@indigoai-us/hq-cli 5.276.0 → 5.278.0

package/assets/scaffold/core/scripts/hq-delegate-transfer.sh

@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+# hq-core: public
+# hq-delegate-transfer.sh — make a delegation real everywhere HQ tracks
+# ownership: board entry, PRD metadata, work mesh, and the project journal.
+#
+# Usage:
+#   core/scripts/hq-delegate-transfer.sh --manifest <path>
+#
+# Behavior (mode "transfer"; mode "share" skips every mutation):
+#   1. companies/<co>/board.json — the project's entry gets owner=<recipient>
+#      and a bumped updated_at; created (once) if absent
+#   2. prd.json metadata gains owner, delegatedFrom, delegatedAt
+#   3. work-mesh: `done` event closes the delegator's in-progress thread and
+#      broadcasts the reassignment; silently skipped when the helper is
+#      unavailable (local/offline installs) — the transfer still succeeds
+#   4. a dated "Delegated" stanza is appended to the project journal naming
+#      the recipient, delegation id, and transferred scope
+#
+# Idempotent: re-running updates owner/timestamps in place — never a
+# duplicate board entry, never a duplicated journal stanza.
+#
+# The delegator's own vault access is untouched (granting the recipient
+# write does not revoke anything).
+#
+# Env: HQ_ROOT — HQ root override (default: resolved from script location)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+
+usage() { sed -n '3,25p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
+die()   { echo "hq-delegate-transfer: $*" >&2; exit 1; }
+
+command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
+
+MANIFEST=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --manifest) MANIFEST="${2:-}"; shift 2 ;;
+    -h|--help)  usage; exit 0 ;;
+    *) die "unknown argument: $1" ;;
+  esac
+done
+
+[ -n "$MANIFEST" ] || die "--manifest is required"
+[ -f "$MANIFEST" ] || die "manifest not found: $MANIFEST"
+jq -e . "$MANIFEST" >/dev/null 2>&1 || die "manifest is not valid JSON: $MANIFEST"
+
+MODE="$(jq -r '.mode // "transfer"' "$MANIFEST")"
+COMPANY="$(jq -r '.company // empty' "$MANIFEST")"
+PROJECT="$(jq -r '.project.name // empty' "$MANIFEST")"
+PRINCIPAL="$(jq -r '.to.principal // empty' "$MANIFEST")"
+DISPLAY="$(jq -r '.to.displayName // .to.principal // empty' "$MANIFEST")"
+DELEGATION_ID="$(jq -r '.delegationId // empty' "$MANIFEST")"
+FROM="$(jq -r '.from.email // .from.personUid // "unknown"' "$MANIFEST")"
+[ -n "$COMPANY" ]   || die "manifest has no company"
+[ -n "$PROJECT" ]   || die "manifest has no project.name"
+[ -n "$PRINCIPAL" ] || die "manifest has no to.principal"
+
+if [ "$MODE" = "share" ]; then
+  echo "hq-delegate-transfer: mode is 'share' — ownership stays with the delegator, nothing mutated"
+  exit 0
+fi
+
+jq -e '.status == "granted"' "$MANIFEST" >/dev/null || die "transfer requires confirmed grants (status granted)"
+[ "$FROM" != "unknown" ] && [ -n "$FROM" ] || die "sender identity missing; rebuild the bundle"
+NOW="$(jq -r '.ownershipTransferredAt // empty' "$MANIFEST")"
+[ -n "$NOW" ] || NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+TODAY="$(date -u +%Y-%m-%d)"
+PRD_PATH="companies/$COMPANY/projects/$PROJECT/prd.json"
+PRD_ABS="$HQ_ROOT/$PRD_PATH"
+PROJECT_DIR="$HQ_ROOT/companies/$COMPANY/projects/$PROJECT"
+BOARD="$HQ_ROOT/companies/$COMPANY/board.json"
+
+[ -f "$PRD_ABS" ] || die "prd not found: $PRD_PATH"
+
+# --- 1. board entry: update in place, create once if absent ------------------
+
+if [ -f "$BOARD" ]; then
+  jq -e . "$BOARD" >/dev/null 2>&1 || die "board.json is not valid JSON: $BOARD"
+else
+  echo '{"projects": []}' > "$BOARD"
+fi
+
+TITLE="$(jq -r '.name // empty' "$PRD_ABS")"
+DESC="$(jq -r '.description // ""' "$PRD_ABS" | head -c 300)"
+
+TMP_BOARD="$(mktemp)"
+jq \
+  --arg prd "$PRD_PATH" \
+  --arg owner "$PRINCIPAL" \
+  --arg now "$NOW" \
+  --arg title "$TITLE" \
+  --arg desc "$DESC" \
+  --arg project "$PROJECT" \
+  '
+  if ([.projects // [] | .[] | select(.prd_path == $prd)] | length) > 0 then
+    .projects = [.projects[] |
+      if .prd_path == $prd then .owner = $owner | .updated_at = $now else . end]
+  else
+    .projects = (.projects // []) + [{
+      id: ("proj-" + $project),
+      title: $title,
+      description: $desc,
+      status: "in_progress",
+      owner: $owner,
+      prd_path: $prd,
+      created_at: $now,
+      updated_at: $now
+    }]
+  end
+  | .updated_at = $now
+  ' "$BOARD" > "$TMP_BOARD" && mv "$TMP_BOARD" "$BOARD"
+
+# --- 2. prd metadata ----------------------------------------------------------
+
+TMP_PRD="$(mktemp)"
+jq \
+  --arg owner "$PRINCIPAL" \
+  --arg from "$FROM" \
+  --arg now "$NOW" \
+  '.metadata.owner = $owner
+   | .metadata.delegatedFrom = $from
+   | .metadata.delegatedAt = $now' \
+  "$PRD_ABS" > "$TMP_PRD" && mv "$TMP_PRD" "$PRD_ABS"
+
+# --- 3. work mesh: close the delegator's thread, broadcast reassignment ------
+# Silently tolerated when unavailable (local/offline installs no-op).
+
+if command -v hq >/dev/null 2>&1; then
+  # `--session-id` is the CLI option (hq-cli 5.157+ rejects `--session` with
+  # "unknown option"); --company-slug/--project attribute the note to the
+  # delegated project.
+  hq mesh session note --enqueue --session-id "${HQ_SESSION_ID:-delegate}" --seq 1 \
+    --harness claude-code --adapter-version 1.0.0 \
+    --company-slug "$COMPANY" --project "$PROJECT" \
+    --summary "Delegated to $DISPLAY ($PRINCIPAL) — delegation $DELEGATION_ID; ownership transferred" \
+    || echo "hq-delegate-transfer: mesh note failed; authoritative mesh ownership remains unconfirmed" >&2
+fi
+
+# --- 4. journal: one dated stanza per delegation id --------------------------
+
+JOURNAL_DIR="$PROJECT_DIR/journal"
+JOURNAL_FILE="$JOURNAL_DIR/delegations.md"
+mkdir -p "$JOURNAL_DIR"
+if [ ! -f "$JOURNAL_FILE" ]; then
+  {
+    echo "# Delegation log — $PROJECT"
+    echo
+    echo "Ownership handoffs for this project, appended by /delegate."
+  } > "$JOURNAL_FILE"
+fi
+
+if ! grep -qF "$DELEGATION_ID" "$JOURNAL_FILE"; then
+  SCOPE="$(jq -r '[.vaultPrefixes // [] | .[] | .prefix] | join(", ")' "$MANIFEST")"
+  {
+    echo
+    echo "## $TODAY — Delegated to $DISPLAY"
+    echo
+    echo "- Delegation: \`$DELEGATION_ID\`"
+    echo "- From: $FROM"
+    echo "- To: $DISPLAY ($PRINCIPAL)"
+    echo "- Transferred scope: $SCOPE"
+    echo "- Local board and PRD ownership updated; Work Mesh ownership is unconfirmed. Existing delegator access is unchanged."
+  } >> "$JOURNAL_FILE"
+fi
+
+# --- record on the manifest ---------------------------------------------------
+
+TMP_MANIFEST="$(mktemp)"
+jq --arg now "$NOW" '.ownershipTransferredAt = $now | .workMeshOwnership = "unconfirmed"' "$MANIFEST" > "$TMP_MANIFEST" \
+  && mv "$TMP_MANIFEST" "$MANIFEST"
+
+echo "hq-delegate-transfer: ownership of '$PROJECT' transferred to $DISPLAY ($PRINCIPAL) — local board, PRD, and journal updated; Work Mesh ownership unconfirmed"

package/assets/scaffold/core/scripts/lib/secret-patterns.sh

@@ -0,0 +1,58 @@
+# shellcheck shell=bash
+# hq-core: public
+# secret-patterns.sh — shared secret-detection patterns for hq-core shell scripts.
+#
+# SOURCED, never executed:  . "$ROOT/core/scripts/lib/secret-patterns.sh"
+# bash 3.2 safe; no associative arrays.
+#
+# Single source of truth for the secret-shaped patterns that generated
+# artifacts (delegation manifests, briefs, pickup prompts, DM payloads) are
+# scanned against before they are written to disk or transmitted. Mirrors the
+# runtime PreToolUse hook at .claude/hooks/detect-secrets.sh — a regression
+# test (core/scripts/tests/hq-delegate-bundle.test.sh) asserts this list stays
+# a superset of the hook's, so the two cannot silently drift.
+#
+# Entries are "<extended-regex>:<human name>". The regex part may not contain
+# a colon; the name may.
+#
+# Entries are the bare token patterns. SECRET_PATTERN_BOUNDARY below is
+# prepended at match time -- keep them in this form so they stay comparable
+# verbatim with the runtime hook's array (see the drift test named above).
+
+# Left token boundary. Without it the sk- pattern matches mid-word and ordinary
+# HQ filenames (a-ri|sk-..., hq-ta|sk-..., controller-di|sk-...) scan as
+# credentials. Mirrors SECRET_BOUNDARY in .claude/hooks/detect-secrets.sh.
+SECRET_PATTERN_BOUNDARY='(^|[^a-zA-Z0-9])'
+
+SECRET_PATTERNS=(
+  "sk-[a-zA-Z0-9._-]{20,}:OpenAI/Stripe key"
+  "ghp_[a-zA-Z0-9]{36,}:GitHub PAT"
+  "AKIA[0-9A-Z]{16}:AWS access key"
+  "xox[bpsa]-[a-zA-Z0-9-]+:Slack token"
+  "Bearer [a-zA-Z0-9._-]{20,}:Bearer token"
+  "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----:Private key"
+  "glpat-[a-zA-Z0-9_-]{20,}:GitLab PAT"
+  "gho_[a-zA-Z0-9]{36,}:GitHub OAuth token"
+  "github_pat_[a-zA-Z0-9_]{22,}:Fine-grained GitHub PAT"
+  "eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{10,}:JWT"
+)
+
+# hq_scan_secrets <file>...
+#   Scan files for secret-shaped content. Prints "pattern: <name> in <file>"
+#   to stderr for every hit (never the matched value itself) and returns 1 if
+#   anything matched, 0 when all files are clean. Missing files are skipped.
+hq_scan_secrets() {
+  local hit=0 f entry pattern name
+  for f in "$@"; do
+    [ -f "$f" ] || continue
+    for entry in "${SECRET_PATTERNS[@]}"; do
+      pattern="${SECRET_PATTERN_BOUNDARY}${entry%%:*}"
+      name="${entry#*:}"
+      if grep -Eq -- "$pattern" "$f" 2>/dev/null; then
+        echo "secret-scan: pattern '$name' matched in $f" >&2
+        hit=1
+      fi
+    done
+  done
+  return "$hit"
+}

package/dist/command-catalog.generated.d.ts

@@ -5224,6 +5224,80 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "print the result as JSON";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "delegate";
+        readonly description: "Delegation handover helpers";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "resolve";
+            readonly description: "Resolve a delegation recipient to a confirmed principal";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "pickup";
+            readonly description: "Record or check evidence that a recipient picked up a delegation";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "repo";
+            readonly description: "Prepare and record repository handover state";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "secrets";
+            readonly description: "Grant a recipient access to declared secret names";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "transfer";
+            readonly description: "Transfer local project ownership to a delegation recipient";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "generate-workers-registry";
         readonly description: "Regenerate the derived workers registry";
@@ -7447,6 +7521,31 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Emit JSON on stdout (default)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "set";
+        readonly description: "Change the model or effort a lane uses from its next resume";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--model <model>";
+            readonly description: "Model for the lane's next and later turns";
+        }, {
+            readonly flags: "--effort <level>";
+            readonly description: "Effort for the lane's next and later turns";
+        }, {
+            readonly flags: "--reason <text>";
+            readonly description: "Why the settings changed; recorded in settings_history";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Emit JSON on stdout (default)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "grant";
         readonly description: "Set a lane's alive child-lane grant as its senior";
@@ -7509,6 +7608,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--senior <ref>";
             readonly description: "Filter by senior ref";
+        }, {
+            readonly flags: "--lane <id>";
+            readonly description: "Filter by lane id (repeatable)";
+        }, {
+            readonly flags: "--active";
+            readonly description: "Include only lanes that are not terminal";
         }, {
             readonly flags: "--json";
             readonly description: "Emit JSON on stdout (default)";
@@ -8062,7 +8167,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "stop";
-        readonly description: "Cancel a queued lane or kill a running one";
+        readonly description: "Cancel a queued lane or kill a running one (terminal; use interrupt to keep it resumable)";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <lane-id>";
@@ -8079,6 +8184,25 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "interrupt";
+        readonly description: "Stop a running lane's turn and keep it resumable with hq lanes resume";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--reason <text>";
+            readonly description: "Record the reason in the lane's stop history";
+        }, {
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "approve";
         readonly description: "Record senior approval for a registry worker checkpoint";
@@ -8732,6 +8856,120 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Print machine-readable JSON";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "sync";
+        readonly description: "Inspect and control the daemon's company sync runner";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "status";
+            readonly description: "Show sync ownership, heartbeat, last pass and log path";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "now";
+            readonly description: "Start a fresh sync pass immediately";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "pause";
+            readonly description: "Pause daemon sync until resumed";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "resume";
+            readonly description: "Resume daemon sync after a pause";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "take-ownership";
+            readonly description: "Persist daemon ownership of desktop sync and reconcile";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print machine-readable JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "mode";
+            readonly description: "Read or change a company's sync footprint";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] [command]";
+            readonly arguments: readonly [];
+            readonly options: readonly [];
+            readonly subcommands: readonly [{
+                readonly name: "get";
+                readonly description: "Read a company's current all/shared sync mode";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly usage: "[options] <company>";
+                readonly arguments: readonly [{
+                    readonly name: "company";
+                    readonly required: true;
+                    readonly variadic: false;
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--json";
+                    readonly description: "Print machine-readable JSON";
+                }];
+                readonly subcommands: readonly [];
+            }, {
+                readonly name: "set";
+                readonly description: "Set a company's sync mode to all or shared";
+                readonly aliases: readonly [];
+                readonly hidden: false;
+                readonly usage: "[options] <company> <mode>";
+                readonly arguments: readonly [{
+                    readonly name: "company";
+                    readonly required: true;
+                    readonly variadic: false;
+                }, {
+                    readonly name: "mode";
+                    readonly required: true;
+                    readonly variadic: false;
+                }];
+                readonly options: readonly [{
+                    readonly flags: "--json";
+                    readonly description: "Print machine-readable JSON";
+                }];
+                readonly subcommands: readonly [];
+            }];
+        }];
     }, {
         readonly name: "logs";
         readonly description: "Print the supervisor log, or one service's log";