@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/core-delegate.js

@@ -1,1040 +0,0 @@
-/** Native implementations of the five `hq core delegate` shell companions. */
-import { spawnSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
-import { describeCoreCommand } from "./core-command-catalog.js";
-import { resolveLiveRoot } from "../utils/hq-roots.js";
-import { runBundledScript } from "../utils/run-bundled-script.js";
-export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
-const SCRIPT_ASSETS = {
-    resolve: "core/scripts/hq-delegate-resolve.sh",
-    pickup: "core/scripts/hq-delegate-pickup.sh",
-    repo: "core/scripts/hq-delegate-repo.sh",
-    secrets: "core/scripts/hq-delegate-secrets.sh",
-    transfer: "core/scripts/hq-delegate-transfer.sh",
-};
-const COMMAND_DESCRIPTIONS = {
-    resolve: "Resolve a delegation recipient to a confirmed principal",
-    pickup: "Record or check evidence that a recipient picked up a delegation",
-    repo: "Prepare and record repository handover state",
-    secrets: "Grant a recipient access to declared secret names",
-    transfer: "Transfer local project ownership to a delegation recipient",
-};
-function writeOut(value) {
-    process.stdout.write(value);
-}
-function writeErr(value) {
-    process.stderr.write(value);
-}
-function runCapturedShell(asset, args, context) {
-    const result = runBundledScript({
-        asset,
-        args,
-        cwd: context.cwd,
-        ...(context.root ? { hqRoot: context.root } : {}),
-        captureOutput: true,
-    });
-    if (result.stdout?.length)
-        process.stdout.write(result.stdout);
-    if (result.stderr?.length)
-        process.stderr.write(result.stderr);
-    return result.code;
-}
-const USAGE_TEXT = {
-    resolve: "hq-delegate-resolve.sh — resolve a delegation recipient to a confirmed\nprincipal (person email / prs_ uid, or fleet-agent agt_ uid). Read-only.\n\nUsage:\n  core/scripts/hq-delegate-resolve.sh --company <slug> --to <token>\n\nOutput (stdout, JSON): {kind, principal, displayName, source}\n  kind      — \"person\" | \"agent\"\n  principal — confirmed email, prs_… or agt_… uid\n  source    — \"verbatim\" | \"people-resolve\" | \"agents-list\"\n\nExit codes:\n  0 — resolved\n  1 — usage error (missing/invalid arguments)\n  3 — ambiguous: candidate list printed to stdout as JSON\n      {status:\"ambiguous\", matches:[…]} — caller must present a picker\n  4 — not found (or found with no email): plain message on stderr\n\nTenancy: every lookup is scoped with an explicit --company. This helper\nnever enumerates or falls back across companies — single-company by\nconstruction, matching the /dm skill's resolution contract.\n\nFast path: a token containing \"@\" or starting with prs_ / agt_ passes\nthrough verbatim with NO lookup, preserving existing invocations exactly.\n",
-    // Preserve the companion usage function’s historical raw source lines.
-    pickup: "# hq-core: public\n# hq-delegate-pickup.sh — close the delegation loop with a receipt or a FAILED\n# state (2026-09-07).\n#\n# Why: the delegate pipeline ended at \"sent\", which is a send receipt, not a\n# delivery receipt. Seven delegations sat at sent/building with no way to tell\n# whether the recipient could act. This script adds the two missing states:\n#\n#   sent --(evidence)--> picked-up      recipient demonstrably has the work\n#   sent --(silence past window)--> failed   nobody picked it up; sender is told why\n#\n# Evidence, checked in order (any one suffices):\n#   1. --ack \"<text>\"            an explicit acknowledgement (DM reply, chat) —\n#                                recorded verbatim with a timestamp\n#   2. repo branch has a commit by the recipient after sentAt\n#      (manifest.repo.path + repo.branch, author email == to.principal)\n#   3. --evidence \"<free text>\"  any other proof the operator observed\n#\n# Usage:\n#   hq-delegate-pickup.sh --manifest <path> --ack \"<text>\"        # record receipt\n#   hq-delegate-pickup.sh --manifest <path> --evidence \"<text>\"   # record receipt\n#   hq-delegate-pickup.sh --manifest <path> --check [--window-hours N]   # probe repo; fail if silent past window (default 72)\n#   hq-delegate-pickup.sh --manifest <path> --status               # print state line\n#\n# Exit 0: picked-up (or already). Exit 5: failed (window elapsed, no evidence).\n# Exit 6: still waiting (inside window, no evidence). Exit 2: usage/precondition.\nset -uo pipefail\n",
-    repo: "hq-delegate-repo.sh — code/branch handover for a delegation: make sure the\nproject's branch exists on the remote, record uncommitted work as NOT\ntransferred, and verify the recipient's repository access read-only.\n\nUsage:\n  core/scripts/hq-delegate-repo.sh --manifest <path> [--yes] [--github-user <login>]\n\nBehavior (driven by the manifest's repo{} block; no-op when repo is null):\n  - records remote URL and the branch's headSha into the manifest\n  - a branch that exists only locally requires confirmation: without --yes\n    the helper prints the plan and exits 2; with --yes it pushes via an\n    explicitly anchored `git -C <abs path> push -u origin <branch>`\n  - dirty/untracked files are captured into repo.dirtyFiles[] and appended\n    to BRIEF.md as work NOT transferred — never silently dropped\n  - recipient access is checked read-only via gh when --github-user is\n    given; otherwise (or on a gh failure) repo.accessVerified stays false\n    and the brief says so plainly — the helper never claims unverified access\n  - never touches vaultPrefixes[] and never pushes repo content to the vault\n\nEnv: HQ_ROOT — HQ root override (default: resolved from script location)\n",
-    secrets: "hq-delegate-secrets.sh — grant a delegation recipient access to the secrets\na project needs, BY NAME ONLY. No command in this helper ever reads,\nprints, logs, or interpolates a secret value.\n\nUsage:\n  core/scripts/hq-delegate-secrets.sh --manifest <path> [--yes] [--no-secrets]\n    [--env-schema <path>]\n\nBehavior:\n  - derives required secret NAMES from the project's / repo's .env.schema\n    (--env-schema overrides discovery); no schema -> records secrets: []\n    and says so plainly rather than guessing at credentials\n  - without --yes: prints a full-prose confirmation listing every name and\n    the principal, then exits 2 granting nothing — this step is a privilege\n    handover and gets its own confirmation, separate from the file grants\n  - with --yes: hq secrets share <NAME> --with <principal> --permission read\n    per name, then records the names (and only the names) in the manifest\n  - --no-secrets: skips everything, records {secrets: [], secretsSkipped: true}\n\nConsumption on the recipient's side is via `hq run` / `hq secrets exec` —\ndocumented in the brief; values never appear in any delegation artifact\n(policy hq-delegate-never-inlines-secrets-or-share-urls).\n",
-    transfer: "hq-delegate-transfer.sh — make a delegation real everywhere HQ tracks\nownership: board entry, PRD metadata, work mesh, and the project journal.\n\nUsage:\n  core/scripts/hq-delegate-transfer.sh --manifest <path>\n\nBehavior (mode \"transfer\"; mode \"share\" skips every mutation):\n  1. companies/<co>/board.json — the project's entry gets owner=<recipient>\n     and a bumped updated_at; created (once) if absent\n  2. prd.json metadata gains owner, delegatedFrom, delegatedAt\n  3. work-mesh: `done` event closes the delegator's in-progress thread and\n     broadcasts the reassignment; silently skipped when the helper is\n     unavailable (local/offline installs) — the transfer still succeeds\n  4. a dated \"Delegated\" stanza is appended to the project journal naming\n     the recipient, delegation id, and transferred scope\n\nIdempotent: re-running updates owner/timestamps in place — never a\nduplicate board entry, never a duplicated journal stanza.\n\nThe delegator's own vault access is untouched (granting the recipient\nwrite does not revoke anything).\n\nEnv: HQ_ROOT — HQ root override (default: resolved from script location)\n",
-};
-function usage(name) {
-    return USAGE_TEXT[name];
-}
-function commandPath(name, cwd = process.cwd(), options = {}) {
-    const env = options.env ?? process.env;
-    if ((options.platform ?? process.platform) === "win32") {
-        const existsSync = options.existsSync ?? ((candidate) => {
-            try {
-                return fs.statSync(candidate).isFile();
-            }
-            catch {
-                return false;
-            }
-        });
-        return resolveWindowsExecutable(name, env, existsSync, cwd) ?? undefined;
-    }
-    const directories = (env.PATH ?? "").split(path.delimiter);
-    for (const directory of directories) {
-        const candidate = path.resolve(cwd, directory || ".", name);
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            if (fs.statSync(candidate).isFile())
-                return candidate;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES")
-                throw error;
-        }
-    }
-    return undefined;
-}
-export function commandExists(name, cwd = process.cwd(), options = {}) {
-    return commandPath(name, cwd, options) !== undefined;
-}
-export function subprocess(command, args, cwd, options = {}) {
-    const result = spawnSync(command, args, {
-        cwd,
-        env: { ...process.env, ...options.env },
-        input: options.input,
-        maxBuffer: options.maxBuffer,
-        encoding: "buffer",
-        stdio: [options.input === undefined ? options.stdinFd ?? "inherit" : "pipe", options.stdout === "inherit" ? "inherit" : options.stdout === "ignore" ? "ignore" : "pipe", options.stderr === "pipe" ? "pipe" : options.stderr ?? "inherit"],
-    });
-    if (result.error) {
-        const stderr = Buffer.from(result.error.message);
-        return { code: 127, stderr: stderr.toString("utf8"), stderrBytes: stderr, stdout: "", stdoutBytes: Buffer.alloc(0) };
-    }
-    const stdoutBytes = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.alloc(0);
-    const stderrBytes = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.alloc(0);
-    return {
-        code: result.status ?? (result.signal ? 128 : 1),
-        stdout: stdoutBytes.toString("utf8"),
-        stderr: stderrBytes.toString("utf8"),
-        stdoutBytes,
-        stderrBytes,
-    };
-}
-export function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-export function readJsonText(text) {
-    return JSON.parse(text);
-}
-export function readJsonFile(file) {
-    return readJsonText(fs.readFileSync(file, "utf8"));
-}
-function jqValid(file) {
-    try {
-        const value = readJsonFile(file);
-        // `jq -e .` exits non-zero when its result is null or false.
-        return value !== null && value !== false;
-    }
-    catch {
-        return false;
-    }
-}
-function jqTruthy(value) {
-    return value !== null && value !== undefined && value !== false;
-}
-export function jqFallback(value, fallback = "") {
-    return jqTruthy(value) ? value : fallback;
-}
-export function jsonAt(value, dottedPath) {
-    let current = value;
-    for (const part of dottedPath.split(".")) {
-        current = isRecord(current) ? current[part] : undefined;
-    }
-    return current;
-}
-export function rawJsonValue(value) {
-    return serializeJqJson(value, "raw").replace(/\n+$/, "");
-}
-export function jqRawPath(value, dottedPath, fallback = "") {
-    const found = jsonAt(value, dottedPath);
-    return found === undefined && fallback === "" ? "" : rawJsonValue(jqFallback(found, fallback));
-}
-export function jqRawPaths(value, dottedPaths, fallback = "") {
-    for (const dottedPath of dottedPaths) {
-        const found = jsonAt(value, dottedPath);
-        if (jqTruthy(found))
-            return rawJsonValue(found);
-    }
-    return rawJsonValue(fallback);
-}
-export function requireRecord(value, property) {
-    const result = isRecord(value) ? value[property] : undefined;
-    if (!isRecord(result))
-        throw new TypeError(`Cannot update non-object field ${property}`);
-    return result;
-}
-export function moveFile(source, target) {
-    try {
-        fs.renameSync(source, target);
-    }
-    catch (error) {
-        if (error.code !== "EXDEV")
-            throw error;
-        // The shell companion uses `mv`, which copies across filesystem boundaries.
-        fs.copyFileSync(source, target);
-        fs.unlinkSync(source);
-    }
-}
-export function writeJsonAtomically(target, value, siblingTemp = false) {
-    const serialized = serializeJqJson(value, "pretty");
-    if (siblingTemp) {
-        const temporary = `${target}.tmp`;
-        fs.writeFileSync(temporary, serialized);
-        moveFile(temporary, target);
-        return;
-    }
-    const temporaryDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-delegate-"));
-    const temporary = path.join(temporaryDir, "result.json");
-    try {
-        fs.writeFileSync(temporary, "", { mode: 0o600 });
-        fs.writeFileSync(temporary, serialized);
-        moveFile(temporary, target);
-    }
-    finally {
-        fs.rmSync(temporaryDir, { recursive: true, force: true });
-    }
-}
-function firstJsonLine(value) {
-    const lines = value.split("\n");
-    const start = lines.findIndex((line) => /^[\t ]*(?:\{|\[)/.test(line));
-    return start < 0 ? "" : lines.slice(start).join("\n").replace(/\n+$/, "");
-}
-function readLineFromFd(fd) {
-    const chunks = [];
-    const byte = Buffer.alloc(1);
-    while (fs.readSync(fd, byte, 0, 1, null) === 1) {
-        if (byte[0] === 0x0a)
-            return Buffer.concat(chunks).toString("utf8");
-        chunks.push(Buffer.from(byte));
-    }
-    return chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : undefined;
-}
-function emitResolved(kind, principal, name, source) {
-    writeOut(serializeJqJson({ kind, principal, displayName: name === "" ? null : name, source }, "compact"));
-    return 0;
-}
-function runResolve(args, context) {
-    let company = "";
-    let token = "";
-    for (let i = 0; i < args.length;) {
-        const arg = args[i];
-        if (arg === "--company") {
-            company = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "--to") {
-            token = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "-h" || arg === "--help") {
-            writeOut(usage("resolve"));
-            return 0;
-        }
-        writeErr(`hq-delegate-resolve: unknown argument: ${arg}\n${usage("resolve")}`);
-        return 1;
-    }
-    if (!company) {
-        writeErr(`hq-delegate-resolve: --company is required (single-company lookups only; never a multi-company scan)\n${usage("resolve")}`);
-        return 1;
-    }
-    if (!token) {
-        writeErr(`hq-delegate-resolve: --to is required\n${usage("resolve")}`);
-        return 1;
-    }
-    if (token.startsWith("agt_"))
-        return emitResolved("agent", token, "", "verbatim");
-    if (token.startsWith("prs_") || token.includes("@"))
-        return emitResolved("person", token, "", "verbatim");
-    const people = subprocess("hq", ["people", "resolve", token, "--json", "--company", company], context.cwd, { stderr: "ignore" });
-    const peopleRaw = firstJsonLine(people.stdout ?? "");
-    let peopleValue;
-    let peopleStatus = "";
-    if (peopleRaw) {
-        try {
-            peopleValue = readJsonText(peopleRaw);
-            if (peopleValue !== null && peopleValue !== false)
-                peopleStatus = jqRawPath(peopleValue, "status");
-        }
-        catch {
-            peopleValue = undefined;
-        }
-    }
-    if (peopleStatus === "found") {
-        const email = jqRawPath(peopleValue, "email");
-        const display = jqRawPaths(peopleValue, ["name", "displayName"]);
-        if (!email) {
-            writeErr(`hq-delegate-resolve: resolver returned found but no email for '${token}'\n`);
-            return 4;
-        }
-        return emitResolved("person", email, display, "people-resolve");
-    }
-    if (peopleStatus === "ambiguous") {
-        writeOut(serializeJqJson({ status: "ambiguous", matches: jqFallback(jsonAt(peopleValue, "matches"), []) }, "compact"));
-        return 3;
-    }
-    const noEmail = peopleStatus === "no_email";
-    if (peopleStatus !== "" && peopleStatus !== "not_found" && !noEmail) {
-        writeErr(`hq-delegate-resolve: unexpected resolver status '${peopleStatus}' for '${token}'\n`);
-        return 4;
-    }
-    const agents = subprocess("hq", ["agents", "list", "--company", company, "--json"], context.cwd, { stderr: "ignore" });
-    const agentsRaw = firstJsonLine(agents.stdout ?? "");
-    let agentsValue = [];
-    try {
-        if (agentsRaw) {
-            const parsedAgents = readJsonText(agentsRaw);
-            if (parsedAgents !== null && parsedAgents !== false)
-                agentsValue = parsedAgents;
-        }
-    }
-    catch {
-        agentsValue = [];
-    }
-    const candidates = Array.isArray(agentsValue)
-        ? agentsValue
-        : isRecord(agentsValue) ? Object.values(agentsValue) : [];
-    const asciiLower = (value) => value.replace(/[A-Z]/g, (character) => character.toLowerCase());
-    const matches = [];
-    for (const candidate of candidates) {
-        const nameValue = jqFallback(jsonAt(candidate, "name"), jsonAt(candidate, "displayName"));
-        const candidateName = jqTruthy(nameValue) ? nameValue : "";
-        if (typeof candidateName !== "string" || asciiLower(candidateName) !== asciiLower(token))
-            continue;
-        const agentUid = jqRawPaths(candidate, ["agentUid", "uid"]);
-        if (agentUid === "")
-            continue;
-        const displayName = jqRawPaths(candidate, ["name", "displayName"]);
-        matches.push({ agentUid, name: displayName });
-    }
-    const count = matches.length;
-    if (count === 1) {
-        const principal = rawJsonValue(matches[0]?.agentUid ?? "");
-        const display = rawJsonValue(matches[0]?.name ?? "");
-        return emitResolved("agent", principal, display, "agents-list");
-    }
-    if (count > 1) {
-        writeOut(serializeJqJson({ status: "ambiguous", matches }, "compact"));
-        return 3;
-    }
-    if (noEmail) {
-        writeErr(`hq-delegate-resolve: '${token}' was found in company '${company}' but has no email on record and matches no fleet agent — pass their exact email, personUid (prs_…), or agentUid (agt_…) instead\n`);
-    }
-    else {
-        writeErr(`hq-delegate-resolve: no teammate or fleet agent named '${token}' found in company '${company}' — pass the exact email, personUid (prs_…), or agentUid (agt_…) instead\n`);
-    }
-    return 4;
-}
-function parsePickup(args) {
-    const values = { manifest: "", ack: "", evidence: "", check: false, status: false, window: process.env.HQ_DELEGATE_PICKUP_WINDOW_HOURS || "72" };
-    for (let i = 0; i < args.length;) {
-        const arg = args[i];
-        if (arg === "--manifest") {
-            values.manifest = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "--ack") {
-            values.ack = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "--evidence") {
-            values.evidence = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "--check") {
-            values.check = true;
-            i += 1;
-            continue;
-        }
-        if (arg === "--window-hours") {
-            values.window = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "--status") {
-            values.status = true;
-            i += 1;
-            continue;
-        }
-        if (arg === "-h" || arg === "--help")
-            return { values, help: true };
-        return { values, error: `hq-delegate-pickup: unknown arg ${arg}\n`, code: 2 };
-    }
-    return { values };
-}
-function runPickup(args, context) {
-    const parsed = parsePickup(args);
-    if (parsed.help) {
-        writeOut(usage("pickup"));
-        return 0;
-    }
-    if (parsed.error) {
-        writeErr(parsed.error);
-        return parsed.code ?? 2;
-    }
-    const manifest = String(parsed.values.manifest ?? "");
-    const requestedManifest = path.resolve(context.cwd, manifest);
-    let readable = false;
-    try {
-        readable = Boolean(manifest) && fs.statSync(requestedManifest).isFile() && (fs.accessSync(requestedManifest, fs.constants.R_OK), true);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES")
-            throw error;
-    }
-    if (!readable) {
-        writeErr("usage: --manifest <path> (--ack|--evidence|--check|--status)\n");
-        return 2;
-    }
-    const file = path.resolve(context.cwd, manifest);
-    const now = process.env.HQ_DELEGATE_NOW || new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    let document;
-    try {
-        document = readJsonFile(file);
-    }
-    catch (error) {
-        if (error instanceof SyntaxError)
-            return runCapturedShell(SCRIPT_ASSETS.pickup, args, context);
-        document = {};
-    }
-    const status = jqRawPath(document, "status");
-    const sentAt = jqRawPath(document, "sentAt");
-    const to = jqRawPath(document, "to.principal");
-    const name = jqRawPaths(document, ["to.displayName", "to.principal"], "the recipient");
-    if (parsed.values.status) {
-        const interpolation = (value) => typeof value === "string"
-            ? value
-            : serializeJqJson(value, "compact").replace(/\n+$/, "");
-        let state = `${interpolation(jsonAt(document, "delegationId") ?? null)} ${interpolation(jsonAt(document, "status") ?? null)}`;
-        const pickedUpAt = jsonAt(document, "pickedUpAt");
-        if (jqTruthy(pickedUpAt)) {
-            state += ` picked-up ${interpolation(pickedUpAt)} via ${jqRawPath(document, "pickup.kind", "?")}`;
-        }
-        const failedAt = jsonAt(document, "failedAt");
-        if (jqTruthy(failedAt)) {
-            state += ` failed ${interpolation(failedAt)}: ${jqRawPath(document, "failure.reason")}`;
-        }
-        writeOut(`${state}\n`);
-        return 0;
-    }
-    if (status === "picked-up") {
-        writeOut(`hq-delegate-pickup: already picked up (${jqRawPath(document, "pickedUpAt")})\n`);
-        return 0;
-    }
-    if (status === "failed") {
-        writeOut(`hq-delegate-pickup: already failed (${jqRawPath(document, "failure.reason")})\n`);
-        return 5;
-    }
-    if (status !== "sent") {
-        writeErr(`hq-delegate-pickup: manifest status is '${status}' — only a 'sent' delegation can be picked up (send it first)\n`);
-        return 2;
-    }
-    const record = (kind, detail) => {
-        if (!isRecord(document))
-            throw new TypeError("Cannot update non-object delegation manifest");
-        writeJsonAtomically(file, {
-            ...document,
-            status: "picked-up",
-            pickedUpAt: now,
-            pickup: { kind, detail, recordedAt: now },
-        }, true);
-        writeOut(`hq-delegate-pickup: ${name} picked up the delegation (${kind}) — status advanced to 'picked-up'\n`);
-        return 0;
-    };
-    const ack = String(parsed.values.ack ?? "");
-    const evidence = String(parsed.values.evidence ?? "");
-    if (ack)
-        return record("ack", ack);
-    if (evidence)
-        return record("evidence", evidence);
-    if (!parsed.values.check) {
-        writeErr("hq-delegate-pickup: nothing to do (pass --ack, --evidence, --check, or --status)\n");
-        return 2;
-    }
-    const repo = jqRawPath(document, "repo.path");
-    const branch = jqRawPath(document, "repo.branch");
-    if (repo && fs.existsSync(repo) && fs.statSync(repo).isDirectory() && branch && to) {
-        subprocess("git", ["-C", repo, "fetch", "-q", "origin", branch], context.cwd, { stderr: "ignore" });
-        let ref = `origin/${branch}`;
-        const showRef = subprocess("git", ["-C", repo, "show-ref", "--verify", "--quiet", `refs/remotes/${ref}`], context.cwd, { stderr: "ignore" });
-        if (showRef.code !== 0)
-            ref = branch;
-        const commandArgs = ["-C", repo, "log", ref, `--author=${to}`];
-        if (sentAt)
-            commandArgs.push(`--since=${sentAt}`);
-        commandArgs.push("--format=%h %ad %s", "--date=short", "-1");
-        const log = subprocess("git", commandArgs, context.cwd, { stderr: "ignore" }).stdout ?? "";
-        if (log)
-            return record("commit", `${log.replace(/\n+$/, "")} on ${branch}`);
-    }
-    let ageHours = 0;
-    if (sentAt) {
-        const sentParsed = Date.parse(sentAt);
-        const nowParsed = Date.parse(now);
-        const sent = Number.isFinite(sentParsed) ? Math.floor(sentParsed / 1000) : 0;
-        const current = Number.isFinite(nowParsed) ? Math.floor(nowParsed / 1000) : Math.floor(Date.now() / 1000);
-        ageHours = Math.trunc((current - sent) / 3600);
-    }
-    const window = Number.parseInt(String(parsed.values.window), 10);
-    if (ageHours < window) {
-        writeOut(`hq-delegate-pickup: waiting — no pickup evidence from ${name} yet (${ageHours}h of a ${String(parsed.values.window)}h window)\n`);
-        return 6;
-    }
-    const reason = `no pickup evidence from ${name} within ${String(parsed.values.window)}h of send (${sentAt || "unknown"}): no acknowledgement, no commit by ${to} on ${branch || "the branch"}`;
-    if (!isRecord(document))
-        throw new TypeError("Cannot update non-object delegation manifest");
-    writeJsonAtomically(file, {
-        ...document,
-        status: "failed",
-        failedAt: now,
-        failure: { reason, recordedAt: now },
-    }, true);
-    writeErr(`hq-delegate-pickup: FAILED — ${reason}. Re-send with a direct ask, or hand it to someone else.\n`);
-    return 5;
-}
-function parseStandard(name, args) {
-    const values = { manifest: "" };
-    if (name === "repo") {
-        values.yes = false;
-        values.githubUser = "";
-    }
-    if (name === "secrets") {
-        values.yes = false;
-        values.noSecrets = false;
-        values.envSchema = "";
-    }
-    for (let i = 0; i < args.length;) {
-        const arg = args[i];
-        if (arg === "--manifest") {
-            values.manifest = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (name === "repo" && arg === "--yes") {
-            values.yes = true;
-            i += 1;
-            continue;
-        }
-        if (name === "repo" && arg === "--github-user") {
-            values.githubUser = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (name === "secrets" && arg === "--yes") {
-            values.yes = true;
-            i += 1;
-            continue;
-        }
-        if (name === "secrets" && arg === "--no-secrets") {
-            values.noSecrets = true;
-            i += 1;
-            continue;
-        }
-        if (name === "secrets" && arg === "--env-schema") {
-            values.envSchema = args[i + 1] ?? "";
-            i += 2;
-            continue;
-        }
-        if (arg === "-h" || arg === "--help")
-            return { values, help: true };
-        return { values, error: `hq-delegate-${name}: unknown argument: ${arg}\n`, code: 1 };
-    }
-    return { values };
-}
-function existingManifest(name, args, context) {
-    const prefix = `hq-delegate-${name}:`;
-    const parsed = parseStandard(name, args);
-    if (parsed.help) {
-        writeOut(usage(name));
-        return { code: 0, parsed };
-    }
-    if (parsed.error) {
-        writeErr(parsed.error);
-        return { code: parsed.code ?? 1, parsed };
-    }
-    const manifestArg = String(parsed.values.manifest ?? "");
-    if (!manifestArg) {
-        writeErr(`${prefix} --manifest is required\n`);
-        return { code: 1, parsed };
-    }
-    const file = path.resolve(context.cwd, manifestArg);
-    if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
-        writeErr(`${prefix} manifest not found: ${manifestArg}\n`);
-        return { code: 1, parsed };
-    }
-    if (!jqValid(file)) {
-        writeErr(`${prefix} manifest is not valid JSON: ${manifestArg}\n`);
-        return { code: 1, parsed };
-    }
-    return { file, parsed, document: readJsonFile(file) };
-}
-function runRepo(args, context) {
-    const loaded = existingManifest("repo", args, context);
-    if (loaded.code !== undefined)
-        return loaded.code;
-    const file = loaded.file;
-    const manifest = loaded.document;
-    if (!isRecord(manifest))
-        throw new TypeError("Cannot read repo from a non-object delegation manifest");
-    const options = loaded.parsed.values;
-    const root = context.root;
-    const repoValue = manifest.repo;
-    if (repoValue === null || repoValue === undefined) {
-        writeOut("hq-delegate-repo: project has no repoPath — nothing to hand over\n");
-        return 0;
-    }
-    const repoRel = jqRawPath(manifest, "repo.path");
-    const branch = jqRawPath(manifest, "repo.branch");
-    const prefix = "hq-delegate-repo:";
-    if (!repoRel) {
-        writeErr(`${prefix} manifest repo block has no path\n`);
-        return 1;
-    }
-    const repoDir = path.join(root, repoRel);
-    const gitDir = path.join(repoDir, ".git");
-    let isGitDir = false;
-    try {
-        isGitDir = fs.statSync(gitDir).isDirectory();
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES")
-            throw error;
-    }
-    if (!isGitDir && subprocess("git", ["-C", repoDir, "rev-parse", "--git-dir"], context.cwd, { stderr: "ignore" }).code !== 0) {
-        writeErr(`${prefix} not a git repository: ${repoDir}\n`);
-        return 1;
-    }
-    const remoteUrl = (subprocess("git", ["-C", repoDir, "remote", "get-url", "origin"], context.cwd, { stderr: "ignore" }).stdout ?? "").replace(/\n+$/, "");
-    const status = subprocess("git", ["-C", repoDir, "status", "--porcelain"], context.cwd).stdout ?? "";
-    const dirtyLines = status.split("\n").filter((line) => line.length > 0).map((line) => line.length >= 3 ? line.slice(3) : line);
-    let pushed = false;
-    let headSha = "";
-    if (branch) {
-        const valid = subprocess("git", ["check-ref-format", "--branch", branch], context.cwd, { stderr: "ignore", stdout: "capture" });
-        if (valid.code !== 0) {
-            writeErr(`${prefix} invalid branch name in PRD: ${branch}\n`);
-            return 1;
-        }
-        const localSha = (subprocess("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], context.cwd).stdout ?? "").replace(/\n+$/, "");
-        const remoteSha = (subprocess("git", ["-C", repoDir, "rev-parse", "--verify", "--quiet", `refs/remotes/origin/${branch}`], context.cwd).stdout ?? "").replace(/\n+$/, "");
-        if (remoteSha) {
-            pushed = true;
-            headSha = remoteSha;
-        }
-        else if (localSha) {
-            writeOut(`Branch handover plan — repo '${repoRel}':\n`);
-            writeOut(`  branch '${branch}' exists only locally (${localSha})\n`);
-            writeOut(`  action: git -C ${repoDir} push -u origin ${branch}\n`);
-            if (!options.yes) {
-                writeOut("\n");
-                writeErr(`${prefix} confirmation required — re-run with --yes to push the branch\n`);
-                return 2;
-            }
-            const push = subprocess("git", ["-C", repoDir, "push", "-u", "origin", branch], context.cwd, { stdout: "inherit" });
-            if (push.code !== 0) {
-                writeErr(`${prefix} failed to push branch '${branch}' to origin\n`);
-                return 1;
-            }
-            pushed = true;
-            headSha = localSha;
-        }
-        else {
-            writeOut(`${prefix} branch '${branch}' does not exist yet (declared in the PRD, not started) — recording as unpushed\n`);
-        }
-    }
-    let accessVerified = false;
-    let accessNote;
-    const ghUser = String(options.githubUser ?? "");
-    if (ghUser && remoteUrl && commandExists("gh", context.cwd)) {
-        const ownerRepo = remoteUrl.replace(/^(git@[^:]+:|https?:\/\/[^/]+\/)/, "").replace(/\.git$/, "");
-        const access = subprocess("gh", ["api", `repos/${ownerRepo}/collaborators/${ghUser}`], context.cwd, { stdout: "ignore", stderr: "ignore" });
-        if (access.code === 0) {
-            accessVerified = true;
-            accessNote = `verified: ${ghUser} is a collaborator on ${ownerRepo}`;
-        }
-        else
-            accessNote = `UNVERIFIED: could not confirm ${ghUser} has access to ${ownerRepo} — the recipient may need to be invited before they can pull the branch`;
-    }
-    else {
-        accessNote = "UNVERIFIED: recipient repository access was not checked (no GitHub login supplied) — confirm they can reach the repo before assuming so";
-    }
-    const repo = requireRecord(manifest, "repo");
-    repo.remote = remoteUrl === "" ? null : remoteUrl;
-    repo.headSha = headSha === "" ? null : headSha;
-    repo.dirtyFiles = dirtyLines;
-    repo.branchPushed = pushed;
-    repo.accessVerified = accessVerified;
-    repo.accessNote = accessNote;
-    writeJsonAtomically(file, manifest);
-    const brief = path.join(path.dirname(file), "BRIEF.md");
-    if (fs.existsSync(brief) && (dirtyLines.length > 0 || !accessVerified)) {
-        let content = "\n## Code handover notes\n\n";
-        if (dirtyLines.length > 0)
-            content += `The delegator's working tree had uncommitted changes that are **not transferred** with this delegation. If something seems missing, these files are why — ask the delegator to commit and push them:\n\n${dirtyLines.map((entry) => `- \`${entry}\``).join("\n")}\n\n`;
-        if (!accessVerified)
-            content += `${accessNote}\n`;
-        fs.appendFileSync(brief, content);
-    }
-    writeOut(`${prefix} recorded branch state (pushed=${pushed}, dirty=${dirtyLines.length} files, accessVerified=${accessVerified})\n`);
-    return 0;
-}
-function scanSecretFiles(file) {
-    let schema;
-    try {
-        schema = fs.readFileSync(file, "utf8");
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "EACCES" || code === "EPERM")
-            return undefined;
-        throw error;
-    }
-    return [...new Set(schema.split(/\r?\n/)
-            .filter((line) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(line))
-            .map((line) => line.slice(0, line.indexOf("="))))].sort();
-}
-function isRegularFile(file) {
-    try {
-        return fs.statSync(file).isFile();
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM")
-            return false;
-        throw error;
-    }
-}
-function updateSecretsManifest(file, document, names, skipped, grantedAt) {
-    if (!isRecord(document))
-        throw new TypeError("Cannot update non-object delegation manifest");
-    document.secrets = names;
-    document.secretsSkipped = skipped;
-    if (grantedAt !== undefined)
-        document.secretsGrantedAt = grantedAt;
-    writeJsonAtomically(file, document);
-}
-function runSecrets(args, context) {
-    const loaded = existingManifest("secrets", args, context);
-    if (loaded.code !== undefined)
-        return loaded.code;
-    const file = loaded.file;
-    const document = loaded.document;
-    if (!isRecord(document))
-        throw new TypeError("Cannot read secrets from a non-object delegation manifest");
-    const options = loaded.parsed.values;
-    const prefix = "hq-delegate-secrets:";
-    const company = jqRawPath(document, "company");
-    const principal = jqRawPath(document, "to.principal");
-    const project = jqRawPath(document, "project.name");
-    if (!company) {
-        writeErr(`${prefix} manifest has no company\n`);
-        return 1;
-    }
-    if (!principal) {
-        writeErr(`${prefix} manifest has no to.principal\n`);
-        return 1;
-    }
-    if (options.noSecrets) {
-        updateSecretsManifest(file, document, [], true);
-        writeOut(`${prefix} skipped (--no-secrets) — no credential access granted\n`);
-        return 0;
-    }
-    let envSchema = String(options.envSchema ?? "");
-    let names;
-    if (envSchema) {
-        envSchema = path.resolve(context.cwd, envSchema);
-        if (isRegularFile(envSchema))
-            names = scanSecretFiles(envSchema);
-    }
-    else {
-        const repoRel = jqRawPath(document, "repo.path");
-        const candidates = [
-            path.join(context.root, "companies", company, "projects", project, ".env.schema"),
-            repoRel ? path.join(context.root, repoRel, ".env.schema") : "",
-        ];
-        for (const candidate of candidates) {
-            if (!candidate || !isRegularFile(candidate))
-                continue;
-            const candidateNames = scanSecretFiles(candidate);
-            if (candidateNames === undefined)
-                continue;
-            envSchema = candidate;
-            names = candidateNames;
-            break;
-        }
-    }
-    if (!envSchema || names === undefined) {
-        updateSecretsManifest(file, document, [], false);
-        writeOut(`${prefix} no .env.schema found for this project or its repo — no secret names to grant. If the project needs credentials, add an .env.schema and re-run, or grant them manually with 'hq secrets share'.\n`);
-        return 0;
-    }
-    if (names.length === 0) {
-        // The source's pipefail exits on grep's status 1 before its empty-name
-        // handling branch; leave the manifest untouched to retain that behavior.
-        return 1;
-    }
-    const schemaName = path.basename(envSchema);
-    writeOut("Secret access handover — this grants the recipient the ability to use these credentials.\n\n");
-    writeOut(`The following ${names.length} secret name(s), declared by ${schemaName} for project '${project}', will be shared with read permission to '${principal}' in company '${company}':\n\n`);
-    writeOut(`${names.map((name) => `  - ${name}`).join("\n")}\n\n`);
-    writeOut("Only the names are granted and recorded; no secret value is read, printed, or transmitted by this step. The recipient consumes them through 'hq run' / 'hq secrets exec'.\n");
-    if (!options.yes) {
-        writeOut("\n");
-        writeErr(`${prefix} confirmation required — re-run with --yes after the user approves (or --no-secrets to skip)\n`);
-        return 2;
-    }
-    const namesDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-delegate-secret-names-"));
-    const namesFile = path.join(namesDir, "names");
-    let namesFd;
-    try {
-        // The shell's `while read` and each hq child share the same input stream.
-        // A child that reads stdin advances the next loop read just as it does in
-        // the bundled script; normal hq commands leave the name stream untouched.
-        fs.writeFileSync(namesFile, `${names.join("\n")}\n`, { mode: 0o600 });
-        namesFd = fs.openSync(namesFile, "r");
-        let name = readLineFromFd(namesFd);
-        while (name !== undefined) {
-            const share = subprocess("hq", ["secrets", "share", name, "--with", principal, "--permission", "read", "--company", company], context.cwd, { stdinFd: namesFd, stdout: "inherit" });
-            if (share.code !== 0) {
-                if (share.stderr)
-                    writeErr(share.stderr);
-                writeErr(`${prefix} failed to grant '${name}' to '${principal}' — aborting; manifest not updated\n`);
-                return 1;
-            }
-            writeOut(`${prefix} granted read on '${name}' to '${principal}'\n`);
-            name = readLineFromFd(namesFd);
-        }
-    }
-    finally {
-        if (namesFd !== undefined)
-            fs.closeSync(namesFd);
-        fs.rmSync(namesDir, { recursive: true, force: true });
-    }
-    const now = process.env.HQ_DELEGATE_NOW || new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    updateSecretsManifest(file, document, names, false, now);
-    writeOut(`${prefix} ${names.length} secret name(s) granted and recorded (names only)\n`);
-    return 0;
-}
-function runTransfer(args, context) {
-    const loaded = existingManifest("transfer", args, context);
-    if (loaded.code !== undefined)
-        return loaded.code;
-    const file = loaded.file;
-    const document = loaded.document;
-    if (!isRecord(document))
-        throw new TypeError("Cannot read transfer data from a non-object delegation manifest");
-    const root = context.root;
-    const prefix = "hq-delegate-transfer:";
-    const mode = jqRawPath(document, "mode", "transfer");
-    const company = jqRawPath(document, "company");
-    const project = jqRawPath(document, "project.name");
-    const principal = jqRawPath(document, "to.principal");
-    const display = jqRawPaths(document, ["to.displayName", "to.principal"]);
-    const delegationId = jqRawPath(document, "delegationId");
-    const from = jqRawPaths(document, ["from.email", "from.personUid"], "unknown");
-    if (!company) {
-        writeErr(`${prefix} manifest has no company\n`);
-        return 1;
-    }
-    if (!project) {
-        writeErr(`${prefix} manifest has no project.name\n`);
-        return 1;
-    }
-    if (!principal) {
-        writeErr(`${prefix} manifest has no to.principal\n`);
-        return 1;
-    }
-    if (mode === "share") {
-        writeOut(`${prefix} mode is 'share' — ownership stays with the delegator, nothing mutated\n`);
-        return 0;
-    }
-    if (jsonAt(document, "status") !== "granted") {
-        writeErr(`${prefix} transfer requires confirmed grants (status granted)\n`);
-        return 1;
-    }
-    if (from === "unknown" || !from) {
-        writeErr(`${prefix} sender identity missing; rebuild the bundle\n`);
-        return 1;
-    }
-    const now = jqRawPath(document, "ownershipTransferredAt") || new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    const today = (process.env.HQ_DELEGATE_NOW || new Date().toISOString()).slice(0, 10);
-    const prdPath = `companies/${company}/projects/${project}/prd.json`;
-    const prdAbs = path.join(root, prdPath);
-    const projectDir = path.join(root, "companies", company, "projects", project);
-    const board = path.join(root, "companies", company, "board.json");
-    if (!fs.existsSync(prdAbs) || !fs.statSync(prdAbs).isFile()) {
-        writeErr(`${prefix} prd not found: ${prdPath}\n`);
-        return 1;
-    }
-    if (fs.existsSync(board)) {
-        if (!jqValid(board)) {
-            writeErr(`${prefix} board.json is not valid JSON: ${board}\n`);
-            return 1;
-        }
-    }
-    else {
-        fs.mkdirSync(path.dirname(board), { recursive: true });
-        fs.writeFileSync(board, '{"projects": []}\n');
-    }
-    const prd = readJsonFile(prdAbs);
-    const title = jqRawPath(prd, "name");
-    const descriptionValue = jqFallback(jsonAt(prd, "description"), "");
-    const description = Buffer.from(serializeJqJson(descriptionValue, "raw"), "utf8")
-        .subarray(0, 300).toString("utf8").replace(/\n+$/, "");
-    const boardDocument = readJsonFile(board);
-    if (!isRecord(boardDocument))
-        throw new TypeError("Cannot update non-object board.json");
-    const projectsValue = jqFallback(boardDocument.projects, []);
-    const projects = Array.isArray(projectsValue)
-        ? projectsValue
-        : isRecord(projectsValue) ? Object.values(projectsValue) : [];
-    const hasProject = projects.some((entry) => jsonAt(entry, "prd_path") === prdPath);
-    if (hasProject) {
-        boardDocument.projects = projects.map((entry) => jsonAt(entry, "prd_path") === prdPath && isRecord(entry)
-            ? { ...entry, owner: principal, updated_at: now }
-            : entry);
-    }
-    else {
-        boardDocument.projects = [...projects, {
-                id: `proj-${project}`,
-                title,
-                description,
-                status: "in_progress",
-                owner: principal,
-                prd_path: prdPath,
-                created_at: now,
-                updated_at: now,
-            }];
-    }
-    boardDocument.updated_at = now;
-    writeJsonAtomically(board, boardDocument);
-    if (!isRecord(prd))
-        throw new TypeError("Cannot update non-object prd.json");
-    if (!isRecord(prd.metadata))
-        prd.metadata = {};
-    const metadata = prd.metadata;
-    metadata.owner = principal;
-    metadata.delegatedFrom = from;
-    metadata.delegatedAt = now;
-    writeJsonAtomically(prdAbs, prd);
-    if (commandExists("hq", context.cwd)) {
-        const sessionId = process.env.HQ_SESSION_ID || "delegate";
-        const mesh = subprocess("hq", ["mesh", "session", "note", "--enqueue", "--session-id", sessionId, "--seq", "1", "--harness", "claude-code", "--adapter-version", "1.0.0", "--company-slug", company, "--project", project, "--summary", `Delegated to ${display} (${principal}) — delegation ${delegationId}; ownership transferred`], context.cwd, { stdout: "inherit" });
-        if (mesh.code !== 0)
-            writeErr(`${prefix} mesh note failed; authoritative mesh ownership remains unconfirmed\n`);
-    }
-    const journalDir = path.join(projectDir, "journal");
-    const journal = path.join(journalDir, "delegations.md");
-    fs.mkdirSync(journalDir, { recursive: true });
-    if (!fs.existsSync(journal))
-        fs.writeFileSync(journal, `# Delegation log — ${project}\n\nOwnership handoffs for this project, appended by /delegate.\n`);
-    const journalText = fs.readFileSync(journal, "utf8");
-    if (!journalText.includes(delegationId)) {
-        const prefixesValue = jqFallback(document.vaultPrefixes, []);
-        const vaultPrefixes = Array.isArray(prefixesValue) ? prefixesValue : [];
-        const scope = vaultPrefixes.map((entry) => jqRawPath(entry, "prefix")).join(", ");
-        fs.appendFileSync(journal, `\n## ${today} — Delegated to ${display}\n\n- Delegation: \`${delegationId}\`\n- From: ${from}\n- To: ${display} (${principal})\n- Transferred scope: ${scope}\n- Local board and PRD ownership updated; Work Mesh ownership is unconfirmed. Existing delegator access is unchanged.\n`);
-    }
-    document.ownershipTransferredAt = now;
-    document.workMeshOwnership = "unconfirmed";
-    writeJsonAtomically(file, document);
-    writeOut(`${prefix} ownership of '${project}' transferred to ${display} (${principal}) — local board, PRD, and journal updated; Work Mesh ownership unconfirmed\n`);
-    return 0;
-}
-function runNative(name, args, context) {
-    switch (name) {
-        case "resolve": return runResolve(args, context);
-        case "pickup": return runPickup(args, context);
-        case "repo": return runRepo(args, context);
-        case "secrets": return runSecrets(args, context);
-        case "transfer": return runTransfer(args, context);
-    }
-}
-/** Fast-entry adapter; family gating and shell fallback happen before import. */
-export function runDelegateFast(args, _stdin, cwd, hqRoot, commandName) {
-    const name = commandName;
-    const context = name === "pickup"
-        ? { cwd }
-        : (() => { const root = hqRoot ?? resolveLiveRoot(); return { cwd: root, root }; })();
-    const savedEnvironment = new Map();
-    if (context.root) {
-        for (const key of ["HQ_ROOT", "CLAUDE_PROJECT_DIR", "PWD"]) {
-            savedEnvironment.set(key, process.env[key]);
-        }
-        process.env.HQ_ROOT = context.root;
-        process.env.CLAUDE_PROJECT_DIR = context.root;
-        process.env.PWD = context.cwd;
-    }
-    let code;
-    try {
-        code = runNative(name, [...args], context);
-    }
-    finally {
-        for (const [key, value] of savedEnvironment) {
-            if (value === undefined)
-                delete process.env[key];
-            else
-                process.env[key] = value;
-        }
-    }
-    if (code !== 0)
-        process.exitCode = code;
-    return code;
-}
-/** Register the Wave 1a delegate commands and preserve the shell rollback path. */
-export function registerCoreDelegateCommand(core, registerWave1b) {
-    const delegate = core.command("delegate").description("Delegation handover helpers");
-    for (const name of ["resolve", "pickup", "repo", "secrets", "transfer"]) {
-        const rootMode = name === "pickup" ? "cwd" : "live";
-        const command = delegate.command(name)
-            .description(COMMAND_DESCRIPTIONS[name])
-            .allowUnknownOption()
-            .allowExcessArguments()
-            .helpOption(false)
-            .argument("[args...]", "arguments accepted for shell ABI compatibility")
-            .action(async (args = []) => {
-            const scope = core.opts();
-            const context = rootMode === "cwd"
-                ? { cwd: process.cwd() }
-                : (() => { const root = resolveLiveRoot({ hqRoot: scope.hqRoot }); return { cwd: root, root }; })();
-            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-            if (!resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false)) {
-                const result = runBundledScript({ asset: SCRIPT_ASSETS[name], args, cwd: context.cwd, hqRoot: context.root });
-                if (result.code !== 0)
-                    process.exit(result.code);
-                return;
-            }
-            const savedEnvironment = new Map();
-            if (context.root) {
-                for (const key of ["HQ_ROOT", "CLAUDE_PROJECT_DIR", "PWD"]) {
-                    savedEnvironment.set(key, process.env[key]);
-                }
-                process.env.HQ_ROOT = context.root;
-                process.env.CLAUDE_PROJECT_DIR = context.root;
-                process.env.PWD = context.cwd;
-            }
-            let code;
-            try {
-                code = runNative(name, args, context);
-            }
-            finally {
-                for (const [key, value] of savedEnvironment) {
-                    if (value === undefined)
-                        delete process.env[key];
-                    else
-                        process.env[key] = value;
-                }
-            }
-            if (code !== 0)
-                process.exit(code);
-        });
-        describeCoreCommand(command, { execution: "native", asset: SCRIPT_ASSETS[name], root: rootMode });
-    }
-    registerWave1b?.(delegate, core);
-}
-//# sourceMappingURL=core-delegate.js.map