@indigoai-us/hq-cli 5.275.0 → 5.277.0

package/dist/fast-scaffold.js

@@ -1,21 +1,117 @@
 /**
- * Fast-path manifest for relocated scaffold scripts, kept deliberately
+ * Fast-path manifest for selected core commands, kept deliberately
  * dependency-light.
  *
  * `main.ts` eagerly imports the CLI's entire (~60-module) command graph, so any
  * command routed through it pays seconds of startup — fine for a human typing a
  * command, ruinous for the hot plumbing this hosts: `hq core hq-session` is
  * called several times per skill/hook, and `hq core checkpoint-stop-gate` runs
- * on every turn's Stop. The entrypoint routes those directly to
- * `runBundledScript` instead, and this module holds the tiny parser + table that
- * routing needs WITHOUT importing anything heavy. `core.ts` names the same
- * assets, and a test pins the two lists together so they cannot drift.
+ * on every turn's Stop. The entrypoint routes eligible commands before loading
+ * the graph, and this module holds the parser + table that routing needs.
  */
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export const FAST_SCAFFOLD_SCRIPTS = [
-    { name: "checkpoint-stop-gate", asset: "core/scripts/checkpoint-stop-gate.sh" },
-    { name: "hq-session", asset: "core/scripts/hq-session.sh" },
+    { name: "checkpoint-stop-gate", kind: "shell", asset: "core/scripts/checkpoint-stop-gate.sh" },
+    { name: "hq-session", kind: "shell", asset: "core/scripts/hq-session.sh" },
+    {
+        name: "timeout-guard",
+        kind: "native",
+        modulePath: "./lib/core-utils/timeout-guard-native.js",
+        exportName: "runTimeoutGuardFast",
+        flagKey: "hq-core-native-fast-route",
+    },
 ];
+/**
+ * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry
+ * fast path. Anything this parser does not understand stays with Commander in
+ * the full CLI, which remains the source of truth for help and errors.
+ */
+export function parseSecretsEnvFastRequest(argv) {
+    if (argv[2] !== "secrets")
+        return null;
+    let index = 3;
+    const scope = {};
+    let hasCompanyScope = false;
+    let hasPersonalScope = false;
+    while (index < argv.length && argv[index] !== "env") {
+        const arg = argv[index];
+        if (arg === "--company") {
+            const value = argv[index + 1];
+            if (!value || value.startsWith("-") || hasPersonalScope)
+                return null;
+            hasCompanyScope = true;
+            scope.company = value;
+            index += 2;
+            continue;
+        }
+        if (arg?.startsWith("--company=")) {
+            const value = arg.slice("--company=".length);
+            if (!value || hasPersonalScope)
+                return null;
+            hasCompanyScope = true;
+            scope.company = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--personal") {
+            if (hasCompanyScope)
+                return null;
+            hasPersonalScope = true;
+            scope.personal = true;
+            index += 1;
+            continue;
+        }
+        return null;
+    }
+    if (argv[index] !== "env")
+        return null;
+    index += 1;
+    const options = { only: [] };
+    let hasOnly = false;
+    while (index < argv.length) {
+        const arg = argv[index];
+        if (arg === "-h" || arg === "--help" || arg === "--")
+            return null;
+        let option;
+        let value;
+        if (arg === "--only" || arg === "--script" || arg === "--script-id") {
+            option = arg;
+            value = argv[index + 1];
+            if (value === undefined || value.startsWith("-"))
+                return null;
+            index += 2;
+        }
+        else if (arg?.startsWith("--only=")) {
+            option = "--only";
+            value = arg.slice("--only=".length);
+            index += 1;
+        }
+        else if (arg?.startsWith("--script=")) {
+            option = "--script";
+            value = arg.slice("--script=".length);
+            index += 1;
+        }
+        else if (arg?.startsWith("--script-id=")) {
+            option = "--script-id";
+            value = arg.slice("--script-id=".length);
+            index += 1;
+        }
+        else {
+            return null;
+        }
+        if (option === "--only") {
+            hasOnly = true;
+            options.only.push(...(value ?? "").split(",").map((key) => key.trim()).filter(Boolean));
+        }
+        else if (option === "--script") {
+            options.script = value;
+        }
+        else if (option === "--script-id") {
+            options.scriptId = value;
+        }
+    }
+    return hasOnly ? { options, scope } : null;
+}
 /**
  * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
  * fast-path script. Returns null for anything else so the caller defers to the
@@ -48,7 +144,7 @@ export function parseFastCore(argv) {
     const entry = FAST_SCAFFOLD_SCRIPTS.find((candidate) => candidate.name === name);
     if (!entry)
         return null;
-    return { asset: entry.asset, hqRootArg, args: argv.slice(i + 1) };
+    return { entry, hqRootArg, args: argv.slice(i + 1) };
 }
 /** Whether this invocation is a fast-path scaffold dispatch. */
 export function isFastCoreRequest(argv) {

package/dist/index.js

@@ -6,7 +6,7 @@ import "./node-network-compat.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.
-import { isFastCoreRequest } from "./fast-scaffold.js";
+import { isFastCoreRequest, parseFastCore, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
 // Also dependency-light: registers a process-level rejection boundary; its only
 // heavy import (main.js) is lazy and reached only when a rejection fires.
 import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.js";
@@ -30,6 +30,37 @@ if (isVersionRequest(process.argv)) {
         });
     }
 }
+else if (parseFastCore(process.argv)?.entry.kind === "native") {
+    // Native routes are default-off. Resolve the company-scoped persisted flag
+    // without loading the command graph; a miss or stale snapshot takes the
+    // existing full-graph route.
+    void import("./native-fast-route.js").then(async ({ nativeFastRouteEnabled }) => {
+        if (await nativeFastRouteEnabled(process.argv)) {
+            const { runFastCore } = await import("./fast-core.js");
+            await runFastCore(process.argv);
+        }
+        else {
+            const { runCli } = await import("./main.js");
+            await runCli();
+        }
+    });
+}
+else if (parseSecretsEnvFastRequest(process.argv)) {
+    const request = parseSecretsEnvFastRequest(process.argv);
+    void import("./secrets-env-fast-route.js").then(async (route) => {
+        await route.dispatchSecretsEnvFastRequest(request, {
+            isEnabled: () => route.secretsEnvFastRouteEnabled(request),
+            runFast: async () => {
+                const { runSecretsEnvFastPath } = await import("./secrets-env-fast-path.js");
+                return runSecretsEnvFastPath(request);
+            },
+            runCurrent: async () => {
+                const { runCli } = await import("./main.js");
+                await runCli();
+            },
+        });
+    });
+}
 else if (isFastCoreRequest(process.argv)) {
     // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
     // dispatches straight to the bundled-script runner, so it never pays for the

package/dist/lanes-drain-hook.js

@@ -1,4 +1,6 @@
-import { runDrainHook } from "./lib/lanes/dropbox.js";
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
 function parseHookInput(text) {
     if (text.trim() === "")
         return {};
@@ -24,6 +26,116 @@ function parseHookInput(text) {
         ...(typeof value.hook_event_name === "string" ? { hook_event_name: value.hook_event_name } : {}),
     };
 }
+function laneIdIsSafe(laneId) {
+    return laneId !== "" && laneId.trim() === laneId &&
+        !laneId.includes("/") && !laneId.includes("\\") &&
+        !laneId.includes("\0") && laneId !== "." && laneId !== ".." &&
+        !laneId.includes("..");
+}
+function fileExists(filePath) {
+    try {
+        fs.statSync(filePath);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+function listVisibleNames(dir) {
+    try {
+        return fs.readdirSync(dir).filter((name) => !name.startsWith("."));
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+}
+/** Return true whenever the full drainer may have work or a condition to report. */
+function dropboxMayNeedDrain(box) {
+    const inbox = path.join(box, "inbox.jsonl");
+    if (fileExists(inbox))
+        return true;
+    const draining = path.join(box, "draining");
+    if (listVisibleNames(draining).length > 0)
+        return true;
+    const inflightRoot = path.join(box, "inflight");
+    for (const name of listVisibleNames(inflightRoot)) {
+        const inflight = path.join(inflightRoot, name);
+        const stat = fs.statSync(inflight);
+        if (!stat.isDirectory())
+            return true;
+        if (listVisibleNames(inflight).length > 0)
+            return true;
+    }
+    return false;
+}
+function replayMayNeedWork(box, turnId, input) {
+    if (!/^[A-Za-z0-9-]{1,80}$/.test(turnId))
+        return false;
+    if (input.transcript_path)
+        return true;
+    let text;
+    const statePath = path.join(box, "message-compaction-replay.json");
+    try {
+        text = fs.readFileSync(statePath, "utf8");
+    }
+    catch {
+        // Keep the existing named replay error behavior for missing or unreadable state.
+        return true;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return true;
+        const state = parsed;
+        if (state.schema_version !== 1 ||
+            state.turn_id !== turnId ||
+            (state.last_compaction_marker !== null &&
+                (!Number.isSafeInteger(state.last_compaction_marker) || Number(state.last_compaction_marker) < 0)) ||
+            (state.transcript_offset !== undefined &&
+                (!Number.isSafeInteger(state.transcript_offset) || Number(state.transcript_offset) < 0)) ||
+            (state.transcript_path !== undefined && typeof state.transcript_path !== "string") ||
+            state.flag_enabled !== undefined) {
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+function recordToolActivity(hqRoot, laneId) {
+    try {
+        const activityPath = path.join(hqRoot, "workspace", "lanes-runs", laneId, "logs", "tool-activity.json");
+        fs.mkdirSync(path.dirname(activityPath), { recursive: true });
+        const record = {
+            at: new Date().toISOString(),
+            hook_pid: process.pid,
+            hook_event: "PreToolUse",
+        };
+        const tempPath = `${activityPath}.${process.pid}.${process.hrtime.bigint()}.${randomBytes(4).toString("hex")}.tmp`;
+        fs.writeFileSync(tempPath, `${JSON.stringify(record)}\n`, "utf8");
+        fs.renameSync(tempPath, activityPath);
+        return "";
+    }
+    catch (err) {
+        return `hq-lanes-drain: failed to record tool activity: ${err instanceof Error ? err.message : String(err)}\n`;
+    }
+}
+function finish(result, inputError) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (inputError || result.stderr)
+        process.stderr.write(`${inputError}${result.stderr}`);
+    process.exitCode = result.exitCode;
+}
+async function runFullPath(input, inputError) {
+    const { runDrainHook } = await import("./lib/lanes/dropbox.js");
+    finish(await runDrainHook(process.env, input), inputError);
+}
 async function main() {
     const chunks = [];
     for await (const chunk of process.stdin)
@@ -37,12 +149,47 @@ async function main() {
     catch (err) {
         inputError = `hq-lanes-drain: ${err instanceof Error ? err.message : String(err)}\n`;
     }
-    const result = await runDrainHook(process.env, input);
-    if (result.stdout)
-        process.stdout.write(result.stdout);
-    if (inputError || result.stderr)
-        process.stderr.write(`${inputError}${result.stderr}`);
-    process.exitCode = result.exitCode;
+    const laneId = process.env.HQ_LANE_ID ?? "";
+    if (laneId === "") {
+        finish({ exitCode: 0, stdout: "", stderr: "" }, inputError);
+        return;
+    }
+    const hqRoot = process.env.HQ_ROOT ?? "";
+    if (hqRoot === "" || !laneIdIsSafe(laneId)) {
+        await runFullPath(input, inputError);
+        return;
+    }
+    const box = path.join(hqRoot, "workspace", "lanes-runs", laneId, "dropbox");
+    let noWork = false;
+    try {
+        noWork = !dropboxMayNeedDrain(box) &&
+            !replayMayNeedWork(box, process.env.HQ_LANE_TURN_ID ?? "", input);
+    }
+    catch {
+        // Filesystem uncertainty must use the full path so it retains its named errors.
+    }
+    if (!noWork) {
+        await runFullPath(input, inputError);
+        return;
+    }
+    let stderr = recordToolActivity(hqRoot, laneId);
+    const directories = [
+        box,
+        path.join(box, "draining"),
+        path.join(box, "delivered"),
+        path.join(box, "inflight"),
+    ];
+    try {
+        for (const directory of directories)
+            fs.mkdirSync(directory, { recursive: true });
+    }
+    catch (err) {
+        const message = `Failed to open drop box ${box}: ${err instanceof Error ? err.message : String(err)}`;
+        stderr += `hq-lanes-drain: ${message}\n`;
+        finish({ exitCode: 1, stdout: "", stderr }, inputError);
+        return;
+    }
+    finish({ exitCode: 0, stdout: "", stderr }, inputError);
 }
 main().catch((err) => {
     process.stderr.write(`hq-lanes-drain: hook_runner_failed: ${err instanceof Error ? err.message : String(err)}\n`);

package/dist/lib/agent-kit/run/inbox.js

@@ -138,8 +138,9 @@ export async function pollInboxOnce(deps) {
     if (res.status !== 200) {
         writeComponentStatus(deps.paths, "inbox", "error");
         const url = res.url ?? agentInboxUrl(deps.apiBaseUrl, deps.agentUid);
-        const bodyText = truncateBody(res.bodyText ?? (res.body === undefined ? "" : JSON.stringify(res.body)));
-        deps.log("warn", `inbox poll GET ${url} → ${res.status}${bodyText ? ` body=${bodyText}` : ""}`);
+        // Non-OK bodies are not constrained to an error envelope and could carry
+        // inbox items. Keep the status and route, but do not copy the body to logs.
+        deps.log("warn", `inbox poll GET ${url} → ${res.status}`);
         return { ok: false, mirrored: 0 };
     }
     writeComponentStatus(deps.paths, "inbox", "ok");

package/dist/lib/billing/plan-lock.d.ts

@@ -125,7 +125,9 @@ export declare const HARD_STOP_SENTENCE: string;
  * dimension this CLI does not know) renders a generic line rather than a claim
  * about a dimension nobody measured.
  */
-export declare function renderPlanLimitNotice(status: PlanLimitStatus): string;
+export declare function renderPlanLimitNotice(status: PlanLimitStatus, opts?: {
+    inviteTeammateEnabled?: boolean;
+}): string;
 /**
  * The one-line form injected on every turn while the workspace stays over.
  * Kept to a single line on purpose — it repeats each turn.

package/dist/lib/billing/plan-lock.js

@@ -375,7 +375,7 @@ function capitalize(text) {
  * dimension this CLI does not know) renders a generic line rather than a claim
  * about a dimension nobody measured.
  */
-export function renderPlanLimitNotice(status) {
+export function renderPlanLimitNotice(status, opts = {}) {
     const { companySlug, freeMonth } = status;
     const lines = [];
     lines.push(`HQ Starter — ${companySlug} is over its plan limits.`);
@@ -405,6 +405,12 @@ export function renderPlanLimitNotice(status) {
         lines.push(`    2. Upgrade to ${WORKFORCE_PLAN_LABEL}.`);
     }
     lines.push(`  Upgrade: ${status.upgradeUrl}`);
+    if (opts.inviteTeammateEnabled === true &&
+        status.plan === "free" &&
+        status.over &&
+        status.members?.used === 1) {
+        lines.push(`  Invite a teammate with: hq members invite <email> --company ${companySlug} --role member`);
+    }
     return lines.join("\n");
 }
 /**

package/dist/lib/checkpoint-ontology/apply.d.ts

@@ -53,6 +53,12 @@ export interface ApplyReport {
         canonical_name: string;
         path: string;
     }>;
+    /** Present only when `checkpoint.ontology.dominant-sibling-link` was on: knowledge links moved from a weak sibling to the dominant one. */
+    dominant_sibling_redirects?: Array<{
+        input: string;
+        from: string;
+        to: string;
+    }>;
     rejected: Array<{
         input: string;
         type: string;

package/dist/lib/checkpoint-ontology/apply.js

@@ -16,7 +16,7 @@ import { checkSyncClient, readSyncClientVersions } from "./sync-client.js";
 import { appendBackRefs, parseEntityFile, patchEntityFile, previewSignalContent, renderNewEntity, validateEntityFrontmatter, } from "./entity-file.js";
 import { canonicalizeName, entityId, isRejectedName, isWritableEntityType, normalizeEntityName, squash, toSlug, } from "./identity.js";
 import { CANDIDATES_FILE, CANDIDATES_SCHEMA, PLAN_FILE, PLAN_SCHEMA, REPORT_FILE, readLedger, writeLedger, } from "./plan.js";
-import { buildEntityIndex, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
+import { buildEntityIndex, countInboundLinks, indexAlias, indexEntity, listSignalFiles, readSignal } from "./tree.js";
 export const CAPS = {
     creates: 25,
     updates: 100,
@@ -26,6 +26,10 @@ export const CAPS = {
     nameLength: MAX_NAME_LENGTH,
 };
 export const MIN_CREATE_CONFIDENCE = 0.7;
+/** Inbound links the dominant sibling must have for each one the named entity has. */
+const DOMINANT_SIBLING_RATIO = 3;
+/** Inbound links the dominant sibling must have before a redirect. */
+const DOMINANT_SIBLING_MIN_INBOUND = 5;
 export class ApplyError extends Error {
     constructor(message) {
         super(message);
@@ -211,6 +215,7 @@ export function applyOntologyRun(options) {
         matched: 0,
         session_links: [],
         links: [],
+        ...(plan.dominant_sibling_link === true ? { dominant_sibling_redirects: [] } : {}),
         rejected: [],
         deferred: [],
         suspect_duplicates: [],
@@ -300,6 +305,44 @@ export function applyOntologyRun(options) {
             if (types.size > 1)
                 crossTypeNames.add(name);
     }
+    // checkpoint.ontology.dominant-sibling-link: cross-type names, and how many other entity files link to each.
+    const inbound = plan.dominant_sibling_link === true ? countInboundLinks(company.dir, index) : new Map();
+    const siblings = new Map();
+    if (plan.dominant_sibling_link === true) {
+        const grouped = new Map();
+        for (const entity of index.byRel.values()) {
+            const key = crossTypeKey(entity.canonical_name);
+            if (key === "")
+                continue;
+            const members = grouped.get(key) ?? [];
+            members.push({ rel: entity.rel, type: entity.type });
+            grouped.set(key, members);
+        }
+        for (const [key, members] of grouped) {
+            if (new Set(members.map((member) => member.type)).size < 2)
+                continue;
+            siblings.set(key, members.map((member) => member.rel));
+        }
+    }
+    const dominantSibling = (rel) => {
+        const group = siblings.get(crossTypeKey(index.byRel.get(rel).canonical_name));
+        if (!group)
+            return null;
+        let best = group[0];
+        for (const member of group) {
+            const count = inbound.get(member) ?? 0;
+            const bestCount = inbound.get(best) ?? 0;
+            if (count > bestCount || (count === bestCount && member.localeCompare(best) < 0))
+                best = member;
+        }
+        const relCount = inbound.get(rel) ?? 0;
+        const bestCount = inbound.get(best) ?? 0;
+        if (relCount >= bestCount)
+            return null;
+        if (bestCount >= DOMINANT_SIBLING_RATIO * relCount && bestCount >= DOMINANT_SIBLING_MIN_INBOUND)
+            return best;
+        return null;
+    };
     // checkpoint.ontology.named-evidence: the company's own company entity.
     const ownCompanyRel = `ontology/entities/company/${company.slug}.md`;
     const isOwnCompany = (entity, rel) => entity.type === "company" && (rel === ownCompanyRel || crossTypeKey(entity.canonical_name) === crossTypeKey(company.slug));
@@ -361,19 +404,33 @@ export function applyOntologyRun(options) {
                 note(report.rejected, "ambiguous_type");
                 continue;
             }
+            const redirect = input.kind === "knowledge" && plan.dominant_sibling_link === true ? dominantSibling(resolved.target) : null;
+            const targetRel = redirect ?? resolved.target;
+            const targetEntity = redirect ? index.byRel.get(targetRel) : linked;
             if (plan.named_evidence === true &&
                 input.kind === "knowledge" &&
-                isOwnCompany(linked, resolved.target) &&
+                isOwnCompany(targetEntity, targetRel) &&
                 !evidenceNames(candidate.evidence, [candidate.name, ...candidate.aliases])) {
                 note(report.rejected, "unnamed_in_evidence");
                 continue;
             }
             report.matched += 1;
-            report.links.push({ input: candidate.input, action: "link", type: linked.type, canonical_name: linked.canonical_name, path: resolved.target });
+            report.links.push({
+                input: candidate.input,
+                action: "link",
+                type: targetEntity.type,
+                canonical_name: targetEntity.canonical_name,
+                path: targetRel,
+            });
             if (resolved.tier === 1 && resolved.duplicates.length > 0) {
                 report.suspect_duplicates.push({ name: canonical, type: candidate.type, paths: [resolved.target, ...resolved.duplicates] });
+            }
+            if (redirect) {
+                report.dominant_sibling_redirects?.push({ input: candidate.input, from: resolved.target, to: targetRel });
                 continue;
             }
+            if (resolved.tier === 1 && resolved.duplicates.length > 0)
+                continue;
             // checkpoint.ontology.no-link-aliases: the link is reported and the entity file is left as it is.
             if (plan.link_aliases === false)
                 continue;

package/dist/lib/checkpoint-ontology/company.d.ts

@@ -29,10 +29,14 @@ export declare class WriteBoundsError extends Error {
     constructor(message: string);
 }
 /**
- * Write `content` to `target` only when it stays inside one of `roots` with no
- * symlink anywhere between `anchor` (the HQ root) and the file. A root or a
- * directory under it that is a symlink fails closed, and so does a target that
- * is itself a symlink. Missing directories are created only after that check.
+ * Resolve `target` only when it stays inside one of `roots` with no symlink
+ * anywhere between `anchor` (the HQ root) and the file. A root or a directory
+ * under it that is a symlink fails closed, and so does a target that is itself
+ * a symlink. Missing directories are created only after that check.
+ */
+export declare function assertSafeTarget(anchor: string, roots: string[], target: string): string;
+/**
+ * Write `content` to `target` only when {@link assertSafeTarget} accepts it.
  * The file is written to a temporary sibling and renamed, so a reader never
  * sees half a file.
  */

package/dist/lib/checkpoint-ontology/company.js

@@ -71,14 +71,12 @@ function nearestExisting(target) {
     return current;
 }
 /**
- * Write `content` to `target` only when it stays inside one of `roots` with no
- * symlink anywhere between `anchor` (the HQ root) and the file. A root or a
- * directory under it that is a symlink fails closed, and so does a target that
- * is itself a symlink. Missing directories are created only after that check.
- * The file is written to a temporary sibling and renamed, so a reader never
- * sees half a file.
+ * Resolve `target` only when it stays inside one of `roots` with no symlink
+ * anywhere between `anchor` (the HQ root) and the file. A root or a directory
+ * under it that is a symlink fails closed, and so does a target that is itself
+ * a symlink. Missing directories are created only after that check.
  */
-export function safeWriteFile(anchor, roots, target, content) {
+export function assertSafeTarget(anchor, roots, target) {
     const resolved = path.resolve(target);
     const root = roots.map((candidate) => path.resolve(candidate)).find((candidate) => isInside(candidate, resolved));
     if (!root)
@@ -103,6 +101,16 @@ export function safeWriteFile(anchor, roots, target, content) {
         if (error.code !== "ENOENT")
             throw error;
     }
+    return path.resolve(target);
+}
+/**
+ * Write `content` to `target` only when {@link assertSafeTarget} accepts it.
+ * The file is written to a temporary sibling and renamed, so a reader never
+ * sees half a file.
+ */
+export function safeWriteFile(anchor, roots, target, content) {
+    const resolved = assertSafeTarget(anchor, roots, target);
+    const parent = path.dirname(resolved);
     const tmp = path.join(parent, `.${path.basename(resolved)}.${process.pid}.tmp`);
     fs.writeFileSync(tmp, content);
     fs.renameSync(tmp, resolved);

package/dist/lib/checkpoint-ontology/plan.d.ts

@@ -70,6 +70,17 @@ export declare const FIRST_NAME_PEOPLE_FLAG = "checkpoint.ontology.first-name-pe
  * to 0.803 and cost recall 0.023 on a replay of six runs.
  */
 export declare const SKIP_AMBIGUOUS_CONCEPT_LINKS_FLAG = "checkpoint.ontology.skip-ambiguous-concept-links";
+/**
+ * A knowledge link to the weaker of two entities that share a canonical name
+ * across types is redirected to the sibling other entity files link to
+ * (`project/build-your-own-agi` beside `concept/build-your-own-agi`, or
+ * `project/hq-core 2` beside `project/hq-core` when a concept also holds the
+ * name). The plan carries `dominant_sibling_link: true`, and apply reports
+ * the move in `dominant_sibling_redirects` without writing the entity files.
+ * CO-60: a replay of six runs raised knowledge precision from 0.725 to 0.754
+ * and recall from 0.784 to 0.816, and never changed a create.
+ */
+export declare const DOMINANT_SIBLING_LINK_FLAG = "checkpoint.ontology.dominant-sibling-link";
 /**
  * A knowledge concept candidate whose name is an alias of more than one
  * entity, and which apply would defer as `ambiguous_alias`, links instead to
@@ -94,6 +105,15 @@ export declare const CONCEPT_PROJECT_LINK_FLAG = "checkpoint.ontology.concept-pr
  * and lost no gold link.
  */
 export declare const NAMED_EVIDENCE_FLAG = "checkpoint.ontology.named-evidence";
+/**
+ * CO-59: consume the files touched by company checkpoints that were queued
+ * behind a busy sibling (see queued-touches.ts). On, the plan adds the
+ * company's queued touches to this run's session-touched set, and a run whose
+ * own payload names no company plans the company the parent picked for it
+ * (`ontology_company`), without that run's session text. Off, queued touches
+ * wait on disk and a company-less run skips the ontology step as before.
+ */
+export declare const QUEUED_TOUCHES_FLAG = "checkpoint.ontology.queued-touches";
 export declare const PLAN_FILE = "ontology-plan.json";
 export declare const CANDIDATES_FILE = "ontology-candidates.json";
 export declare const REPORT_FILE = "ontology-report.json";
@@ -164,6 +184,8 @@ export interface OntologyPlan {
     first_name_people?: true;
     /** Set by checkpoint.ontology.skip-ambiguous-concept-links: apply rejects a knowledge link to a concept whose name another type also holds. */
     skip_ambiguous_concept_links?: true;
+    /** Set by checkpoint.ontology.dominant-sibling-link: apply redirects a knowledge link from a weak cross-type sibling to the one other files link to. */
+    dominant_sibling_link?: true;
     /** Set by checkpoint.ontology.concept-project-link: apply links a knowledge concept with an ambiguous alias to the one project of that canonical name. */
     concept_project_link?: true;
     /** Set by checkpoint.ontology.named-evidence: apply rejects a knowledge link to the company's own entity, or a concept-project-link redirect, whose evidence does not name it as a word. */
@@ -183,6 +205,11 @@ export interface OntologyPlan {
 }
 export interface CheckpointPayloadLike {
     company?: unknown;
+    /**
+     * Set by `hq core checkpoint` only when the payload names no company and
+     * another company has queued touches (CO-59). Never scopes anything else.
+     */
+    ontology_company?: unknown;
     /** The sibling backend `hq core checkpoint` spawned for this payload. */
     backend?: unknown;
     files?: unknown;
@@ -234,6 +261,15 @@ export declare function refreshLedger(company: OntologyCompany, existing: Ledger
     ledger: Ledger;
     firstRun: boolean;
 };
+/**
+ * The company this run's ontology step works on: the payload's own company,
+ * or else the `ontology_company` the checkpoint parent picked for queued
+ * touches (`borrowed`).
+ */
+export declare function payloadOntologyCompany(payload: CheckpointPayloadLike): {
+    slug: string | null;
+    borrowed: boolean;
+};
 /** Plan this run. Never throws for a skip; returns the reason instead. */
 export declare function planOntologyRun(options: PlanOptions): Promise<PlanOutcome>;
 /**