@indigoai-us/hq-cli 5.98.2 → 5.98.3

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.98.3] — 2026-08-11
+
+### Fixed
+
+- Session-log capture now records Claude/Codex/Grok transcripts even when the
+  HQ root is reached through a symlink or case-aliased path (for example,
+  `/Users/x/HQ` versus its realpath): `hq reindex` matches the recorded working
+  directory against both the lexical root and its realpath. Delivered by bumping
+  the bundled `@indigoai-us/hq-cloud` runtime to 6.14.49
+  (indigoai-us/hq-cloud#298).
+
 ## [5.98.2] — 2026-08-11
 
 ### Fixed

package/dist/utils/hook-trust.d.ts

@@ -2,19 +2,8 @@ export interface CodexRpcClient {
     request(method: string, params: unknown): Promise<unknown>;
     close(): Promise<void>;
 }
-type SpawnSyncLike = (command: string, args: string[], options: {
-    cwd: string;
-    encoding: 'utf8';
-    stdio: 'pipe';
-}) => {
-    status: number | null;
-    stdout?: string | Buffer | null;
-    stderr?: string | Buffer | null;
-    error?: Error;
-};
 export interface HookTrustDependencies {
     createCodexClient: (cwd: string) => Promise<CodexRpcClient>;
-    spawnSync: SpawnSyncLike;
     homeDir?: () => string;
 }
 export interface RuntimeHookTrustResult {
@@ -27,9 +16,17 @@ export interface RuntimeHookTrustResult {
 export declare function createCodexAppServerClient(cwd: string, executable?: string, args?: string[]): Promise<CodexRpcClient>;
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
 export declare function trustCodexProjectHooks(hqRoot: string, deps?: HookTrustDependencies): Promise<RuntimeHookTrustResult>;
-/** Grok trusts hooks at folder scope; the shipped installer also refreshes the HQ bridge. */
+/**
+ * Grok trusts hooks at folder scope, and on observed builds project
+ * .grok/hooks often never load, so the user-global bridge under ~/.grok/hooks
+ * is the reliable dispatch path. This installer (ported from the retired
+ * core/scripts/grok-trust.sh) converges all four pieces:
+ *   1. modern folder trust (~/.grok/trusted_folders.toml)
+ *   2. legacy trusted-hook-projects entry
+ *   3. the user-global bridge copied from <hqRoot>/.grok/hooks/ (all events)
+ *   4. [compat.claude] hooks=false in ~/.grok/config.toml
+ */
 export declare function trustGrokProjectHooks(hqRoot: string, deps?: HookTrustDependencies): RuntimeHookTrustResult;
 /** Converge hook trust without turning an absent runtime into a reindex failure. */
 export declare function trustHqRuntimeHooks(hqRoot: string, deps?: HookTrustDependencies): Promise<RuntimeHookTrustResult[]>;
-export {};
 //# sourceMappingURL=hook-trust.d.ts.map

package/dist/utils/hook-trust.js

@@ -1,4 +1,4 @@
-import { spawn, spawnSync as nodeSpawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
@@ -154,7 +154,6 @@ export async function createCodexAppServerClient(cwd, executable = 'codex', args
 }
 const DEFAULT_DEPS = {
     createCodexClient: createCodexAppServerClient,
-    spawnSync: nodeSpawnSync,
     homeDir: () => process.env.HOME ?? os.homedir(),
 };
 /** Trust only hooks declared by this HQ root's project `.codex/` layer. */
@@ -183,14 +182,17 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
                 reason: 'no HQ project hooks discovered',
             };
         }
-        const pending = projectHooks.filter((hook) => hook.trustStatus === 'untrusted' || hook.trustStatus === 'modified');
+        // Converge every HQ project hook to trusted AND enabled. A hook that is
+        // already trusted but was toggled off would otherwise silently stay
+        // disabled forever — reindex is the convergence point, so it re-enables.
+        const pending = projectHooks.filter((hook) => hook.trustStatus === 'untrusted' || hook.trustStatus === 'modified' || !hook.enabled);
         if (pending.length === 0) {
             return { runtime: 'codex', status: 'unchanged', trusted: 0 };
         }
         const state = Object.fromEntries(pending.map((hook) => [
             hook.key,
             {
-                enabled: hook.enabled,
+                enabled: true,
                 trusted_hash: hook.currentHash,
             },
         ]));
@@ -201,7 +203,10 @@ export async function trustCodexProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
         const verified = hooksFromListResponse(await client.request('hooks/list', { cwds: [hqRoot] }));
         const verifiedByKey = new Map(verified.hooks.map((hook) => [hook.key, hook]));
         const stillPending = pending
-            .filter((hook) => verifiedByKey.get(hook.key)?.trustStatus !== 'trusted')
+            .filter((hook) => {
+            const after = verifiedByKey.get(hook.key);
+            return after?.trustStatus !== 'trusted' || after.enabled !== true;
+        })
             .map((hook) => hook.key);
         if (verified.errors.length > 0 || stillPending.length > 0) {
             return {
@@ -238,9 +243,15 @@ function filesMatch(left, right) {
         return false;
     }
 }
+/** Escape a value for use inside a TOML double-quoted (basic) string key. */
+function tomlEscapeKey(value) {
+    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
 function grokTrustIsCurrent(hqRoot, home) {
     const grokHome = path.join(home, '.grok');
-    const rootPattern = regexEscape(hqRoot);
+    // The key is written TOML-escaped, so match the escaped form. On POSIX paths
+    // (no backslash/quote) this is identical to the raw path.
+    const rootPattern = regexEscape(tomlEscapeKey(hqRoot));
     let modernTrust;
     let legacyTrust;
     let config;
@@ -252,9 +263,11 @@ function grokTrustIsCurrent(hqRoot, home) {
     catch {
         return false;
     }
-    const folderTrusted = new RegExp(`^\\[folders\\."${rootPattern}"\\]\\s*\\n(?:(?!\\[)[^\\n]*\\n)*trusted\\s*=\\s*true\\b`, 'm').test(modernTrust);
+    // `[^[]` spans any line ending (LF or CRLF) and EOF, so these matchers are
+    // newline-agnostic: header line, then the block body up to the next table.
+    const folderTrusted = new RegExp(`\\[folders\\."${rootPattern}"\\][^[]*?trusted\\s*=\\s*true\\b`).test(modernTrust);
     const legacyTrusted = legacyTrust.split(/\r?\n/).includes(hqRoot);
-    const claudeCompatQuiet = /^\[compat\.claude\]\s*\n(?:(?!\[)[^\n]*\n)*hooks\s*=\s*false\b/m.test(config);
+    const claudeCompatQuiet = /\[compat\.claude\][^[]*?hooks\s*=\s*false\b/.test(config);
     const sourceHooks = path.join(hqRoot, '.grok', 'hooks');
     const userHooks = path.join(grokHome, 'hooks');
     return (folderTrusted &&
@@ -263,32 +276,140 @@ function grokTrustIsCurrent(hqRoot, home) {
         filesMatch(path.join(sourceHooks, 'hq-grok-user-bridge.sh'), path.join(userHooks, 'hq-hq-bridge.sh')) &&
         filesMatch(path.join(sourceHooks, 'hq-grok-user-bridge.json'), path.join(userHooks, 'hq-hq-bridge.json')));
 }
-/** Grok trusts hooks at folder scope; the shipped installer also refreshes the HQ bridge. */
-export function trustGrokProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
-    const script = path.join(hqRoot, 'core', 'scripts', 'grok-trust.sh');
-    if (!fs.existsSync(script)) {
-        return { runtime: 'grok', status: 'skipped', trusted: 0, reason: 'grok-trust.sh absent' };
+/**
+ * Upsert the `[folders."<hqRoot>"]` trust block in ~/.grok/trusted_folders.toml.
+ * Mirrors the retired core/scripts/grok-trust.sh writer: replace an existing
+ * block for this root in place, else append one.
+ */
+function writeGrokFolderTrust(trustTomlPath, hqRoot) {
+    let text = '';
+    try {
+        text = fs.readFileSync(trustTomlPath, 'utf8');
     }
-    const home = deps.homeDir?.() ?? process.env.HOME ?? os.homedir();
-    if (grokTrustIsCurrent(hqRoot, home)) {
-        return { runtime: 'grok', status: 'unchanged', trusted: 0 };
+    catch {
+        // First install: file does not exist yet.
     }
-    const result = deps.spawnSync('bash', [script], {
-        cwd: hqRoot,
-        encoding: 'utf8',
-        stdio: 'pipe',
-    });
-    if (result.error || result.status !== 0) {
-        const detail = String(result.stderr ?? '').trim().split('\n')[0];
+    const decidedAt = Math.floor(Date.now() / 1000);
+    const key = tomlEscapeKey(hqRoot);
+    const block = `[folders."${key}"]\ntrusted = true\ndecided_at = ${decidedAt}\n`;
+    // Consume the header AND the whole block body (any line endings, and a final
+    // property with no trailing newline) so replacement never leaves a stray
+    // decided_at behind. `[^[]` matches everything up to the next table / EOF.
+    const existing = new RegExp(`\\[folders\\."${regexEscape(key)}"\\][^[]*`);
+    if (existing.test(text)) {
+        text = text.replace(existing, block);
+        if (!text.endsWith('\n'))
+            text += '\n';
+    }
+    else {
+        if (text && !text.endsWith('\n'))
+            text += '\n';
+        if (text && !text.endsWith('\n\n'))
+            text += '\n';
+        text += block;
+    }
+    fs.writeFileSync(trustTomlPath, text);
+}
+/** Append the HQ root to the legacy trusted-hook-projects list if missing. */
+function writeGrokLegacyTrust(legacyPath, hqRoot) {
+    let text = '';
+    try {
+        text = fs.readFileSync(legacyPath, 'utf8');
+    }
+    catch {
+        // First install.
+    }
+    if (text.split(/\r?\n/).includes(hqRoot))
+        return;
+    if (text && !text.endsWith('\n'))
+        text += '\n';
+    fs.writeFileSync(legacyPath, `${text}${hqRoot}\n`);
+}
+/**
+ * Set `[compat.claude] hooks = false` in ~/.grok/config.toml so Grok does not
+ * ALSO load every project .claude/settings.json hook (double-running guards and
+ * flooding the TUI). HQ policy still runs via bridge -> adapter -> hook-gate.
+ */
+function quietGrokClaudeCompat(configPath) {
+    let text = '';
+    try {
+        text = fs.readFileSync(configPath, 'utf8');
+    }
+    catch {
+        // First install.
+    }
+    // Newline-agnostic (LF/CRLF/EOF): the section is its header plus everything up
+    // to the next table declaration.
+    const section = /\[compat\.claude\][^[]*/;
+    const match = text.match(section);
+    if (match) {
+        let body = match[0];
+        if (/^hooks[^\S\r\n]*=/m.test(body)) {
+            body = body.replace(/^hooks[^\S\r\n]*=[^\r\n]*/m, 'hooks = false');
+        }
+        else {
+            body = `${body.replace(/\s+$/, '')}\nhooks = false\n`;
+        }
+        text = text.replace(section, body);
+    }
+    else {
+        if (text && !text.endsWith('\n'))
+            text += '\n';
+        if (text && !text.endsWith('\n\n'))
+            text += '\n';
+        text +=
+            '# HQ reindex: Grok enforces via hq-hq-bridge -> adapter -> .claude/hooks.\n' +
+                '# Do not also load every .claude/settings.json hook (double work + noisy UI).\n' +
+                '[compat.claude]\nhooks = false\n';
+    }
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, text);
+}
+/**
+ * Grok trusts hooks at folder scope, and on observed builds project
+ * .grok/hooks often never load, so the user-global bridge under ~/.grok/hooks
+ * is the reliable dispatch path. This installer (ported from the retired
+ * core/scripts/grok-trust.sh) converges all four pieces:
+ *   1. modern folder trust (~/.grok/trusted_folders.toml)
+ *   2. legacy trusted-hook-projects entry
+ *   3. the user-global bridge copied from <hqRoot>/.grok/hooks/ (all events)
+ *   4. [compat.claude] hooks=false in ~/.grok/config.toml
+ */
+export function trustGrokProjectHooks(hqRoot, deps = DEFAULT_DEPS) {
+    const sourceHooks = path.join(hqRoot, '.grok', 'hooks');
+    const sourceBridgeSh = path.join(sourceHooks, 'hq-grok-user-bridge.sh');
+    const sourceBridgeJson = path.join(sourceHooks, 'hq-grok-user-bridge.json');
+    if (!fs.existsSync(sourceBridgeSh) || !fs.existsSync(sourceBridgeJson)) {
         return {
             runtime: 'grok',
-            status: 'failed',
+            status: 'skipped',
             trusted: 0,
-            reason: result.error?.message ??
-                (detail || `grok-trust.sh exited ${result.status ?? 'unknown'}`),
+            reason: 'project .grok bridge sources absent',
         };
     }
-    return { runtime: 'grok', status: 'trusted', trusted: 1 };
+    const home = deps.homeDir?.() ?? process.env.HOME ?? os.homedir();
+    if (grokTrustIsCurrent(hqRoot, home)) {
+        return { runtime: 'grok', status: 'unchanged', trusted: 0 };
+    }
+    try {
+        const grokHome = path.join(home, '.grok');
+        const userHooks = path.join(grokHome, 'hooks');
+        fs.mkdirSync(userHooks, { recursive: true });
+        writeGrokFolderTrust(path.join(grokHome, 'trusted_folders.toml'), hqRoot);
+        writeGrokLegacyTrust(path.join(grokHome, 'trusted-hook-projects'), hqRoot);
+        // Quiet Claude compat BEFORE publishing the bridge. If the config write
+        // fails (e.g. read-only), the bridge is not yet active, so we never leave
+        // the bridge running while `.claude/settings.json` hooks also load — the
+        // double-execution this convergence is meant to prevent.
+        quietGrokClaudeCompat(path.join(grokHome, 'config.toml'));
+        fs.copyFileSync(sourceBridgeSh, path.join(userHooks, 'hq-hq-bridge.sh'));
+        fs.chmodSync(path.join(userHooks, 'hq-hq-bridge.sh'), 0o755);
+        fs.copyFileSync(sourceBridgeJson, path.join(userHooks, 'hq-hq-bridge.json'));
+        return { runtime: 'grok', status: 'trusted', trusted: 1 };
+    }
+    catch (error) {
+        return { runtime: 'grok', status: 'failed', trusted: 0, reason: errorMessage(error) };
+    }
 }
 /** Converge hook trust without turning an absent runtime into a reindex failure. */
 export async function trustHqRuntimeHooks(hqRoot, deps = DEFAULT_DEPS) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.98.2",
+  "version": "5.98.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -29,7 +29,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "^6.14.47",
+    "@indigoai-us/hq-cloud": "^6.14.49",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",