@indigoai-us/hq-cli 5.309.1 → 5.311.0

package/dist/commands/core-native-worker-skills-flag.js

@@ -0,0 +1,7 @@
+/** Default-off rollout gate for native worker-scoped skill commands. */
+export const CORE_NATIVE_WORKER_SKILLS_FLAG = "core-native-worker-skills";
+export async function coreNativeWorkerSkillsEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_NATIVE_WORKER_SKILLS_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-native-worker-skills-flag.js.map

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -0,0 +1,32 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export declare const WORK_MESH_BIND_TRUSTED_HELP = "hq-core: public\nUS-011 \u2014 write session meta + reconcile with observation.trustedContext.\nNo --trusted CLI flag in hq-cli; trusted bind is the observation field.\nset -euo pipefail\n\nROOT=\"${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}\"\nif [ -z \"$ROOT\" ]; then\n";
+export type WorkMeshBindDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    fs: typeof fs;
+    runHq: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    spawnHq: (args: string[], env: NodeJS.ProcessEnv) => void;
+    pid: number;
+    tmpDir: string;
+    ulid: (now: Date) => string;
+};
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
+export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
+export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -0,0 +1,190 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { generateUlid } from "../lib/mesh/live/ulid.js";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
+US-011 — write session meta + reconcile with observation.trustedContext.
+No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+`;
+export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+    root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    runHq: (args, childEnv) => {
+        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    runHqSession: (scriptRoot, args, childEnv) => {
+        const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    spawnHq: (args, childEnv) => {
+        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
+        child.unref();
+    },
+});
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
+        const value = (env[key] ?? "").replace(/\s/g, "");
+        if (value)
+            return value;
+    }
+    try {
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+        return value;
+    }
+    catch {
+        return "";
+    }
+}
+function hasExecutable(deps, command) {
+    for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        try {
+            const stat = deps.fs.statSync(path.join(directory, command));
+            if (stat.isFile() && (stat.mode & 0o111) !== 0)
+                return true;
+        }
+        catch { /* PATH entry is absent */ }
+    }
+    return false;
+}
+function workMeshJsonQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
+}
+function workMeshObservationJson(observation) {
+    const identity = observation.identity;
+    const trusted = observation.trustedContext;
+    let json = `{"contractVersion":1,"clientOperationId":${workMeshJsonQuote(String(observation.clientOperationId))},"identity":{"sessionId":${workMeshJsonQuote(identity.sessionId)},"harness":${workMeshJsonQuote(identity.harness)},"adapterVersion":${workMeshJsonQuote(identity.adapterVersion)}},"cwd":${workMeshJsonQuote(String(observation.cwd))},"hqRoot":${workMeshJsonQuote(String(observation.hqRoot))}`;
+    if (trusted) {
+        json += ',"trustedContext":{';
+        let first = true;
+        for (const [key, value] of Object.entries(trusted)) {
+            if (!first)
+                json += ",";
+            first = false;
+            json += `${workMeshJsonQuote(key)}:${workMeshJsonQuote(value)}`;
+        }
+        json += "}";
+    }
+    return `${json}}`;
+}
+export function runWorkMeshBindTrusted(args, deps) {
+    let root = deps.env.HQ_ROOT || deps.env.CLAUDE_PROJECT_DIR || deps.root;
+    let company = "", project = "", task = "", sid = "", noReconcile = false;
+    const output = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (["--company", "--company-slug", "--project", "--task", "--session", "--session-id", "--root"].includes(arg)) {
+            const value = args[i + 1] ?? "";
+            if (arg === "--company" || arg === "--company-slug")
+                company = value;
+            else if (arg === "--project")
+                project = value;
+            else if (arg === "--task")
+                task = value;
+            else if (arg === "--session" || arg === "--session-id")
+                sid = value;
+            else
+                root = value;
+            i += 2;
+        }
+        else if (arg === "--no-reconcile") {
+            noReconcile = true;
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { code: 0, stdout: WORK_MESH_BIND_TRUSTED_HELP.replace(/^# ?/gm, ""), stderr: "" };
+        else
+            i += 1;
+    }
+    if (!sid) {
+        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
+        if (!sid) {
+            try {
+                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+            }
+            catch {
+                sid = "";
+            }
+        }
+    }
+    const childEnv = { ...deps.env, HQ_ROOT: root };
+    const pin = sid ? ["--session-id", sid] : [];
+    let stderr = "";
+    for (const [key, value] of [["company_slug", company], ["project", project], ["task", task]]) {
+        if (!value)
+            continue;
+        const result = deps.runHqSession(root, [...pin, "set", key, value], deps.env);
+        output.push(result.stdout);
+        stderr += result.stderr;
+        if (result.code !== 0)
+            return { code: result.code, stdout: output.join(""), stderr };
+    }
+    if (noReconcile || !sid)
+        return { code: 0, stdout: output.join(""), stderr };
+    let harness = deps.env.HQ_HARNESS || deps.env.HQ_WORK_MESH_HARNESS || "claude-code";
+    if (["claude", "Claude", "ClaudeCode"].includes(harness))
+        harness = "claude-code";
+    else if (harness === "Codex")
+        harness = "codex";
+    else if (harness === "Grok")
+        harness = "grok";
+    const adapter = deps.env.HQ_ADAPTER_CONTRACT_VERSION || "1.0.0";
+    const clientOperationId = deps.ulid(deps.now());
+    const observation = {
+        contractVersion: 1,
+        clientOperationId,
+        identity: { sessionId: sid, harness, adapterVersion: adapter },
+        cwd: deps.env.PWD ?? "",
+        hqRoot: root,
+    };
+    if (company || project || task) {
+        const trusted = {};
+        if (company)
+            trusted.companySlug = company;
+        if (project)
+            trusted.project = project;
+        if (task)
+            trusted.task = task;
+        observation.trustedContext = trusted;
+    }
+    const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");
+    try {
+        deps.fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        deps.fs.chmodSync(directory, 0o700);
+    }
+    catch { /* legacy mkdir/chmod are best effort */ }
+    const observationFile = path.join(directory, `${sid}.bind.${deps.pid}.json`);
+    try {
+        deps.fs.writeFileSync(observationFile, `${workMeshObservationJson(observation)}\n`);
+    }
+    catch { /* legacy printf redirection failure is non-fatal */ }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_LOG) {
+        try {
+            deps.fs.appendFileSync(deps.env.HQ_WORK_MESH_RECONCILE_LOG, `reconcile-trusted ${observationFile}\n`);
+        }
+        catch { /* legacy log write is best effort */ }
+    }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
+        return { code: 0, stdout: output.join(""), stderr };
+    if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
+        deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
+    }
+    return { code: 0, stdout: output.join(""), stderr };
+}
+export function registerCoreWorkMeshBindTrustedNative(core) {
+    registerNativeUtility(core, {
+        name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+    });
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map

package/dist/commands/core-worker-lint-native.d.ts

@@ -0,0 +1,4 @@
+import { type WorkerSkillDependencies, type WorkerSkillResult } from "./core-worker-skills-runtime.js";
+export declare const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
+export declare function runWorkerSkillLint(args: string[], dependencies: WorkerSkillDependencies): WorkerSkillResult;
+//# sourceMappingURL=core-worker-lint-native.d.ts.map

package/dist/commands/core-worker-lint-native.js

@@ -0,0 +1,160 @@
+/** Native port of lint-shared-worker-skills.sh. */
+import * as crypto from "node:crypto";
+import * as path from "node:path";
+import { errorCode, missingOrUnreadable, resolveWorkerCallerRoot, } from "./core-worker-skills-runtime.js";
+export const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
+const DEFAULT_ROOTS = ["core/workers", "core/packages"];
+function joinFindPath(parent, child) {
+    return `${parent}${parent.endsWith("/") ? "" : "/"}${child}`;
+}
+function matchesFindPredicate(displayPath) {
+    // GNU/BSD find's `-path '*/skills/*.md'` glob lets `*` span `/`, but still
+    // requires a slash before `skills/`. In particular `skills/x.md` does not
+    // match while `./skills/x.md` and `workers/a/skills/x.md` do.
+    if (!/.+\/skills\/.*\.md$/.test(displayPath))
+        return false;
+    const name = displayPath.slice(displayPath.lastIndexOf("/") + 1);
+    if (name.startsWith("._"))
+        return false;
+    // Mirrors find's `-not -path '*/.*/*'`: a hidden directory is excluded only
+    // when it has a slash before and after the dot-prefixed component.
+    return !/\/\.[^/]*\//.test(displayPath);
+}
+function collectEntries(rootArg, cwd, fileSystem) {
+    const entries = [];
+    const visit = (displayPath) => {
+        const absolutePath = path.resolve(cwd, displayPath);
+        let info;
+        try {
+            info = fileSystem.lstatSync(absolutePath);
+        }
+        catch (error) {
+            if (missingOrUnreadable(error))
+                return;
+            throw error;
+        }
+        if (info.isDirectory()) {
+            let names;
+            try {
+                names = fileSystem.readdirSync(absolutePath);
+            }
+            catch (error) {
+                if (missingOrUnreadable(error))
+                    return;
+                throw error;
+            }
+            for (const name of names)
+                visit(joinFindPath(displayPath, name));
+            return;
+        }
+        if ((info.isFile() || info.isSymbolicLink()) && matchesFindPredicate(displayPath)) {
+            entries.push({ displayPath, absolutePath, symlink: info.isSymbolicLink() });
+        }
+    };
+    visit(rootArg);
+    return entries;
+}
+function ownershipDomain(displayPath) {
+    const value = displayPath.startsWith("./") ? displayPath.slice(2) : displayPath;
+    if (value.startsWith("core/packages/")) {
+        const rest = value.slice("core/packages/".length);
+        return `core/packages/${rest.split("/", 1)[0]}`;
+    }
+    if (value.startsWith("companies/")) {
+        const rest = value.slice("companies/".length);
+        return `companies/${rest.split("/", 1)[0]}`;
+    }
+    if (value === "core/workers" || value.startsWith("core/workers/"))
+        return "core/workers";
+    return value.split("/", 1)[0] ?? "";
+}
+function readFileForHash(filePath, fileSystem) {
+    const content = fileSystem.readFileSync(filePath);
+    return Buffer.isBuffer(content) ? content : Buffer.from(content);
+}
+function brokenLink(filePath, fileSystem) {
+    try {
+        fileSystem.statSync(filePath);
+        return false;
+    }
+    catch (error) {
+        if (missingOrUnreadable(error))
+            return true;
+        throw error;
+    }
+}
+function sorted(entries) {
+    // The legacy command pipes `find` into `sort`; the project environment uses
+    // the C locale, so preserve its byte ordering instead of ICU collation.
+    return entries.sort((left, right) => left.displayPath < right.displayPath ? -1 : left.displayPath > right.displayPath ? 1 : 0);
+}
+function resultError(error) {
+    const code = errorCode(error);
+    if (code === "EACCES" || code === "EPERM") {
+        return { code: 1, stdout: "", stderr: `md5sum: failed to read file: ${error instanceof Error ? error.message : String(error)}\n` };
+    }
+    throw error;
+}
+export function runWorkerSkillLint(args, dependencies) {
+    const { root, fs: fileSystem } = resolveWorkerCallerRoot(dependencies);
+    const roots = args.length > 0 ? args : DEFAULT_ROOTS;
+    const entries = sorted(roots.flatMap((entry) => collectEntries(entry, root, fileSystem)));
+    if (entries.length === 0) {
+        return {
+            code: 0,
+            stdout: `OK: worker-scoped skills are single-sourced (0 skill entries under: ${roots.join(" ")})\n`,
+            stderr: "",
+        };
+    }
+    const broken = [];
+    const hashGroups = new Map();
+    try {
+        for (const entry of entries) {
+            if (entry.symlink) {
+                if (brokenLink(entry.absolutePath, fileSystem))
+                    broken.push(entry.displayPath);
+                continue;
+            }
+            const digest = crypto.createHash("md5").update(readFileForHash(entry.absolutePath, fileSystem)).digest("hex");
+            const domain = ownershipDomain(entry.displayPath);
+            const key = `${domain}|${digest}`;
+            const group = hashGroups.get(key);
+            if (group)
+                group.paths.push(entry.displayPath);
+            else
+                hashGroups.set(key, { domain, paths: [entry.displayPath] });
+        }
+    }
+    catch (error) {
+        return resultError(error);
+    }
+    const duplicates = [...hashGroups.values()].filter((group) => group.paths.length >= 2);
+    const findings = duplicates.length + broken.length;
+    if (findings === 0) {
+        return {
+            code: 0,
+            stdout: `OK: worker-scoped skills are single-sourced (${entries.length} skill entries scanned under: ${roots.join(" ")})\n`,
+            stderr: "",
+        };
+    }
+    const lines = [];
+    if (duplicates.length > 0) {
+        lines.push("lint-shared-worker-skills: FAIL — duplicated worker skills (single-source these via _shared-skills/ + relative symlinks):");
+    }
+    for (const group of duplicates) {
+        lines.push(`  DUPLICATE in domain '${group.domain}' (identical content, ${group.paths.length} copies — pick one canonical and symlink the rest):`);
+        // The shell prefixes the newline-joined group only once, so only the first
+        // path carries these spaces in the resulting stderr.
+        lines.push(`    ${group.paths.join("\n")}`);
+    }
+    if (broken.length > 0) {
+        if (duplicates.length === 0)
+            lines.push("lint-shared-worker-skills: FAIL — broken shared-skill symlink(s):");
+        lines.push("  BROKEN (symlink target does not resolve):");
+        for (const filePath of broken)
+            lines.push(`    ${filePath}`);
+    }
+    lines.push("", "  Fix: keep ONE canonical file in the narrowest-scope _shared-skills/ store", "  (core/workers/_shared-skills, core/packages/<pack>/workers/_shared-skills,", "  or companies/<co>/workers/_shared-skills) and replace each duplicate with a", "  relative symlink. Helper: hq core worker share", "  Doc: core/knowledge/public/hq-core/shared-worker-skills.md");
+    return { code: 1, stdout: "", stderr: `${lines.join("\n")}\n` };
+}
+//# sourceMappingURL=core-worker-lint-native.js.map

package/dist/commands/core-worker-share-native.d.ts

@@ -0,0 +1,5 @@
+import { type WorkerSkillDependencies, type WorkerSkillResult } from "./core-worker-skills-runtime.js";
+export declare const WORKER_SKILL_SHARE_ASSET = "core/scripts/share-worker-skill.sh";
+export declare const WORKER_SKILL_SHARE_USAGE = "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>...\n";
+export declare function runWorkerSkillShare(argv: string[], dependencies: WorkerSkillDependencies): WorkerSkillResult;
+//# sourceMappingURL=core-worker-share-native.d.ts.map

package/dist/commands/core-worker-share-native.js

@@ -0,0 +1,260 @@
+/** Native port of share-worker-skill.sh. */
+import * as path from "node:path";
+import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { existsFollowingLinks, isDirectory, isSymlink, resolveWorkerCallerRoot, runGit, errorCode, } from "./core-worker-skills-runtime.js";
+export const WORKER_SKILL_SHARE_ASSET = "core/scripts/share-worker-skill.sh";
+export const WORKER_SKILL_SHARE_USAGE = "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>...\n";
+function error(message, code = 2) {
+    return { code, stdout: "", stderr: `${message}\n` };
+}
+function toolFailure(output, tool, target, caught, destination) {
+    const code = errorCode(caught);
+    const reason = code === "EACCES" || code === "EPERM" ? "Permission denied"
+        : code === "ENOENT" ? "No such file or directory"
+            : code === "ENOTDIR" ? "Not a directory"
+                : code === "EEXIST" ? "File exists"
+                    : code === "ENOSPC" ? "No space left on device"
+                        : code === "EXDEV" ? "Invalid cross-device link"
+                            : caught instanceof Error ? caught.message : String(caught);
+    const message = tool === "mkdir" ? `mkdir: cannot create directory ‘${target}’: ${reason}`
+        : tool === "mv" ? `mv: cannot move '${target}' to '${destination ?? ""}': ${reason}`
+            : tool === "rm" ? `rm: cannot remove '${target}': ${reason}`
+                : `ln: failed to create symbolic link '${target}': ${reason}`;
+    return { code: 1, stdout: `${output.join("\n")}\n`, stderr: `${message}\n` };
+}
+function removeOneTrailingSlash(value) {
+    return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function stripOneDotSlash(value) {
+    return value.startsWith("./") ? value.slice(2) : value;
+}
+function isUnderScope(workerPath, scopeDir) {
+    const worker = stripOneDotSlash(workerPath);
+    const scope = stripOneDotSlash(scopeDir);
+    return worker.startsWith(`${scope}/`);
+}
+function relativePath(fromDirectory, toFile) {
+    const from = stripOneDotSlash(fromDirectory);
+    const to = stripOneDotSlash(toFile);
+    const fromParts = from.split("/");
+    const toParts = to.split("/");
+    let index = 0;
+    while (index < fromParts.length && index < toParts.length && fromParts[index] === toParts[index])
+        index += 1;
+    const up = "../".repeat(fromParts.length - index);
+    const down = toParts.slice(index).join("/");
+    return `${up}${down}`;
+}
+function isRegularFile(filePath, fileSystem) {
+    if (isSymlink(filePath, fileSystem))
+        return false;
+    try {
+        return fileSystem.statSync(filePath).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function readLink(filePath, fileSystem) {
+    return fileSystem.readlinkSync(filePath);
+}
+function sameBytes(leftPath, rightPath, fileSystem) {
+    try {
+        const left = fileSystem.readFileSync(leftPath);
+        const right = fileSystem.readFileSync(rightPath);
+        return Buffer.from(left).equals(Buffer.from(right));
+    }
+    catch {
+        // The shell sends cmp's diagnostics to /dev/null and treats every nonzero
+        // result as a drifted copy.
+        return false;
+    }
+}
+function unlinkIfPresent(filePath, fileSystem) {
+    try {
+        fileSystem.unlinkSync(filePath);
+    }
+    catch (caught) {
+        const code = caught && typeof caught === "object" && "code" in caught
+            ? caught.code
+            : undefined;
+        if (code !== "ENOENT")
+            throw caught;
+    }
+}
+function forceSymlink(target, filePath, fileSystem) {
+    unlinkIfPresent(filePath, fileSystem);
+    fileSystem.symlinkSync(target, filePath);
+}
+function runtimeScriptPath(dependencies) {
+    return dependencies.scriptPath ?? resolveBundledAsset(WORKER_SKILL_SHARE_ASSET);
+}
+export function runWorkerSkillShare(argv, dependencies) {
+    let apply = false;
+    let force = false;
+    const args = [];
+    for (const value of argv) {
+        if (value === "--apply")
+            apply = true;
+        else if (value === "--force")
+            force = true;
+        else if (value.startsWith("-"))
+            return error(`unknown flag: ${value}`);
+        else
+            args.push(value);
+    }
+    if (args.length < 3) {
+        return error(WORKER_SKILL_SHARE_USAGE.replace("$0", runtimeScriptPath(dependencies)).trimEnd());
+    }
+    const { root, env, fs: fileSystem } = resolveWorkerCallerRoot(dependencies);
+    const scopeDir = removeOneTrailingSlash(args[0]);
+    const skillName = args[1];
+    const workerPaths = args.slice(2);
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(skillName)) {
+        return error(`error: skill-name '${skillName}' is not a bare skill name (no slashes, no .md)`);
+    }
+    if (scopeDir === "" || !isDirectory(path.resolve(root, scopeDir), fileSystem)) {
+        return error(`error: scope dir does not exist: ${scopeDir}`);
+    }
+    const canonical = `${scopeDir}/_shared-skills/${skillName}.md`;
+    const canonicalPath = path.resolve(root, canonical);
+    for (const originalPath of workerPaths) {
+        const workerPath = stripOneDotSlash(originalPath);
+        if (!isUnderScope(workerPath, scopeDir)) {
+            return error(`error: worker path '${workerPath}' is not under scope dir '${scopeDir}'\n       canonical must live in the narrowest scope covering all sharers;\n       cross-scope symlinks are disallowed. Aborting (no changes made).`);
+        }
+    }
+    const output = [`Canonical: ${canonical}`, `Scope:     ${scopeDir}`];
+    if (!apply)
+        output.push("(dry run — pass --apply to make changes)");
+    const note = (message) => { output.push(message); };
+    const would = (message) => {
+        note(apply ? `  did:   ${message}` : `  would: ${message}`);
+    };
+    const canonicalIsReusable = existsFollowingLinks(canonicalPath, fileSystem) && !isSymlink(canonicalPath, fileSystem);
+    if (canonicalIsReusable) {
+        note("canonical already exists (regular file) — reusing it");
+    }
+    else {
+        const seed = workerPaths.find((workerPath) => isRegularFile(path.resolve(root, stripOneDotSlash(workerPath)), fileSystem));
+        if (seed === undefined) {
+            return {
+                ...error("error: no canonical exists and no worker path is a regular file to seed it from"),
+                stdout: `${output.join("\n")}\n`,
+            };
+        }
+        would(`mkdir -p ${scopeDir}/_shared-skills`);
+        would(`git mv ${seed} ${canonical}  (promote first copy to canonical)`);
+        if (apply) {
+            try {
+                fileSystem.mkdirSync(path.resolve(root, `${scopeDir}/_shared-skills`), { recursive: true });
+            }
+            catch (caught) {
+                return toolFailure(output, "mkdir", `${scopeDir}/_shared-skills`, caught);
+            }
+            let moved;
+            try {
+                moved = runGit(["mv", seed, canonical], root, env, dependencies.runGit);
+            }
+            catch (caught) {
+                if (errorCode(caught) === undefined)
+                    throw caught;
+                moved = { code: 127, stdout: "" };
+            }
+            if (moved.code !== 0) {
+                try {
+                    fileSystem.renameSync(path.resolve(root, stripOneDotSlash(seed)), canonicalPath);
+                }
+                catch (caught) {
+                    return toolFailure(output, "mv", seed, caught, canonical);
+                }
+            }
+        }
+    }
+    for (const originalPath of workerPaths) {
+        const workerPath = stripOneDotSlash(originalPath);
+        const targetDir = path.posix.dirname(workerPath);
+        const relative = relativePath(targetDir, canonical);
+        const absoluteWorkerPath = path.resolve(root, workerPath);
+        if (isSymlink(absoluteWorkerPath, fileSystem)) {
+            const current = readLink(absoluteWorkerPath, fileSystem);
+            if (current === relative) {
+                note(`ok: ${workerPath} already links to canonical`);
+                continue;
+            }
+            would(`relink ${workerPath} -> ${relative} (was: ${current})`);
+            if (apply) {
+                try {
+                    forceSymlink(relative, absoluteWorkerPath, fileSystem);
+                }
+                catch (caught) {
+                    return toolFailure(output, "ln", workerPath, caught);
+                }
+            }
+            continue;
+        }
+        if (existsFollowingLinks(absoluteWorkerPath, fileSystem)) {
+            if (sameBytes(absoluteWorkerPath, canonicalPath, fileSystem)) {
+                would(`replace identical copy ${workerPath} with symlink -> ${relative}`);
+                if (apply) {
+                    try {
+                        unlinkIfPresent(absoluteWorkerPath, fileSystem);
+                    }
+                    catch (caught) {
+                        return toolFailure(output, "rm", workerPath, caught);
+                    }
+                    try {
+                        fileSystem.symlinkSync(relative, absoluteWorkerPath);
+                    }
+                    catch (caught) {
+                        return toolFailure(output, "ln", workerPath, caught);
+                    }
+                }
+            }
+            else if (force) {
+                would(`FORCE replace DRIFTED copy ${workerPath} with symlink -> ${relative} (content discarded)`);
+                if (apply) {
+                    try {
+                        unlinkIfPresent(absoluteWorkerPath, fileSystem);
+                    }
+                    catch (caught) {
+                        return toolFailure(output, "rm", workerPath, caught);
+                    }
+                    try {
+                        fileSystem.symlinkSync(relative, absoluteWorkerPath);
+                    }
+                    catch (caught) {
+                        return toolFailure(output, "ln", workerPath, caught);
+                    }
+                }
+            }
+            else {
+                return {
+                    code: 3,
+                    stdout: `${output.join("\n")}\n`,
+                    stderr: `  DRIFT: ${workerPath} differs from canonical — reconcile by hand, then re-run\n         (diff ${workerPath} ${canonical}), or pass --force to accept canonical.\n`,
+                };
+            }
+        }
+        else {
+            would(`create symlink ${workerPath} -> ${relative}`);
+            if (apply) {
+                try {
+                    fileSystem.mkdirSync(path.resolve(root, targetDir), { recursive: true });
+                }
+                catch (caught) {
+                    return toolFailure(output, "mkdir", targetDir, caught);
+                }
+                try {
+                    fileSystem.symlinkSync(relative, absoluteWorkerPath);
+                }
+                catch (caught) {
+                    return toolFailure(output, "ln", workerPath, caught);
+                }
+            }
+        }
+    }
+    output.push("done.");
+    return { code: 0, stdout: `${output.join("\n")}\n`, stderr: "" };
+}
+//# sourceMappingURL=core-worker-share-native.js.map

package/dist/commands/core-worker-skills-command.d.ts

@@ -0,0 +1,8 @@
+export type WorkerSkillCommandName = "lint" | "share";
+export type WorkerSkillCommandContext = {
+    cwd: string;
+    hqRoot?: string;
+};
+/** Keep the shell rollback route byte-transparent while the family flag is off. */
+export declare function runWorkerSkillCommand(name: WorkerSkillCommandName, args: string[], context: WorkerSkillCommandContext): Promise<number>;
+//# sourceMappingURL=core-worker-skills-command.d.ts.map