@indigoai-us/hq-cli 5.98.1 → 5.98.3

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.98.3] — 2026-08-11
+
+### Fixed
+
+- Session-log capture now records Claude/Codex/Grok transcripts even when the
+  HQ root is reached through a symlink or case-aliased path (for example,
+  `/Users/x/HQ` versus its realpath): `hq reindex` matches the recorded working
+  directory against both the lexical root and its realpath. Delivered by bumping
+  the bundled `@indigoai-us/hq-cloud` runtime to 6.14.49
+  (indigoai-us/hq-cloud#298).
+
+## [5.98.2] — 2026-08-11
+
+### Fixed
+
+- `hq core hq-status-summary` — and through it the `/handoff` status summary —
+  no longer crashes, or files a Sentry report, on a mature HQ root (HQ-CLI-N,
+  Sentry 7664842324). The shared `command()` helper behind the native `hq core`
+  utilities ran `spawnSync` with no `maxBuffer`, so every child inherited Node's
+  1 MiB default. `hq-status-summary` shells out to `git status --porcelain
+  --ignored`, whose output exceeds 1 MiB on any HQ root carrying the usual
+  individually-ignored files alongside tracked content; Node then killed git with
+  SIGTERM, handed back truncated stdout, and surfaced `Error: spawnSync git
+  ENOBUFS`, failing the handoff (observed once, from a single user). The helper
+  now caps captured output at 512 MiB — the same ceiling the repo already uses
+  for git reads — matching the bundled shell oracle, which redirects git straight
+  to a temp file and has no ceiling at all. Spawn errors stay fatal, so a
+  truncated status is never reported as a real summary, and an ENOBUFS above the
+  new ceiling now throws an error naming the command, its args, and the cap
+  instead of the opaque original.
+
 ## [5.98.1] — 2026-08-10
 
 ### Fixed

package/dist/bin/hq-auth-refresh.d.ts

@@ -11,4 +11,5 @@
  * non-interactively.
  */
 import "../node-preflight.js";
+import "../node-network-compat.js";
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -13,6 +13,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "../node-preflight.js";
+import "../node-network-compat.js";
 import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
 initSentry();

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import "./node-preflight.js";
+import "./node-network-compat.js";
 declare function isVersionRequest(argv: readonly string[]): boolean;
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;

package/dist/index.js

@@ -2,6 +2,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "./node-preflight.js";
+import "./node-network-compat.js";
 import { CLI_VERSION } from "./cli-version.js";
 function isVersionRequest(argv) {
     const args = argv.slice(2);

package/dist/lib/core-utils/common.js

@@ -9,10 +9,34 @@ export function ioFor(io = {}) {
 export function line(write, value) {
     write(`${value}\n`);
 }
+/**
+ * Ceiling for a single child's captured stdout, mirroring the git-read cap the
+ * repo already uses (src/utils/large-file-guard.ts:48). spawnSync defaults
+ * maxBuffer to 1 MiB; once a child's output crosses that, Node kills it with
+ * SIGTERM and hands back TRUNCATED stdout plus an ENOBUFS error. `hq core
+ * hq-status-summary` runs `git status --porcelain --ignored`, whose output
+ * exceeds 1 MiB on any mature HQ root (the individually-ignored files that sit
+ * beside tracked content), so the default turned a routine /handoff status
+ * summary into a crash. The bundled shell oracle this module ports
+ * (assets/scaffold/core/scripts/hq-status-summary.sh:108) redirects git straight
+ * to a temp file and has no ceiling at all; an explicit, generous cap matches it.
+ */
+const MAX_SPAWN_BUFFER = 512 * 1024 * 1024;
 export function command(command, args, cwd) {
-    const result = spawnSync(command, args, { cwd, encoding: "utf8" });
-    if (result.error)
-        throw result.error;
+    const result = spawnSync(command, args, { cwd, encoding: "utf8", maxBuffer: MAX_SPAWN_BUFFER });
+    // Spawn errors stay fatal: a truncated child result must never be reported as
+    // a real one — that would silently under-count a handoff's status instead of
+    // failing loudly. Above the new ceiling ENOBUFS is still theoretically
+    // reachable, so wrap it to name the command, its args and the cap; a future
+    // recurrence then arrives in Sentry self-diagnosed instead of as the opaque
+    // "spawnSync <cmd> ENOBUFS".
+    if (result.error) {
+        const error = result.error;
+        if (error.code === "ENOBUFS") {
+            throw new Error(`spawnSync ${command} ${args.join(" ")} exceeded the ${MAX_SPAWN_BUFFER}-byte output ceiling`, { cause: error });
+        }
+        throw error;
+    }
     return { status: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }
 export function exists(pathname) {

package/dist/main.d.ts

@@ -3,6 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 import "./node-preflight.js";
+import "./node-network-compat.js";
 import { Sentry } from "./sentry.js";
 export declare function runCli(): Promise<void>;
 export type TopLevelErrorDependencies = {

package/dist/main.js

@@ -5,6 +5,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "./node-preflight.js";
+import "./node-network-compat.js";
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";

package/dist/node-network-compat.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Node network defaults for HQ CLI entry points.
+ *
+ * Node's default 250 ms address-family attempt window can fail on hosts where
+ * IPv6 is advertised but black-holed. On affected WSL installations, undici's
+ * fetch() reaches ETIMEDOUT before its usable IPv4 path completes. A 1 second
+ * window fixes the connection while retaining Node's automatic family choice.
+ *
+ * Keep this module dependency-free and import it immediately after the Node
+ * version preflight. Operators can retain a custom value through NODE_OPTIONS
+ * or a direct Node CLI option; HQ only supplies the compatibility default when
+ * neither is present.
+ *
+ * Use a namespace import of `node:net` (not a static named import of
+ * `setDefaultAutoSelectFamilyAttemptTimeout`). Named ESM imports are linked
+ * before any entry-module body runs — including `node-preflight` — so importing
+ * a Node 18.13+/20.4+ API by name would turn unsupported runtimes into a
+ * module-link SyntaxError instead of the preflight's upgrade message.
+ */
+export declare const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
+export interface NodeNetworkCompatibilityOptions {
+    nodeOptions?: string;
+    execArgv?: readonly string[];
+    /**
+     * Inject the net timeout setter (tests). Pass `null` to simulate a runtime
+     * that lacks `setDefaultAutoSelectFamilyAttemptTimeout`.
+     */
+    setAttemptTimeout?: ((milliseconds: number) => void) | null;
+}
+export declare function configureNodeNetworkCompatibility(options?: NodeNetworkCompatibilityOptions): boolean;
+//# sourceMappingURL=node-network-compat.d.ts.map

package/dist/node-network-compat.js

@@ -0,0 +1,52 @@
+/**
+ * Node network defaults for HQ CLI entry points.
+ *
+ * Node's default 250 ms address-family attempt window can fail on hosts where
+ * IPv6 is advertised but black-holed. On affected WSL installations, undici's
+ * fetch() reaches ETIMEDOUT before its usable IPv4 path completes. A 1 second
+ * window fixes the connection while retaining Node's automatic family choice.
+ *
+ * Keep this module dependency-free and import it immediately after the Node
+ * version preflight. Operators can retain a custom value through NODE_OPTIONS
+ * or a direct Node CLI option; HQ only supplies the compatibility default when
+ * neither is present.
+ *
+ * Use a namespace import of `node:net` (not a static named import of
+ * `setDefaultAutoSelectFamilyAttemptTimeout`). Named ESM imports are linked
+ * before any entry-module body runs — including `node-preflight` — so importing
+ * a Node 18.13+/20.4+ API by name would turn unsupported runtimes into a
+ * module-link SyntaxError instead of the preflight's upgrade message.
+ */
+import * as nodeNet from "node:net";
+export const HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS = 1000;
+const ATTEMPT_TIMEOUT_OPTION = "--network-family-autoselection-attempt-timeout";
+function hasExplicitAttemptTimeout(nodeOptions, execArgv) {
+    const optionPattern = new RegExp(`(?:^|\\s)${ATTEMPT_TIMEOUT_OPTION}(?:=|\\s|$)`);
+    return (optionPattern.test(nodeOptions) ||
+        execArgv.some((argument) => argument === ATTEMPT_TIMEOUT_OPTION ||
+            argument.startsWith(`${ATTEMPT_TIMEOUT_OPTION}=`)));
+}
+function resolveSetAttemptTimeout(override) {
+    if (override === null)
+        return undefined;
+    if (override)
+        return override;
+    const fn = nodeNet.setDefaultAutoSelectFamilyAttemptTimeout;
+    return typeof fn === "function" ? fn.bind(nodeNet) : undefined;
+}
+export function configureNodeNetworkCompatibility(options = {}) {
+    const nodeOptions = options.nodeOptions ?? process.env.NODE_OPTIONS ?? "";
+    const execArgv = options.execArgv ?? process.execArgv;
+    if (hasExplicitAttemptTimeout(nodeOptions, execArgv)) {
+        return false;
+    }
+    const setAttemptTimeout = resolveSetAttemptTimeout(options.setAttemptTimeout);
+    if (!setAttemptTimeout) {
+        // Runtime lacks the API (pre-Node 18.13 / preflight should already have exited).
+        return false;
+    }
+    setAttemptTimeout(HQ_NETWORK_FAMILY_ATTEMPT_TIMEOUT_MS);
+    return true;
+}
+configureNodeNetworkCompatibility();
+//# sourceMappingURL=node-network-compat.js.map

package/dist/utils/hook-trust.d.ts

@@ -2,19 +2,8 @@ export interface CodexRpcClient {
     request(method: string, params: unknown): Promise<unknown>;
     close(): Promise<void>;
 }
-type SpawnSyncLike = (command: string, args: string[], options: {
-    cwd: string;
-    encoding: 'utf8';
-    stdio: 'pipe';
-}) => {
-    status: number | null;
-    stdout?: string | Buffer | null;
-    stderr?: string | Buffer | null;
-    error?: Error;
-};
 export interface HookTrustDependencies {
     createCodexClient: (cwd: string) => Promise<CodexRpcClient>;
-    spawnSync: SpawnSyncLike;
     homeDir?: () => string;
 }
 export interface RuntimeHookTrustResult {
@@ -27,9 +16,17 @@ export interface RuntimeHookTrustResult {
 export declare function createCodexAppServerClient(cwd: string, executable?: string, args?: string[]): Promise<CodexRpcClient>;
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
 export declare function trustCodexProjectHooks(hqRoot: string, deps?: HookTrustDependencies): Promise<RuntimeHookTrustResult>;
-/** Grok trusts hooks at folder scope; the shipped installer also refreshes the HQ bridge. */
+/**
+ * Grok trusts hooks at folder scope, and on observed builds project
+ * .grok/hooks often never load, so the user-global bridge under ~/.grok/hooks
+ * is the reliable dispatch path. This installer (ported from the retired
+ * core/scripts/grok-trust.sh) converges all four pieces:
+ *   1. modern folder trust (~/.grok/trusted_folders.toml)
+ *   2. legacy trusted-hook-projects entry
+ *   3. the user-global bridge copied from <hqRoot>/.grok/hooks/ (all events)
+ *   4. [compat.claude] hooks=false in ~/.grok/config.toml
+ */
 export declare function trustGrokProjectHooks(hqRoot: string, deps?: HookTrustDependencies): RuntimeHookTrustResult;
 /** Converge hook trust without turning an absent runtime into a reindex failure. */
 export declare function trustHqRuntimeHooks(hqRoot: string, deps?: HookTrustDependencies): Promise<RuntimeHookTrustResult[]>;
-export {};
 //# sourceMappingURL=hook-trust.d.ts.map

package/dist/utils/hook-trust.js

@@ -1,4 +1,4 @@
-import { spawn, spawnSync as nodeSpawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -154,7 +154,6 @@ export async function createCodexAppServerClient(cwd, executable = 'codex', args
 }
 const DEFAULT_DEPS = {
     createCodexClient: createCodexAppServerClient,
-    spawnSync: nodeSpawnSync,
     homeDir: () => process.env.HOME ?? os.homedir(),
 };
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
@@ -183,14 +182,17 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
                 reason: 'no HQ project hooks discovered',
             };
         }
-        const pending = projectHooks.filter((hook) => hook.trustStatus === 'untrusted' || hook.trustStatus === 'modified');
+        // Converge every HQ project hook to trusted AND enabled. A hook that is
+        // already trusted but was toggled off would otherwise silently stay
+        // disabled forever — reindex is the convergence point, so it re-enables.
+        const pending = projectHooks.filter((hook) => hook.trustStatus === 'untrusted' || hook.trustStatus === 'modified' || !hook.enabled);
         if (pending.length === 0) {
             return { runtime: 'codex', status: 'unchanged', trusted: 0 };
         }
         const state = Object.fromEntries(pending.map((hook) => [
             hook.key,
             {
-                enabled: hook.enabled,
+                enabled: true,
                 trusted_hash: hook.currentHash,
             },
         ]));
@@ -201,7 +203,10 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
         const verified = hooksFromListResponse(await client.request('hooks/list', { cwds: [hqRoot] }));
         const verifiedByKey = new Map(verified.hooks.map((hook) => [hook.key, hook]));
         const stillPending = pending
-            .filter((hook) => verifiedByKey.get(hook.key)?.trustStatus !== 'trusted')
+            .filter((hook) => {
+            const after = verifiedByKey.get(hook.key);
+            return after?.trustStatus !== 'trusted' || after.enabled !== true;
+        })
             .map((hook) => hook.key);
         if (verified.errors.length > 0 || stillPending.length > 0) {
             return {
@@ -238,9 +243,15 @@ function filesMatch(left, right) {
         return false;
     }
 }
+/** Escape a value for use inside a TOML double-quoted (basic) string key. */
+function tomlEscapeKey(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
 function grokTrustIsCurrent(hqRoot, home) {
     const grokHome = path.join(home, '.grok');
-    const rootPattern = regexEscape(hqRoot);
+    // The key is written TOML-escaped, so match the escaped form. On POSIX paths
+    // (no backslash/quote) this is identical to the raw path.
+    const rootPattern = regexEscape(tomlEscapeKey(hqRoot));
     let modernTrust;
     let legacyTrust;
     let config;
@@ -252,9 +263,11 @@ function grokTrustIsCurrent(hqRoot, home) {
     catch {
         return false;
     }
-    const folderTrusted = new RegExp(`^\\[folders\\."${rootPattern}"\\]\\s*\\n(?:(?!\\[)[^\\n]*\\n)*trusted\\s*=\\s*true\\b`, 'm').test(modernTrust);
+    // `[^[]` spans any line ending (LF or CRLF) and EOF, so these matchers are
+    // newline-agnostic: header line, then the block body up to the next table.
+    const folderTrusted = new RegExp(`\\[folders\\."${rootPattern}"\\][^[]*?trusted\\s*=\\s*true\\b`).test(modernTrust);
     const legacyTrusted = legacyTrust.split(/\r?\n/).includes(hqRoot);
-    const claudeCompatQuiet = /^\[compat\.claude\]\s*\n(?:(?!\[)[^\n]*\n)*hooks\s*=\s*false\b/m.test(config);
+    const claudeCompatQuiet = /\[compat\.claude\][^[]*?hooks\s*=\s*false\b/.test(config);
     const sourceHooks = path.join(hqRoot, '.grok', 'hooks');
     const userHooks = path.join(grokHome, 'hooks');
     return (folderTrusted &&
@@ -263,32 +276,140 @@ function grokTrustIsCurrent(hqRoot, home) {
         filesMatch(path.join(sourceHooks, 'hq-grok-user-bridge.sh'), path.join(userHooks, 'hq-hq-bridge.sh')) &&
         filesMatch(path.join(sourceHooks, 'hq-grok-user-bridge.json'), path.join(userHooks, 'hq-hq-bridge.json')));
 }
-/** Grok trusts hooks at folder scope; the shipped installer also refreshes the HQ bridge. */
-export function trustGrokProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
-    const script = path.join(hqRoot, 'core', 'scripts', 'grok-trust.sh');
-    if (!fs.existsSync(script)) {
-        return { runtime: 'grok', status: 'skipped', trusted: 0, reason: 'grok-trust.sh absent' };
+/**
+ * Upsert the `[folders."<hqRoot>"]` trust block in ~/.grok/trusted_folders.toml.
+ * Mirrors the retired core/scripts/grok-trust.sh writer: replace an existing
+ * block for this root in place, else append one.
+ */
+function writeGrokFolderTrust(trustTomlPath, hqRoot) {
+    let text = '';
+    try {
+        text = fs.readFileSync(trustTomlPath, 'utf8');
     }
-    const home = deps.homeDir?.() ?? process.env.HOME ?? os.homedir();
-    if (grokTrustIsCurrent(hqRoot, home)) {
-        return { runtime: 'grok', status: 'unchanged', trusted: 0 };
+    catch {
+        // First install: file does not exist yet.
     }
-    const result = deps.spawnSync('bash', [script], {
-        cwd: hqRoot,
-        encoding: 'utf8',
-        stdio: 'pipe',
-    });
-    if (result.error || result.status !== 0) {
-        const detail = String(result.stderr ?? '').trim().split('\n')[0];
+    const decidedAt = Math.floor(Date.now() / 1000);
+    const key = tomlEscapeKey(hqRoot);
+    const block = `[folders."${key}"]\ntrusted = true\ndecided_at = ${decidedAt}\n`;
+    // Consume the header AND the whole block body (any line endings, and a final
+    // property with no trailing newline) so replacement never leaves a stray
+    // decided_at behind. `[^[]` matches everything up to the next table / EOF.
+    const existing = new RegExp(`\\[folders\\."${regexEscape(key)}"\\][^[]*`);
+    if (existing.test(text)) {
+        text = text.replace(existing, block);
+        if (!text.endsWith('\n'))
+            text += '\n';
+    }
+    else {
+        if (text && !text.endsWith('\n'))
+            text += '\n';
+        if (text && !text.endsWith('\n\n'))
+            text += '\n';
+        text += block;
+    }
+    fs.writeFileSync(trustTomlPath, text);
+}
+/** Append the HQ root to the legacy trusted-hook-projects list if missing. */
+function writeGrokLegacyTrust(legacyPath, hqRoot) {
+    let text = '';
+    try {
+        text = fs.readFileSync(legacyPath, 'utf8');
+    }
+    catch {
+        // First install.
+    }
+    if (text.split(/\r?\n/).includes(hqRoot))
+        return;
+    if (text && !text.endsWith('\n'))
+        text += '\n';
+    fs.writeFileSync(legacyPath, `${text}${hqRoot}\n`);
+}
+/**
+ * Set `[compat.claude] hooks = false` in ~/.grok/config.toml so Grok does not
+ * ALSO load every project .claude/settings.json hook (double-running guards and
+ * flooding the TUI). HQ policy still runs via bridge -> adapter -> hook-gate.
+ */
+function quietGrokClaudeCompat(configPath) {
+    let text = '';
+    try {
+        text = fs.readFileSync(configPath, 'utf8');
+    }
+    catch {
+        // First install.
+    }
+    // Newline-agnostic (LF/CRLF/EOF): the section is its header plus everything up
+    // to the next table declaration.
+    const section = /\[compat\.claude\][^[]*/;
+    const match = text.match(section);
+    if (match) {
+        let body = match[0];
+        if (/^hooks[^\S\r\n]*=/m.test(body)) {
+            body = body.replace(/^hooks[^\S\r\n]*=[^\r\n]*/m, 'hooks = false');
+        }
+        else {
+            body = `${body.replace(/\s+$/, '')}\nhooks = false\n`;
+        }
+        text = text.replace(section, body);
+    }
+    else {
+        if (text && !text.endsWith('\n'))
+            text += '\n';
+        if (text && !text.endsWith('\n\n'))
+            text += '\n';
+        text +=
+            '# HQ reindex: Grok enforces via hq-hq-bridge -> adapter -> .claude/hooks.\n' +
+                '# Do not also load every .claude/settings.json hook (double work + noisy UI).\n' +
+                '[compat.claude]\nhooks = false\n';
+    }
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, text);
+}
+/**
+ * Grok trusts hooks at folder scope, and on observed builds project
+ * .grok/hooks often never load, so the user-global bridge under ~/.grok/hooks
+ * is the reliable dispatch path. This installer (ported from the retired
+ * core/scripts/grok-trust.sh) converges all four pieces:
+ *   1. modern folder trust (~/.grok/trusted_folders.toml)
+ *   2. legacy trusted-hook-projects entry
+ *   3. the user-global bridge copied from <hqRoot>/.grok/hooks/ (all events)
+ *   4. [compat.claude] hooks=false in ~/.grok/config.toml
+ */
+export function trustGrokProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
+    const sourceHooks = path.join(hqRoot, '.grok', 'hooks');
+    const sourceBridgeSh = path.join(sourceHooks, 'hq-grok-user-bridge.sh');
+    const sourceBridgeJson = path.join(sourceHooks, 'hq-grok-user-bridge.json');
+    if (!fs.existsSync(sourceBridgeSh) || !fs.existsSync(sourceBridgeJson)) {
         return {
             runtime: 'grok',
-            status: 'failed',
+            status: 'skipped',
             trusted: 0,
-            reason: result.error?.message ??
-                (detail || `grok-trust.sh exited ${result.status ?? 'unknown'}`),
+            reason: 'project .grok bridge sources absent',
         };
     }
-    return { runtime: 'grok', status: 'trusted', trusted: 1 };
+    const home = deps.homeDir?.() ?? process.env.HOME ?? os.homedir();
+    if (grokTrustIsCurrent(hqRoot, home)) {
+        return { runtime: 'grok', status: 'unchanged', trusted: 0 };
+    }
+    try {
+        const grokHome = path.join(home, '.grok');
+        const userHooks = path.join(grokHome, 'hooks');
+        fs.mkdirSync(userHooks, { recursive: true });
+        writeGrokFolderTrust(path.join(grokHome, 'trusted_folders.toml'), hqRoot);
+        writeGrokLegacyTrust(path.join(grokHome, 'trusted-hook-projects'), hqRoot);
+        // Quiet Claude compat BEFORE publishing the bridge. If the config write
+        // fails (e.g. read-only), the bridge is not yet active, so we never leave
+        // the bridge running while `.claude/settings.json` hooks also load — the
+        // double-execution this convergence is meant to prevent.
+        quietGrokClaudeCompat(path.join(grokHome, 'config.toml'));
+        fs.copyFileSync(sourceBridgeSh, path.join(userHooks, 'hq-hq-bridge.sh'));
+        fs.chmodSync(path.join(userHooks, 'hq-hq-bridge.sh'), 0o755);
+        fs.copyFileSync(sourceBridgeJson, path.join(userHooks, 'hq-hq-bridge.json'));
+        return { runtime: 'grok', status: 'trusted', trusted: 1 };
+    }
+    catch (error) {
+        return { runtime: 'grok', status: 'failed', trusted: 0, reason: errorMessage(error) };
+    }
 }
 /** Converge hook trust without turning an absent runtime into a reindex failure. */
 export async function trustHqRuntimeHooks(hqRoot, deps = DEFAULT_DEPS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.98.1",
+  "version": "5.98.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,7 +29,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.47",
+    "@indigoai-us/hq-cloud": "^6.14.49",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",