@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/commands/core-job-run-native.js

@@ -1,1215 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { JSON_SCHEMA, load } from "js-yaml";
-import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveLiveRoot, resolveBundledAsset } from "../utils/hq-roots.js";
-import { runBundledScript } from "../utils/run-bundled-script.js";
-import { describeCoreCommand } from "./core-command-catalog.js";
-import { coreNativeJobsEnabled } from "./core-native-jobs-flag.js";
-const RUN_ASSET = "core/scripts/hq-job-run.sh";
-const RUNNER_NAME = "hq-job-run";
-export const OUTPOST_IDENTITY_FILE = "/etc/outpost/codex-identity.env";
-export const OUTPOST_RUNNER_FILE = "/usr/local/bin/outpost-runner.sh";
-const REMOTE_LAUNCHER = fileURLToPath(new URL("./core-job-remote-launcher.js", import.meta.url));
-const USAGE = `hq-job-run.sh — serialized Outpost scheduled-job executor (US-004 + US-006).
-
-Invoked by systemd user units (hq-job-{id}.service) or on demand:
-  core/scripts/hq-job-run.sh --job-id <id>
-  core/scripts/hq-job-run.sh <job.yaml>
-
-Behavior:
-  - Global file lock (~/.hq/jobs/run.lock) — serialized-only (US-001)
-  - Enforces job timeout_seconds (default 600; schema 60–14400)
-  - Credentials only via \`hq secrets exec\` (requirements.secrets[]) or
-    the box's cached CLI auth — never env vars / unit-file secrets
-  - Trust model (7A): injects ONLY requirements.secrets[] — no static prompt scan
-  - Appends stdout/stderr + exit to ~/.hq/jobs/logs/{id}/
-  - Emits a compute-meter attribution marker (scheduled vs interactive)
-  - Classifies failures (auth|secrets|timeout|agent_error|infra), writes
-    failure_class to hq-pro jobs status (kind=run), bounded self-remediate,
-    then dm-notify via hq-job-notify.sh (collapse 1/24h; never create-thread)
-  - Missing runtime CLI auth: classify auth, notify re-login, exit 0 (unit OK)
-
-Runtime dispatch (US-001 spike flags):
-  claude → claude -p … --output-format text --permission-mode bypassPermissions
-  codex  → codex exec -s workspace-write --skip-git-repo-check …
-
-Env / overrides (tests):
-  HQ_ROOT, HOME, HQ_JOB_LOCK, HQ_JOB_LOG_DIR, HQ_JOB_METER_DIR
-  HQ_JOB_TIMEOUT_BIN, HQ_JOB_FLOCK_BIN, HQ_JOB_NOW
-  HQ_JOB_PROBE_CLAUDE_CRED, HQ_JOB_PROBE_CODEX_AUTH (auth paths; shared with probe)
-  HQ_JOB_RUN_SKIP_EXEC=1  — acquire lock + write marker/logs without calling CLI
-  HQ_JOB_NOTIFY_BIN, HQ_JOB_REMEDIATE_BIN, HQ_JOB_RUN_NO_NOTIFY=1, HQ_JOB_RUN_NO_INGEST=1
-  HQ_JOB_RUN_CURL, HQ_PRO_API_URL, OUTPOST_USER_ID, OUTPOST_INSTANCE_TOKEN
-
-Exit: 0 success or intentional auth/cwd skip; 1 agent/job failure; 2 usage/config;
-      124 timeout (GNU timeout convention when available).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
-HQ_ROOT="\${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-`;
-class JobYamlParseFailure extends Error {
-    source;
-    parseError;
-    constructor(source, parseError) {
-        super("job YAML parse failed");
-        this.source = source;
-        this.parseError = parseError;
-    }
-}
-const LOCK_HOLDER = "process.stdout.write('HQ_LOCK_READY\\n'); process.stdin.resume();";
-const SIGNAL_NUMBER = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
-function numericSignal(signal) {
-    return signal ? SIGNAL_NUMBER[signal] ?? 0 : 0;
-}
-function appendLog(file, chunk) {
-    fs.appendFileSync(file, chunk);
-}
-function appendArgvRecord(file, executable, args) {
-    if (!file)
-        return;
-    const fields = [executable, ...args].map((value) => Buffer.from(`${value}\0`));
-    fs.appendFileSync(file, Buffer.concat(fields));
-}
-function signalProcessTree(child, signal, processGroup) {
-    if (processGroup && process.platform !== "win32" && child.pid !== undefined && child.pid > 0) {
-        try {
-            process.kill(-child.pid, signal);
-            return;
-        }
-        catch (error) {
-            if (error.code === "ESRCH")
-                return;
-            child.kill(signal);
-            throw error;
-        }
-    }
-    child.kill(signal);
-}
-function runtimeArgv(file, args) {
-    if (file === "claude" || file === "codex")
-        return { runtime: file, args };
-    let command = args;
-    if (file === "hq") {
-        const separator = args.lastIndexOf("--");
-        if (separator < 0)
-            return undefined;
-        command = args.slice(separator + 1);
-    }
-    if (command[0] === "timeout" || command[0] === "gtimeout")
-        command = command.slice(4);
-    const runtime = command[0];
-    return runtime === "claude" || runtime === "codex" ? { runtime, args: command.slice(1) } : undefined;
-}
-function pathExecutable(name, env) {
-    if (name.includes(path.sep)) {
-        try {
-            fs.accessSync(name, fs.constants.X_OK);
-            return name;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    const pathValue = env.PATH ?? "";
-    for (const directory of pathValue.split(path.delimiter)) {
-        const candidate = path.join(directory || ".", name);
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            return candidate;
-        }
-        catch { /* keep searching PATH */ }
-    }
-    return undefined;
-}
-export async function spawnProcess(request) {
-    if (request.env.HQ_JOB_RUN_STUBS === "1") {
-        const recordFile = request.env.HQ_JOB_RUN_PROCESS_RECORD;
-        if (recordFile) {
-            appendLog(recordFile, `${JSON.stringify({ file: request.file, args: request.args, cwd: request.cwd })}\n`);
-        }
-        const nestedAgent = runtimeArgv(request.file, request.args);
-        if (nestedAgent)
-            appendArgvRecord(request.env.HQ_JOB_RUN_AGENT_ARGV_RECORD, nestedAgent.runtime, nestedAgent.args);
-        if (request.file === "bash") {
-            const helperArgs = request.args.slice(1);
-            const helper = path.basename(request.args[0] ?? "");
-            if (helper === "notify.sh" || helper === "hq-job-notify.sh")
-                appendArgvRecord(request.env.HQ_JOB_RUN_NOTIFY_ARGV_RECORD, "hq-job-notify.sh", helperArgs);
-            if (helper === "remediate.sh" || helper === "hq-job-remediate.sh")
-                appendArgvRecord(request.env.HQ_JOB_RUN_REMEDIATE_ARGV_RECORD, "hq-job-remediate.sh", helperArgs);
-        }
-        if (request.file === "tmux" && request.args[0] === "new-session") {
-            const doneFile = request.env.HQ_JOB_RUN_REMOTE_DONE_FILE;
-            const exitFile = request.env.HQ_JOB_RUN_REMOTE_EXIT_FILE;
-            if (doneFile)
-                fs.writeFileSync(doneFile, "");
-            if (exitFile)
-                fs.writeFileSync(exitFile, `EXIT=${request.env.HQ_JOB_RUN_STUB_EXIT_CODE ?? "0"}\n`);
-        }
-        const diagnostic = request.env.HQ_JOB_RUN_STUB_DIAGNOSTIC || "";
-        if (nestedAgent && request.logPath && diagnostic)
-            appendLog(request.logPath, `${diagnostic}\n`);
-        const response = request.env.HQ_JOB_RUN_STUB_REMEDIATE_OUTPUT
-            ?? '{"retry_recommended":false,"attempted":false,"notes":"stubbed"}';
-        const code = nestedAgent ? Number(request.env.HQ_JOB_RUN_STUB_EXIT_CODE ?? "0") : 0;
-        const helperName = path.basename(request.args[0] ?? "");
-        const isRemediation = request.file === "bash" && (helperName === "remediate.sh" || helperName === "hq-job-remediate.sh");
-        const stdout = isRemediation ? Buffer.from(response) : Buffer.alloc(0);
-        return { code: Number.isInteger(code) ? code : 0, stdout, stderr: Buffer.alloc(0) };
-    }
-    return await new Promise((resolve, reject) => {
-        let settled = false;
-        let timedOut = false;
-        let forceTimer;
-        let timeout;
-        const stdout = [];
-        const stderr = [];
-        let logWriteError;
-        let processSignalError;
-        const processGroup = Boolean(request.timeoutMs && request.timeoutMs > 0 && process.platform !== "win32");
-        const child = spawn(request.file, request.args, {
-            cwd: request.cwd,
-            env: request.env,
-            stdio: ["ignore", "pipe", "pipe"],
-            detached: processGroup,
-        });
-        child.once("error", reject);
-        child.stdout.on("data", (chunk) => {
-            if (request.logPath) {
-                try {
-                    appendLog(request.logPath, chunk);
-                }
-                catch (error) {
-                    logWriteError = error;
-                }
-            }
-            else
-                stdout.push(Buffer.from(chunk));
-        });
-        child.stderr.on("data", (chunk) => {
-            if (request.logPath) {
-                try {
-                    appendLog(request.logPath, chunk);
-                }
-                catch (error) {
-                    logWriteError = error;
-                }
-            }
-            else
-                stderr.push(Buffer.from(chunk));
-        });
-        if (request.timeoutMs && request.timeoutMs > 0) {
-            timeout = setTimeout(() => {
-                timedOut = true;
-                try {
-                    signalProcessTree(child, "SIGTERM", processGroup);
-                }
-                catch (error) {
-                    processSignalError = error;
-                }
-                forceTimer = setTimeout(() => {
-                    try {
-                        signalProcessTree(child, "SIGKILL", processGroup);
-                    }
-                    catch (error) {
-                        processSignalError ??= error;
-                    }
-                }, 15_000);
-            }, request.timeoutMs);
-            timeout.unref?.();
-        }
-        child.once("close", (code, signal) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timeout)
-                clearTimeout(timeout);
-            if (forceTimer)
-                clearTimeout(forceTimer);
-            if (processSignalError) {
-                reject(processSignalError);
-                return;
-            }
-            if (logWriteError) {
-                reject(logWriteError);
-                return;
-            }
-            resolve({
-                code: timedOut ? 124 : code ?? 128 + numericSignal(signal),
-                stdout: Buffer.concat(stdout),
-                stderr: Buffer.concat(stderr),
-            });
-        });
-    });
-}
-/** Holds the same kernel flock(2) lock used by the shell companion. */
-export async function acquireFlock(file, env = process.env) {
-    const binary = env.HQ_JOB_FLOCK_BIN || pathExecutable("flock", env);
-    if (!binary)
-        throw new Error("Outpost/Linux requires util-linux flock(1) for serialized job runs");
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    return await new Promise((resolve, reject) => {
-        const child = spawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], {
-            env,
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        let released = false;
-        child.stdout.setEncoding("utf8");
-        child.stderr.setEncoding("utf8");
-        child.stdout.on("data", (chunk) => { stdout += chunk; });
-        child.stderr.on("data", (chunk) => { stderr += chunk; });
-        child.once("error", reject);
-        child.once("close", (code) => {
-            if (released)
-                return;
-            released = true;
-            if (!stdout.includes("HQ_LOCK_READY\n")) {
-                reject(new Error(stderr.trim() || `failed to acquire global run lock: ${file} (flock exit ${code ?? 1})`));
-            }
-        });
-        const readyTimer = setInterval(() => {
-            if (!stdout.includes("HQ_LOCK_READY\n"))
-                return;
-            clearInterval(readyTimer);
-            let done = false;
-            resolve({
-                release: async () => {
-                    if (done)
-                        return;
-                    done = true;
-                    child.stdin.end();
-                    await new Promise((complete) => child.once("close", () => complete()));
-                    released = true;
-                },
-            });
-        }, 5);
-        readyTimer.unref?.();
-    });
-}
-function defaultDependencies(env) {
-    const stubbed = env.HQ_JOB_RUN_STUBS === "1";
-    return {
-        env,
-        cwd: process.cwd(),
-        home: env.HOME || os.homedir(),
-        now: () => stubbed && env.HQ_JOB_RUN_STUB_DATE ? new Date(env.HQ_JOB_RUN_STUB_DATE) : new Date(),
-        epochNow: () => stubbed && env.HQ_JOB_RUN_STUB_EPOCH
-            ? Number(env.HQ_JOB_RUN_STUB_EPOCH)
-            : Math.floor(Date.now() / 1000),
-        readFile: (file) => fs.readFileSync(file),
-        stat: (file) => fs.statSync(file),
-        mkdir: (directory) => fs.mkdirSync(directory, { recursive: true }),
-        writeFile: (file, content) => fs.writeFileSync(file, content),
-        appendFile: (file, content) => fs.appendFileSync(file, content),
-        chmod: (file, mode) => fs.chmodSync(file, mode),
-        remove: (file) => fs.rmSync(file, { force: true }),
-        fetch: stubbed
-            ? async (input, init) => {
-                const recordFile = env.HQ_JOB_RUN_FETCH_RECORD;
-                if (recordFile)
-                    appendLog(recordFile, `${JSON.stringify({ input, method: init.method, headers: init.headers, body: init.body })}\n`);
-                if (env.HQ_JOB_RUN_REQUEST_BODY_RECORD && init.body !== undefined) {
-                    appendLog(env.HQ_JOB_RUN_REQUEST_BODY_RECORD, `${String(init.body)}\n`);
-                }
-                if (env.HQ_JOB_RUN_AUTH_HEADER_RECORD) {
-                    const token = new Headers(init.headers).get("x-outpost-instance-token") ?? "";
-                    appendLog(env.HQ_JOB_RUN_AUTH_HEADER_RECORD, `x-outpost-instance-token: ${token}\n`);
-                }
-                const scenario = env.HQ_JOB_RUN_FETCH_SCENARIO || "200";
-                if (scenario === "transport-error")
-                    throw new Error("synthetic transport error");
-                if (scenario === "timeout")
-                    throw Object.assign(new Error("synthetic timeout"), { name: "AbortError" });
-                const status = Number(scenario);
-                return new Response("", { status: Number.isInteger(status) && status >= 200 && status <= 599 ? status : 200 });
-            }
-            : (input, init) => globalThis.fetch(input, init),
-        runProcess: spawnProcess,
-        acquireLock: stubbed && env.HQ_JOB_RUN_LOCK_REAL !== "1"
-            ? async (file) => {
-                fs.mkdirSync(path.dirname(file), { recursive: true });
-                fs.writeFileSync(file, "");
-                return { release: async () => undefined };
-            }
-            : (file) => acquireFlock(file, env),
-        sleep: stubbed ? async () => undefined : (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-        scriptPath: resolveBundledAsset(RUN_ASSET),
-    };
-}
-function yqText(value, fallback = "") {
-    if (value === undefined || value === null)
-        return fallback;
-    if (typeof value === "string")
-        return value;
-    if (typeof value === "boolean" || typeof value === "number")
-        return String(value);
-    return JSON.stringify(value);
-}
-function parseYamlJob(file, deps) {
-    const source = deps.readFile(file).toString("utf8");
-    let value;
-    try {
-        value = load(source, { schema: JSON_SCHEMA });
-    }
-    catch (error) {
-        throw new JobYamlParseFailure(source, error);
-    }
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function malformedYamlDiagnostic(file, source, error) {
-    if (!error || typeof error !== "object" || !("reason" in error))
-        return undefined;
-    const reason = String(error.reason ?? "");
-    if (reason !== "unexpected end of the stream within a flow collection")
-        return undefined;
-    const flowSequence = source.lastIndexOf("[") > source.lastIndexOf("]");
-    const flowMapping = source.lastIndexOf("{") > source.lastIndexOf("}");
-    if (!flowSequence && !flowMapping)
-        return undefined;
-    const flow = flowSequence ? "flow sequence" : "flow mapping";
-    const closer = flowSequence ? "]" : "}";
-    const lineCount = Math.max(1, source.split(/\r\n|\n/).length - (source.endsWith("\n") ? 1 : 0));
-    return `Error: bad file '${file}': yaml: while parsing a ${flow} at <unknown position>: line ${lineCount}: did not find expected ',' or '${closer}'\n`;
-}
-function yamlReason(error) {
-    if (!error || typeof error !== "object" || !("reason" in error))
-        return "invalid YAML document";
-    const reason = String(error.reason ?? "");
-    return reason || "invalid YAML document";
-}
-function findJobFileById(id, root, deps) {
-    const files = [];
-    const personal = path.join(root, "personal", "jobs");
-    try {
-        for (const entry of fs.readdirSync(personal, { withFileTypes: true })) {
-            if (entry.isFile() && /\.ya?ml$/.test(entry.name))
-                files.push(path.join(personal, entry.name));
-        }
-    }
-    catch { /* The shell find ignores a missing job registry. */ }
-    const companies = path.join(root, "companies");
-    try {
-        for (const company of fs.readdirSync(companies, { withFileTypes: true })) {
-            if (!company.isDirectory())
-                continue;
-            const jobs = path.join(companies, company.name, "jobs");
-            try {
-                for (const entry of fs.readdirSync(jobs, { withFileTypes: true })) {
-                    if (entry.isFile() && /\.ya?ml$/.test(entry.name))
-                        files.push(path.join(jobs, entry.name));
-                }
-            }
-            catch { /* The shell find ignores a company without jobs. */ }
-        }
-    }
-    catch { /* The shell find ignores a missing company registry. */ }
-    const candidates = files.filter((file) => !/\.conflict-|\/\.conflicts\//.test(file)).sort();
-    let found;
-    for (const file of candidates) {
-        let value;
-        try {
-            value = load(deps.readFile(file).toString("utf8"), { schema: JSON_SCHEMA });
-        }
-        catch {
-            continue;
-        }
-        if (!value || typeof value !== "object" || Array.isArray(value))
-            continue;
-        if (yqText(value.id) !== id)
-            continue;
-        if (found)
-            throw new Error(`duplicate job id '${id}' in registry: ${found} and ${file}`);
-        found = file;
-    }
-    return found;
-}
-function parseArgs(argv) {
-    let jobTarget = "";
-    let jobId = "";
-    let hqRoot = "";
-    for (let index = 0; index < argv.length;) {
-        const argument = argv[index];
-        if (argument === "--hq-root" || argument === "--job-id") {
-            const value = argv[index + 1] ?? "";
-            if (argument === "--hq-root") {
-                if (!value)
-                    return { jobTarget, jobId, hqRoot, error: "--hq-root requires a directory", help: false };
-                hqRoot = value;
-            }
-            else {
-                if (!value)
-                    return { jobTarget, jobId, hqRoot, error: "--job-id requires a value", help: false };
-                jobId = value;
-            }
-            index += 2;
-        }
-        else if (argument === "-h" || argument === "--help") {
-            return { jobTarget, jobId, hqRoot, help: true };
-        }
-        else if (argument === "--") {
-            break;
-        }
-        else if (argument.startsWith("-")) {
-            return { jobTarget, jobId, hqRoot, error: `unknown option: ${argument}`, help: false };
-        }
-        else {
-            if (jobTarget)
-                return { jobTarget, jobId, hqRoot, error: `unexpected argument: ${argument}`, help: false };
-            jobTarget = argument;
-            index += 1;
-        }
-    }
-    return { jobTarget, jobId, hqRoot, help: false };
-}
-function emitUsage() { process.stdout.write(USAGE); }
-function emitLog(message) { process.stderr.write(`${RUNNER_NAME}: ${message}\n`); }
-function emitDie(message) { process.stderr.write(`${RUNNER_NAME}: ${message}\n`); return 2; }
-function getPath(job, dotted) {
-    let cursor = job;
-    for (const piece of dotted.split(".")) {
-        if (!cursor || typeof cursor !== "object" || Array.isArray(cursor))
-            return undefined;
-        cursor = cursor[piece];
-    }
-    return cursor;
-}
-function isPlainRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function resolveJobPath(target, jobId, root, deps) {
-    if (jobId) {
-        const found = findJobFileById(jobId, root, deps);
-        if (!found)
-            throw new Error(`job id not found: ${jobId}`);
-        return found;
-    }
-    if (!target)
-        throw new Error("usage: hq-job-run.sh --job-id <id> | <job.yaml>");
-    if (fs.existsSync(target) && fs.statSync(target).isFile())
-        return target;
-    const underRoot = path.join(root, target);
-    if (fs.existsSync(underRoot) && fs.statSync(underRoot).isFile())
-        return underRoot;
-    const found = findJobFileById(target, root, deps);
-    if (!found)
-        throw new Error(`job not found: ${target}`);
-    return found;
-}
-function compactJson(value) {
-    return serializeJqJson(value, "compact").replace(/\n$/, "");
-}
-function buildPrompt(job, file) {
-    const prompt = yqText(getPath(job, "exec.prompt"));
-    const skill = yqText(getPath(job, "exec.skill"));
-    if (prompt && prompt !== "null")
-        return prompt;
-    if (skill && skill !== "null") {
-        let args = getPath(job, "exec.args");
-        if (args === undefined || args === null)
-            args = {};
-        return `Execute the HQ skill "${skill}" unattended with these args (JSON): ${compactJson(args)}. Follow the skill instructions exactly and produce a concise completion summary.`;
-    }
-    throw new Error(`job missing exec.prompt and exec.skill: ${file}`);
-}
-function jobSecretNames(job) {
-    const raw = getPath(job, "requirements.secrets");
-    if (raw === undefined || raw === null)
-        return [];
-    if (Array.isArray(raw))
-        return raw.map((value) => yqText(value)).filter((value) => value !== "" && value !== "null");
-    if (typeof raw === "string")
-        return [...raw].filter((value) => value !== "" && value !== "null");
-    return [];
-}
-function isoNow(deps) {
-    const override = deps.env.HQ_JOB_NOW;
-    return override ? override : deps.now().toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-function runStamp(deps) {
-    const value = deps.now();
-    return value.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
-}
-function elapsed(start, deps) {
-    return Math.max(0, deps.epochNow() - start);
-}
-function appendMeterMarker(jobId, runtime, started, ended, exitStatus, duration, skipReason, deps) {
-    const directory = deps.env.HQ_JOB_METER_DIR || path.join(deps.home, ".hq/jobs/meters");
-    deps.mkdir(directory);
-    const value = {
-        schema: "hq.outpost.job-run/v1",
-        kind: "scheduled-job-run",
-        job_id: jobId,
-        runtime,
-        started_at: started,
-        ended_at: ended,
-        exit_status: exitStatus,
-        duration_seconds: duration,
-        ...(deps.env.OUTPOST_ID ? { outpost_id: deps.env.OUTPOST_ID } : {}),
-        ...(skipReason ? { skip_reason: skipReason } : {}),
-    };
-    const meter = path.join(directory, "runs.jsonl");
-    deps.appendFile(meter, `${compactJson(value)}\n`);
-    try {
-        deps.chmod(meter, 0o600);
-    }
-    catch { /* The shell ignores chmod failure. */ }
-}
-function apiBase(env) {
-    return (env.HQ_PRO_API_URL || env.HQ_API_URL || env.HQ_VAULT_API_URL || "https://hqapi.hq.computer").replace(/\/$/, "");
-}
-function assignmentValue(value) {
-    if (value.length >= 2 && ((value[0] === "'" && value.at(-1) === "'") || (value[0] === '"' && value.at(-1) === '"'))) {
-        return value.slice(1, -1);
-    }
-    return value;
-}
-function parseIdentityEnvironment(contents) {
-    const identity = {};
-    for (const line of contents.split(/\r?\n/)) {
-        const match = /^\s*(?:export\s+)?(OUTPOST_USER_ID|OUTPOST_INSTANCE_TOKEN|OUTPOST_ID)\s*=\s*(.*?)\s*$/.exec(line);
-        if (!match)
-            continue;
-        const value = assignmentValue(match[2] ?? "");
-        if (match[1] === "OUTPOST_USER_ID")
-            identity.userId = value;
-        else if (match[1] === "OUTPOST_INSTANCE_TOKEN")
-            identity.instanceToken = value;
-        else
-            identity.outpostId = value;
-    }
-    return identity;
-}
-function parseRunnerAssignments(contents) {
-    const identity = {};
-    for (const line of contents.split(/\r?\n/)) {
-        const match = /^(USER_ID|INSTANCE_TOKEN|OUTPOST_ID)="(.*)"$/.exec(line);
-        if (!match)
-            continue;
-        if (match[1] === "USER_ID" && identity.userId === undefined)
-            identity.userId = match[2] ?? "";
-        else if (match[1] === "INSTANCE_TOKEN" && identity.instanceToken === undefined)
-            identity.instanceToken = match[2] ?? "";
-        else if (match[1] === "OUTPOST_ID" && identity.outpostId === undefined)
-            identity.outpostId = match[2] ?? "";
-    }
-    return identity;
-}
-function readOptionalIdentity(file, parser, deps) {
-    try {
-        return parser(deps.readFile(file).toString("utf8"));
-    }
-    catch {
-        return {};
-    }
-}
-function resolveBoxIdentity(env, deps) {
-    let userId = env.OUTPOST_USER_ID || "";
-    let instanceToken = env.OUTPOST_INSTANCE_TOKEN || "";
-    let outpostId = env.OUTPOST_ID || "";
-    if (userId && instanceToken)
-        return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
-    const stubIdentityFile = env.HQ_JOB_RUN_STUBS === "1" ? env.HQ_JOB_RUN_STUB_IDENTITY_FILE : undefined;
-    const identityFile = readOptionalIdentity(stubIdentityFile || OUTPOST_IDENTITY_FILE, parseIdentityEnvironment, deps);
-    if (identityFile.userId !== undefined)
-        userId = identityFile.userId;
-    if (identityFile.instanceToken !== undefined)
-        instanceToken = identityFile.instanceToken;
-    if (identityFile.outpostId !== undefined)
-        outpostId = identityFile.outpostId;
-    if (userId && instanceToken)
-        return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
-    const runnerFile = env.HQ_JOB_PROBE_RUNNER || OUTPOST_RUNNER_FILE;
-    const runner = readOptionalIdentity(runnerFile, parseRunnerAssignments, deps);
-    userId ||= runner.userId || "";
-    instanceToken ||= runner.instanceToken || "";
-    outpostId ||= runner.outpostId || "";
-    if (!userId || !instanceToken)
-        return undefined;
-    return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
-}
-async function ingestRunStatus(jobId, runAt, runId, exit, failureClass, actions, logFile, deps) {
-    if (deps.env.HQ_JOB_RUN_NO_INGEST === "1") {
-        emitLog("ingest skipped (HQ_JOB_RUN_NO_INGEST=1)");
-        return;
-    }
-    const identity = resolveBoxIdentity(deps.env, deps);
-    if (!identity) {
-        emitLog("run status ingest skipped — missing Outpost identity");
-        return;
-    }
-    const payload = {
-        userId: identity.userId,
-        jobId,
-        kind: "run",
-        run_at: runAt,
-        event_id: runId,
-        run_id: runId,
-        last_exit: exit,
-        failure_class: failureClass ? failureClass : null,
-        next_actions: actions,
-        ...(identity.outpostId ? { outpostId: identity.outpostId } : {}),
-    };
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 20_000);
-    let status = 0;
-    try {
-        const response = await deps.fetch(`${apiBase(deps.env)}/outpost/internal/jobs-status`, {
-            method: "POST",
-            redirect: "manual",
-            headers: {
-                "content-type": "application/json",
-                "x-outpost-instance-token": identity.instanceToken,
-            },
-            body: compactJson(payload),
-            signal: controller.signal,
-        });
-        status = response.status;
-    }
-    catch {
-        status = 0;
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-    if (status >= 200 && status < 300)
-        emitLog(`run status ingested job=${jobId} failure_class=${failureClass || "null"} http=${status}`);
-    else
-        emitLog(`run status ingest failed job=${jobId} http=${status} (logged; not failing run)`);
-    void logFile;
-}
-async function runHelper(binary, args, cwd, env, deps, logPath, timeoutMs) {
-    return await deps.runProcess({ file: binary, args, cwd, env, ...(logPath ? { logPath } : {}), ...(timeoutMs ? { timeoutMs } : {}) });
-}
-async function callNotify(jobId, jobName, outcome, summary, duration, logPath, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps) {
-    if (deps.env.HQ_JOB_RUN_NO_NOTIFY === "1") {
-        emitLog("notify skipped (HQ_JOB_RUN_NO_NOTIFY=1)");
-        return;
-    }
-    try {
-        const info = deps.stat(notifyBin);
-        if (!(info.mode & 0o111)) {
-            try {
-                deps.chmod(notifyBin, info.mode | 0o111);
-            }
-            catch { /* shell ignores chmod failure */ }
-        }
-    }
-    catch (error) {
-        if (error.code === "ENOENT") {
-            emitLog(`notify skipped — missing ${notifyBin}`);
-            return;
-        }
-        throw error;
-    }
-    const args = [notifyBin,
-        "--hq-root", hqRoot,
-        "--job-id", jobId,
-        "--job-name", jobName,
-        "--outcome", outcome,
-        "--summary", summary,
-        "--duration", String(duration),
-        "--log-path", logPath,
-        "--failure-class", failureClass,
-        "--next-action", nextAction,
-        "--owner", owner,
-        "--notify", notifyMode,
-    ];
-    const result = await runHelper("bash", args, deps.cwd, { ...deps.env, HQ_ROOT: hqRoot }, deps, logPath);
-    if (result.code !== 0)
-        emitLog(`notify helper exited ${result.code} (ignored)`);
-}
-async function callRemediate(failureClass, jobId, company, hqRoot, remediateBin, logFile, deps) {
-    try {
-        const info = deps.stat(remediateBin);
-        if (!(info.mode & 0o111)) {
-            try {
-                deps.chmod(remediateBin, info.mode | 0o111);
-            }
-            catch { /* shell ignores chmod failure */ }
-        }
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return '{"retry_recommended":false,"attempted":false,"notes":"remediate missing"}';
-        throw error;
-    }
-    const args = [remediateBin, "--hq-root", hqRoot, "--failure-class", failureClass, "--job-id", jobId, "--company", company];
-    const result = await runHelper("bash", args, deps.cwd, { ...deps.env, HQ_ROOT: hqRoot, HQ_JOB_REMEDIATE_LOG: logFile }, deps);
-    if (result.stderr.length)
-        deps.appendFile(logFile, result.stderr);
-    const output = result.stdout.toString("utf8").replace(/\n+$/, "");
-    return result.code !== 0 || !output ? '{"retry_recommended":false,"attempted":false,"notes":"remediate failed"}' : output;
-}
-function nextActionForClass(failureClass, runtime) {
-    switch (failureClass) {
-        case "auth": return `re-login on Outpost (device code) for ${runtime || "the runtime CLI"}`;
-        case "secrets": return "share the missing secret to this Outpost (hq secrets share KEY) then re-probe";
-        case "timeout": return "raise timeout_seconds or split the job work";
-        case "infra": return "check Outpost disk/network; job will self-retry once on transient infra";
-        case "agent_error": return "inspect the job log and fix the prompt/skill";
-        default: return "";
-    }
-}
-function classifyFailure(exitCode, logFile, authHint = "", deps) {
-    if (authHint && authHint !== "ok")
-        return "auth";
-    if (exitCode === 124 || exitCode === 137)
-        return "timeout";
-    let text = "";
-    try {
-        const lines = deps.readFile(logFile).toString("utf8").split(/\r?\n/);
-        if (lines[lines.length - 1] === "")
-            lines.pop();
-        text = lines.slice(-80).join("\n");
-    }
-    catch { /* tail ignores a missing log */ }
-    const lower = text.toLowerCase();
-    if (/not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required/.test(lower))
-        return "auth";
-    if (/secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret/.test(lower))
-        return "secrets";
-    if (/(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][\s]*124\b/.test(lower))
-        return "timeout";
-    if (/connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i\/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable/.test(lower))
-        return "infra";
-    return exitCode === 0 ? "" : "agent_error";
-}
-function canonicalPath(candidate) {
-    const absolute = path.resolve(candidate);
-    let cursor = absolute;
-    const suffix = [];
-    while (!fs.existsSync(cursor)) {
-        const parent = path.dirname(cursor);
-        if (parent === cursor)
-            return absolute;
-        suffix.unshift(path.basename(cursor));
-        cursor = parent;
-    }
-    try {
-        return path.join(fs.realpathSync(cursor), ...suffix);
-    }
-    catch {
-        return absolute;
-    }
-}
-function cwdSkip(cwdRel, hqRoot) {
-    if (!cwdRel || cwdRel === "null")
-        return undefined;
-    if (cwdRel.startsWith("/"))
-        return { reason: `cwd absolute not allowed: ${cwdRel} — skip`, action: "fix job cwd to an HQ-root-relative path (no absolute, no '..')" };
-    if (cwdRel.split("/").includes(".."))
-        return { reason: `cwd contains '..': ${cwdRel} — skip`, action: "fix job cwd to an HQ-root-relative path without '..'" };
-    const root = canonicalPath(hqRoot);
-    const runCwd = canonicalPath(path.join(hqRoot, cwdRel));
-    if (runCwd !== root && !runCwd.startsWith(`${root}${path.sep}`))
-        return { reason: `cwd escapes HQ_ROOT: ${cwdRel} → ${runCwd} — skip`, action: "fix job cwd to stay under HQ root" };
-    if (!fs.existsSync(runCwd) || !fs.statSync(runCwd).isDirectory())
-        return { reason: `cwd missing: ${runCwd} — skip`, action: `create missing cwd on Outpost: ${runCwd}` };
-    return undefined;
-}
-function readAuthStatus(runtime, env, home, deps) {
-    if (runtime !== "claude" && runtime !== "codex")
-        return "unknown_runtime";
-    if (env.HQ_JOB_RUN_STUBS !== "1" && !pathExecutable(runtime, env))
-        return "no_cli";
-    if (env.HQ_JOB_RUN_STUBS === "1" && env.HQ_JOB_RUN_STUB_MISSING_CLI === runtime)
-        return "no_cli";
-    const file = runtime === "claude"
-        ? env.HQ_JOB_PROBE_CLAUDE_CRED || path.join(home, ".claude/.credentials.json")
-        : env.HQ_JOB_PROBE_CODEX_AUTH || path.join(home, ".codex/auth.json");
-    try {
-        return deps.stat(file).size > 0 ? "ok" : "missing";
-    }
-    catch {
-        return "missing";
-    }
-}
-function statusText(exit, started, ended, duration, failureClass, retried) {
-    return `exit=${exit}\nstarted_at=${started}\nended_at=${ended}\nduration_seconds=${duration}\nfailure_class=${failureClass}\nretried=${retried}\n`;
-}
-function resolveNumber(value, fallback) {
-    const raw = yqText(value, String(fallback));
-    if (!/^\d+$/.test(raw))
-        return fallback;
-    return Math.max(60, Math.min(14_400, Number(raw)));
-}
-function bashPrintfQuote(value) {
-    const safe = /^[A-Za-z0-9_@%+=:,./-]+$/;
-    if (value.length === 0)
-        return "''";
-    if (safe.test(value))
-        return value;
-    const hasControlCharacter = [...value].some((character) => {
-        const code = character.codePointAt(0);
-        return code < 0x20 || code === 0x7f;
-    });
-    if (hasControlCharacter) {
-        const encoded = [...value].map((character) => {
-            if (character === "\\")
-                return "\\\\";
-            if (character === "'")
-                return "\\'";
-            if (character === "\n")
-                return "\\n";
-            if (character === "\r")
-                return "\\r";
-            if (character === "\t")
-                return "\\t";
-            if (character === "\v")
-                return "\\v";
-            if (character === "\f")
-                return "\\f";
-            const code = character.codePointAt(0);
-            if (code < 0x20 || code === 0x7f)
-                return `\\x${code.toString(16).padStart(2, "0")}`;
-            return character;
-        }).join("");
-        return `$'${encoded}'`;
-    }
-    return [...value].map((character) => safe.test(character) ? character : `\\${character}`).join("");
-}
-async function runRemoteClaude(jobId, runtime, prompt, runCwd, timeoutSeconds, stamp, logDir, logFile, deps) {
-    if (!pathExecutable("tmux", deps.env) && deps.env.HQ_JOB_RUN_STUBS !== "1") {
-        deps.appendFile(logFile, "remote surface requested but tmux missing — falling back to headless\n");
-        return 99;
-    }
-    const session = `hq-job-${jobId}-${stamp}`;
-    const remoteName = `schedule/${jobId}`;
-    const deadline = timeoutSeconds + 30;
-    const exitFile = path.join(logDir, `${stamp}.remote-exit`);
-    const doneFile = path.join(logDir, `${stamp}.remote-done`);
-    try {
-        deps.remove(doneFile);
-    }
-    catch { /* rm -f */ }
-    const remotePrompt = `${prompt}\n\nWhen ALL work above is fully finished (success or failure), create this exact empty file with a shell tool (and do not create it earlier):\n  touch ${bashPrintfQuote(doneFile)}\nThen stop.`;
-    if (deps.env.HQ_JOB_RUN_STUBS === "1") {
-        appendArgvRecord(deps.env.HQ_JOB_RUN_AGENT_ARGV_RECORD, "claude", ["--remote-control", remoteName, "--permission-mode", "bypassPermissions", "--dangerously-skip-permissions", remotePrompt]);
-    }
-    deps.appendFile(logFile, `surface=remote remote_name=${remoteName} tmux_session=${session} done_file=${doneFile}\n`);
-    const remoteArgs = ["--remote-control", remoteName, "--permission-mode", "bypassPermissions", "--dangerously-skip-permissions", remotePrompt];
-    const tmuxCommand = [process.execPath, REMOTE_LAUNCHER, exitFile, ...remoteArgs].map(bashPrintfQuote).join(" ");
-    const tmuxEnv = deps.env.HQ_JOB_RUN_STUBS === "1"
-        ? { ...deps.env, HQ_JOB_RUN_REMOTE_DONE_FILE: doneFile, HQ_JOB_RUN_REMOTE_EXIT_FILE: exitFile }
-        : deps.env;
-    const runTmux = async (args) => await runHelper("tmux", args, deps.cwd, tmuxEnv, deps);
-    await runTmux(["kill-session", "-t", session]);
-    await runTmux(["new-session", "-d", "-s", session, "-x", "120", "-y", "40", "-c", runCwd, tmuxCommand]);
-    let elapsedSeconds = 0;
-    let code = 0;
-    while (elapsedSeconds < deadline) {
-        await deps.sleep(2_000);
-        elapsedSeconds += 2;
-        let pane = (await runTmux(["capture-pane", "-t", session, "-p", "-S", "-120"])).stdout.toString("utf8");
-        if (pane.includes("Yes, I accept")) {
-            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
-            continue;
-        }
-        if (pane.includes("Try the new fullscreen renderer")) {
-            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
-            continue;
-        }
-        if (pane.includes("Do you want to proceed")) {
-            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
-            deps.appendFile(logFile, "auto-accepted tool permission prompt\n");
-            continue;
-        }
-        if (fs.existsSync(doneFile)) {
-            deps.appendFile(logFile, "remote done sentinel present\n");
-            await deps.sleep(2_000);
-            pane = (await runTmux(["capture-pane", "-t", session, "-p", "-S", "-300"])).stdout.toString("utf8");
-            code = 0;
-            break;
-        }
-        if (fs.existsSync(exitFile)) {
-            const raw = deps.readFile(exitFile).toString("utf8").replace(/[^0-9]/g, "").slice(0, 3);
-            code = Number(raw || "0");
-            break;
-        }
-    }
-    if (elapsedSeconds >= deadline) {
-        deps.appendFile(logFile, `remote surface timed out after ${timeoutSeconds}s\n`);
-        code = 124;
-    }
-    const capture = await runTmux(["capture-pane", "-t", session, "-p", "-S", "-300"]);
-    deps.appendFile(logFile, `=== remote pane capture ===\n${capture.stdout.toString("utf8")}`);
-    deps.appendFile(logFile, `tearing down remote session ${remoteName} (review under Desktop Archived)\n`);
-    await runTmux(["kill-session", "-t", session]);
-    return code;
-}
-async function runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps) {
-    if (deps.env.HQ_JOB_RUN_SKIP_EXEC === "1") {
-        deps.appendFile(logFile, "(HQ_JOB_RUN_SKIP_EXEC=1 — not invoking runtime CLI)\n");
-        return 0;
-    }
-    if (runtime === "claude" && surface === "remote") {
-        const remoteCode = await runRemoteClaude(jobId, runtime, prompt, runCwd, timeoutSeconds, stamp, logDir, logFile, deps);
-        if (remoteCode !== 99)
-            return remoteCode;
-    }
-    if (runtime === "codex" && surface === "remote")
-        deps.appendFile(logFile, "surface=remote ignored for codex — using headless\n");
-    let agentArgs;
-    if (runtime === "claude")
-        agentArgs = ["-p", prompt, "--output-format", "text", "--permission-mode", "bypassPermissions"];
-    else if (runtime === "codex")
-        agentArgs = ["exec", "-s", "workspace-write", "--skip-git-repo-check", "-C", runCwd, prompt];
-    else {
-        deps.appendFile(logFile, `unknown runtime: ${runtime}\n`);
-        return 2;
-    }
-    const wrap = deps.env.HQ_JOB_TIMEOUT_BIN
-        || (pathExecutable("timeout", deps.env) ? "timeout" : pathExecutable("gtimeout", deps.env) ? "gtimeout" : "");
-    const timeoutMs = wrap ? timeoutSeconds * 1000 : undefined;
-    let file = runtime;
-    let args = agentArgs;
-    if (secretNames.length > 0 && (deps.env.HQ_JOB_RUN_STUBS === "1" || pathExecutable("hq", deps.env))) {
-        const only = secretNames.join(",");
-        args = ["secrets", ...(company && company !== "null" ? ["--company", company] : ["--personal"]), "exec", "--only", only, "--script", deps.scriptPath, "--", ...(wrap ? [wrap, "--signal=TERM", "--kill-after=15s", `${timeoutSeconds}s`] : []), runtime, ...agentArgs];
-        file = "hq";
-    }
-    else if (secretNames.length > 0) {
-        deps.appendFile(logFile, "warning: requirements.secrets set but hq CLI missing — running without secrets exec\n");
-    }
-    const result = await runHelper(file, args, runCwd, deps.env, deps, logFile, timeoutMs);
-    return result.code;
-}
-async function recordSkip(jobId, jobName, runtime, skipReason, failureClass, action, statusSuffix, notifyOutcome, owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps, authStatus = "") {
-    deps.appendFile(logFile, `skip_reason=${skipReason}\n${authStatus ? `auth_status=${authStatus}\n` : ""}failure_class=${failureClass}\n`);
-    emitLog(skipReason);
-    const endedAt = isoNow(deps);
-    const duration = elapsed(startedEpoch, deps);
-    deps.writeFile(statusFile, `exit=0\nskip_reason=${skipReason}\nfailure_class=${failureClass}\nstarted_at=${startedAt}\nended_at=${endedAt}\n`);
-    appendMeterMarker(jobId, runtime, startedAt, endedAt, 0, duration, skipReason, deps);
-    let nextAction = action;
-    if (failureClass === "auth") {
-        const remediate = await callRemediate("auth", jobId, company, hqRoot, remediateBin, logFile, deps);
-        deps.appendFile(logFile, `remediate=${remediate}\n`);
-        try {
-            nextAction = yqText(JSON.parse(remediate).next_action);
-        }
-        catch {
-            nextAction = "";
-        }
-        if (!nextAction)
-            nextAction = nextActionForClass("auth", runtime);
-    }
-    const actions = nextAction ? [nextAction] : [];
-    const runId = `run-${jobId}-${stamp}-${statusSuffix}`;
-    await ingestRunStatus(jobId, endedAt, runId, 1, failureClass, actions, logFile, deps);
-    await callNotify(jobId, jobName, notifyOutcome, skipReason, duration, logFile, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps);
-    void logDir;
-    return 0;
-}
-export async function runJob(argv, hqRootOverride, injected) {
-    const env = injected?.env ?? process.env;
-    const deps = { ...defaultDependencies(env), ...injected };
-    const args = parseArgs(argv);
-    if (args.help) {
-        emitUsage();
-        return 0;
-    }
-    if (args.error)
-        return emitDie(args.error);
-    const explicitRoot = hqRootOverride || args.hqRoot || env.HQ_ROOT;
-    const hqRoot = resolveLiveRoot({ hqRoot: explicitRoot });
-    let jobFile;
-    try {
-        jobFile = resolveJobPath(args.jobTarget, args.jobId, hqRoot, deps);
-    }
-    catch (error) {
-        return emitDie(error instanceof Error ? error.message : String(error));
-    }
-    if (!fs.existsSync(jobFile))
-        return emitDie(`job file missing: ${jobFile}`);
-    let job;
-    try {
-        job = parseYamlJob(jobFile, deps);
-    }
-    catch (error) {
-        if (error instanceof JobYamlParseFailure) {
-            const diagnostic = malformedYamlDiagnostic(jobFile, error.source, error.parseError)
-                ?? `Error: bad file '${jobFile}': yaml: ${yamlReason(error.parseError)}\n`;
-            process.stderr.write(diagnostic);
-            return 1;
-        }
-        return emitDie(error instanceof Error ? error.message : String(error));
-    }
-    const jobId = yqText(job.id);
-    const runtime = yqText(job.runtime);
-    const jobName = yqText(job.name, jobId) || jobId;
-    const timeoutSeconds = resolveNumber(job.timeout_seconds, 600);
-    const cwdRel = yqText(job.cwd ?? getPath(job, "requirements.cwd"));
-    const company = yqText(getPath(job, "requirements.company"));
-    const owner = yqText(job.owner);
-    const notifyMode = yqText(job.notify, "profile") || "profile";
-    const enabledValue = Object.hasOwn(job, "enabled") ? yqText(job.enabled) : "true";
-    let surface = yqText(getPath(job, "exec.surface"));
-    if (!surface || surface === "null") {
-        const alertsFile = env.HQ_JOB_ALERTS_FILE || path.join(hqRoot, "personal/settings/schedule-alerts.yaml");
-        try {
-            const alerts = load(deps.readFile(alertsFile).toString("utf8"), { schema: JSON_SCHEMA });
-            if (isPlainRecord(alerts))
-                surface = yqText(alerts.execution_surface);
-        }
-        catch { /* Optional alerts file. */ }
-    }
-    surface = surface === "remote" ? "remote" : "headless";
-    if (!jobId || jobId === "null")
-        return emitDie(`job missing id: ${jobFile}`);
-    if (!runtime || runtime === "null")
-        return emitDie(`job missing runtime: ${jobFile}`);
-    if (!jobName) {
-        // yq's `.name // .id // ""` returns the id when name is null or absent.
-    }
-    if (enabledValue === "false" || enabledValue === "False" || enabledValue === "0") {
-        emitLog(`skip job ${jobId} — enabled=false`);
-        return 0;
-    }
-    const logBase = env.HQ_JOB_LOG_DIR || path.join(deps.home, ".hq/jobs/logs");
-    const logDir = path.join(logBase, jobId);
-    deps.mkdir(logDir);
-    const lockPath = env.HQ_JOB_LOCK || path.join(deps.home, ".hq/jobs/run.lock");
-    deps.mkdir(path.dirname(lockPath));
-    const stamp = runStamp(deps);
-    const logFile = path.join(logDir, `${stamp}.log`);
-    const statusFile = path.join(logDir, `${stamp}.status`);
-    let lease;
-    try {
-        lease = await deps.acquireLock(lockPath);
-    }
-    catch (error) {
-        return emitDie(`failed to acquire global run lock: ${lockPath}${error instanceof Error && error.message.includes("flock") ? ` (${error.message})` : ""}`);
-    }
-    try {
-        const startedAt = isoNow(deps);
-        const startedEpoch = deps.epochNow();
-        deps.appendFile(logFile, `=== hq-job-run ${jobId} ===\nstarted_at=${startedAt}\nruntime=${runtime}\ntimeout_seconds=${timeoutSeconds}\nsurface=${surface}\njob_file=${jobFile}\nhq_root=${hqRoot}\n`);
-        const notifyBin = env.HQ_JOB_NOTIFY_BIN || path.join(path.dirname(deps.scriptPath), "hq-job-notify.sh");
-        const remediateBin = env.HQ_JOB_REMEDIATE_BIN || path.join(path.dirname(deps.scriptPath), "hq-job-remediate.sh");
-        const authStatus = readAuthStatus(runtime, env, deps.home, deps);
-        if (authStatus !== "ok") {
-            const reason = authStatus === "no_cli"
-                ? `runtime CLI '${runtime}' not installed on PATH — skip (re-login/install on Outpost)`
-                : authStatus === "missing"
-                    ? `runtime CLI '${runtime}' not authenticated on Outpost (cached credentials missing) — skip`
-                    : `unsupported or unknown runtime '${runtime}' — skip`;
-            return await recordSkip(jobId, jobName, runtime, reason, "auth", "", "authskip", "failed", owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps, authStatus);
-        }
-        const cwdProblem = cwdSkip(cwdRel, hqRoot);
-        if (cwdProblem)
-            return await recordSkip(jobId, jobName, runtime, cwdProblem.reason, "infra", cwdProblem.action, "cwd", "blocked", owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps);
-        const runCwd = cwdRel && cwdRel !== "null" ? canonicalPath(path.join(hqRoot, cwdRel)) : hqRoot;
-        let prompt;
-        try {
-            prompt = buildPrompt(job, jobFile);
-        }
-        catch (error) {
-            return emitDie(error instanceof Error ? error.message : String(error));
-        }
-        const secretNames = jobSecretNames(job);
-        let exitCode = await runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps);
-        let failureClass = "";
-        let nextAction = "";
-        let retried = 0;
-        if (exitCode !== 0) {
-            failureClass = classifyFailure(exitCode, logFile, "", deps);
-            deps.appendFile(logFile, `failure_class=${failureClass}\n`);
-            const remediation = await callRemediate(failureClass, jobId, company, hqRoot, remediateBin, logFile, deps);
-            deps.appendFile(logFile, `remediate=${remediation}\n`);
-            let retryRecommended = false;
-            try {
-                const parsed = JSON.parse(remediation);
-                nextAction = yqText(parsed.next_action);
-                retryRecommended = yqText(parsed.retry_recommended, "false") === "true";
-            }
-            catch { /* Invalid helper output follows the shell's jq path; it cannot recommend retry. */ }
-            if (!nextAction)
-                nextAction = nextActionForClass(failureClass, runtime);
-            if (retryRecommended && retried === 0) {
-                retried = 1;
-                deps.appendFile(logFile, "remediate_retry=1\n");
-                emitLog(`self-remediate recommended retry for ${failureClass} — retrying once`);
-                exitCode = await runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps);
-                if (exitCode !== 0) {
-                    failureClass = classifyFailure(exitCode, logFile, "", deps);
-                    deps.appendFile(logFile, `failure_class_after_retry=${failureClass}\n`);
-                    nextAction = nextActionForClass(failureClass, runtime);
-                }
-                else {
-                    failureClass = "";
-                    nextAction = "";
-                }
-            }
-        }
-        const endedAt = isoNow(deps);
-        const endedEpoch = deps.epochNow();
-        const duration = Math.max(0, endedEpoch - startedEpoch);
-        deps.appendFile(logFile, `ended_at=${endedAt}\nexit=${exitCode}\nduration_seconds=${duration}\nretried=${retried}\n${failureClass ? `failure_class=${failureClass}\n` : ""}`);
-        deps.writeFile(statusFile, statusText(exitCode, startedAt, endedAt, duration, failureClass, retried));
-        appendMeterMarker(jobId, runtime, startedAt, endedAt, exitCode, duration, "", deps);
-        const runId = `run-${jobId}-${stamp}`;
-        if (exitCode === 0) {
-            await ingestRunStatus(jobId, endedAt, runId, 0, "", [], logFile, deps);
-            const summary = retried === 1 ? "completed ok after self-remediation retry" : "completed ok";
-            await callNotify(jobId, jobName, "ok", summary, duration, logFile, "", "", owner, notifyMode, hqRoot, notifyBin, deps);
-            emitLog(`job ${jobId} completed ok (${duration}s)`);
-            return 0;
-        }
-        await ingestRunStatus(jobId, endedAt, runId, Math.max(0, Math.min(255, exitCode)), failureClass, nextAction ? [nextAction] : [], logFile, deps);
-        const summary = `exit=${exitCode} class=${failureClass}`;
-        await callNotify(jobId, jobName, "failed", summary, duration, logFile, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps);
-        emitLog(`job ${jobId} failed exit=${exitCode} class=${failureClass} (${duration}s) log=${logFile}`);
-        return exitCode;
-    }
-    finally {
-        await lease.release();
-    }
-}
-export function registerCoreJobRunCommand(job) {
-    const command = job.command("run")
-        .description("Run a scheduled job")
-        .helpOption(false)
-        .allowUnknownOption()
-        .allowExcessArguments(true)
-        .argument("[args...]", "Arguments passed to the scaffold helper")
-        .action(async (args, _options, current) => {
-        const argv = rawArgumentsForCommand(current, args);
-        const root = current.parent?.parent?.opts().hqRoot ?? process.env.HQ_ROOT;
-        if (!await coreNativeJobsEnabled()) {
-            const resolvedRoot = resolveLiveRoot({ hqRoot: root });
-            const result = runBundledScript({ asset: RUN_ASSET, args: argv, cwd: process.cwd(), hqRoot: resolvedRoot });
-            if (result.code !== 0)
-                process.exit(result.code);
-            return;
-        }
-        const result = await runJob(argv, root);
-        if (result !== 0)
-            process.exit(result);
-    });
-    describeCoreCommand(command, { execution: "native", asset: RUN_ASSET, root: "live" });
-}
-function rawArgumentsForCommand(command, fallback, raw = process.argv) {
-    const names = [];
-    for (let current = command; current?.parent; current = current.parent)
-        names.unshift(current.name());
-    let cursor = 0;
-    let start = -1;
-    for (const name of names) {
-        const index = raw.indexOf(name, cursor);
-        if (index < 0)
-            return command.args.length ? command.args : fallback;
-        cursor = index + 1;
-        start = cursor;
-    }
-    return start >= 0 ? raw.slice(start) : command.args.length ? command.args : fallback;
-}
-//# sourceMappingURL=core-job-run-native.js.map