@indigoai-us/hq-cli 5.309.1 → 5.310.0

package/dist/commands/core-native-utilities.d.ts

@@ -5,6 +5,7 @@ export type UtilityOutput = {
     code: number;
     stdout: string;
     stderr: string;
+    stderrBytes?: Uint8Array;
 };
 export type UtilityContext = {
     root: string;
@@ -18,7 +19,7 @@ export type NativeUtilityDefinition = {
     root: CoreCommandRoot;
     summary: string;
     resolveRoot: (cwd: string, hqRoot?: string) => string;
-    run: (args: string[], context: UtilityContext) => UtilityOutput;
+    run: (args: string[], context: UtilityContext) => UtilityOutput | Promise<UtilityOutput>;
 };
 /** Register one raw-argv command and retain the original shell as rollback. */
 export declare function registerNativeUtility(core: Command, definition: NativeUtilityDefinition): void;

package/dist/commands/core-native-utilities.js

@@ -31,10 +31,12 @@ export function registerNativeUtility(core, definition) {
                 process.exitCode = result.code;
             return;
         }
-        const result = definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
+        const result = await definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
         if (result.stdout)
             process.stdout.write(result.stdout);
-        if (result.stderr)
+        if (result.stderrBytes)
+            process.stderr.write(result.stderrBytes);
+        else if (result.stderr)
             process.stderr.write(result.stderr);
         if (result.code !== 0)
             process.exitCode = result.code;

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -0,0 +1,32 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export declare const WORK_MESH_BIND_TRUSTED_HELP = "hq-core: public\nUS-011 \u2014 write session meta + reconcile with observation.trustedContext.\nNo --trusted CLI flag in hq-cli; trusted bind is the observation field.\nset -euo pipefail\n\nROOT=\"${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}\"\nif [ -z \"$ROOT\" ]; then\n";
+export type WorkMeshBindDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    fs: typeof fs;
+    runHq: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    spawnHq: (args: string[], env: NodeJS.ProcessEnv) => void;
+    pid: number;
+    tmpDir: string;
+    ulid: (now: Date) => string;
+};
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
+export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
+export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -0,0 +1,190 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { generateUlid } from "../lib/mesh/live/ulid.js";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
+US-011 — write session meta + reconcile with observation.trustedContext.
+No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+`;
+export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+    root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    runHq: (args, childEnv) => {
+        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    runHqSession: (scriptRoot, args, childEnv) => {
+        const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    spawnHq: (args, childEnv) => {
+        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
+        child.unref();
+    },
+});
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
+        const value = (env[key] ?? "").replace(/\s/g, "");
+        if (value)
+            return value;
+    }
+    try {
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+        return value;
+    }
+    catch {
+        return "";
+    }
+}
+function hasExecutable(deps, command) {
+    for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        try {
+            const stat = deps.fs.statSync(path.join(directory, command));
+            if (stat.isFile() && (stat.mode & 0o111) !== 0)
+                return true;
+        }
+        catch { /* PATH entry is absent */ }
+    }
+    return false;
+}
+function workMeshJsonQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
+}
+function workMeshObservationJson(observation) {
+    const identity = observation.identity;
+    const trusted = observation.trustedContext;
+    let json = `{"contractVersion":1,"clientOperationId":${workMeshJsonQuote(String(observation.clientOperationId))},"identity":{"sessionId":${workMeshJsonQuote(identity.sessionId)},"harness":${workMeshJsonQuote(identity.harness)},"adapterVersion":${workMeshJsonQuote(identity.adapterVersion)}},"cwd":${workMeshJsonQuote(String(observation.cwd))},"hqRoot":${workMeshJsonQuote(String(observation.hqRoot))}`;
+    if (trusted) {
+        json += ',"trustedContext":{';
+        let first = true;
+        for (const [key, value] of Object.entries(trusted)) {
+            if (!first)
+                json += ",";
+            first = false;
+            json += `${workMeshJsonQuote(key)}:${workMeshJsonQuote(value)}`;
+        }
+        json += "}";
+    }
+    return `${json}}`;
+}
+export function runWorkMeshBindTrusted(args, deps) {
+    let root = deps.env.HQ_ROOT || deps.env.CLAUDE_PROJECT_DIR || deps.root;
+    let company = "", project = "", task = "", sid = "", noReconcile = false;
+    const output = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (["--company", "--company-slug", "--project", "--task", "--session", "--session-id", "--root"].includes(arg)) {
+            const value = args[i + 1] ?? "";
+            if (arg === "--company" || arg === "--company-slug")
+                company = value;
+            else if (arg === "--project")
+                project = value;
+            else if (arg === "--task")
+                task = value;
+            else if (arg === "--session" || arg === "--session-id")
+                sid = value;
+            else
+                root = value;
+            i += 2;
+        }
+        else if (arg === "--no-reconcile") {
+            noReconcile = true;
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { code: 0, stdout: WORK_MESH_BIND_TRUSTED_HELP.replace(/^# ?/gm, ""), stderr: "" };
+        else
+            i += 1;
+    }
+    if (!sid) {
+        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
+        if (!sid) {
+            try {
+                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+            }
+            catch {
+                sid = "";
+            }
+        }
+    }
+    const childEnv = { ...deps.env, HQ_ROOT: root };
+    const pin = sid ? ["--session-id", sid] : [];
+    let stderr = "";
+    for (const [key, value] of [["company_slug", company], ["project", project], ["task", task]]) {
+        if (!value)
+            continue;
+        const result = deps.runHqSession(root, [...pin, "set", key, value], deps.env);
+        output.push(result.stdout);
+        stderr += result.stderr;
+        if (result.code !== 0)
+            return { code: result.code, stdout: output.join(""), stderr };
+    }
+    if (noReconcile || !sid)
+        return { code: 0, stdout: output.join(""), stderr };
+    let harness = deps.env.HQ_HARNESS || deps.env.HQ_WORK_MESH_HARNESS || "claude-code";
+    if (["claude", "Claude", "ClaudeCode"].includes(harness))
+        harness = "claude-code";
+    else if (harness === "Codex")
+        harness = "codex";
+    else if (harness === "Grok")
+        harness = "grok";
+    const adapter = deps.env.HQ_ADAPTER_CONTRACT_VERSION || "1.0.0";
+    const clientOperationId = deps.ulid(deps.now());
+    const observation = {
+        contractVersion: 1,
+        clientOperationId,
+        identity: { sessionId: sid, harness, adapterVersion: adapter },
+        cwd: deps.env.PWD ?? "",
+        hqRoot: root,
+    };
+    if (company || project || task) {
+        const trusted = {};
+        if (company)
+            trusted.companySlug = company;
+        if (project)
+            trusted.project = project;
+        if (task)
+            trusted.task = task;
+        observation.trustedContext = trusted;
+    }
+    const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");
+    try {
+        deps.fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        deps.fs.chmodSync(directory, 0o700);
+    }
+    catch { /* legacy mkdir/chmod are best effort */ }
+    const observationFile = path.join(directory, `${sid}.bind.${deps.pid}.json`);
+    try {
+        deps.fs.writeFileSync(observationFile, `${workMeshObservationJson(observation)}\n`);
+    }
+    catch { /* legacy printf redirection failure is non-fatal */ }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_LOG) {
+        try {
+            deps.fs.appendFileSync(deps.env.HQ_WORK_MESH_RECONCILE_LOG, `reconcile-trusted ${observationFile}\n`);
+        }
+        catch { /* legacy log write is best effort */ }
+    }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
+        return { code: 0, stdout: output.join(""), stderr };
+    if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
+        deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
+    }
+    return { code: 0, stdout: output.join(""), stderr };
+}
+export function registerCoreWorkMeshBindTrustedNative(core) {
+    registerNativeUtility(core, {
+        name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+    });
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map

package/dist/commands/core.js

@@ -40,9 +40,11 @@ import { registerCoreJobsNativeCommand } from "./core-job-native.js";
 import { registerCoreResolveCompanyNativeCommand } from "./core-resolve-company-command.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { registerCoreAuditLogNative } from "./core-audit-log-native.js";
+import { registerCoreDmBindNative } from "./core-dm-bind-native.js";
 import { registerCoreGitPackExtensionCheckNative } from "./core-git-pack-extension-check-native.js";
 import { registerCorePinNative } from "./core-pin-native.js";
 import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
+import { registerCoreWorkMeshBindTrustedNative } from "./core-work-mesh-bind-trusted-native.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -227,6 +229,8 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-job-run.sh", root: "live", summary: "Scheduled jobs runner used by generated systemd units" },
     { asset: "core/scripts/hq-job-notify.sh", root: "live", summary: "Scheduled jobs failure notification helper" },
     { asset: "core/scripts/hq-job-remediate.sh", root: "live", summary: "Scheduled jobs bounded remediation helper" },
+    { asset: "core/scripts/hq-dm-bind.sh", root: "live", summary: "Rollback shell for native dm-bind" },
+    { asset: "core/scripts/work-mesh-live-bind-trusted.sh", root: "live", summary: "Rollback shell for native work-mesh-bind-trusted" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -372,6 +376,8 @@ export function registerCoreCommands(program) {
     registerCoreGitPackExtensionCheckNative(core);
     registerCorePinNative(core);
     registerCoreRefreshVaultAccessNative(core);
+    registerCoreDmBindNative(core);
+    registerCoreWorkMeshBindTrustedNative(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.309.1",
+  "version": "5.310.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {