@indigoai-us/hq-cli 5.290.0 → 5.291.0

package/dist/commands/core-jobs-native.js

@@ -0,0 +1,624 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { JSON_SCHEMA, load, loadAll } from "js-yaml";
+import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { describeCoreCommand } from "./core-command-catalog.js";
+import { coreNativeJobsEnabled } from "./core-native-jobs-flag.js";
+const SCHEDULE_PARSE_ASSET = "core/scripts/jobs-schedule-parse.sh";
+const VALIDATE_ASSET = "core/scripts/jobs-validate.sh";
+const SCHEDULE_PARSE_USAGE = 'usage: jobs-schedule-parse.sh [--tz IANA] "<nl or cron schedule>"\n';
+const VALIDATE_USAGE = "usage: jobs-validate.sh <file-or-dir> [file-or-dir...]\n";
+const CRON_RE = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$/;
+const DAY_NAMES = {
+    sun: 0, sunday: 0, mon: 1, monday: 1, tue: 2, tues: 2, tuesday: 2,
+    wed: 3, wednesday: 3, thu: 4, thur: 4, thurs: 4, thursday: 4,
+    fri: 5, friday: 5, sat: 6, saturday: 6,
+};
+const DAY_LABELS = {
+    "0": "Sunday", "1": "Monday", "2": "Tuesday", "3": "Wednesday",
+    "4": "Thursday", "5": "Friday", "6": "Saturday", "1-5": "weekday",
+    "*": "day",
+};
+function parseClock(text) {
+    const match = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)?$/i.exec(text.trim().toLowerCase().replace(/ /g, ""));
+    if (!match)
+        return undefined;
+    let hour = Number.parseInt(match[1], 10);
+    const minute = Number.parseInt(match[2] || "0", 10);
+    const meridiem = match[3];
+    if (minute > 59)
+        return undefined;
+    if (meridiem) {
+        if (hour < 1 || hour > 12)
+            return undefined;
+        hour = meridiem === "am"
+            ? (hour === 12 ? 0 : hour)
+            : (hour === 12 ? 12 : hour + 12);
+    }
+    else if (hour > 23) {
+        return undefined;
+    }
+    return [hour, minute];
+}
+function formatClock(hour, minute) {
+    const hour12 = hour % 12 || 12;
+    return `${hour12}:${String(minute).padStart(2, "0")} ${hour < 12 ? "AM" : "PM"}`;
+}
+function humanizeCron(cron, timezone) {
+    const fields = cron.split(/\s+/);
+    if (fields.length !== 5)
+        return `Cron \`${cron}\` (${timezone})`;
+    const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
+        && month === "*" && (dayOfWeek === "*" || dayOfWeek === "1-5")) {
+        const day = dayOfWeek === "1-5" ? "Every weekday" : "Every day";
+        return `${day} at ${formatClock(+hour, +minute)} (${timezone})`;
+    }
+    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
+        && month === "*" && /^\d+$/.test(dayOfWeek)) {
+        const day = DAY_LABELS[dayOfWeek] || `day ${dayOfWeek}`;
+        return `Every ${day} at ${formatClock(+hour, +minute)} (${timezone})`;
+    }
+    if (minute.startsWith("*/") && hour === "*" && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every ${minute.slice(2)} minutes (${timezone})`;
+    }
+    if (minute === "0" && hour.startsWith("*/") && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every ${hour.slice(2)} hours (${timezone})`;
+    }
+    if (minute === "0" && hour === "*" && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every hour on the hour (${timezone})`;
+    }
+    return `Cron \`${cron}\` (${timezone})`;
+}
+function parseNaturalLanguage(text) {
+    const normalized = text.trim().toLowerCase();
+    let match = /^every\s+(\d+)\s+minutes?$/.exec(normalized);
+    if (match) {
+        const minutes = Number(match[1]);
+        if (minutes < 1 || minutes > 59)
+            return [null, "minute interval must be 1..59"];
+        return [`*/${minutes} * * * *`, `Every ${minutes} minutes`];
+    }
+    if (normalized === "every hour" || normalized === "hourly") {
+        return ["0 * * * *", "Every hour on the hour"];
+    }
+    match = /^every\s+(\d+)\s+hours?$/.exec(normalized);
+    if (match) {
+        const hours = Number(match[1]);
+        if (hours < 1 || hours > 23)
+            return [null, "hour interval must be 1..23"];
+        return [`0 */${hours} * * *`, `Every ${hours} hours`];
+    }
+    match = /^(?:every\s+)?(weekday|weekdays|day|daily)\s+(?:at\s+)?(.+)$/.exec(normalized);
+    if (match) {
+        const clock = parseClock(match[2]);
+        if (!clock)
+            return [null, `could not parse time: ${match[2]}`];
+        const [hour, minute] = clock;
+        const weekdays = match[1] === "weekday" || match[1] === "weekdays";
+        return [
+            `${minute} ${hour} * * ${weekdays ? "1-5" : "*"}`,
+            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(hour, minute)}`,
+        ];
+    }
+    match = /^(?:every\s+)?(sun(?:day)?|mon(?:day)?|tue(?:s|sday)?|wed(?:nesday)?|thu(?:r|rs|rsday)?|fri(?:day)?|sat(?:urday)?)s?\s+(?:at\s+)?(.+)$/.exec(normalized);
+    if (match) {
+        const day = DAY_NAMES[match[1]];
+        const clock = parseClock(match[2]);
+        if (!clock)
+            return [null, `could not parse time: ${match[2]}`];
+        return [
+            `${clock[1]} ${clock[0]} * * ${day}`,
+            `Every ${DAY_LABELS[String(day)]} at ${formatClock(...clock)}`,
+        ];
+    }
+    match = /^at\s+(.+?)\s+every\s+(weekday|weekdays|day|daily)$/.exec(normalized);
+    if (match) {
+        const clock = parseClock(match[1]);
+        if (!clock)
+            return [null, `could not parse time: ${match[1]}`];
+        const weekdays = match[2] === "weekday" || match[2] === "weekdays";
+        return [
+            `${clock[1]} ${clock[0]} * * ${weekdays ? "1-5" : "*"}`,
+            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(...clock)}`,
+        ];
+    }
+    return [
+        null,
+        "unrecognized schedule — try 'every weekday at 9am', 'every day at 14:30', "
+            + "'every monday at 9am', a 5-field cron, or 'every 15 minutes'",
+    ];
+}
+function isValidTimezone(timezone) {
+    const wellFormed = /^(UTC|[A-Za-z0-9_+-]+(\/[A-Za-z0-9_+-]+)+)$/;
+    if (!wellFormed.test(timezone))
+        return false;
+    try {
+        new Intl.DateTimeFormat(undefined, { timeZone: timezone });
+        return true;
+    }
+    catch {
+        // Hosts without tzdata accept the same well-formed names as the shell.
+        return wellFormed.test(timezone);
+    }
+}
+export function detectHostTimezone(override, resolveLocaltime = fs.realpathSync, readTimedatectl = () => {
+    const result = spawnSync("timedatectl", ["show", "-p", "Timezone", "--value"], { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] });
+    if (result.error || result.status !== 0)
+        return "";
+    return result.stdout || "";
+}) {
+    if (override)
+        return override;
+    const environmentTimezone = (process.env.TZ || "").trim();
+    if (environmentTimezone && environmentTimezone.includes("/"))
+        return environmentTimezone;
+    try {
+        const realpath = resolveLocaltime("/etc/localtime");
+        const parts = realpath.split(path.sep).filter(Boolean);
+        const zoneinfo = parts.indexOf("zoneinfo");
+        if (zoneinfo >= 0 && parts.slice(zoneinfo + 1).length) {
+            return parts.slice(zoneinfo + 1).join("/");
+        }
+    }
+    catch {
+        // Ignore an unavailable local timezone link.
+    }
+    try {
+        const timezone = readTimedatectl().trim();
+        if (timezone && timezone.includes("/"))
+            return timezone;
+    }
+    catch {
+        // Ignore unavailable timedatectl.
+    }
+    return "UTC";
+}
+export function runScheduleParse(argv) {
+    let timezoneOverride = "";
+    const args = [...argv];
+    while (args.length) {
+        const argument = args[0];
+        if (argument === "--tz") {
+            if (args.length < 2) {
+                process.stderr.write(SCHEDULE_PARSE_USAGE);
+                return 2;
+            }
+            timezoneOverride = args[1];
+            args.splice(0, 2);
+        }
+        else if (argument === "--json") {
+            args.shift();
+        }
+        else if (argument === "-h" || argument === "--help") {
+            process.stderr.write(SCHEDULE_PARSE_USAGE);
+            return 2;
+        }
+        else if (argument === "--") {
+            args.shift();
+            break;
+        }
+        else if (argument.startsWith("-")) {
+            process.stderr.write(`jobs-schedule-parse: unknown flag: ${argument}\n${SCHEDULE_PARSE_USAGE}`);
+            return 2;
+        }
+        else {
+            break;
+        }
+    }
+    if (!args.length) {
+        process.stderr.write(SCHEDULE_PARSE_USAGE);
+        return 2;
+    }
+    const input = args.join(" ").trim();
+    if (!input) {
+        process.stdout.write('{"ok":false,"error":"empty schedule"}\n');
+        return 1;
+    }
+    const timezone = detectHostTimezone(timezoneOverride);
+    if (!isValidTimezone(timezone)) {
+        process.stdout.write(`${JSON.stringify({ ok: false, error: `invalid IANA timezone: ${timezone}` })}\n`);
+        return 1;
+    }
+    if (CRON_RE.test(input) && !/[A-Za-z]/.test(input)) {
+        process.stdout.write(`${JSON.stringify({ ok: true, cron: input, timezone, human: humanizeCron(input, timezone), source: "cron" })}\n`);
+        return 0;
+    }
+    const namedCron = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(mon-fri|monday-friday)$/i.exec(input);
+    if (namedCron) {
+        const cron = `${namedCron[1]} ${namedCron[2]} ${namedCron[3]} ${namedCron[4]} 1-5`;
+        process.stdout.write(`${JSON.stringify({ ok: true, cron, timezone, human: humanizeCron(cron, timezone), source: "cron" })}\n`);
+        return 0;
+    }
+    const [cron, message] = parseNaturalLanguage(input);
+    if (cron === null) {
+        process.stdout.write(`${JSON.stringify({ ok: false, error: message })}\n`);
+        return 1;
+    }
+    process.stdout.write(`${JSON.stringify({ ok: true, cron, timezone, human: `${message} (${timezone})`, source: "nl" })}\n`);
+    return 0;
+}
+function isValidCronField(value, minimum, maximum) {
+    return value.split(",").every((part) => {
+        if (part === "*")
+            return true;
+        if (/^\*\/[1-9]\d*$/.test(part))
+            return true;
+        if (/^(sun|mon|tue|wed|thu|fri|sat)$/i.test(part))
+            return maximum === 7;
+        if (/^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)$/i.test(part))
+            return maximum === 12;
+        const range = /^(\d+)-(\d+)(?:\/([1-9]\d*))?$/.exec(part);
+        if (range) {
+            return Number(range[1]) >= minimum && Number(range[2]) <= maximum
+                && Number(range[1]) <= Number(range[2]);
+        }
+        const number = /^(\d+)(?:\/([1-9]\d*))?$/.exec(part);
+        if (!number)
+            return false;
+        return Number(number[1]) >= minimum && Number(number[1]) <= maximum;
+    });
+}
+function validateCron(file, cron, emit) {
+    const fields = cron.trim().split(/\s+/);
+    if (fields.length !== 5) {
+        emit(file, "schedule", `invalid cron — expected 5 fields (minute hour dom month dow), got ${fields.length}`);
+        return;
+    }
+    const names = ["minute", "hour", "day-of-month", "month", "day-of-week"];
+    const ranges = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
+    fields.forEach((field, index) => {
+        const [minimum, maximum] = ranges[index];
+        if (!isValidCronField(field, minimum, maximum)) {
+            emit(file, "schedule", `invalid cron ${names[index]} field '${field}'`);
+        }
+    });
+}
+function asText(value) {
+    if (value === null || value === undefined || value === false)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "object")
+        return JSON.stringify(value, null, 2);
+    return String(value);
+}
+function matchingJobSecretPatterns(value) {
+    // jobs-validate.sh calls grep with a leading-hyphen pattern and omits `--`.
+    // Preserve that shell behavior: grep interprets this class as an option.
+    return matchingSecretPatterns(value, { requireBoundary: false })
+        .filter((name) => name !== "Private key");
+}
+function validateCwd(file, field, cwd, emit) {
+    if (cwd.startsWith("/")) {
+        emit(file, field, "absolute cwd not allowed — use an HQ-root-relative path");
+        return;
+    }
+    if (cwd.split("/").includes("..")) {
+        emit(file, field, "cwd must not contain '..' path components");
+    }
+}
+function validateJobId(file, value, seenIds, emit) {
+    if (!value)
+        return;
+    if (!/^[a-z][a-z0-9-]{1,62}$/.test(value)) {
+        emit(file, "id", `must match [a-z][a-z0-9-]{1,62}, got '${value}'`);
+    }
+    if (seenIds.includes(value))
+        emit(file, "id", `duplicate id '${value}'`);
+    seenIds.push(value);
+}
+function validateExec(file, exec, emit) {
+    if (exec === undefined || exec === null) {
+        emit(file, "exec", "missing required field");
+        return;
+    }
+    if (typeof exec !== "object" || Array.isArray(exec)) {
+        emit(file, "exec", "must be an object with prompt or skill");
+        return;
+    }
+    const definition = exec;
+    const prompt = asText(definition.prompt);
+    const skill = asText(definition.skill);
+    if (!prompt && !skill)
+        emit(file, "exec", "must set prompt or skill");
+    else if (prompt && skill)
+        emit(file, "exec", "set exactly one of prompt or skill, not both");
+    for (const [field, value] of [["exec.prompt", prompt], ["exec.skill", skill]]) {
+        for (const name of matchingJobSecretPatterns(value)) {
+            emit(file, field, `inline credential-shaped value matched pattern '${name}' (names only; never values)`);
+        }
+    }
+    if (definition.args !== undefined) {
+        if (!definition.args || typeof definition.args !== "object" || Array.isArray(definition.args)) {
+            emit(file, "exec.args", "must be a mapping when present");
+        }
+        else {
+            const collectStrings = (value) => {
+                if (typeof value === "string")
+                    return [value];
+                if (Array.isArray(value))
+                    return value.flatMap(collectStrings);
+                if (value && typeof value === "object")
+                    return Object.values(value).flatMap(collectStrings);
+                return [];
+            };
+            for (const value of collectStrings(definition.args)) {
+                for (const name of matchingJobSecretPatterns(value)) {
+                    emit(file, "exec.args", `inline credential-shaped value matched pattern '${name}' (names only; never values)`);
+                }
+            }
+        }
+    }
+    const surface = asText(definition.surface);
+    if (surface && !["headless", "remote"].includes(surface)) {
+        emit(file, "exec.surface", `unknown surface '${surface}' (allowed: headless|remote)`);
+    }
+    for (const key of Object.keys(definition)) {
+        if (!["prompt", "skill", "args", "surface"].includes(key)) {
+            emit(file, `exec.${key}`, "unknown exec key (allowed: prompt, skill, args, surface)");
+        }
+    }
+}
+function validateRequirements(file, requirements, runtime, emit) {
+    if (requirements === undefined || requirements === null)
+        return;
+    if (!requirements || typeof requirements !== "object" || Array.isArray(requirements)) {
+        emit(file, "requirements", "must be a mapping");
+        return;
+    }
+    const value = requirements;
+    for (const key of Object.keys(value)) {
+        if (["runtime", "secrets", "company", "cwd", "tools"].includes(key))
+            continue;
+        const message = ["readiness", "last_probe", "last_run", "failure_class", "pending_probe"].includes(key)
+            ? "unknown requirements key (status belongs in hq-pro, not requirements)"
+            : "unknown requirements key (allowed: runtime, secrets, company, cwd, tools)";
+        emit(file, `requirements.${key}`, message);
+    }
+    const requiredRuntime = asText(value.runtime);
+    if (requiredRuntime && !["claude", "codex"].includes(requiredRuntime)) {
+        emit(file, "requirements.runtime", `unknown runtime '${requiredRuntime}' (allowed: claude|codex)`);
+    }
+    if (requiredRuntime && runtime && value.runtime !== runtime) {
+        emit(file, "requirements.runtime", `mismatches top-level runtime ('${requiredRuntime}' vs '${runtime}')`);
+    }
+    if (value.secrets !== undefined) {
+        if (!Array.isArray(value.secrets)) {
+            emit(file, "requirements.secrets", "must be an array of vault key names");
+        }
+        else {
+            for (const secret of value.secrets) {
+                const name = asText(secret);
+                for (const pattern of matchingJobSecretPatterns(name)) {
+                    emit(file, "requirements.secrets", `inline credential-shaped value matched pattern '${pattern}' (names only; never values)`);
+                }
+                if (name && !/^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/.test(name)) {
+                    emit(file, "requirements.secrets", `invalid vault key name '${name}' (use names only)`);
+                }
+                if (name.includes("=")) {
+                    emit(file, "requirements.secrets", "looks like KEY=value inline credential — names only");
+                }
+            }
+        }
+    }
+    if (value.tools !== undefined && !Array.isArray(value.tools)) {
+        emit(file, "requirements.tools", "must be an array of strings");
+    }
+    if (value.cwd)
+        validateCwd(file, "requirements.cwd", asText(value.cwd), emit);
+    const company = asText(value.company);
+    if (company && !/^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$/.test(company)) {
+        emit(file, "requirements.company", `invalid company slug '${company}' (lowercase kebab/underscore)`);
+    }
+}
+function validateJob(file, document, seenIds, emit) {
+    if (!document || typeof document !== "object" || Array.isArray(document)) {
+        emit(file, "yaml", "job root must be a mapping");
+        return;
+    }
+    const job = document;
+    for (const field of ["id", "name", "schedule", "runtime", "timeout_seconds", "notify", "enabled", "owner", "created_at"]) {
+        const missing = field === "enabled" ? !Object.hasOwn(job, field) : asText(job[field]) === "";
+        if (missing)
+            emit(file, field, "missing required field");
+    }
+    const id = asText(job.id);
+    const schedule = asText(job.schedule);
+    const timezone = asText(job.timezone);
+    const runtime = asText(job.runtime);
+    const timeout = asText(job.timeout_seconds);
+    const notify = asText(job.notify);
+    if (job.timezone !== undefined && (typeof job.timezone !== "string" || !job.timezone)) {
+        emit(file, "timezone", "must be a non-empty string when present");
+    }
+    validateJobId(file, id, seenIds, emit);
+    if (schedule) {
+        const fields = schedule.trim().split(/\s+/);
+        if (fields.length !== 5) {
+            const message = /[a-z]/i.test(schedule)
+                ? "natural-language schedule is not allowed — store canonical cron only"
+                : `invalid cron — expected 5 fields (minute hour dom month dow), got ${fields.length}`;
+            emit(file, "schedule", message);
+        }
+        else {
+            validateCron(file, schedule, emit);
+        }
+    }
+    if (timezone && !(/^[A-Za-z_]+(\/[A-Za-z0-9_+-]+)+$/.test(timezone) || timezone === "UTC")) {
+        emit(file, "timezone", `not an IANA-looking timezone '${timezone}'`);
+    }
+    if (runtime && !["claude", "codex"].includes(runtime)) {
+        emit(file, "runtime", `unknown runtime '${runtime}' (allowed: claude|codex)`);
+    }
+    validateExec(file, job.exec, emit);
+    if (timeout) {
+        if (!/^\d+$/.test(timeout))
+            emit(file, "timeout_seconds", `must be an integer, got '${timeout}'`);
+        else if (+timeout < 60 || +timeout > 14400) {
+            emit(file, "timeout_seconds", `must be between 60 and 14400, got ${timeout}`);
+        }
+    }
+    if (notify && !["dm", "none", "profile"].includes(notify)) {
+        emit(file, "notify", `unknown notify '${notify}' (allowed: dm|none|profile)`);
+    }
+    if (job.enabled !== undefined && typeof job.enabled !== "boolean") {
+        emit(file, "enabled", `must be boolean true|false, got '${String(job.enabled)}'`);
+    }
+    const createdAt = asText(job.created_at);
+    if (createdAt && !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(Z|[+-]\d{2}:\d{2})$/.test(createdAt)) {
+        emit(file, "created_at", `must be ISO-8601 datetime, got '${createdAt}'`);
+    }
+    validateRequirements(file, job.requirements, runtime, emit);
+    if (job.cwd)
+        validateCwd(file, "cwd", asText(job.cwd), emit);
+}
+function parseJobFile(contents) {
+    const documents = [];
+    loadAll(contents, (document) => documents.push(document), { schema: JSON_SCHEMA, json: true });
+    if (documents.length > 1)
+        return [];
+    const parsed = documents.length === 0
+        ? load(contents, { schema: JSON_SCHEMA, json: true })
+        : documents[0];
+    return expandYamlMergeKeys(parsed);
+}
+function expandYamlMergeKeys(value) {
+    if (Array.isArray(value))
+        return value.map(expandYamlMergeKeys);
+    if (!value || typeof value !== "object")
+        return value;
+    const mapping = value;
+    const merged = mapping["<<"];
+    const sources = Array.isArray(merged) ? merged : merged === undefined ? [] : [merged];
+    const result = {};
+    for (const source of [...sources].reverse()) {
+        if (source && typeof source === "object" && !Array.isArray(source)) {
+            Object.assign(result, expandYamlMergeKeys(source));
+        }
+    }
+    for (const [key, entry] of Object.entries(mapping)) {
+        if (key !== "<<")
+            result[key] = expandYamlMergeKeys(entry);
+    }
+    return result;
+}
+function collectJobFiles(args, emit) {
+    const files = [];
+    const collect = (argument) => {
+        try {
+            const stat = fs.statSync(argument);
+            if (stat.isFile()) {
+                if (/\.(yaml|yml)$/.test(argument))
+                    files.push(argument);
+                else
+                    emit(argument, "path", "not a .yaml/.yml job file");
+                return;
+            }
+            if (stat.isDirectory()) {
+                const walk = (directory) => {
+                    const entries = fs.readdirSync(directory, { withFileTypes: true });
+                    for (const entry of entries) {
+                        const file = path.join(directory, entry.name);
+                        if (entry.isDirectory())
+                            walk(file);
+                        else if (entry.isFile() && /\.(yaml|yml)$/.test(entry.name))
+                            files.push(file);
+                    }
+                };
+                walk(argument);
+                return;
+            }
+            emit(argument, "path", "file or directory not found");
+        }
+        catch {
+            emit(argument, "path", "file or directory not found");
+        }
+    };
+    args.forEach(collect);
+    return files;
+}
+function comparePathsLikeSort(left, right) {
+    return Buffer.compare(Buffer.from(left), Buffer.from(right));
+}
+export function validateJobs(args) {
+    if (!args.length) {
+        process.stderr.write(VALIDATE_USAGE);
+        return 2;
+    }
+    const errors = [];
+    const emit = (file, field, message) => {
+        errors.push(`jobs-validate: ${file}: ${field}: ${message}`);
+    };
+    const seenIds = [];
+    const files = collectJobFiles(args, emit).sort(comparePathsLikeSort);
+    if (!files.length) {
+        for (const error of errors)
+            process.stderr.write(`${error}\n`);
+        process.stderr.write("jobs-validate: no job YAML files found\n");
+        return 1;
+    }
+    for (const file of files) {
+        try {
+            validateJob(file, parseJobFile(fs.readFileSync(file, "utf8")), seenIds, emit);
+        }
+        catch {
+            emit(file, "yaml", "failed to parse YAML");
+        }
+    }
+    for (const error of errors)
+        process.stderr.write(`${error}\n`);
+    if (errors.length) {
+        process.stderr.write(`jobs-validate: ${errors.length} error(s)\n`);
+        return 1;
+    }
+    return 0;
+}
+export function registerCoreJobsNativeCommand(core) {
+    const jobs = core.command("jobs").description("Scheduled jobs helpers");
+    const register = (name, asset, summary, run) => {
+        const command = jobs.command(name)
+            .description(summary)
+            .helpOption(false)
+            .allowUnknownOption()
+            .allowExcessArguments(true)
+            .argument("[args...]", "Arguments passed to the scaffold helper")
+            .action(async (args, _options, current) => {
+            const argv = rawArgumentsForCommand(current, args);
+            if (!await coreNativeJobsEnabled()) {
+                const result = runBundledScript({ asset, args: argv, cwd: process.cwd() });
+                if (result.code !== 0)
+                    process.exit(result.code);
+                return;
+            }
+            const result = run(argv);
+            if (result !== 0)
+                process.exit(result);
+        });
+        describeCoreCommand(command, { execution: "native", asset, root: "live" });
+    };
+    register("schedule-parse", SCHEDULE_PARSE_ASSET, "Resolve natural-language or raw cron schedules", runScheduleParse);
+    register("validate", VALIDATE_ASSET, "Validate scheduled-job YAML files", validateJobs);
+}
+export function rawArgumentsForCommand(command, fallback, raw = process.argv) {
+    const names = [];
+    for (let current = command; current?.parent; current = current.parent) {
+        names.unshift(current.name());
+    }
+    let start = -1;
+    let cursor = 0;
+    for (const name of names) {
+        const index = raw.indexOf(name, cursor);
+        if (index < 0)
+            return command.args.length ? command.args : fallback;
+        cursor = index + 1;
+        start = cursor;
+    }
+    return start >= 0 ? raw.slice(start) : (command.args.length ? command.args : fallback);
+}
+//# sourceMappingURL=core-jobs-native.js.map

package/dist/commands/core-native-jobs-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off rollout gate for the native scheduled-jobs helpers. */
+export declare const CORE_NATIVE_JOBS_FLAG = "core-native-jobs";
+export declare function coreNativeJobsEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-jobs-flag.d.ts.map

package/dist/commands/core-native-jobs-flag.js

@@ -0,0 +1,7 @@
+/** Default-off rollout gate for the native scheduled-jobs helpers. */
+export const CORE_NATIVE_JOBS_FLAG = "core-native-jobs";
+export async function coreNativeJobsEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_NATIVE_JOBS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-native-jobs-flag.js.map

package/dist/commands/core-policy.js

@@ -205,6 +205,28 @@ function extractRulePaths(file) {
     }
     return [...paths].sort();
 }
+function shellReferenceStem(reference) {
+    const lastDot = reference.lastIndexOf('.');
+    return lastDot === -1 ? reference : reference.slice(0, lastDot);
+}
+function shellLsExtensionGlobHasMatch(root, stem) {
+    const patternPath = path.join(root, `${stem}.*`);
+    const directory = path.dirname(patternPath);
+    const basenamePattern = path.basename(patternPath);
+    const literalPrefix = basenamePattern.slice(0, -1);
+    let entries;
+    try {
+        entries = fs.readdirSync(directory);
+    }
+    catch (error) {
+        if (expectedFsMiss(error))
+            return false;
+        throw error;
+    }
+    // Bash 5.2 enables globskipdots by default, so `.*` only matches when the
+    // directory has an actual hidden entry. readdir omits `.` and `..`.
+    return entries.some((entry) => entry.startsWith(literalPrefix));
+}
 function refSummary(file, root) {
     const refs = extractRulePaths(file);
     const judged = refs.filter((reference) => {
@@ -228,11 +250,8 @@ function refSummary(file, root) {
         }
         if (fs.existsSync(path.join(root, reference)))
             continue;
-        const extension = path.posix.extname(reference);
-        const stem = extension ? reference.slice(0, -extension.length) : reference;
-        const parent = path.join(root, path.posix.dirname(stem));
-        const basename = path.posix.basename(stem);
-        const hasSibling = listFiles(parent).some((name) => name.startsWith(`${basename}.`));
+        const stem = shellReferenceStem(reference);
+        const hasSibling = shellLsExtensionGlobHasMatch(root, stem);
         if (hasSibling)
             renamed.push(reference);
         else