@indigoai-us/hq-cli 5.273.0-alpha.0 → 5.274.0

package/dist/utils/scaffold-sibling-references.d.ts

@@ -0,0 +1,21 @@
+export type SiblingAssetReference = {
+    referringAsset: string;
+    targetAsset: string;
+};
+export type HqRootAssetReference = {
+    referringAsset: string;
+    reference: string;
+};
+export type ScaffoldReferenceScan = {
+    missing: SiblingAssetReference[];
+    allowedHqRoot: HqRootAssetReference[];
+};
+/**
+ * Scan every asset below assets/scaffold for local file loads. Node source is
+ * identified by extension or shebang; unknown text assets use shell scanning.
+ * `${HQ_ROOT}/...` paths stay rooted in the live HQ tree and are returned as
+ * allowed references for review instead of being mistaken for package assets.
+ */
+export declare function scanScaffoldSiblingReferences(scaffoldRoot: string): ScaffoldReferenceScan;
+export declare function assertNoMissingScaffoldSiblings(scan: ScaffoldReferenceScan): void;
+//# sourceMappingURL=scaffold-sibling-references.d.ts.map

package/dist/utils/scaffold-sibling-references.js

@@ -0,0 +1,156 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+const SCRIPT_ROOT_TOKENS = /(?:\$\{SCRIPT_DIR\}|\$SCRIPT_DIR)/g;
+const BASH_SOURCE_TOKEN = String.raw `(?:\$\{BASH_SOURCE\[0\](?::-\$0)?\}|\$\{?0\}?)`;
+function relativePath(root, target) {
+    return path.relative(root, target).split(path.sep).join("/") || ".";
+}
+function filesBelow(root) {
+    const files = [];
+    const pending = [root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (!current)
+            continue;
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+            const fullPath = path.join(current, entry.name);
+            if (entry.isDirectory())
+                pending.push(fullPath);
+            else if (entry.isFile())
+                files.push(fullPath);
+        }
+    }
+    return files.sort();
+}
+function shellLocationAliases(contents) {
+    // Asset-relative values point into the package. HQ-root values are live-tree
+    // paths, so keep them visible as allowed references instead of package deps.
+    const aliases = new Map([
+        ["SCRIPT_DIR", { kind: "asset", baseDirectory: "." }],
+        ["HQ_ROOT", { kind: "hq-root", baseDirectory: "." }],
+    ]);
+    for (const line of contents.split(/\r?\n/)) {
+        const assignment = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+        if (!assignment)
+            continue;
+        const [, name, value] = assignment;
+        if (name === "HQ_ROOT" || /\$\{?(?:HQ_ROOT|CLAUDE_PROJECT_DIR)(?:\}|(?=[:/}]))/.test(value)) {
+            aliases.set(name, { kind: "hq-root", baseDirectory: "." });
+            continue;
+        }
+        SCRIPT_ROOT_TOKENS.lastIndex = 0;
+        const scriptRoot = SCRIPT_ROOT_TOKENS.exec(value);
+        if (scriptRoot) {
+            const suffix = value.slice(scriptRoot.index + scriptRoot[0].length)
+                .match(/^\/([^"'`\s;|&)]+)/)?.[1] ?? ".";
+            aliases.set(name, { kind: "asset", baseDirectory: path.posix.normalize(suffix) });
+            continue;
+        }
+        const dirname = new RegExp(String.raw `\$\(\s*dirname\s+["']?${BASH_SOURCE_TOKEN}["']?\s*\)(\/[^"'\x60\s;|&)]+)?`).exec(value);
+        if (dirname) {
+            const suffix = dirname[1]?.replace(/^\/+/, "") ?? ".";
+            aliases.set(name, { kind: "asset", baseDirectory: path.posix.normalize(suffix) });
+        }
+    }
+    return aliases;
+}
+function isNodeAsset(file, contents) {
+    if ([".js", ".mjs", ".cjs"].includes(path.extname(file).toLowerCase()))
+        return true;
+    const shebang = contents.split(/\r?\n/, 1)[0] ?? "";
+    return /^#!.*(?:[\s/])node(?:js)?(?:\s|$)/.test(shebang);
+}
+/**
+ * Scan every asset below assets/scaffold for local file loads. Node source is
+ * identified by extension or shebang; unknown text assets use shell scanning.
+ * `${HQ_ROOT}/...` paths stay rooted in the live HQ tree and are returned as
+ * allowed references for review instead of being mistaken for package assets.
+ */
+export function scanScaffoldSiblingReferences(scaffoldRoot) {
+    const root = path.resolve(scaffoldRoot);
+    const bundledFiles = filesBelow(root);
+    const bundledPaths = new Set(bundledFiles.map((file) => relativePath(root, file)));
+    const missing = [];
+    const allowedHqRoot = new Map();
+    const missingSet = new Set();
+    const recordRelative = (sourceFile, specifier, baseDirectory = ".") => {
+        const referringAsset = relativePath(root, sourceFile);
+        const targetPath = path.resolve(path.dirname(sourceFile), baseDirectory, specifier.replace(/^\/+/, ""));
+        const targetAsset = relativePath(root, targetPath);
+        if (bundledPaths.has(targetAsset))
+            return;
+        const key = `${referringAsset}\0${targetAsset}`;
+        if (missingSet.has(key))
+            return;
+        missingSet.add(key);
+        missing.push({ referringAsset, targetAsset });
+    };
+    for (const sourceFile of bundledFiles) {
+        const contents = fs.readFileSync(sourceFile, "utf8");
+        const referringAsset = relativePath(root, sourceFile);
+        for (const line of contents.split(/\r?\n/)) {
+            if (/^\s*#/.test(line))
+                continue;
+            for (const match of line.matchAll(/\$\{HQ_ROOT(?::-[^}]*)?\}\/([^"'`\s;|&)]+)/g)) {
+                const reference = "${HQ_ROOT}/" + match[1];
+                allowedHqRoot.set(`${referringAsset}\0${reference}`, { referringAsset, reference });
+            }
+            for (const match of line.matchAll(/\$HQ_ROOT\/([^"'`\s;|&)]+)/g)) {
+                const reference = `$HQ_ROOT/${match[1]}`;
+                allowedHqRoot.set(`${referringAsset}\0${reference}`, { referringAsset, reference });
+            }
+        }
+        if (isNodeAsset(sourceFile, contents)) {
+            const nodePatterns = [
+                /new\s+URL\(\s*(['"])(\.\.?\/[^'"]+)\1\s*,\s*import\.meta\.url\s*\)/g,
+                /path\.join\(\s*__dirname\s*,\s*(['"])(\.\.?\/[^'"]+|[^.'"/][^'"]*)\1\s*\)/g,
+            ];
+            for (const pattern of nodePatterns) {
+                for (const match of contents.matchAll(pattern))
+                    recordRelative(sourceFile, match[2]);
+            }
+            continue;
+        }
+        const aliases = shellLocationAliases(contents);
+        const commandLines = contents.split(/\r?\n/).filter((line) => !/^\s*#/.test(line) &&
+            (/\b(?:source|exec|bash|sh|node)\b/.test(line) || /^\s*\.\s+/.test(line)));
+        for (const line of commandLines) {
+            SCRIPT_ROOT_TOKENS.lastIndex = 0;
+            for (const match of line.matchAll(/(?:\$\{SCRIPT_DIR\}|\$SCRIPT_DIR)\/([^"'`\s;|&)]+)/g)) {
+                recordRelative(sourceFile, match[1]);
+            }
+            const dirnamePath = new RegExp(String.raw `\$\(\s*dirname\s+["']?${BASH_SOURCE_TOKEN}["']?\s*\)(\/[^"'\x60\s;|&)]+)`, "g");
+            for (const match of line.matchAll(dirnamePath))
+                recordRelative(sourceFile, match[1]);
+            for (const [alias, location] of aliases) {
+                const escapedAlias = alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+                const aliasPath = new RegExp(String.raw `(?:\$\{${escapedAlias}\}|\$${escapedAlias})\/([^"'\x60\s;|&)]+)`, "g");
+                for (const match of line.matchAll(aliasPath)) {
+                    if (location.kind === "hq-root") {
+                        const reference = match[0];
+                        allowedHqRoot.set(`${referringAsset}\0${reference}`, { referringAsset, reference });
+                    }
+                    else {
+                        recordRelative(sourceFile, match[1], location.baseDirectory);
+                    }
+                }
+            }
+            const relativeCommand = /(?:\b(?:source|exec|bash|sh|node)\s+|^\s*\.\s+)(?:"(\.\.?\/[^"]+)"|'(\.\.?\/[^']+)'|(\.\.?\/[^\s;|&)]+))/g;
+            for (const match of line.matchAll(relativeCommand)) {
+                recordRelative(sourceFile, match[1] ?? match[2] ?? match[3]);
+            }
+        }
+    }
+    return {
+        missing: missing.sort((a, b) => `${a.referringAsset}\0${a.targetAsset}`.localeCompare(`${b.referringAsset}\0${b.targetAsset}`)),
+        allowedHqRoot: [...allowedHqRoot.values()].sort((a, b) => `${a.referringAsset}\0${a.reference}`.localeCompare(`${b.referringAsset}\0${b.reference}`)),
+    };
+}
+export function assertNoMissingScaffoldSiblings(scan) {
+    if (scan.missing.length === 0)
+        return;
+    throw new Error(scan.missing
+        .map(({ referringAsset, targetAsset }) => `${referringAsset} references missing ${targetAsset}`)
+        .join("\n"));
+}
+//# sourceMappingURL=scaffold-sibling-references.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.273.0-alpha.0",
+  "version": "5.274.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -44,7 +44,7 @@
   "dependencies": {
     "@aws-sdk/client-iot-data-plane": "^3.1096.0",
     "@aws-sdk/client-s3": "^3.1049.0",
-    "@indigoai-us/hq-cloud": "~6.18.13",
+    "@indigoai-us/hq-cloud": "~6.18.10",
     "@indigoai-us/hq-flags-client": "^0.1.2",
     "@sentry/node": "^10.49.0",
     "@tobilu/qmd": "2.5.3",

package/dist/commands/lanes-import.d.ts

@@ -1,14 +0,0 @@
-import type { Command } from "commander";
-import { type TrackerStore } from "../lib/lanes/tracker-store.js";
-import type { LaneCompanyRef } from "../lib/lanes/types.js";
-type WrapHandler = <Args extends unknown[]>(action: (...args: Args) => Promise<void>) => (...args: Args) => Promise<void>;
-export interface LaneTrackerImportDeps {
-    hqRoot: () => string;
-    resolveCompany: (company?: string) => Promise<LaneCompanyRef>;
-    trackerEnabled: (company: LaneCompanyRef) => boolean | Promise<boolean>;
-    now: () => Date;
-    store?: (projectDirectory: string) => TrackerStore;
-}
-export declare function registerLaneTrackerImportCommand(parent: Command, deps: LaneTrackerImportDeps, wrap: WrapHandler): void;
-export {};
-//# sourceMappingURL=lanes-import.d.ts.map