@indigoai-us/hq-cli 5.309.1 → 5.311.0

package/dist/commands/core-hq-session-native.d.ts

@@ -0,0 +1,39 @@
+export declare const HQ_SESSION_ASSET = "core/scripts/hq-session.sh";
+export declare const HQ_SESSION_HELP: string;
+export type HqSessionResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type HqSessionDependencies = {
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    readFile: (filePath: string, encoding: BufferEncoding) => string;
+    exists: (filePath: string) => boolean;
+    isFile: (filePath: string) => boolean;
+    isDirectory: (filePath: string) => boolean;
+    isSymlink: (filePath: string) => boolean;
+    listDirectory: (directory: string) => string[];
+    mkdir: (directory: string) => void;
+    writeFile: (filePath: string, contents: string, mode?: number) => void;
+    rename: (from: string, to: string) => void;
+    remove: (filePath: string) => void;
+    makeTempPath: () => string;
+    umask: () => number;
+    findExecutable: (name: string, env?: NodeJS.ProcessEnv) => string | undefined;
+    spawnDetached: (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, logFile: string) => void;
+    runCommand: (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv) => {
+        status: number | null;
+        stdout: string;
+        stderr: string;
+        error?: Error;
+    };
+};
+/** In-process command body, with injectable file access for parity tests. */
+export declare function executeHqSession(argv: readonly string[], context: {
+    cwd: string;
+    hqRoot?: string;
+}, overrides?: Partial<HqSessionDependencies>): HqSessionResult;
+/** Signature consumed by the lightweight fast-core dispatcher. */
+export declare function runHqSessionFast(argv: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-hq-session-native.d.ts.map

package/dist/commands/core-hq-session-native.js

@@ -0,0 +1,579 @@
+/** Native fast-route implementation of the bundled hq-session.sh contract. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+export const HQ_SESSION_ASSET = "core/scripts/hq-session.sh";
+export const HQ_SESSION_HELP = [
+    "hq-core: public",
+    "hq-session.sh — read/write the current session's metadata.",
+    "",
+    "Usage:",
+    "  core/scripts/hq-session.sh current               # print current session_id (or empty)",
+    "  core/scripts/hq-session.sh path                  # print path to current meta.yaml",
+    "  core/scripts/hq-session.sh get <key>             # read a key from meta.yaml",
+    "  core/scripts/hq-session.sh set <key> <value>     # set/replace a top-level key",
+    "",
+    "Reserved value:",
+    "  set company_slug personal   # bind the session to no-company (personal) work",
+    "",
+    "Global option (before the subcommand):",
+    "  --session-id <id>   operate on this session instead of the resolved one",
+].join("\n") + "\n";
+const defaultDependencies = () => ({
+    env: process.env,
+    now: () => new Date(),
+    readFile: (filePath) => fs.readFileSync(filePath, "utf8"),
+    exists: (filePath) => fs.existsSync(filePath),
+    isFile: (filePath) => {
+        try {
+            return fs.statSync(filePath).isFile();
+        }
+        catch (error) {
+            if (isExpectedFsMiss(error))
+                return false;
+            throw error;
+        }
+    },
+    isDirectory: (filePath) => {
+        try {
+            return fs.statSync(filePath).isDirectory();
+        }
+        catch (error) {
+            if (isExpectedFsMiss(error))
+                return false;
+            throw error;
+        }
+    },
+    isSymlink: (filePath) => {
+        try {
+            return fs.lstatSync(filePath).isSymbolicLink();
+        }
+        catch (error) {
+            if (isExpectedFsMiss(error))
+                return false;
+            throw error;
+        }
+    },
+    listDirectory: (directory) => fs.readdirSync(directory),
+    mkdir: (directory) => fs.mkdirSync(directory, { recursive: true }),
+    writeFile: (filePath, contents, mode) => fs.writeFileSync(filePath, contents, mode === undefined ? undefined : { mode }),
+    rename: (from, to) => fs.renameSync(from, to),
+    remove: (filePath) => { try {
+        fs.unlinkSync(filePath);
+    }
+    catch (error) {
+        if (!isExpectedFsMiss(error))
+            throw error;
+    } },
+    makeTempPath: () => path.join(os.tmpdir(), `tmp.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`),
+    umask: () => process.umask(),
+    findExecutable: (name, env = process.env) => {
+        for (const directory of (env.PATH ?? "").split(path.delimiter)) {
+            if (!directory)
+                continue;
+            const candidate = path.join(directory, name);
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                return candidate;
+            }
+            catch (error) {
+                const code = error?.code;
+                if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES" && code !== "ELOOP")
+                    throw error;
+            }
+        }
+        return undefined;
+    },
+    spawnDetached: (command, args, cwd, env, logFile) => {
+        const output = fs.openSync(logFile, "a");
+        const child = spawn(command, args, { cwd, env, detached: true, stdio: ["ignore", output, output], windowsHide: true });
+        fs.closeSync(output);
+        child.once("error", (error) => {
+            fs.appendFileSync(logFile, `${error.message}\n`, { encoding: "utf8" });
+        });
+        child.unref();
+    },
+    runCommand: (command, args, cwd, env) => {
+        const result = spawnSync(command, args, { cwd, env, encoding: "utf8" });
+        return {
+            status: result.status,
+            stdout: result.stdout ?? "",
+            stderr: result.stderr ?? "",
+            ...(result.error ? { error: result.error } : {}),
+        };
+    },
+});
+function isExpectedFsMiss(error) {
+    const code = error?.code;
+    return code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "ELOOP";
+}
+function asciiWhitespace(value) {
+    return value.replace(/[\t\n\v\f\r ]/g, "");
+}
+function validSessionId(value) {
+    return value.length > 0 && value !== "." && value !== ".." && /^[A-Za-z0-9._-]+$/.test(value);
+}
+function sessionIdFromEnv(env) {
+    for (const name of [
+        "HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID",
+        "CODEX_SESSION_ID", "CODEX_THREAD_ID", "GROK_SESSION_ID",
+    ]) {
+        const value = asciiWhitespace(env[name] ?? "");
+        if (validSessionId(value))
+            return value;
+    }
+    return "";
+}
+function sessionIdFromCurrentFile(root, deps) {
+    const filePath = path.join(root, "workspace", "sessions", ".current");
+    if (!deps.isFile(filePath))
+        return "";
+    try {
+        const value = asciiWhitespace(deps.readFile(filePath, "utf8"));
+        return validSessionId(value) ? value : "";
+    }
+    catch (error) {
+        if (isExpectedFsMiss(error))
+            return "";
+        throw error;
+    }
+}
+function resolveSessionId(root, deps) {
+    return sessionIdFromEnv(deps.env) || sessionIdFromCurrentFile(root, deps);
+}
+function findMetaValue(contents, key) {
+    for (const line of contents.split("\n")) {
+        const first = line.match(/^\s*(\S+)/)?.[1] ?? "";
+        if (first !== `${key}:`)
+            continue;
+        return { found: true, value: line.replace(/^[^:]+:[\t ]*/, "").replace(/^"|"$/g, "") };
+    }
+    return { found: false, value: "" };
+}
+function getMetaValue(contents, key) { return findMetaValue(contents, key).value; }
+const WORK_MESH_SESSION_START_COMMAND = 'printf "%s" "$1" | bash "$2" SessionStart';
+function recordWorkMeshSessionStart(input) {
+    const hook = path.join(input.root, "core", "hooks", "SessionStart", "35-work-mesh-session-start.sh");
+    // Keep the shell hook as the single owner of SessionStart's Work Mesh behavior.
+    // The bundled hq-session helper skips this path if either dependency is absent.
+    if (!input.isFile(hook) || !input.findExecutable("jq", input.env))
+        return "";
+    const event = JSON.stringify({ session_id: input.sessionId, cwd: input.env.PWD || input.cwd });
+    if (!event)
+        return "";
+    const logFile = path.join(input.root, "workspace", "logs", "work-mesh-hook.log");
+    try {
+        input.mkdir(path.dirname(logFile));
+    }
+    catch { /* The shell also suppresses mkdir failure and attempts the redirected launch. */ }
+    try {
+        input.spawnDetached("nohup", ["bash", "-c", WORK_MESH_SESSION_START_COMMAND, "_", event, hook], input.cwd, {
+            ...input.env,
+            HQ_ROOT: input.root,
+            CLAUDE_CODE_SESSION_ID: input.sessionId,
+        }, logFile);
+        return "";
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return `${message}\n`;
+    }
+}
+function runWorkMeshProjectRebind(input) {
+    const library = path.join(input.root, "core", "scripts", "lib");
+    if (!input.isFile(path.join(library, "work-mesh-enqueue.sh")) ||
+        !input.isFile(path.join(library, "work-mesh-live-rebind.sh")))
+        return { stdout: "", stderr: "" };
+    const script = [
+        '. "$1/work-mesh-enqueue.sh" 2>/dev/null || true',
+        '. "$1/work-mesh-live-hook.sh" 2>/dev/null || true',
+        '. "$1/work-mesh-live-rebind.sh" 2>/dev/null || true',
+        'if [ -n "$4" ] && command -v work_mesh_live_rebind >/dev/null 2>&1; then',
+        '  work_mesh_live_rebind "$2" "$3" "$4" "$5" "$3" "$6" "$5" || true',
+        'elif command -v work_mesh_live_write_binding_marker >/dev/null 2>&1; then',
+        '  work_mesh_live_write_binding_marker "$2" "$3" "$6" "$5" || true',
+        'fi',
+    ].join("\n");
+    const childEnv = { ...input.env, HQ_ROOT: input.root, PWD: input.env.PWD || input.cwd };
+    const result = input.runCommand("bash", ["-c", script, "_", library, input.sessionId, input.company,
+        input.previousProject, input.task, input.project], input.cwd, childEnv);
+    if (result.error) {
+        const code = result.error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return { stdout: "", stderr: "" };
+        throw result.error;
+    }
+    return { stdout: result.stdout, stderr: result.stderr };
+}
+function recordHqSessionWorkMeshEffects(input, deps) {
+    if (input.key === "company_slug" && input.value && input.value !== input.previous && input.value !== "personal") {
+        const stderr = recordWorkMeshSessionStart({
+            sessionId: input.sessionId,
+            root: input.root,
+            cwd: input.cwd,
+            env: deps.env,
+            isFile: deps.isFile,
+            findExecutable: deps.findExecutable,
+            mkdir: deps.mkdir,
+            spawnDetached: deps.spawnDetached,
+        });
+        return { stdout: "", stderr };
+    }
+    if (input.key === "project" && input.value && input.value !== input.previous) {
+        return runWorkMeshProjectRebind({
+            sessionId: input.sessionId,
+            previousProject: input.previous,
+            project: input.value,
+            root: input.root,
+            cwd: input.cwd,
+            company: getMetaValue(input.metadata, "company_slug"),
+            task: getMetaValue(input.metadata, "task"),
+            env: deps.env,
+            isFile: deps.isFile,
+            runCommand: deps.runCommand,
+        });
+    }
+    return { stdout: "", stderr: "" };
+}
+function timestamp(date) {
+    return date.toISOString().slice(0, 19) + "Z";
+}
+function currentMetaPath(root, sessionOverride, deps) {
+    const id = sessionOverride || resolveSessionId(root, deps);
+    return id ? path.join(root, "workspace", "sessions", id, "meta.yaml") : "";
+}
+function exactCompanyDir(root, slug, deps) {
+    if (!root || !slug)
+        return false;
+    const companies = path.join(root, "companies");
+    try {
+        for (const entry of deps.listDirectory(companies)) {
+            const candidate = path.join(companies, entry);
+            if (!deps.isDirectory(candidate) || deps.isSymlink(candidate))
+                continue;
+            if (entry === slug)
+                return true;
+        }
+    }
+    catch (error) {
+        if (!isExpectedFsMiss(error))
+            throw error;
+    }
+    return false;
+}
+function hasCompanyCaseAlias(root, slug, deps) {
+    if (!root || !slug)
+        return false;
+    const companies = path.join(root, "companies");
+    let entries;
+    try {
+        entries = deps.listDirectory(companies);
+    }
+    catch (error) {
+        if (isExpectedFsMiss(error))
+            return false;
+        throw error;
+    }
+    const realEntries = entries.filter((entry) => {
+        const candidate = path.join(companies, entry);
+        return deps.isDirectory(candidate) && !deps.isSymlink(candidate);
+    });
+    if (realEntries.some((entry) => entry === slug))
+        return false;
+    const folded = slug.toLowerCase();
+    return realEntries.some((entry) => entry !== slug && entry.toLowerCase() === folded);
+}
+function hardPolicyLines(root, company, deps) {
+    if (!exactCompanyDir(root, company, deps))
+        return [];
+    const dir = path.join(root, "companies", company, "policies");
+    if (!deps.isDirectory(dir))
+        return [];
+    let files;
+    try {
+        files = deps.listDirectory(dir).sort();
+    }
+    catch (error) {
+        if (isExpectedFsMiss(error))
+            return [];
+        throw error;
+    }
+    const result = [];
+    for (const basename of files) {
+        if (!basename.endsWith(".md") || /^_digest.*\.md$/.test(basename) || basename === "README.md" ||
+            basename === "readme.md" || basename === "example-policy.md" || basename.includes(".conflict-") || basename.includes(" "))
+            continue;
+        const filePath = path.join(dir, basename);
+        let body;
+        try {
+            body = deps.readFile(filePath, "utf8");
+        }
+        catch (error) {
+            if (isExpectedFsMiss(error))
+                continue;
+            throw error;
+        }
+        const lines = body.split("\n");
+        let delimiters = 0;
+        let id = "";
+        let enforcement = "";
+        let ruleSection = false;
+        let rule = "";
+        for (const line of lines) {
+            if (/^---[\t ]*$/.test(line)) {
+                delimiters += 1;
+                if (delimiters >= 2 && ruleSection)
+                    ruleSection = false;
+                continue;
+            }
+            if (delimiters === 1) {
+                const idMatch = line.match(/^id:[\t ]*(.*)$/);
+                if (idMatch)
+                    id = (idMatch[1] ?? "").replace(/^["']|["']$/g, "");
+                const enforceMatch = line.match(/^enforcement:[\t ]*(.*)$/);
+                if (enforceMatch)
+                    enforcement = (enforceMatch[1] ?? "").replace(/[\t ]/g, "");
+                if (/^status:[\t ]*retired/.test(line))
+                    enforcement = "";
+            }
+            if (delimiters >= 2 && line === "## Rule") {
+                ruleSection = true;
+                continue;
+            }
+            if (delimiters >= 2 && ruleSection && line.startsWith("## ")) {
+                ruleSection = false;
+                continue;
+            }
+            if (delimiters >= 2 && ruleSection && !rule && line.trim()) {
+                rule = line.replaceAll("**", "");
+                if (rule.length > 160)
+                    rule = `${rule.slice(0, 157)}...`;
+            }
+        }
+        if (enforcement !== "hard" || !rule)
+            continue;
+        const policyId = id || basename.replace(/\.md$/, "");
+        result.push(`- [hard] **${policyId}**: ${rule} Full text: \`companies/${company}/policies/${basename}\`.`);
+    }
+    return result;
+}
+function awkNumericValue(value, fallback) {
+    if (!value)
+        return fallback;
+    const match = value.match(/^\s*([+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?)/);
+    return match ? Number(match[1]) : 0;
+}
+function emitHardPolicies(root, company, deps) {
+    const lines = hardPolicyLines(root, company, deps);
+    if (!lines.length)
+        return "";
+    const cap = awkNumericValue(deps.env.HQ_COMPANY_BIND_POLICY_CAP, 32);
+    const maxBytes = awkNumericValue(deps.env.HQ_COMPANY_BIND_POLICY_BYTES, 7168);
+    let bytes = 0;
+    let kept = 0;
+    for (let index = 0; index < lines.length; index += 1) {
+        const next = Buffer.byteLength(lines[index], "utf8") + 1;
+        if (index + 1 > cap || bytes + next > maxBytes)
+            break;
+        bytes += next;
+        kept += 1;
+    }
+    const dropped = lines.length - kept;
+    const output = [
+        "",
+        `<company-policy-digest co="${company}">`,
+        `# ${company} hard-enforcement policies (auto-surfaced on company bind)`,
+        "> Company context just bound mid-session. These HARD rules now apply.",
+        `> Full text: open the file path shown on each policy line. Browse \`companies/${company}/policies/\` for the full set.`,
+        "",
+        ...lines.slice(0, kept),
+    ];
+    if (dropped > 0) {
+        output.push("", `> ${dropped} more hard ${dropped === 1 ? "policy" : "policies"} not shown (bind budget: ${Math.trunc(cap)} policies / ${Math.trunc(maxBytes)} bytes). Browse \`companies/${company}/policies/\` for the full set; matching rules re-surface via the policy trigger hook when they apply.`);
+    }
+    output.push("</company-policy-digest>");
+    return `${output.join("\n")}\n`;
+}
+function validateSenior(value) {
+    if (value === "user")
+        return true;
+    const match = value.match(/^(session|lane):(.*)$/);
+    if (!match)
+        return false;
+    const id = match[2];
+    return id !== "" && id !== "." && id !== ".." && /^[A-Za-z0-9._-]+$/.test(id);
+}
+function atomicWrite(filePath, contents, deps) {
+    const temp = deps.makeTempPath();
+    try {
+        deps.writeFile(temp, contents, 0o600);
+        deps.rename(temp, filePath);
+    }
+    catch (error) {
+        deps.remove(temp);
+        throw error;
+    }
+}
+function mintScopeCapability(root, sessionId, company, deps) {
+    if (!root || !sessionId || !company || !/^[A-Za-z0-9_-]+$/.test(company))
+        return false;
+    const directory = path.join(root, "workspace", "sessions", sessionId);
+    const filePath = path.join(directory, "scope-capability.json");
+    try {
+        deps.mkdir(directory);
+        const value = { session_id: sessionId, company_slug: company, minted_at: timestamp(deps.now()) };
+        atomicWrite(filePath, `${JSON.stringify(value, null, 2)}\n`, deps);
+        return true;
+    }
+    catch (error) {
+        if (isExpectedFsMiss(error))
+            return false;
+        throw error;
+    }
+}
+/** In-process command body, with injectable file access for parity tests. */
+export function executeHqSession(argv, context, overrides = {}) {
+    const deps = { ...defaultDependencies(), ...overrides };
+    const root = context.hqRoot || context.cwd;
+    let sessionOverride = "";
+    let index = 0;
+    while (index < argv.length) {
+        const value = argv[index];
+        if (value === "--session-id") {
+            sessionOverride = argv[index + 1] ?? "";
+            if (!validSessionId(sessionOverride))
+                return { code: 1, stdout: "", stderr: `hq-session: invalid --session-id: '${sessionOverride}'\n` };
+            index += 2;
+            continue;
+        }
+        if (value?.startsWith("--session-id=")) {
+            sessionOverride = value.slice("--session-id=".length);
+            if (!validSessionId(sessionOverride))
+                return { code: 1, stdout: "", stderr: `hq-session: invalid --session-id: '${sessionOverride}'\n` };
+            index += 1;
+            continue;
+        }
+        break;
+    }
+    const subcommand = argv[index] ?? "";
+    const args = argv.slice(index + 1);
+    if (!subcommand || subcommand === "-h" || subcommand === "--help" || subcommand === "help") {
+        return { code: 0, stdout: HQ_SESSION_HELP, stderr: "" };
+    }
+    if (!["current", "path", "get", "set"].includes(subcommand)) {
+        return { code: 1, stdout: "", stderr: `hq-session: unknown subcommand '${subcommand}'\n${HQ_SESSION_HELP}` };
+    }
+    if (subcommand === "current") {
+        return { code: 0, stdout: sessionOverride || resolveSessionId(root, deps), stderr: "" };
+    }
+    const metaPath = currentMetaPath(root, sessionOverride, deps);
+    if (subcommand === "path")
+        return { code: 0, stdout: metaPath, stderr: "" };
+    if (subcommand === "get") {
+        const key = args[0] ?? "";
+        if (!key)
+            return { code: 1, stdout: "", stderr: "usage: hq-session.sh get <key>\n" };
+        if (!metaPath || !deps.isFile(metaPath))
+            return { code: 0, stdout: "", stderr: "" };
+        try {
+            const result = findMetaValue(deps.readFile(metaPath, "utf8"), key);
+            return { code: 0, stdout: result.found ? `${result.value}\n` : "", stderr: "" };
+        }
+        catch (error) {
+            if (error?.code === "EACCES" || error?.code === "EPERM") {
+                return { code: 2, stdout: "", stderr: `awk: fatal: cannot open file \`${metaPath}' for reading: Permission denied\n` };
+            }
+            if (isExpectedFsMiss(error))
+                return { code: 1, stdout: "", stderr: `awk: cannot open ${metaPath} (Permission denied)\n` };
+            throw error;
+        }
+    }
+    const key = args[0] ?? "";
+    const value = args[1] ?? "";
+    if (!key || args.length < 2)
+        return { code: 1, stdout: "", stderr: "usage: hq-session.sh set <key> <value>\n" };
+    if (key === "company_slug" && value) {
+        if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+            return { code: 1, stdout: "", stderr: `hq-session: invalid company_slug: '${value}' (allowed characters: A-Z a-z 0-9 - _)\n` };
+        }
+        const dir = path.join(root, "companies", value);
+        if (value !== "personal" && (deps.isSymlink(dir) || hasCompanyCaseAlias(root, value, deps))) {
+            return { code: 1, stdout: "", stderr: `hq-session: company_slug must use the exact real directory name: '${value}'\n` };
+        }
+    }
+    if (key === "senior" && !validateSenior(value)) {
+        return { code: 1, stdout: "", stderr: `hq-session: invalid senior: '${value}' (accepted forms: user, session:<id>, lane:<id>)\n` };
+    }
+    const sessionId = sessionOverride || resolveSessionId(root, deps);
+    if (!sessionId) {
+        return {
+            code: 1,
+            stdout: "",
+            stderr: "hq-session: no current session — no session id in the environment (HQ_SESSION_ID, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID, CODEX_SESSION_ID, CODEX_THREAD_ID) and workspace/sessions/.current is missing or invalid. Is master-hook installed? Pass --session-id <id> to target a session explicitly.\n",
+        };
+    }
+    const target = path.join(root, "workspace", "sessions", sessionId, "meta.yaml");
+    try {
+        deps.mkdir(path.dirname(target));
+        if (!deps.isFile(target)) {
+            const initial = `session_id: ${sessionId}\nstarted_at: "${timestamp(deps.now())}"\nsenior: user\n`;
+            deps.writeFile(target, initial, 0o666 & ~deps.umask());
+        }
+        let previous = "";
+        try {
+            previous = getMetaValue(deps.readFile(target, "utf8"), key);
+        }
+        catch {
+            previous = "";
+        }
+        const oldText = deps.readFile(target, "utf8");
+        const records = oldText.split("\n");
+        if (records.at(-1) === "")
+            records.pop();
+        let found = false;
+        const replaced = records.map((line) => {
+            const first = line.match(/^\s*(\S+)/)?.[1] ?? "";
+            if (first !== `${key}:`)
+                return line;
+            found = true;
+            return `${key}: ${value}`;
+        });
+        if (!found)
+            replaced.push(`${key}: ${value}`);
+        const updatedText = `${replaced.join("\n")}\n`;
+        atomicWrite(target, updatedText, deps);
+        let stdout = "";
+        if (key === "company_slug" && value && value !== previous) {
+            if (!mintScopeCapability(root, sessionId, value, deps)) {
+                return { code: 1, stdout: "", stderr: `hq-session: failed to mint scope-capability for session ${sessionId}\n` };
+            }
+            if (value !== "personal")
+                stdout = emitHardPolicies(root, value, deps);
+        }
+        const workMeshOutput = recordHqSessionWorkMeshEffects({
+            key,
+            value,
+            previous,
+            sessionId,
+            root,
+            cwd: deps.env.PWD || context.cwd,
+            metadata: updatedText,
+        }, deps);
+        return { code: 0, stdout: stdout + workMeshOutput.stdout, stderr: workMeshOutput.stderr };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { code: 1, stdout: "", stderr: `${message}\n` };
+    }
+}
+/** Signature consumed by the lightweight fast-core dispatcher. */
+export async function runHqSessionFast(argv, _stdin, cwd, hqRoot) {
+    const result = executeHqSession(argv, { cwd, hqRoot });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-hq-session-native.js.map

package/dist/commands/core-jobs-native.js

@@ -291,10 +291,7 @@ function asText(value) {
     return String(value);
 }
 function matchingJobSecretPatterns(value) {
-    // jobs-validate.sh calls grep with a leading-hyphen pattern and omits `--`.
-    // Preserve that shell behavior: grep interprets this class as an option.
-    return matchingSecretPatterns(value, { requireBoundary: false })
-        .filter((name) => name !== "Private key");
+    return matchingSecretPatterns(value, { requireBoundary: false });
 }
 function validateCwd(file, field, cwd, emit) {
     if (cwd.startsWith("/")) {

package/dist/commands/core-native-session-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off rollout gate for native session and Stop-hook plumbing. */
+export declare const CORE_NATIVE_SESSION_FLAG = "core-native-session";
+export declare function coreNativeSessionEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-session-flag.d.ts.map

package/dist/commands/core-native-session-flag.js

@@ -0,0 +1,7 @@
+/** Default-off rollout gate for native session and Stop-hook plumbing. */
+export const CORE_NATIVE_SESSION_FLAG = "core-native-session";
+export async function coreNativeSessionEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_NATIVE_SESSION_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-native-session-flag.js.map

package/dist/commands/core-native-utilities.d.ts

@@ -5,6 +5,7 @@ export type UtilityOutput = {
     code: number;
     stdout: string;
     stderr: string;
+    stderrBytes?: Uint8Array;
 };
 export type UtilityContext = {
     root: string;
@@ -18,7 +19,7 @@ export type NativeUtilityDefinition = {
     root: CoreCommandRoot;
     summary: string;
     resolveRoot: (cwd: string, hqRoot?: string) => string;
-    run: (args: string[], context: UtilityContext) => UtilityOutput;
+    run: (args: string[], context: UtilityContext) => UtilityOutput | Promise<UtilityOutput>;
 };
 /** Register one raw-argv command and retain the original shell as rollback. */
 export declare function registerNativeUtility(core: Command, definition: NativeUtilityDefinition): void;

package/dist/commands/core-native-utilities.js

@@ -31,10 +31,12 @@ export function registerNativeUtility(core, definition) {
                 process.exitCode = result.code;
             return;
         }
-        const result = definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
+        const result = await definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
         if (result.stdout)
             process.stdout.write(result.stdout);
-        if (result.stderr)
+        if (result.stderrBytes)
+            process.stderr.write(result.stderrBytes);
+        else if (result.stderr)
             process.stderr.write(result.stderr);
         if (result.code !== 0)
             process.exitCode = result.code;

package/dist/commands/core-native-worker-skills-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off rollout gate for native worker-scoped skill commands. */
+export declare const CORE_NATIVE_WORKER_SKILLS_FLAG = "core-native-worker-skills";
+export declare function coreNativeWorkerSkillsEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-worker-skills-flag.d.ts.map