@indigoai-us/hq-cli 5.309.0 → 5.310.0

package/assets/scaffold/core/scripts/work-mesh-live-bind-trusted.sh

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# hq-core: public
+# US-011 — write session meta + reconcile with observation.trustedContext.
+# No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+  ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+
+COMPANY=""
+PROJECT=""
+TASK=""
+SESSION_ID=""
+NO_RECONCILE=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --company|--company-slug) COMPANY="${2:-}"; shift 2 ;;
+    --project) PROJECT="${2:-}"; shift 2 ;;
+    --task) TASK="${2:-}"; shift 2 ;;
+    --session|--session-id) SESSION_ID="${2:-}"; shift 2 ;;
+    --no-reconcile) NO_RECONCILE=1; shift ;;
+    --root) ROOT="${2:-}"; shift 2 ;;
+    -h|--help)
+      sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) shift ;;
+  esac
+done
+
+HQ_SESSION="$ROOT/core/scripts/hq-session.sh"
+
+# Resolve session id before metadata writes so a known session is pinned even
+# when the caller omitted --session-id. Empty `pin` must still be safe on
+# macOS Bash 3.2 (`set -u` + `"${pin[@]}"` is an unbound-variable abort).
+if [ -z "$SESSION_ID" ]; then
+  SESSION_ID="${HQ_SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-${CLAUDE_SESSION_ID:-${CODEX_SESSION_ID:-${CODEX_THREAD_ID:-}}}}}"
+  SESSION_ID="$(printf '%s' "$SESSION_ID" | tr -d '[:space:]')"
+  if [ -z "$SESSION_ID" ] && [ -f "$ROOT/workspace/sessions/.current" ]; then
+    SESSION_ID="$(tr -d '[:space:]' <"$ROOT/workspace/sessions/.current")"
+  fi
+fi
+
+pin=()
+if [ -n "$SESSION_ID" ]; then
+  pin=(--session-id "$SESSION_ID")
+fi
+
+if [ -n "$COMPANY" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set company_slug "$COMPANY"
+fi
+if [ -n "$PROJECT" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set project "$PROJECT"
+fi
+if [ -n "$TASK" ]; then
+  bash "$HQ_SESSION" ${pin[@]+"${pin[@]}"} set task "$TASK"
+fi
+
+if [ "$NO_RECONCILE" -eq 1 ]; then
+  exit 0
+fi
+
+[ -n "$SESSION_ID" ] || exit 0
+
+# shellcheck source=lib/work-mesh-enqueue.sh
+. "$ROOT/core/scripts/lib/work-mesh-enqueue.sh" 2>/dev/null || true
+
+HARNESS="${HQ_HARNESS:-${HQ_WORK_MESH_HARNESS:-claude-code}}"
+case "$HARNESS" in
+  claude|Claude|ClaudeCode) HARNESS=claude-code ;;
+  Codex) HARNESS=codex ;;
+  Grok) HARNESS=grok ;;
+esac
+ADAPTER="${HQ_ADAPTER_CONTRACT_VERSION:-1.0.0}"
+
+if command -v work_mesh_ulid >/dev/null 2>&1; then
+  work_mesh_ulid >/dev/null; CLIENT_OP=$REPLY
+else
+  CLIENT_OP="cop_$(date +%s)_$$"
+fi
+
+json_quote() {
+  if command -v work_mesh_json_quote >/dev/null 2>&1; then
+    work_mesh_json_quote "$1"; printf '%s' "$REPLY"
+    return 0
+  fi
+  if command -v jq >/dev/null 2>&1; then
+    jq -n --arg s "$1" '$s'
+    return 0
+  fi
+  # bash-only fallback (hooks-no-python)
+  local s=$1
+  s=${s//'\'/'\\'}
+  s=${s//'"'/'\"'}
+  s=${s//$'\n'/'\n'}
+  s=${s//$'\r'/'\r'}
+  s=${s//$'\t'/'\t'}
+  printf '"%s"' "$s"
+}
+
+_q_sid="$(json_quote "$SESSION_ID")"
+_q_har="$(json_quote "$HARNESS")"
+_q_ad="$(json_quote "$ADAPTER")"
+_q_op="$(json_quote "$CLIENT_OP")"
+_q_cwd="$(json_quote "${PWD:-}")"
+_q_root="$(json_quote "$ROOT")"
+
+OBS='{"contractVersion":1,"clientOperationId":'"$_q_op"',"identity":{"sessionId":'"$_q_sid"',"harness":'"$_q_har"',"adapterVersion":'"$_q_ad"'},"cwd":'"$_q_cwd"',"hqRoot":'"$_q_root"
+if [ -n "$COMPANY" ] || [ -n "$PROJECT" ] || [ -n "$TASK" ]; then
+  OBS+=',"trustedContext":{'
+  _first=1
+  if [ -n "$COMPANY" ]; then
+    OBS+='"companySlug":'"$(json_quote "$COMPANY")"
+    _first=0
+  fi
+  if [ -n "$PROJECT" ]; then
+    [ "$_first" -eq 1 ] || OBS+=','
+    OBS+='"project":'"$(json_quote "$PROJECT")"
+    _first=0
+  fi
+  if [ -n "$TASK" ]; then
+    [ "$_first" -eq 1 ] || OBS+=','
+    OBS+='"task":'"$(json_quote "$TASK")"
+  fi
+  OBS+='}'
+fi
+OBS+='}'
+
+OBS_DIR="${TMPDIR:-/tmp}/hq-work-mesh-obs"
+mkdir -p -- "$OBS_DIR" 2>/dev/null || true
+chmod 700 -- "$OBS_DIR" 2>/dev/null || true
+OBS_FILE="$OBS_DIR/$SESSION_ID.bind.$$.json"
+printf '%s\n' "$OBS" >"$OBS_FILE"
+
+if [ -n "${HQ_WORK_MESH_RECONCILE_LOG:-}" ]; then
+  printf 'reconcile-trusted %s\n' "$OBS_FILE" >>"$HQ_WORK_MESH_RECONCILE_LOG" 2>/dev/null || true
+fi
+
+if [ "${HQ_WORK_MESH_RECONCILE_STUB:-}" = "1" ]; then
+  exit 0
+fi
+
+HQ_BIN="$(command -v hq 2>/dev/null || true)"
+if [ -n "$HQ_BIN" ] && [ -f "$OBS_FILE" ]; then
+  nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
+    >/dev/null 2>&1 </dev/null &
+  disown 2>/dev/null || true
+fi
+exit 0

package/dist/command-catalog.generated.d.ts

@@ -1734,7 +1734,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "delete";
-        readonly description: "Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.";
+        readonly description: "Delete vault objects by exact key or bounded prefix. A trailing slash expands recursively; use * for an explicit wildcard prefix. Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <prefix>";
@@ -3492,6 +3492,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--json";
             readonly description: "Machine-readable output";
+        }, {
+            readonly flags: "--history";
+            readonly description: "Include recently decided calls";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -5795,6 +5798,32 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "dm-bind";
+        readonly description: "Bind this session to one HQ DM channel";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "work-mesh-bind-trusted";
+        readonly description: "Bind trusted session context and reconcile it with Work Mesh";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[args...]";
+        readonly arguments: readonly [{
+            readonly name: "args";
+            readonly required: false;
+            readonly variadic: true;
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "worktree-gc";
         readonly description: "Safely collect old, preserved HQ worktrees";

package/dist/command-catalog.generated.js

@@ -2213,7 +2213,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "delete",
-                "description": "Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.",
+                "description": "Delete vault objects by exact key or bounded prefix. A trailing slash expands recursively; use * for an explicit wildcard prefix. Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <prefix>",
@@ -4500,6 +4500,10 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--json",
                         "description": "Machine-readable output"
+                    },
+                    {
+                        "flags": "--history",
+                        "description": "Include recently decided calls"
                     }
                 ],
                 "subcommands": []
@@ -7464,6 +7468,38 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "dm-bind",
+                "description": "Bind this session to one HQ DM channel",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
+            {
+                "name": "work-mesh-bind-trusted",
+                "description": "Bind trusted session context and reconcile it with Work Mesh",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[args...]",
+                "arguments": [
+                    {
+                        "name": "args",
+                        "required": false,
+                        "variadic": true
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "worktree-gc",
                 "description": "Safely collect old, preserved HQ worktrees",

package/dist/commands/agents.js

@@ -1946,6 +1946,12 @@ export function registerAgentsCommand(program) {
         }
         try {
             const token = (await resolveVaultCredential()).token;
+            const status = await getAgentStatus(token, agentUid);
+            if (recordValue(status.agent)?.runtimeKind === "external") {
+                await revokeAgent(token, agentUid, true);
+                console.log(chalk.green(`Revoked and removed external agent ${agentUid}.`));
+                return;
+            }
             const result = await deprovisionAgent(token, agentUid, opts.confirmDestroyAgentsV2);
             if (result.terminal === false) {
                 console.log(chalk.yellow(`Deprovision in progress for agent ${agentUid} (not yet fully torn down — re-run to continue).`));

package/dist/commands/core-checkpoint-gate-setting.d.ts

@@ -18,16 +18,6 @@
  */
 import { Command } from "commander";
 export declare const CHECKPOINT_GATE_SETTING_FLAG = "checkpoint.gate.company-setting";
-/** The refresh gives up after this long; the gate keeps the cached value. */
-export declare const CHECKPOINT_GATE_REFRESH_TIMEOUT_MS = 3000;
-export declare function assertCompanySlug(slug: string): void;
-export interface CheckpointGateCacheEntry {
-    company: string;
-    checkpointGateEnabled: boolean;
-    /** Unix seconds. The gate treats an entry older than 600 s as stale. */
-    fetched_at: number;
-}
-export declare function checkpointGateCacheDir(home?: string): string;
 export declare function checkpointGateCachePath(slug: string, home?: string): string;
 export type CheckpointGateRefreshOutcome = {
     status: "written";

package/dist/commands/core-checkpoint-gate-setting.js

@@ -25,15 +25,15 @@ import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 export const CHECKPOINT_GATE_SETTING_FLAG = "checkpoint.gate.company-setting";
 /** The refresh gives up after this long; the gate keeps the cached value. */
-export const CHECKPOINT_GATE_REFRESH_TIMEOUT_MS = 3_000;
+const CHECKPOINT_GATE_REFRESH_TIMEOUT_MS = 3_000;
 /** Same character set the gate script accepts; anything else is refused. */
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
-export function assertCompanySlug(slug) {
+function assertCompanySlug(slug) {
     if (!SLUG_RE.test(slug) || slug === "personal") {
         throw new Error(`checkpoint-gate-setting: '${slug}' is not a company slug`);
     }
 }
-export function checkpointGateCacheDir(home = os.homedir()) {
+function checkpointGateCacheDir(home = os.homedir()) {
     return path.join(home, ".hq", "cache", "checkpoint-gate");
 }
 export function checkpointGateCachePath(slug, home = os.homedir()) {

package/dist/commands/core-dm-bind-native.d.ts

@@ -0,0 +1,32 @@
+/** Native implementation of core/scripts/hq-dm-bind.sh. */
+import * as fs from "node:fs";
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const DM_BIND_ASSET = "core/scripts/hq-dm-bind.sh";
+export declare const DM_BIND_HELP = "# hq-dm-bind.sh \u2014 bind the current session to one HQ DM channel, post\n# structured updates to it, and listen for replies (feedback / requests).\n#\n# Usage:\n#   core/scripts/hq-dm-bind.sh bind <channel>                 # bind + set the read cursor to \"now\"\n#   core/scripts/hq-dm-bind.sh status                         # show the binding and cursor\n#   core/scripts/hq-dm-bind.sh post --title <t> [--state <s>] [--line <l>]... [--next <l>]... [--ask <l>]... [--to <name>]... [--topic <t>] [--under <id>] [--new-thread]\n#   core/scripts/hq-dm-bind.sh post --title <t> - < body.md    # body from stdin (already structured)\n#   core/scripts/hq-dm-bind.sh threads                        # list the channel's recent top-level threads (id, replies, author, text)\n#   core/scripts/hq-dm-bind.sh roster                         # print the channel members a post will @-mention\n#   core/scripts/hq-dm-bind.sh poll                           # print new messages since the cursor, advance it\n#   core/scripts/hq-dm-bind.sh listen [--interval 60] [--timeout 1800]\n#                                                             # block until a new message arrives (or timeout)\n#   core/scripts/hq-dm-bind.sh unbind\n#\n# The binding lives in the session's meta.yaml (`dm_channel`) via hq-session.sh;\n# the cursor is `workspace/sessions/<sid>/dm-bind.cursor` (the last seen sort\n# key from `hq dm channel --json`). `listen` is meant to run detached\n# (Bash run_in_background): it exits 0 and prints the new messages the moment\n# one lands, exits 3 on timeout with nothing new.\n#\n# Every post opens with an @-mention of every other member of the channel, so\n# the update reaches people (HQ mentions are structured: the `hq` CLI resolves\n# the `@\"Display Name\"` tokens against the roster and sends the real mention\n";
+export type DmBindDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    now: () => Date;
+    fs: typeof fs;
+    runHq: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    runHqSession: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    fetch: typeof fetch;
+    readStdin: () => Promise<string>;
+    sleep: (milliseconds: number) => Promise<void>;
+};
+export declare const createDmBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date, home?: string) => DmBindDeps;
+export declare function resolveDmBindSessionId(d: Pick<DmBindDeps, "root" | "env" | "fs">): string;
+export declare function runDmBind(args: string[], deps: DmBindDeps): Promise<UtilityOutput>;
+export declare function registerCoreDmBindNative(core: Command): void;
+//# sourceMappingURL=core-dm-bind-native.d.ts.map