@indigoai-us/hq-cli 5.108.1 → 5.108.2

package/CHANGELOG.md

@@ -2,6 +2,83 @@
 
 ## [Unreleased]
 
+## [5.108.2] — 2026-09-04
+
+### Fixed
+
+- Hybrid search (`hq search --mode hybrid`) no longer fails on a multi-line
+  query. A whole multi-line message (for example a Slack message forwarded as
+  the query) is now collapsed to a single line before it reaches the search
+  engine, and a genuinely malformed structured query prints a short "put your
+  terms on one line" hint instead of crashing (HQ-CLI-1B).
+- An interrupted local search-model download now reports an actionable "re-run,
+  it resumes" message instead of crashing, so two searches racing to download
+  the same model on one machine no longer file a crash (HQ-CLI-1B).
+- Machine-credential auth is opt-in via `HQ_MACHINE_CREDS_FILE` / the daemon
+  (`{ tokenSource: "machine" }`); the mere presence of
+  `~/.hq-agent/machine-creds.json` no longer flips other CLI commands onto
+  Cognito machine-token minting.
+
+### Added
+
+- Machine-credential auth for the mesh daemon on fleet agent boxes: when
+  `HQ_MACHINE_CREDS_FILE` is set (or the daemon passes
+  `{ tokenSource: "machine" }`), `ensureCognitoToken` mints/refreshes via Cognito
+  `USER_PASSWORD_AUTH`, caches under the daemon state dir (never a person's
+  `~/.hq/cognito-tokens.json`), and `HQ_AGENT_IDENTITY_FILE` supplies
+  `companyUid` as trusted_explicit company scope; `hq mesh daemon doctor`
+  reports token source and actor kind.
+- Work Mesh Live session spool: `hq mesh session
+  start|turn-start|turn-end|end|task-status|blocked|note --enqueue` appends
+  one event line under `~/.hq/work-mesh/` with no network I/O, so hooks stay
+  fast. `hq mesh session flush` claims the spool and held queue by rename,
+  holds events that still need company context, drops untracked sessions,
+  dead-letters non-retryable failures, and POSTs batches of up to 100 to the
+  vault API (default base `https://hqapi.hq.computer`). A matching
+  printf-only shell helper ships at
+  `assets/scaffold/core/scripts/lib/work-mesh-enqueue.sh` for hq-core hooks.
+- Work context: `hq mesh context reconcile`, `default get|set|clear`,
+  `untracked`, `organize`, and `correct`, plus `hq mesh session status --company`.
+  Company resolution follows a fixed precedence (trusted explicit → existing
+  scope → session meta → device default → deterministic cwd/remote), gates on
+  conflict without tenant I/O, asks once for project/task after work signals,
+  and trusted or deterministic evidence auto-binds without prompting. Device
+  default company set validates current membership and ships dark behind
+  `DEFAULT_COMPANY_LOCKED` until `GET /v1/work-mesh/capabilities` reports
+  `migration: true` for every company the caller belongs to.
+  `hq mesh context correct` is the explicit, receipted cross-company migrate
+  path (confirmation gate, `migration_pending` until destination receipt).
+- Resident mesh daemon: `hq mesh daemon run|install|uninstall|status|doctor`.
+  Publishes MQTT presence with keepalive 15 s and retained online (offline is
+  server-only via IoT lifecycle), drains the spool and outbox, and installs as
+  LaunchAgent `ai.getindigo.hq-mesh-daemon` on macOS or a systemd user unit on
+  Linux (`--system-user` writes a system-unit fallback for agent boxes).
+  `hq doctor` gained a `work-context` check family covering sessions, outbox,
+  spool/held/dead-letter, and daemon health.
+- Transcript-watch fallback for hosts without hooks: the daemon enumerates
+  Claude/Codex transcript paths every 15 s with readdir+stat only (mtime),
+  never opens transcript bytes, and synthesizes
+  session_start/turn_end/session_end when hooks are absent.
+- Session-event schema copy (verbatim from hq-pro) with Ajv draft 2020-12
+  validation, a fixture corpus, and a cross-repo SHA-256 checksum test. New
+  dependencies: `ajv`, and `mqtt` pinned at 5.15.2.
+
+### Changed
+
+- hq-core hooks from the matching Work Mesh Live release require hq-cli
+  5.109.0 or newer (spool enqueue format and flush semantics).
+- Mesh daemon presence: offline is now **server-only**. Graceful stop
+  flushes once more and issues a clean MQTT `DISCONNECT` (broker lifecycle
+  event); the client no longer publishes retained offline. Retained online
+  on connect/renew is unchanged.
+
+### Fixed
+
+- Session-event flush now accounts 2xx batch responses honestly: parses
+  `accepted` / `duplicates` / `rejected[{eventId,code}]`, dead-letters each
+  rejected event with its code, and retains any eventId not accounted for
+  on the spool instead of deleting the whole chunk as posted.
+
 ## [5.108.1] — 2026-09-04
 
 ## [5.108.0] — 2026-09-03

package/assets/mesh-daemon/README.md

@@ -0,0 +1,23 @@
+# HQ mesh daemon service templates
+
+Rendered at install time by `hq mesh daemon install` with the resolved `hq`
+and `node` binaries written into the unit.
+
+| Platform | Unit | Label / name |
+|----------|------|----------------|
+| macOS | LaunchAgent | `ai.getindigo.hq-mesh-daemon` |
+| Linux (user) | systemd user unit | `hq-mesh-daemon.service` |
+| Linux (agent box) | systemd system unit | `hq-mesh-daemon.service` as `ec2-user` |
+
+## Agent-box fallback
+
+When no user session bus exists (typical EC2 agent boxes):
+
+```bash
+hq mesh daemon install --system-user ec2-user
+sudo cp ~/.hq/work-mesh/daemon/hq-mesh-daemon.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now hq-mesh-daemon.service
+```
+
+Logs: `~/.hq/work-mesh/daemon/log` (rotated at 5MB by the daemon process).

package/assets/mesh-daemon/launchd.plist.template

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>ai.getindigo.hq-mesh-daemon</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>{{NODE_BINARY}}</string>
+    <string>{{HQ_BINARY}}</string>
+    <string>mesh</string>
+    <string>daemon</string>
+    <string>run</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>{{DAEMON_DIR}}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>{{LOG_PATH}}</string>
+  <key>StandardErrorPath</key>
+  <string>{{LOG_PATH}}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>{{HOME}}</string>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  </dict>
+</dict>
+</plist>

package/assets/mesh-daemon/systemd.system.service.template

@@ -0,0 +1,27 @@
+[Unit]
+Description=HQ Work Mesh Live daemon (system, user={{SYSTEM_USER}})
+After=network-online.target
+Wants=network-online.target
+
+# Fallback for agent boxes where no user session bus exists:
+# hq mesh daemon install --system-user {{SYSTEM_USER}}
+# sudo cp ~/.hq/work-mesh/daemon/hq-mesh-daemon.service /etc/systemd/system/
+# sudo systemctl daemon-reload && sudo systemctl enable --now hq-mesh-daemon.service
+
+[Service]
+Type=simple
+User={{SYSTEM_USER}}
+Group={{SYSTEM_USER}}
+ExecStart={{NODE_BINARY}} {{HQ_BINARY}} mesh daemon run
+WorkingDirectory=/home/{{SYSTEM_USER}}/.hq/work-mesh/daemon
+Restart=on-failure
+RestartSec=5
+Environment=HOME=/home/{{SYSTEM_USER}}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+Environment=HQ_MACHINE_CREDS_FILE=/home/{{SYSTEM_USER}}/.hq-agent/machine-creds.json
+Environment=HQ_AGENT_IDENTITY_FILE=/var/lib/hq-agent/identity.json
+StandardOutput=append:/home/{{SYSTEM_USER}}/.hq/work-mesh/daemon/log
+StandardError=append:/home/{{SYSTEM_USER}}/.hq/work-mesh/daemon/log
+
+[Install]
+WantedBy=multi-user.target

package/assets/mesh-daemon/systemd.user.service.template

@@ -0,0 +1,18 @@
+[Unit]
+Description=HQ Work Mesh Live daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart={{NODE_BINARY}} {{HQ_BINARY}} mesh daemon run
+WorkingDirectory={{DAEMON_DIR}}
+Restart=on-failure
+RestartSec=5
+Environment=HOME={{HOME}}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+StandardOutput=append:{{LOG_PATH}}
+StandardError=append:{{LOG_PATH}}
+
+[Install]
+WantedBy=default.target

package/assets/scaffold/core/scripts/lib/work-mesh-enqueue.sh

@@ -0,0 +1,267 @@
+#!/usr/bin/env bash
+# hq-core: public
+# work-mesh-enqueue.sh — append one Work Mesh Live spool line with printf only.
+#
+# Sourced by hooks. Never execute directly.
+# No jq. No node. One write under PIPE_BUF via printf >> spool (O_APPEND).
+#
+# Line format is byte-identical to hq-cli formatSpoolLine() for the same inputs
+# (fixed key order, compact JSON). See src/lib/mesh/live/format-spool-line.ts.
+#
+# Usage:
+#   source "$HQ_ROOT/core/scripts/lib/work-mesh-enqueue.sh"
+#   work_mesh_enqueue \
+#     --kind session_start \
+#     --session-id "$sid" \
+#     --harness claude-code \
+#     --adapter-version 1.0.0 \
+#     --seq 1 \
+#     [--event-id ULID] [--at ISO8601] [--runtime-version V] \
+#     [--task-id T] [--status S] [--reason R] [--summary S] \
+#     [--cwd P] [--hq-root P] [--company-slug S] [--project P] [--task T] \
+#     [--tool-writes N] [--spool PATH]
+
+# Crockford base32 alphabet (ULID) — no I L O U
+_WORK_MESH_CROCKFORD='0123456789ABCDEFGHJKMNPQRSTVWXYZ'
+
+# work_mesh_json_quote <string>
+#   Set REPLY to a JSON string value (with surrounding quotes). No subshell.
+#   Fast path for values without \ " or controls (typical session metadata).
+work_mesh_json_quote() {
+  local s=$1
+  case "$s" in
+    *'\\'*|*'\"'*|*$'\n'*|*$'\r'*|*$'\t'*)
+      s=${s//'\'/'\\'}
+      s=${s//'"'/'\"'}
+      s=${s//$'\n'/'\n'}
+      s=${s//$'\r'/'\r'}
+      s=${s//$'\t'/'\t'}
+      REPLY="\"${s}\""
+      ;;
+    *)
+      REPLY="\"${s}\""
+      ;;
+  esac
+}
+
+# work_mesh_json_escape <string>
+#   Print a JSON string value (compat wrapper for tests / callers).
+work_mesh_json_escape() {
+  work_mesh_json_quote "$1"
+  printf '%s' "$REPLY"
+}
+
+# Cached: bash 5.1+ has $SRANDOM (re-read yields new entropy).
+_WORK_MESH_HAS_SRANDOM=0
+if [[ ${BASH_VERSINFO[0]} -gt 5 || ( ${BASH_VERSINFO[0]} -eq 5 && ${BASH_VERSINFO[1]} -ge 1 ) ]]; then
+  _WORK_MESH_HAS_SRANDOM=1
+fi
+
+# work_mesh_ulid
+#   Print a 26-char Crockford ULID (48-bit ms time + 80-bit entropy).
+#   Prefer bash 5+ builtins ($EPOCHREALTIME, $SRANDOM) to stay under the
+#   20ms hook budget; fall back to date/dd/od on older bash.
+#   Also sets REPLY (avoids command-substitution fork when callers use it).
+work_mesh_ulid() {
+  local alphabet=$_WORK_MESH_CROCKFORD
+  local now_ms time_part="" rand_part=""
+  local -i i rem val
+
+  if [[ -n "${EPOCHREALTIME-}" ]]; then
+    local sec=${EPOCHREALTIME%.*}
+    local frac=${EPOCHREALTIME#*.}000
+    frac=${frac:0:3}
+    now_ms=$((10#$sec * 1000 + 10#$frac))
+  else
+    now_ms=$(date +%s%3N 2>/dev/null || true)
+    case "$now_ms" in
+      ""|*[!0-9]*)
+        now_ms=$(date +%s)
+        now_ms=$((now_ms * 1000))
+        ;;
+    esac
+  fi
+
+  # 48-bit timestamp → 10 Crockford chars (fits in signed 64-bit).
+  val=$((now_ms & 0xFFFFFFFFFFFF))
+  for ((i = 0; i < 10; i++)); do
+    rem=$((val & 31))
+    time_part="${alphabet:rem:1}${time_part}"
+    val=$((val >> 5))
+  done
+
+  local -a b=()
+  if [ "$_WORK_MESH_HAS_SRANDOM" -eq 1 ]; then
+    for ((i = 0; i < 10; i++)); do
+      b+=($((SRANDOM & 255)))
+    done
+  else
+    local bytes
+    bytes=$(dd if=/dev/urandom bs=10 count=1 2>/dev/null | od -An -tu1 | tr -s ' ' '\n' | grep -E '^[0-9]+$' | head -n 10 | tr '\n' ' ')
+    # shellcheck disable=SC2206
+    local -a bb=($bytes)
+    b=("${bb[@]}")
+    while [ "${#b[@]}" -lt 10 ]; do
+      b+=($((RANDOM % 256)))
+    done
+  fi
+
+  # Encode 80 bits MSB-first as 16×5-bit Crockford chars without a 80-bit int:
+  # maintain a bit buffer that never exceeds ~16 bits of pending state.
+  local -i bitbuf=0 bits=0 bi=0 byte
+  rand_part=
+  for ((i = 0; i < 16; i++)); do
+    while [ "$bits" -lt 5 ]; do
+      if [ "$bi" -lt 10 ]; then
+        byte=${b[bi]}
+        bi=$((bi + 1))
+        bitbuf=$(((bitbuf << 8) | (byte & 255)))
+        bits=$((bits + 8))
+      else
+        bitbuf=$((bitbuf << 5))
+        bits=$((bits + 5))
+      fi
+    done
+    rem=$(((bitbuf >> (bits - 5)) & 31))
+    bits=$((bits - 5))
+    rand_part+="${alphabet:rem:1}"
+  done
+
+  REPLY="${time_part}${rand_part}"
+  printf '%s' "$REPLY"
+}
+
+# work_mesh_ensure_spool <path>
+#   Create parent dir 0700 and spool file 0600 when missing.
+#   Hot path: existing spool returns immediately (no chmod/stat storms).
+work_mesh_ensure_spool() {
+  local spool=$1 dir
+  if [ -f "$spool" ]; then
+    return 0
+  fi
+  dir=$(dirname -- "$spool")
+  mkdir -p -- "$dir" 2>/dev/null || true
+  chmod 700 -- "$dir" 2>/dev/null || true
+  (umask 077; printf '' >"$spool") || return 1
+  chmod 600 -- "$spool" 2>/dev/null || true
+}
+
+# work_mesh_enqueue [options]
+#   Build one compact JSON line and append with a single printf write.
+work_mesh_enqueue() {
+  local kind="" session_id="" harness="" adapter_version="" runtime_version=""
+  local at="" seq="" event_id="" task_id="" status="" reason="" summary=""
+  local cwd="" hq_root="" company_slug="" project="" task="" tool_writes=""
+  local spool=${WORK_MESH_SPOOL:-"${HOME}/.hq/work-mesh/spool.jsonl"}
+
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --kind) kind=$2; shift 2 ;;
+      --session-id) session_id=$2; shift 2 ;;
+      --harness) harness=$2; shift 2 ;;
+      --adapter-version) adapter_version=$2; shift 2 ;;
+      --runtime-version) runtime_version=$2; shift 2 ;;
+      --at) at=$2; shift 2 ;;
+      --seq) seq=$2; shift 2 ;;
+      --event-id) event_id=$2; shift 2 ;;
+      --task-id) task_id=$2; shift 2 ;;
+      --status) status=$2; shift 2 ;;
+      --reason) reason=$2; shift 2 ;;
+      --summary) summary=$2; shift 2 ;;
+      --cwd) cwd=$2; shift 2 ;;
+      --hq-root) hq_root=$2; shift 2 ;;
+      --company-slug) company_slug=$2; shift 2 ;;
+      --project) project=$2; shift 2 ;;
+      --task) task=$2; shift 2 ;;
+      --tool-writes) tool_writes=$2; shift 2 ;;
+      --spool) spool=$2; shift 2 ;;
+      *) printf 'work_mesh_enqueue: unknown arg %s\n' "$1" >&2; return 2 ;;
+    esac
+  done
+
+  if [ -z "$session_id" ]; then
+    printf 'work_mesh_enqueue: sessionId required\n' >&2
+    return 1
+  fi
+  if [ -z "$kind" ] || [ -z "$harness" ] || [ -z "$adapter_version" ] || [ -z "$seq" ]; then
+    printf 'work_mesh_enqueue: kind, harness, adapter-version, seq required\n' >&2
+    return 1
+  fi
+
+  if [ -z "$event_id" ]; then
+    work_mesh_ulid >/dev/null
+    event_id=$REPLY
+  fi
+  if [ -z "$at" ]; then
+    # Builtin UTC clock (bash 4.2+ printf %( )T) — no date(1) fork.
+    if TZ=UTC printf -v at '%(%Y-%m-%dT%H:%M:%S)T.000Z' -1 2>/dev/null && [ -n "$at" ]; then
+      :
+    else
+      at=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z" 2>/dev/null || date -u +"%Y-%m-%dT%H:%M:%SZ")
+    fi
+  fi
+
+  # Build compact JSON without command-substitution forks (keeps hook p95 low).
+  local line q
+  work_mesh_json_quote "$event_id"; q=$REPLY
+  line='{"v":1,"eventId":'"$q"
+  work_mesh_json_quote "$kind"; q=$REPLY
+  line+=',"kind":'"$q"
+  work_mesh_json_quote "$session_id"; q=$REPLY
+  line+=',"sessionId":'"$q"
+  work_mesh_json_quote "$harness"; q=$REPLY
+  line+=',"harness":'"$q"
+  work_mesh_json_quote "$adapter_version"; q=$REPLY
+  line+=',"adapterVersion":'"$q"
+  if [ -n "$runtime_version" ]; then
+    work_mesh_json_quote "$runtime_version"; q=$REPLY
+    line+=',"runtimeVersion":'"$q"
+  fi
+  work_mesh_json_quote "$at"; q=$REPLY
+  line+=',"at":'"$q"',"seq":'"$seq"
+  if [ -n "$task_id" ]; then
+    work_mesh_json_quote "$task_id"; q=$REPLY
+    line+=',"taskId":'"$q"
+  fi
+  if [ -n "$status" ]; then
+    work_mesh_json_quote "$status"; q=$REPLY
+    line+=',"status":'"$q"
+  fi
+  if [ -n "$reason" ]; then
+    work_mesh_json_quote "$reason"; q=$REPLY
+    line+=',"reason":'"$q"
+  fi
+  if [ -n "$summary" ]; then
+    work_mesh_json_quote "$summary"; q=$REPLY
+    line+=',"summary":'"$q"
+  fi
+  if [ -n "$cwd" ]; then
+    work_mesh_json_quote "$cwd"; q=$REPLY
+    line+=',"cwd":'"$q"
+  fi
+  if [ -n "$hq_root" ]; then
+    work_mesh_json_quote "$hq_root"; q=$REPLY
+    line+=',"hqRoot":'"$q"
+  fi
+  if [ -n "$company_slug" ]; then
+    work_mesh_json_quote "$company_slug"; q=$REPLY
+    line+=',"companySlug":'"$q"
+  fi
+  if [ -n "$project" ]; then
+    work_mesh_json_quote "$project"; q=$REPLY
+    line+=',"project":'"$q"
+  fi
+  if [ -n "$task" ]; then
+    work_mesh_json_quote "$task"; q=$REPLY
+    line+=',"task":'"$q"
+  fi
+  if [ -n "$tool_writes" ]; then
+    line+=',"toolWrites":'"$tool_writes"
+  fi
+  line+='}'
+
+  work_mesh_ensure_spool "$spool" || return 1
+  # Single write under O_APPEND (printf → one write syscall for the line).
+  printf '%s\n' "$line" >>"$spool" || return 1
+  return 0
+}

package/dist/commands/core.js

@@ -191,13 +191,14 @@ export const SCAFFOLD_COMMANDS = [
  * direct `hq core` command.
  */
 export const SCAFFOLD_ONLY_ASSETS = [
-    // Shared shell libs sourced by the two relocated scripts. Never dispatched on
-    // their own (so no `hq core` command), but they MUST ship in the tarball, or
-    // the bundled hq-session / checkpoint-stop-gate die at `source` time on a
-    // user's box. `root` is inert here — they are sourced, not run.
+    // Shared shell libs sourced by the two relocated scripts (and hooks). Never
+    // dispatched on their own (so no `hq core` command), but they MUST ship in the
+    // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
+    // time on a user's box. `root` is inert here — they are sourced, not run.
     { asset: "core/scripts/hook-lib.sh", root: "live", summary: "Shared shell primitives sourced by the checkpoint gate" },
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
+    { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
     { asset: "core/scripts/archive-old-threads.sh", root: "live", summary: "Scaffold-only native utility companion" },
     { asset: "core/scripts/codex-skill-bridge.sh", root: "live", summary: "Scaffold-only native utility companion" },
     { asset: "core/scripts/qmd-reindex-after-sync.sh", root: "cwd", summary: "Scaffold-only native utility companion" },

package/dist/commands/mesh.d.ts

@@ -8,5 +8,20 @@
 import { Command } from "commander";
 import { type MeshCompany, type MeshThread } from "../lib/mesh/api.js";
 export declare function formatCheckLines(threads: MeshThread[], company: MeshCompany, projectId?: string): string[];
+/** Injectable confirmation seam for `hq mesh context correct` (stubbed in tests). */
+export type MeshConfirmFn = (message: string) => Promise<boolean>;
+/** Exported for confirmation-gate unit tests (US-017B). */
+export declare function runContextCorrect(opts: {
+    session?: string;
+    toCompany?: string;
+    project?: string;
+    task?: string;
+    yes?: boolean;
+    json?: boolean;
+    machine?: boolean;
+    expectedVersion?: string;
+}, deps?: {
+    confirm?: MeshConfirmFn;
+}): Promise<void>;
 export declare function registerMeshCommand(program: Command): void;
 //# sourceMappingURL=mesh.d.ts.map