
+                }
+                if (!inlineNeedsEdit)
+                    continue;
+                if (hookHeaders.length === 0) {
+                    const hooksLine = lines.findIndex((line, index) => index > start && index < end && /^\s*hooks\s*=/.test(line));
+                    if (hooksLine === -1) {
+                        throw new LanesError("config_toml_migration_failed", `Could not safely find inline ${event} hooks in ${configPath}; refusing to add a second drain`, { path: configPath, event, groupIndex });
+                    }
+                    changed = true;
+                    if (keptInlineHooks.length === 0) {
+                        spans.push({ start, end });
+                    }
+                    else {
+                        const indent = /^\s*/.exec(lines[hooksLine])?.[0] ?? "";
+                        lines[hooksLine] = `${indent}hooks = ${renderTomlInline(keptInlineHooks)}`;
+                    }
+                    continue;
+                }
+                throw new LanesError("config_toml_migration_failed", `Could not safely map ${event} hook entries in ${configPath}; refusing to add a second drain`, { path: configPath, event, groupIndex, hooks: groupHooks.length, headers: hookHeaders.length });
+            }
+            const removeHooks = [];
+            for (let hookIndex = 0; hookIndex < hookHeaders.length; hookIndex += 1) {
+                const hookStart = hookHeaders[hookIndex];
+                let hookEnd = hookStart + 1;
+                for (; hookEnd < end; hookEnd += 1) {
+                    const header = tomlHeader(lines[hookEnd]);
+                    if (header?.array && header.path === `hooks.${event}.hooks`)
+                        break;
+                    if (header && !header.path.startsWith(`hooks.${event}.hooks.`))
+                        break;
+                }
+                const hook = groupHooks[hookIndex];
+                const command = isPlainObject(hook) && hook.type === "command" && typeof hook.command === "string"
+                    ? hook.command
+                    : undefined;
+                if (!command)
+                    continue;
+                const current = command === expected;
+                const drain = drainCommandsMatch(command, expected) || command === legacyCommand;
+                if (!drain || (current && !keptCurrent)) {
+                    if (current)
+                        keptCurrent = true;
+                    continue;
+                }
+                removeHooks.push({ start: hookStart, end: hookEnd });
+            }
+            if (removeHooks.length === 0)
+                continue;
+            changed = true;
+            if (removeHooks.length === hookHeaders.length) {
+                spans.push({ start, end });
+            }
+            else {
+                spans.push(...removeHooks);
+            }
+        }
+    }
+    if (!changed)
+        return { text, changed: false };
+    for (const span of spans.sort((a, b) => b.start - a.start)) {
+        lines.splice(span.start, span.end - span.start);
+    }
+    const cleaned = lines.join("\n");
+    return { text: cleaned, changed: true };
+}
 /**
  * Set `hooks = true` inside `[features]` by editing lines, so the operator's
  * comments and layout survive. A `[features]` header that exists gets the
@@ -442,12 +609,21 @@ export function mergeCodexConfigHook(existingText, command, configPath, legacyCo
     const original = existingText ?? "";
     const parsed = parseTomlOrThrow(original, configPath, "before merge");
     const migration = removeLegacyCodexHook(original, parsed, legacyCommand, configPath);
-    const textAfterMigration = migration.text;
+    const parsedAfterMigration = parseTomlOrThrow(migration.text, configPath, "after legacy hook removal");
+    const drainCleanup = removeStaleCodexDrainHooks(migration.text, parsedAfterMigration, command, legacyCommand, configPath);
+    const changedByCleanup = migration.changed || drainCleanup.changed;
+    const textAfterMigration = drainCleanup.text;
     const current = parseTomlOrThrow(textAfterMigration, configPath, "after legacy hook removal");
     const hasPreToolCommand = tomlHasCommand(current, command);
     const hasCommand = tomlHasDrainCommand(current, command);
     const featureOn = tomlHooksFeatureEnabled(current);
-    if (hasCommand && featureOn && !migration.changed) {
+    if (hasCommand && featureOn && !changedByCleanup &&
+        ["PreToolUse", "PostToolUse", "Stop"].every((event) => {
+            const groups = isPlainObject(current.hooks) && Array.isArray(current.hooks[event])
+                ? current.hooks[event]
+                : [];
+            return groupHasExactlyOneCommand(groups, command);
+        })) {
         return { text: original, changed: false };
     }
     let text = textAfterMigration;
@@ -509,7 +685,7 @@ export function probeDrainHookRegistration(provider, providerHome) {
             const toml = parseToml(text);
             return {
                 ...base,
-                registered: isPlainObject(toml) && tomlHasDrainCommand(toml, command) && tomlHooksFeatureEnabled(toml),
+                registered: isPlainObject(toml) && tomlHasDrainCommand(toml, command, true) && tomlHooksFeatureEnabled(toml),
             };
         }
         const json = JSON.parse(text);
@@ -517,7 +693,7 @@ export function probeDrainHookRegistration(provider, providerHome) {
         return {
             ...base,
             registered: hooks !== null &&
-                (parsed === "grok" ? ["PreToolUse"] : ["PreToolUse", "PostToolUse", "Stop"]).every((event) => groupsContainDrainCommand(hooks[event], command)),
+                (parsed === "grok" ? ["PreToolUse"] : ["PreToolUse", "PostToolUse", "Stop"]).every((event) => groupsContainDrainCommand(hooks[event], command, true)),
         };
     }
     catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.81",
+  "version": "5.345.83",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {