@indigoai-us/hq-cli 5.305.0 → 5.307.0

package/assets/scaffold/core/scripts/lib/portable.sh

@@ -0,0 +1,211 @@
+# shellcheck shell=bash
+# portable.sh — shared OS-portability helpers for hq-core shell scripts.
+#
+# SOURCED, never executed:  . "$ROOT/core/scripts/lib/portable.sh"
+# bash 3.2 safe; works under Linux, macOS, and Windows Git Bash with set -u.
+#
+# Canonicalizes good in-repo dual-implementation patterns:
+#   - work-mesh-lib.sh wm_file_mtime (numeric-probe dual stat)
+#   - archive-old-threads.sh dual stat / date -d | date -v
+#   - compute-checksums.sh Git Bash awareness
+#
+# JSON engines are NOT here — source core/scripts/hook-lib.sh (hq_json_get /
+# hq_json_encode: jq first, then node). This file owns OS primitives + hard-fail
+# jq install messaging only.
+
+# portable_stat_mtime <path>
+#   Print mtime as epoch seconds. Uses BSD-form stat -f first, accepts only a
+#   strictly numeric result (GNU stat -f is filesystem mode and may print text),
+#   then falls through to GNU stat -c. Mirrors work-mesh-lib.sh:215-230.
+#   Returns 1 when both forms fail.
+portable_stat_mtime() {
+  local f="${1:-}" value
+  [ -n "$f" ] || return 1
+  value="$(stat -f %m "$f" 2>/dev/null)" || value=""
+  case "$value" in
+    ''|*[!0-9]*) ;;
+    *) printf '%s' "$value"; return 0 ;;
+  esac
+  value="$(stat -c %Y "$f" 2>/dev/null)" || value=""
+  case "$value" in
+    ''|*[!0-9]*) return 1 ;;
+    *) printf '%s' "$value"; return 0 ;;
+  esac
+}
+
+# portable_sed_inplace <sed-script> <file> [extra sed args...]
+#   In-place sed that works on both GNU sed (sed -i) and BSD sed (sed -i '').
+portable_sed_inplace() {
+  local script="${1:-}"
+  local file="${2:-}"
+  shift 2 2>/dev/null || true
+  [ -n "$script" ] && [ -n "$file" ] || return 1
+  [ -f "$file" ] || return 1
+  # Prefer GNU form; fall back to BSD empty-suffix form.
+  if sed --version >/dev/null 2>&1; then
+    sed -i "$@" -e "$script" "$file"
+  else
+    sed -i '' "$@" -e "$script" "$file"
+  fi
+}
+
+# portable_tmpdir
+#   Print a writable temp directory (no trailing slash). Prefer TMPDIR, else /tmp.
+portable_tmpdir() {
+  local d="${TMPDIR:-/tmp}"
+  # Strip trailing slash except for root.
+  case "$d" in
+    /) printf '%s' "$d" ;;
+    */) printf '%s' "${d%/}" ;;
+    *) printf '%s' "$d" ;;
+  esac
+}
+
+# portable_date_epoch_to_iso <epoch_seconds>
+#   Convert epoch seconds to UTC ISO-8601 (YYYY-MM-DDTHH:MM:SSZ).
+#   Dual: GNU date -d @N / BSD date -r N.
+portable_date_epoch_to_iso() {
+  local epoch="${1:-}"
+  case "$epoch" in
+    ''|*[!0-9]*) return 1 ;;
+  esac
+  date -u -d "@${epoch}" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
+    || date -u -r "$epoch" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
+    || return 1
+}
+
+# portable_user
+#   Print a filename-safe user key from USER or USERNAME (Git Bash often lacks USER).
+portable_user() {
+  local u="${USER:-${USERNAME:-unknown}}"
+  # shellcheck disable=SC2001
+  u="$(printf '%s' "$u" | sed 's/[^[:alnum:]_.-]/_/g')"
+  [ -n "$u" ] || u="unknown"
+  printf '%s' "$u"
+}
+
+# portable_jq_install_hint
+#   Print multi-line per-OS jq install guidance to stdout.
+portable_jq_install_hint() {
+  # Single multi-OS line so portability lint does not flag brew-only messages.
+  printf '%s\n' "Install jq: Windows: winget install jqlang.jq | choco install jq | scoop install jq; Linux: sudo apt install jq | sudo dnf install jq; macOS: brew install jq"
+}
+
+# require_jq
+#   Return 0 if jq is on PATH. Otherwise print install guidance to stderr and
+#   return 1. Caller decides whether to die. Does not implement JSON parse.
+require_jq() {
+  if command -v jq >/dev/null 2>&1; then
+    return 0
+  fi
+  printf 'jq is required but not installed.\n' >&2
+  portable_jq_install_hint >&2
+  return 1
+}
+
+# portable_native_path <path>
+#   Print a path a native (non-MSYS) Windows binary can open. Git Bash mktemp
+#   and $TMPDIR often yield /tmp/... which Node's hq.exe cannot read, so
+#   --body-file looks empty. cygpath -m produces C:/... mixed paths. On
+#   POSIX hosts this is identity. Empty input returns 1.
+portable_native_path() {
+  local p="${1:-}"
+  [ -n "$p" ] || return 1
+  if command -v cygpath >/dev/null 2>&1; then
+    cygpath -m "$p" 2>/dev/null || printf '%s' "$p"
+    return 0
+  fi
+  printf '%s' "$p"
+}
+
+# portable_qmd_models_dir
+#   Print qmd's GGUF cache directory (no trailing slash). Override with
+#   QMD_MODELS_DIR. Otherwise XDG_CACHE_HOME/qmd/models, then
+#   HOME/.cache/qmd/models, then USERPROFILE/.cache/qmd/models (Windows).
+portable_qmd_models_dir() {
+  local d
+  if [ -n "${QMD_MODELS_DIR:-}" ]; then
+    d="$QMD_MODELS_DIR"
+  elif [ -n "${XDG_CACHE_HOME:-}" ]; then
+    d="$XDG_CACHE_HOME/qmd/models"
+  elif [ -n "${HOME:-}" ]; then
+    d="$HOME/.cache/qmd/models"
+  elif [ -n "${USERPROFILE:-}" ]; then
+    d="$USERPROFILE/.cache/qmd/models"
+    if command -v cygpath >/dev/null 2>&1; then
+      d="$(cygpath -u "$d" 2>/dev/null || printf '%s' "$d")"
+    fi
+  else
+    return 1
+  fi
+  case "$d" in
+    */) d="${d%/}" ;;
+  esac
+  printf '%s' "$d"
+}
+
+# portable_qmd_embed_model_ready
+#   Return 0 when a usable GGUF already sits in the qmd models dir so
+#   vsearch/query/embed will not start a multi-hundred-MB download. A file
+#   named by QMD_EMBED_MODEL (basename after the last /) counts; otherwise
+#   any *.gguf of at least 1 MiB counts. Missing dir or tiny placeholders
+#   return 1.
+portable_qmd_embed_model_ready() {
+  local dir want f sz
+  dir="$(portable_qmd_models_dir)" || return 1
+  [ -d "$dir" ] || return 1
+  if [ -n "${QMD_EMBED_MODEL:-}" ]; then
+    want="${QMD_EMBED_MODEL##*/}"
+    if [ -n "$want" ] && [ -f "$dir/$want" ]; then
+      sz="$(wc -c < "$dir/$want" | tr -d '[:space:]')"
+      case "$sz" in
+        ''|*[!0-9]*) ;;
+        *) [ "$sz" -ge 1048576 ] && return 0 ;;
+      esac
+    fi
+  fi
+  for f in "$dir"/*.gguf; do
+    [ -f "$f" ] || continue
+    sz="$(wc -c < "$f" | tr -d '[:space:]')"
+    case "$sz" in
+      ''|*[!0-9]*) continue ;;
+    esac
+    [ "$sz" -ge 1048576 ] && return 0
+  done
+  return 1
+}
+
+# portable_qmd_cmd_would_download_model <command>
+#   Return 0 when a shell command would invoke qmd vsearch, query, embed, or
+#   pull — the subcommands that auto-download GGUF models on first use.
+#   First non-flag argument after a qmd token is the subcommand, so
+#   `qmd search "how to vsearch"` is NOT a match.
+portable_qmd_cmd_would_download_model() {
+  local cmd="${1:-}"
+  [ -n "$cmd" ] || return 1
+  case "$cmd" in
+    *qmd*) ;;
+    *) return 1 ;;
+  esac
+  printf '%s\n' "$cmd" | awk '
+    BEGIN { found = 0 }
+    {
+      n = split($0, raw, /[[:space:];|&]+/)
+      for (i = 1; i <= n; i++) {
+        tok = raw[i]
+        if (tok == "") continue
+        base = tok
+        sub(/^.*\//, "", base)
+        if (base == "qmd" || base == "qmd.exe") {
+          j = i + 1
+          while (j <= n && raw[j] ~ /^-/) j++
+          if (j <= n && raw[j] ~ /^(vsearch|query|embed|pull)$/) {
+            found = 1
+            exit
+          }
+        }
+      }
+    }
+    END { exit found ? 0 : 1 }
+  '
+}

package/assets/scaffold/core/scripts/refresh-vault-access.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: `hq files shared-with-me` (explicit per-prefix grants)
+#   - role:   `hq members --company <slug> list` matched against the caller's
+#             email (from `hq whoami`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+# With no --company, refreshes every company that appears in the
+# `hq files shared-with-me` cross-company roll-up.
+
+set -uo pipefail
+
+log() { printf 'refresh-vault-access: %s\n' "$*" >&2; }
+
+ROOT=""
+SLUGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root)
+      ROOT="${2:-}"
+      shift 2 || { log "--root requires a value"; exit 1; }
+      ;;
+    --company)
+      SLUGS[${#SLUGS[@]}]="${2:-}"
+      shift 2 || { log "--company requires a value"; exit 1; }
+      ;;
+    -h|--help)
+      sed -n '2,33p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      log "unknown argument: $1"
+      exit 1
+      ;;
+  esac
+done
+
+is_hq_root() { [ -n "${1:-}" ] && [ -d "${1%/}/core" ] && [ -d "${1%/}/.claude" ]; }
+
+if [ -z "$ROOT" ]; then
+  if is_hq_root "${CLAUDE_PROJECT_DIR:-}"; then
+    ROOT="$CLAUDE_PROJECT_DIR"
+  else
+    dir="$PWD"
+    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
+      if is_hq_root "$dir"; then ROOT="$dir"; break; fi
+      dir="$(dirname "$dir")"
+    done
+  fi
+fi
+if ! is_hq_root "$ROOT"; then
+  log "could not resolve the HQ root (pass --root <hqRoot>)"
+  exit 1
+fi
+
+command -v jq >/dev/null 2>&1 || { log "jq is required"; exit 1; }
+if ! command -v hq >/dev/null 2>&1; then
+  log "hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)"
+  exit 0
+fi
+
+strip_ansi() { sed -e 's/\x1b\[[0-9;]*m//g'; }
+
+# ── caller email (for role lookup) ─────────────────────────────────────────
+EMAIL="${HQ_VAULT_ACCESS_EMAIL:-}"
+if [ -z "$EMAIL" ]; then
+  EMAIL="$(hq whoami 2>/dev/null | strip_ansi \
+    | grep -Eo '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' \
+    | grep -v '@outposts\.' | head -1 || true)"
+fi
+[ -n "$EMAIL" ] || log "could not determine caller email — roles will be 'unknown' (hook will not enforce)"
+
+# ── explicit grants via shared-with-me ─────────────────────────────────────
+# Table columns: COMPANY  PATH  PERMISSION  SOURCE (header + ─── separator).
+fetch_grants_tsv() {
+  # $1 = optional slug filter; prints "slug<TAB>path<TAB>permission" rows.
+  local slug="${1:-}" out
+  if [ -n "$slug" ]; then
+    out="$(hq files shared-with-me --company "$slug" 2>/dev/null | strip_ansi)" || return 1
+  else
+    out="$(hq files shared-with-me 2>/dev/null | strip_ansi)" || return 1
+  fi
+  # hq-cli >= 5.142 renders a private-folder row as "foo/ (private folder)";
+  # drop the label so the PATH column stays the verbatim `foo/` pattern.
+  printf '%s\n' "$out" | awk '
+    { sub(/ \(private folder\)/, "") }
+    /^COMPANY[[:space:]]/ { next }
+    /^─/ { next }
+    /^[[:space:]]*$/ { next }
+    /^Nothing is explicitly shared/ { next }
+    NF >= 3 {
+      perm = ""
+      if ($3 == "read" || $3 == "write" || $3 == "admin") perm = $3
+      else if (NF >= 4 && ($4 == "read" || $4 == "write" || $4 == "admin")) perm = $4
+      if (perm != "") printf "%s\t%s\t%s\n", $1, $2, perm
+    }'
+}
+
+# ── role lookup ────────────────────────────────────────────────────────────
+fetch_role() {
+  # $1 = slug; prints role or "unknown". Never fails.
+  local slug="$1" out role=""
+  if [ -n "$EMAIL" ]; then
+    # --company is declared on the parent `members` group, so it goes first.
+    out="$(hq members --company "$slug" list 2>/dev/null | strip_ansi)" || out=""
+    if [ -n "$out" ]; then
+      role="$(printf '%s\n' "$out" | awk -v email="$EMAIL" '$1 == email { print $2; exit }')"
+    fi
+  fi
+  case "$role" in
+    owner|admin|member|guest) printf '%s' "$role" ;;
+    *) printf 'unknown' ;;
+  esac
+}
+
+GRANTS_TSV=""
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  for slug in "${SLUGS[@]}"; do
+    rows="$(fetch_grants_tsv "$slug")" || { log "skipping $slug — shared-with-me query failed"; continue; }
+    GRANTS_TSV="${GRANTS_TSV}${rows}
+"
+  done
+else
+  GRANTS_TSV="$(fetch_grants_tsv)" || { log "shared-with-me roll-up failed — nothing refreshed"; exit 0; }
+fi
+
+# Companies to include = every slug present in the grant rows (plus any
+# explicitly requested slugs, so a company with zero explicit grants still
+# gets a role entry when asked for by name).
+ALL_SLUGS="$(printf '%s\n' "$GRANTS_TSV" | awk -F'\t' 'NF { print $1 }' | sort -u)"
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  ALL_SLUGS="$(printf '%s\n%s\n' "$ALL_SLUGS" "$(printf '%s\n' "${SLUGS[@]}")" | awk 'NF' | sort -u)"
+fi
+
+if [ -z "$ALL_SLUGS" ]; then
+  log "no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)"
+fi
+
+COMPANIES_JSON="{}"
+while IFS= read -r slug; do
+  [ -n "$slug" ] || continue
+  role="$(fetch_role "$slug")"
+  grants_json="$(printf '%s\n' "$GRANTS_TSV" \
+    | awk -F'\t' -v s="$slug" '$1 == s { printf "%s\t%s\n", $2, $3 }' \
+    | jq -Rn '[inputs | split("\t") | select(length == 2) | {path: .[0], permission: .[1]}]')"
+  COMPANIES_JSON="$(printf '%s' "$COMPANIES_JSON" \
+    | jq --arg slug "$slug" --arg role "$role" --argjson grants "$grants_json" \
+        '. + {($slug): {role: $role, grants: $grants}}')"
+done <<EOF
+$ALL_SLUGS
+EOF
+
+mkdir -p "$ROOT/.hq"
+TMP_OUT="$(mktemp "$ROOT/.hq/vault-access.json.XXXXXX")"
+jq -n --argjson companies "$COMPANIES_JSON" \
+  --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  '{version: 1, generatedAt: $ts, companies: $companies}' > "$TMP_OUT"
+mv "$TMP_OUT" "$ROOT/.hq/vault-access.json"
+
+N_COMPANIES="$(printf '%s\n' "$ALL_SLUGS" | awk 'NF' | wc -l | tr -d ' ')"
+log "wrote .hq/vault-access.json ($N_COMPANIES companies, identity: ${EMAIL:-unknown})"
+exit 0

package/dist/command-catalog.generated.d.ts

@@ -5730,6 +5730,58 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "audit-log";
+        readonly description: "Append, query, or summarize the HQ audit log";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "git-pack-extension-check";
+        readonly description: "Find or repair extensionless Git pack files";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "pin";
+        readonly description: "Pin the current session to one goal";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "refresh-vault-access";
+        readonly description: "Refresh the local vault access manifest";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "worktree-gc";
         readonly description: "Safely collect old, preserved HQ worktrees";
@@ -9664,7 +9716,7 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly arguments: readonly [];
             readonly options: readonly [{
                 readonly flags: "--claude <path>";
-                readonly description: "claude binary";
+                readonly description: "claude binary (default: the one installed for this user)";
             }, {
                 readonly flags: "--name <name>";
                 readonly description: "remote-control session name";
@@ -9685,7 +9737,7 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "the box's Codex runner script";
             }, {
                 readonly flags: "--codex <path>";
-                readonly description: "codex binary, watched for updates";
+                readonly description: "codex binary, watched for updates (default: the one installed for this user)";
             }];
             readonly subcommands: readonly [];
         }];

package/dist/command-catalog.generated.js

@@ -7384,6 +7384,70 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "audit-log",
+                "description": "Append, query, or summarize the HQ audit log",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "git-pack-extension-check",
+                "description": "Find or repair extensionless Git pack files",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "pin",
+                "description": "Pin the current session to one goal",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "refresh-vault-access",
+                "description": "Refresh the local vault access manifest",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "worktree-gc",
                 "description": "Safely collect old, preserved HQ worktrees",
@@ -12457,7 +12521,7 @@ export const COMMAND_CATALOG = [
                         "options": [
                             {
                                 "flags": "--claude <path>",
-                                "description": "claude binary"
+                                "description": "claude binary (default: the one installed for this user)"
                             },
                             {
                                 "flags": "--name <name>",
@@ -12484,7 +12548,7 @@ export const COMMAND_CATALOG = [
                             },
                             {
                                 "flags": "--codex <path>",
-                                "description": "codex binary, watched for updates"
+                                "description": "codex binary, watched for updates (default: the one installed for this user)"
                             }
                         ],
                         "subcommands": []

package/dist/commands/core-audit-log-native.d.ts

@@ -0,0 +1,9 @@
+import { type UtilityContext, type UtilityOutput } from "./core-native-utilities.js";
+import type { Command } from "commander";
+export declare const AUDIT_LOG_ASSET = "core/scripts/audit-log.sh";
+export declare const AUDIT_LOG_HELP = "audit-log.sh \u2014 HQ audit log utility\n\nSUBCOMMANDS:\n  append    Write one JSONL record to the audit log\n  query     Filter and display records\n  summary   Show aggregated table (project | worker | status)\n\nAPPEND FLAGS (--event and --project are required):\n  --timestamp    ISO8601 (auto-filled if omitted)\n  --event        task_started | phase_completed | task_completed | task_failed |\n                 project_started | project_completed |\n                 story_dispatched | story_completed | story_failed |\n                 pipeline_started | pipeline_completed | pipeline_paused |\n                 pipeline_failed | project_pr_created | project_reviewed |\n                 project_merged | project_deployed | project_canary_pass |\n                 project_canary_fail | gate_requested | gate_resolved\n  --company      Company slug (e.g. {company})\n  --project      Project slug (e.g. hq-observability)\n  --story-id     Story ID (e.g. US-001)\n  --worker       Worker name (e.g. backend-dev)\n  --model        Model name (e.g. sonnet)\n  --action       Short description of what happened\n  --files        Comma-separated file paths touched\n  --result       success | fail | skipped\n  --duration-ms  Wall-clock time in milliseconds (integer)\n  --error        Error message if result=fail\n  --session-id   Claude session/thread ID\n\nQUERY FLAGS:\n  --project      Filter by project slug\n  --company      Filter by company slug\n  --worker       Filter by worker name\n  --since        Filter by timestamp >= YYYY-MM-DD (or full ISO8601)\n  --event        Filter by event type\n\nEXAMPLES:\n  # Append a task_started event\n  core/scripts/audit-log.sh append \\\n    --event task_started \\\n    --project hq-observability \\\n    --company {company} \\\n    --story-id US-001 \\\n    --worker backend-dev \\\n    --model sonnet\n\n  # Query all failures for a project\n  core/scripts/audit-log.sh query --project hq-observability --event task_failed\n\n  # Query since a date\n  core/scripts/audit-log.sh query --since 2026-03-01\n\n  # Show summary table\n  core/scripts/audit-log.sh summary\n\nLOG FILE:\n  workspace/metrics/audit-log.jsonl\n";
+type AuditDeps = Pick<UtilityContext, "root" | "now">;
+export declare function runAuditLog(args: string[], deps: AuditDeps): UtilityOutput;
+export declare function registerCoreAuditLogNative(core: Command): void;
+export {};
+//# sourceMappingURL=core-audit-log-native.d.ts.map