@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/core-jobs-native.js

@@ -1,1339 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { spawnSync } from "node:child_process";
-import { JSON_SCHEMA, load, loadAll } from "js-yaml";
-import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
-import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveLiveRoot } from "../utils/hq-roots.js";
-import { runBundledScript } from "../utils/run-bundled-script.js";
-import { describeCoreCommand } from "./core-command-catalog.js";
-const SCHEDULE_PARSE_ASSET = "core/scripts/jobs-schedule-parse.sh";
-const VALIDATE_ASSET = "core/scripts/jobs-validate.sh";
-const RECONCILE_ASSET = "core/scripts/outpost-jobs-reconcile.sh";
-const SCHEDULE_PARSE_USAGE = 'usage: jobs-schedule-parse.sh [--tz IANA] "<nl or cron schedule>"\n';
-const VALIDATE_USAGE = "usage: jobs-validate.sh <file-or-dir> [file-or-dir...]\n";
-const CRON_RE = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$/;
-const DAY_NAMES = {
-    sun: 0, sunday: 0, mon: 1, monday: 1, tue: 2, tues: 2, tuesday: 2,
-    wed: 3, wednesday: 3, thu: 4, thur: 4, thurs: 4, thursday: 4,
-    fri: 5, friday: 5, sat: 6, saturday: 6,
-};
-const DAY_LABELS = {
-    "0": "Sunday", "1": "Monday", "2": "Tuesday", "3": "Wednesday",
-    "4": "Thursday", "5": "Friday", "6": "Saturday", "1-5": "weekday",
-    "*": "day",
-};
-function parseClock(text) {
-    const match = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)?$/i.exec(text.trim().toLowerCase().replace(/ /g, ""));
-    if (!match)
-        return undefined;
-    let hour = Number.parseInt(match[1], 10);
-    const minute = Number.parseInt(match[2] || "0", 10);
-    const meridiem = match[3];
-    if (minute > 59)
-        return undefined;
-    if (meridiem) {
-        if (hour < 1 || hour > 12)
-            return undefined;
-        hour = meridiem === "am"
-            ? (hour === 12 ? 0 : hour)
-            : (hour === 12 ? 12 : hour + 12);
-    }
-    else if (hour > 23) {
-        return undefined;
-    }
-    return [hour, minute];
-}
-function formatClock(hour, minute) {
-    const hour12 = hour % 12 || 12;
-    return `${hour12}:${String(minute).padStart(2, "0")} ${hour < 12 ? "AM" : "PM"}`;
-}
-function humanizeCron(cron, timezone) {
-    const fields = cron.split(/\s+/);
-    if (fields.length !== 5)
-        return `Cron \`${cron}\` (${timezone})`;
-    const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
-    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
-        && month === "*" && (dayOfWeek === "*" || dayOfWeek === "1-5")) {
-        const day = dayOfWeek === "1-5" ? "Every weekday" : "Every day";
-        return `${day} at ${formatClock(+hour, +minute)} (${timezone})`;
-    }
-    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
-        && month === "*" && /^\d+$/.test(dayOfWeek)) {
-        const day = DAY_LABELS[dayOfWeek] || `day ${dayOfWeek}`;
-        return `Every ${day} at ${formatClock(+hour, +minute)} (${timezone})`;
-    }
-    if (minute.startsWith("*/") && hour === "*" && dayOfMonth === "*"
-        && month === "*" && dayOfWeek === "*") {
-        return `Every ${minute.slice(2)} minutes (${timezone})`;
-    }
-    if (minute === "0" && hour.startsWith("*/") && dayOfMonth === "*"
-        && month === "*" && dayOfWeek === "*") {
-        return `Every ${hour.slice(2)} hours (${timezone})`;
-    }
-    if (minute === "0" && hour === "*" && dayOfMonth === "*"
-        && month === "*" && dayOfWeek === "*") {
-        return `Every hour on the hour (${timezone})`;
-    }
-    return `Cron \`${cron}\` (${timezone})`;
-}
-function parseNaturalLanguage(text) {
-    const normalized = text.trim().toLowerCase();
-    let match = /^every\s+(\d+)\s+minutes?$/.exec(normalized);
-    if (match) {
-        const minutes = Number(match[1]);
-        if (minutes < 1 || minutes > 59)
-            return [null, "minute interval must be 1..59"];
-        return [`*/${minutes} * * * *`, `Every ${minutes} minutes`];
-    }
-    if (normalized === "every hour" || normalized === "hourly") {
-        return ["0 * * * *", "Every hour on the hour"];
-    }
-    match = /^every\s+(\d+)\s+hours?$/.exec(normalized);
-    if (match) {
-        const hours = Number(match[1]);
-        if (hours < 1 || hours > 23)
-            return [null, "hour interval must be 1..23"];
-        return [`0 */${hours} * * *`, `Every ${hours} hours`];
-    }
-    match = /^(?:every\s+)?(weekday|weekdays|day|daily)\s+(?:at\s+)?(.+)$/.exec(normalized);
-    if (match) {
-        const clock = parseClock(match[2]);
-        if (!clock)
-            return [null, `could not parse time: ${match[2]}`];
-        const [hour, minute] = clock;
-        const weekdays = match[1] === "weekday" || match[1] === "weekdays";
-        return [
-            `${minute} ${hour} * * ${weekdays ? "1-5" : "*"}`,
-            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(hour, minute)}`,
-        ];
-    }
-    match = /^(?:every\s+)?(sun(?:day)?|mon(?:day)?|tue(?:s|sday)?|wed(?:nesday)?|thu(?:r|rs|rsday)?|fri(?:day)?|sat(?:urday)?)s?\s+(?:at\s+)?(.+)$/.exec(normalized);
-    if (match) {
-        const day = DAY_NAMES[match[1]];
-        const clock = parseClock(match[2]);
-        if (!clock)
-            return [null, `could not parse time: ${match[2]}`];
-        return [
-            `${clock[1]} ${clock[0]} * * ${day}`,
-            `Every ${DAY_LABELS[String(day)]} at ${formatClock(...clock)}`,
-        ];
-    }
-    match = /^at\s+(.+?)\s+every\s+(weekday|weekdays|day|daily)$/.exec(normalized);
-    if (match) {
-        const clock = parseClock(match[1]);
-        if (!clock)
-            return [null, `could not parse time: ${match[1]}`];
-        const weekdays = match[2] === "weekday" || match[2] === "weekdays";
-        return [
-            `${clock[1]} ${clock[0]} * * ${weekdays ? "1-5" : "*"}`,
-            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(...clock)}`,
-        ];
-    }
-    return [
-        null,
-        "unrecognized schedule — try 'every weekday at 9am', 'every day at 14:30', "
-            + "'every monday at 9am', a 5-field cron, or 'every 15 minutes'",
-    ];
-}
-function isValidTimezone(timezone) {
-    const wellFormed = /^(UTC|[A-Za-z0-9_+-]+(\/[A-Za-z0-9_+-]+)+)$/;
-    if (!wellFormed.test(timezone))
-        return false;
-    try {
-        new Intl.DateTimeFormat(undefined, { timeZone: timezone });
-        return true;
-    }
-    catch {
-        // Hosts without tzdata accept the same well-formed names as the shell.
-        return wellFormed.test(timezone);
-    }
-}
-export function detectHostTimezone(override, resolveLocaltime = fs.realpathSync, readTimedatectl = () => {
-    const result = spawnSync("timedatectl", ["show", "-p", "Timezone", "--value"], { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] });
-    if (result.error || result.status !== 0)
-        return "";
-    return result.stdout || "";
-}) {
-    if (override)
-        return override;
-    const environmentTimezone = (process.env.TZ || "").trim();
-    if (environmentTimezone && environmentTimezone.includes("/"))
-        return environmentTimezone;
-    try {
-        const realpath = resolveLocaltime("/etc/localtime");
-        const parts = realpath.split(path.sep).filter(Boolean);
-        const zoneinfo = parts.indexOf("zoneinfo");
-        if (zoneinfo >= 0 && parts.slice(zoneinfo + 1).length) {
-            return parts.slice(zoneinfo + 1).join("/");
-        }
-    }
-    catch {
-        // Ignore an unavailable local timezone link.
-    }
-    try {
-        const timezone = readTimedatectl().trim();
-        if (timezone && timezone.includes("/"))
-            return timezone;
-    }
-    catch {
-        // Ignore unavailable timedatectl.
-    }
-    return "UTC";
-}
-export function runScheduleParse(argv) {
-    let timezoneOverride = "";
-    const args = [...argv];
-    while (args.length) {
-        const argument = args[0];
-        if (argument === "--tz") {
-            if (args.length < 2) {
-                process.stderr.write(SCHEDULE_PARSE_USAGE);
-                return 2;
-            }
-            timezoneOverride = args[1];
-            args.splice(0, 2);
-        }
-        else if (argument === "--json") {
-            args.shift();
-        }
-        else if (argument === "-h" || argument === "--help") {
-            process.stderr.write(SCHEDULE_PARSE_USAGE);
-            return 2;
-        }
-        else if (argument === "--") {
-            args.shift();
-            break;
-        }
-        else if (argument.startsWith("-")) {
-            process.stderr.write(`jobs-schedule-parse: unknown flag: ${argument}\n${SCHEDULE_PARSE_USAGE}`);
-            return 2;
-        }
-        else {
-            break;
-        }
-    }
-    if (!args.length) {
-        process.stderr.write(SCHEDULE_PARSE_USAGE);
-        return 2;
-    }
-    const input = args.join(" ").trim();
-    if (!input) {
-        process.stdout.write('{"ok":false,"error":"empty schedule"}\n');
-        return 1;
-    }
-    const timezone = detectHostTimezone(timezoneOverride);
-    if (!isValidTimezone(timezone)) {
-        process.stdout.write(`${JSON.stringify({ ok: false, error: `invalid IANA timezone: ${timezone}` })}\n`);
-        return 1;
-    }
-    if (CRON_RE.test(input) && !/[A-Za-z]/.test(input)) {
-        process.stdout.write(`${JSON.stringify({ ok: true, cron: input, timezone, human: humanizeCron(input, timezone), source: "cron" })}\n`);
-        return 0;
-    }
-    const namedCron = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(mon-fri|monday-friday)$/i.exec(input);
-    if (namedCron) {
-        const cron = `${namedCron[1]} ${namedCron[2]} ${namedCron[3]} ${namedCron[4]} 1-5`;
-        process.stdout.write(`${JSON.stringify({ ok: true, cron, timezone, human: humanizeCron(cron, timezone), source: "cron" })}\n`);
-        return 0;
-    }
-    const [cron, message] = parseNaturalLanguage(input);
-    if (cron === null) {
-        process.stdout.write(`${JSON.stringify({ ok: false, error: message })}\n`);
-        return 1;
-    }
-    process.stdout.write(`${JSON.stringify({ ok: true, cron, timezone, human: `${message} (${timezone})`, source: "nl" })}\n`);
-    return 0;
-}
-function isValidCronField(value, minimum, maximum) {
-    return value.split(",").every((part) => {
-        if (part === "*")
-            return true;
-        if (/^\*\/[1-9]\d*$/.test(part))
-            return true;
-        if (/^(sun|mon|tue|wed|thu|fri|sat)$/i.test(part))
-            return maximum === 7;
-        if (/^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)$/i.test(part))
-            return maximum === 12;
-        const range = /^(\d+)-(\d+)(?:\/([1-9]\d*))?$/.exec(part);
-        if (range) {
-            return Number(range[1]) >= minimum && Number(range[2]) <= maximum
-                && Number(range[1]) <= Number(range[2]);
-        }
-        const number = /^(\d+)(?:\/([1-9]\d*))?$/.exec(part);
-        if (!number)
-            return false;
-        return Number(number[1]) >= minimum && Number(number[1]) <= maximum;
-    });
-}
-function validateCron(file, cron, emit) {
-    const fields = cron.trim().split(/\s+/);
-    if (fields.length !== 5) {
-        emit(file, "schedule", `invalid cron — expected 5 fields (minute hour dom month dow), got ${fields.length}`);
-        return;
-    }
-    const names = ["minute", "hour", "day-of-month", "month", "day-of-week"];
-    const ranges = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
-    fields.forEach((field, index) => {
-        const [minimum, maximum] = ranges[index];
-        if (!isValidCronField(field, minimum, maximum)) {
-            emit(file, "schedule", `invalid cron ${names[index]} field '${field}'`);
-        }
-    });
-}
-function asText(value) {
-    if (value === null || value === undefined || value === false)
-        return "";
-    if (typeof value === "string")
-        return value;
-    if (typeof value === "object")
-        return JSON.stringify(value, null, 2);
-    return String(value);
-}
-function matchingJobSecretPatterns(value) {
-    return matchingSecretPatterns(value, { requireBoundary: false });
-}
-function validateCwd(file, field, cwd, emit) {
-    if (cwd.startsWith("/")) {
-        emit(file, field, "absolute cwd not allowed — use an HQ-root-relative path");
-        return;
-    }
-    if (cwd.split("/").includes("..")) {
-        emit(file, field, "cwd must not contain '..' path components");
-    }
-}
-function validateJobId(file, value, seenIds, emit) {
-    if (!value)
-        return;
-    if (!/^[a-z][a-z0-9-]{1,62}$/.test(value)) {
-        emit(file, "id", `must match [a-z][a-z0-9-]{1,62}, got '${value}'`);
-    }
-    if (seenIds.includes(value))
-        emit(file, "id", `duplicate id '${value}'`);
-    seenIds.push(value);
-}
-function validateExec(file, exec, emit) {
-    if (exec === undefined || exec === null) {
-        emit(file, "exec", "missing required field");
-        return;
-    }
-    if (typeof exec !== "object" || Array.isArray(exec)) {
-        emit(file, "exec", "must be an object with prompt or skill");
-        return;
-    }
-    const definition = exec;
-    const prompt = asText(definition.prompt);
-    const skill = asText(definition.skill);
-    if (!prompt && !skill)
-        emit(file, "exec", "must set prompt or skill");
-    else if (prompt && skill)
-        emit(file, "exec", "set exactly one of prompt or skill, not both");
-    for (const [field, value] of [["exec.prompt", prompt], ["exec.skill", skill]]) {
-        for (const name of matchingJobSecretPatterns(value)) {
-            emit(file, field, `inline credential-shaped value matched pattern '${name}' (names only; never values)`);
-        }
-    }
-    if (definition.args !== undefined) {
-        if (!definition.args || typeof definition.args !== "object" || Array.isArray(definition.args)) {
-            emit(file, "exec.args", "must be a mapping when present");
-        }
-        else {
-            const collectStrings = (value) => {
-                if (typeof value === "string")
-                    return [value];
-                if (Array.isArray(value))
-                    return value.flatMap(collectStrings);
-                if (value && typeof value === "object")
-                    return Object.values(value).flatMap(collectStrings);
-                return [];
-            };
-            for (const value of collectStrings(definition.args)) {
-                for (const name of matchingJobSecretPatterns(value)) {
-                    emit(file, "exec.args", `inline credential-shaped value matched pattern '${name}' (names only; never values)`);
-                }
-            }
-        }
-    }
-    const surface = asText(definition.surface);
-    if (surface && !["headless", "remote"].includes(surface)) {
-        emit(file, "exec.surface", `unknown surface '${surface}' (allowed: headless|remote)`);
-    }
-    for (const key of Object.keys(definition)) {
-        if (!["prompt", "skill", "args", "surface"].includes(key)) {
-            emit(file, `exec.${key}`, "unknown exec key (allowed: prompt, skill, args, surface)");
-        }
-    }
-}
-function validateRequirements(file, requirements, runtime, emit) {
-    if (requirements === undefined || requirements === null)
-        return;
-    if (!requirements || typeof requirements !== "object" || Array.isArray(requirements)) {
-        emit(file, "requirements", "must be a mapping");
-        return;
-    }
-    const value = requirements;
-    for (const key of Object.keys(value)) {
-        if (["runtime", "secrets", "company", "cwd", "tools"].includes(key))
-            continue;
-        const message = ["readiness", "last_probe", "last_run", "failure_class", "pending_probe"].includes(key)
-            ? "unknown requirements key (status belongs in hq-pro, not requirements)"
-            : "unknown requirements key (allowed: runtime, secrets, company, cwd, tools)";
-        emit(file, `requirements.${key}`, message);
-    }
-    const requiredRuntime = asText(value.runtime);
-    if (requiredRuntime && !["claude", "codex"].includes(requiredRuntime)) {
-        emit(file, "requirements.runtime", `unknown runtime '${requiredRuntime}' (allowed: claude|codex)`);
-    }
-    if (requiredRuntime && runtime && value.runtime !== runtime) {
-        emit(file, "requirements.runtime", `mismatches top-level runtime ('${requiredRuntime}' vs '${runtime}')`);
-    }
-    if (value.secrets !== undefined) {
-        if (!Array.isArray(value.secrets)) {
-            emit(file, "requirements.secrets", "must be an array of vault key names");
-        }
-        else {
-            for (const secret of value.secrets) {
-                const name = asText(secret);
-                for (const pattern of matchingJobSecretPatterns(name)) {
-                    emit(file, "requirements.secrets", `inline credential-shaped value matched pattern '${pattern}' (names only; never values)`);
-                }
-                if (name && !/^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/.test(name)) {
-                    emit(file, "requirements.secrets", `invalid vault key name '${name}' (use names only)`);
-                }
-                if (name.includes("=")) {
-                    emit(file, "requirements.secrets", "looks like KEY=value inline credential — names only");
-                }
-            }
-        }
-    }
-    if (value.tools !== undefined && !Array.isArray(value.tools)) {
-        emit(file, "requirements.tools", "must be an array of strings");
-    }
-    if (value.cwd)
-        validateCwd(file, "requirements.cwd", asText(value.cwd), emit);
-    const company = asText(value.company);
-    if (company && !/^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$/.test(company)) {
-        emit(file, "requirements.company", `invalid company slug '${company}' (lowercase kebab/underscore)`);
-    }
-}
-function validateJob(file, document, seenIds, emit) {
-    if (!document || typeof document !== "object" || Array.isArray(document)) {
-        emit(file, "yaml", "job root must be a mapping");
-        return;
-    }
-    const job = document;
-    for (const field of ["id", "name", "schedule", "runtime", "timeout_seconds", "notify", "enabled", "owner", "created_at"]) {
-        const missing = field === "enabled" ? !Object.hasOwn(job, field) : asText(job[field]) === "";
-        if (missing)
-            emit(file, field, "missing required field");
-    }
-    const id = asText(job.id);
-    const schedule = asText(job.schedule);
-    const timezone = asText(job.timezone);
-    const runtime = asText(job.runtime);
-    const timeout = asText(job.timeout_seconds);
-    const notify = asText(job.notify);
-    if (job.timezone !== undefined && (typeof job.timezone !== "string" || !job.timezone)) {
-        emit(file, "timezone", "must be a non-empty string when present");
-    }
-    validateJobId(file, id, seenIds, emit);
-    if (schedule) {
-        const fields = schedule.trim().split(/\s+/);
-        if (fields.length !== 5) {
-            const message = /[a-z]/i.test(schedule)
-                ? "natural-language schedule is not allowed — store canonical cron only"
-                : `invalid cron — expected 5 fields (minute hour dom month dow), got ${fields.length}`;
-            emit(file, "schedule", message);
-        }
-        else {
-            validateCron(file, schedule, emit);
-        }
-    }
-    if (timezone && !(/^[A-Za-z_]+(\/[A-Za-z0-9_+-]+)+$/.test(timezone) || timezone === "UTC")) {
-        emit(file, "timezone", `not an IANA-looking timezone '${timezone}'`);
-    }
-    if (runtime && !["claude", "codex"].includes(runtime)) {
-        emit(file, "runtime", `unknown runtime '${runtime}' (allowed: claude|codex)`);
-    }
-    validateExec(file, job.exec, emit);
-    if (timeout) {
-        if (!/^\d+$/.test(timeout))
-            emit(file, "timeout_seconds", `must be an integer, got '${timeout}'`);
-        else if (+timeout < 60 || +timeout > 14400) {
-            emit(file, "timeout_seconds", `must be between 60 and 14400, got ${timeout}`);
-        }
-    }
-    if (notify && !["dm", "none", "profile"].includes(notify)) {
-        emit(file, "notify", `unknown notify '${notify}' (allowed: dm|none|profile)`);
-    }
-    if (job.enabled !== undefined && typeof job.enabled !== "boolean") {
-        emit(file, "enabled", `must be boolean true|false, got '${String(job.enabled)}'`);
-    }
-    const createdAt = asText(job.created_at);
-    if (createdAt && !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(Z|[+-]\d{2}:\d{2})$/.test(createdAt)) {
-        emit(file, "created_at", `must be ISO-8601 datetime, got '${createdAt}'`);
-    }
-    validateRequirements(file, job.requirements, runtime, emit);
-    if (job.cwd)
-        validateCwd(file, "cwd", asText(job.cwd), emit);
-}
-function parseJobFile(contents) {
-    const documents = [];
-    loadAll(contents, (document) => documents.push(document), { schema: JSON_SCHEMA, json: true });
-    if (documents.length > 1)
-        return [];
-    const parsed = documents.length === 0
-        ? load(contents, { schema: JSON_SCHEMA, json: true })
-        : documents[0];
-    return expandYamlMergeKeys(parsed);
-}
-function expandYamlMergeKeys(value) {
-    if (Array.isArray(value))
-        return value.map(expandYamlMergeKeys);
-    if (!value || typeof value !== "object")
-        return value;
-    const mapping = value;
-    const merged = mapping["<<"];
-    const sources = Array.isArray(merged) ? merged : merged === undefined ? [] : [merged];
-    const result = {};
-    for (const source of [...sources].reverse()) {
-        if (source && typeof source === "object" && !Array.isArray(source)) {
-            Object.assign(result, expandYamlMergeKeys(source));
-        }
-    }
-    for (const [key, entry] of Object.entries(mapping)) {
-        if (key !== "<<")
-            result[key] = expandYamlMergeKeys(entry);
-    }
-    return result;
-}
-function collectJobFiles(args, emit) {
-    const files = [];
-    const collect = (argument) => {
-        try {
-            const stat = fs.statSync(argument);
-            if (stat.isFile()) {
-                if (/\.(yaml|yml)$/.test(argument))
-                    files.push({ diskPath: argument, displayPath: argument });
-                else
-                    emit(argument, "path", "not a .yaml/.yml job file");
-                return;
-            }
-            if (stat.isDirectory()) {
-                const strippedArgument = argument.replace(/\/+$/, "") || path.parse(argument).root;
-                const walk = (directory, displayDirectory) => {
-                    const entries = fs.readdirSync(directory, { withFileTypes: true });
-                    for (const entry of entries) {
-                        const file = path.join(directory, entry.name);
-                        const displayFile = `${displayDirectory.replace(/\/$/, "")}/${entry.name}`;
-                        if (entry.isDirectory())
-                            walk(file, displayFile);
-                        else if (entry.isFile() && /\.(yaml|yml)$/.test(entry.name)) {
-                            files.push({ diskPath: file, displayPath: displayFile });
-                        }
-                    }
-                };
-                walk(argument, strippedArgument);
-                return;
-            }
-            emit(argument, "path", "file or directory not found");
-        }
-        catch {
-            emit(argument, "path", "file or directory not found");
-        }
-    };
-    args.forEach(collect);
-    return files;
-}
-function comparePathsLikeSort(left, right) {
-    return Buffer.compare(Buffer.from(left), Buffer.from(right));
-}
-export function validateJobs(args) {
-    if (!args.length) {
-        process.stderr.write(VALIDATE_USAGE);
-        return 2;
-    }
-    const errors = [];
-    const emit = (file, field, message) => {
-        errors.push(`jobs-validate: ${file}: ${field}: ${message}`);
-    };
-    const seenIds = [];
-    const files = collectJobFiles(args, emit).sort((left, right) => comparePathsLikeSort(left.diskPath, right.diskPath));
-    if (!files.length) {
-        for (const error of errors)
-            process.stderr.write(`${error}\n`);
-        process.stderr.write("jobs-validate: no job YAML files found\n");
-        return 1;
-    }
-    for (const { diskPath, displayPath } of files) {
-        try {
-            validateJob(displayPath, parseJobFile(fs.readFileSync(diskPath, "utf8")), seenIds, emit);
-        }
-        catch {
-            emit(displayPath, "yaml", "failed to parse YAML");
-        }
-    }
-    for (const error of errors)
-        process.stderr.write(`${error}\n`);
-    if (errors.length) {
-        process.stderr.write(`jobs-validate: ${errors.length} error(s)\n`);
-        return 1;
-    }
-    return 0;
-}
-const RECONCILE_USAGE = `outpost-jobs-reconcile.sh — registry YAML → systemd user timers (US-004).
-
-Reads personal/jobs/*.yaml and companies/*/jobs/*.yaml from the box HQ tree,
-validates each with jobs-validate.sh, and materializes disposable units:
-  ~/.config/systemd/user/hq-job-{id}.service
-  ~/.config/systemd/user/hq-job-{id}.timer
-with Persistent=true and RandomizedDelaySec. Timers are armed only when
-hq-pro jobs status readiness=ready (box cache from probe ingest, or live
-GET when available). Disabled/deleted jobs have units removed.
-
-Company-scoped jobs materialize only when job.owner matches this Outpost's
-owner identity (creator's box only in v1).
-
-Usage:
-  core/scripts/outpost-jobs-reconcile.sh [options]
-  core/scripts/outpost-jobs-reconcile.sh --after-sync   # post-sync entrypoint
-
-Options:
-  --hq-root DIR       HQ tree root (default: HQ_ROOT or repo root above core/)
-  --dry-run           Write units to unit dir / print plan; skip systemctl
-  --no-probe          Do not probe non-ready jobs
-  --probe-only        Probe non-ready jobs then exit (no unit changes)
-  --ensure-hook       Install personal/hooks/Stop/90-outpost-jobs-reconcile.sh
-  --after-sync        Alias for default reconcile + probe path (sync Stop hook)
-  -h, --help
-
-Env / overrides (tests):
-  HQ_ROOT, HOME, HQ_JOB_UNIT_DIR, HQ_JOB_SYSTEMCTL, HQ_JOB_STATUS_CACHE_DIR
-  HQ_JOB_OWNER_EMAIL, HQ_JOB_OWNER_UID, OUTPOST_USER_ID, OUTPOST_ID
-  HQ_JOB_RANDOMIZE_SEC (default 60), HQ_JOB_RECONCILE_STATE
-  HQ_PRO_API_URL / HQ_API_URL / HQ_VAULT_API_URL, HQ_ACCESS_TOKEN (optional GET)
-
-Exit: 0 success; 1 partial failures; 2 usage/config.
-`;
-function commandResult(command, args) {
-    const result = spawnSync(command, args, {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    return {
-        status: result.status ?? (result.error ? 127 : 1),
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
-}
-function isExecutable(file) {
-    try {
-        fs.accessSync(file, fs.constants.X_OK);
-        return fs.statSync(file).isFile();
-    }
-    catch {
-        return false;
-    }
-}
-function findExecutable(command, searchPath) {
-    if (path.isAbsolute(command) || command.includes(path.sep)) {
-        return isExecutable(command) ? command : undefined;
-    }
-    for (const directory of searchPath.split(path.delimiter)) {
-        if (!directory)
-            continue;
-        const candidate = path.join(directory, command);
-        if (isExecutable(candidate))
-            return candidate;
-    }
-    return undefined;
-}
-function shellText(value) {
-    if (value === undefined || value === null)
-        return "";
-    if (typeof value === "string")
-        return value;
-    if (typeof value === "object")
-        return JSON.stringify(value);
-    return String(value);
-}
-function parseIdentityAssignments(contents) {
-    const values = [];
-    for (const line of contents.split(/\r?\n/)) {
-        const assignment = /^\s*(?:export\s+)?(OUTPOST_USER_ID|OUTPOST_OWNER_EMAIL|OWNER_EMAIL)\s*=\s*(.*?)\s*$/.exec(line);
-        if (!assignment)
-            continue;
-        let value = assignment[2] ?? "";
-        if ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"'))) {
-            value = value.slice(1, -1);
-        }
-        else {
-            value = value.replace(/\s+#.*$/, "");
-        }
-        values.push(value);
-    }
-    return values;
-}
-function identityFileTokens(options) {
-    if (process.env.HQ_JOB_SKIP_SYSTEM_IDENTITY === "1")
-        return [];
-    const filename = "/etc/outpost/codex-identity.env";
-    try {
-        const contents = options.identityFileReader
-            ? options.identityFileReader(filename)
-            : fs.readFileSync(filename, "utf8");
-        return contents ? parseIdentityAssignments(contents) : [];
-    }
-    catch {
-        return [];
-    }
-}
-function resolveBoxOwners(options) {
-    const owners = [];
-    const add = (value) => {
-        if (!value || value === "null" || owners.includes(value))
-            return;
-        owners.push(value);
-    };
-    add(process.env.HQ_JOB_OWNER_EMAIL);
-    add(process.env.HQ_JOB_OWNER_UID);
-    add(process.env.OUTPOST_USER_ID);
-    const searchPath = process.env.PATH ?? "";
-    if (findExecutable("hq", searchPath)) {
-        const run = options.commandRunner ?? commandResult;
-        let result = run("hq", ["whoami", "--json"]);
-        if (result.status !== 0)
-            result = run("hq", ["whoami"]);
-        const who = result.stdout;
-        if (who) {
-            let parsed;
-            try {
-                parsed = JSON.parse(who);
-            }
-            catch {
-                parsed = undefined;
-            }
-            let email = "";
-            if (parsed && typeof parsed === "object") {
-                const record = parsed;
-                const user = record.user && typeof record.user === "object"
-                    ? record.user
-                    : undefined;
-                email = shellText(record.email ?? user?.email);
-                add(email);
-                add(shellText(record.personUid ?? record.person_uid ?? record.uid));
-            }
-            if (!email) {
-                const humanEmail = /.*Email:\s*(.*)/i.exec(who)?.[1]
-                    ?? /.*email\s*[:=]\s*(.*)/i.exec(who)?.[1];
-                if (humanEmail)
-                    add(humanEmail.replace(/\s/g, ""));
-            }
-        }
-    }
-    for (const value of identityFileTokens(options))
-        add(value);
-    return owners;
-}
-function ownerMatches(jobOwner, owners) {
-    if (!jobOwner)
-        return false;
-    return owners.some((owner) => owner === jobOwner
-        || (owner.includes("@") && owner.toLowerCase() === jobOwner.toLowerCase()));
-}
-function compareReconcilePaths(left, right) {
-    return Buffer.compare(Buffer.from(left), Buffer.from(right));
-}
-function addYamlFilesAtDepth(directory, maxDepth) {
-    const result = [];
-    const walk = (current, depth) => {
-        let entries;
-        try {
-            entries = fs.readdirSync(current, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const entry of entries) {
-            const file = path.join(current, entry.name);
-            if (entry.isFile() && depth <= maxDepth && /\.(yaml|yml)$/.test(entry.name)) {
-                result.push(file);
-            }
-            else if (entry.isDirectory() && depth < maxDepth) {
-                walk(file, depth + 1);
-            }
-        }
-    };
-    walk(directory, 1);
-    return result;
-}
-function collectReconcileJobs(root) {
-    const files = addYamlFilesAtDepth(path.join(root, "personal", "jobs"), 1);
-    const companies = path.join(root, "companies");
-    let companyEntries = [];
-    try {
-        companyEntries = fs.readdirSync(companies, { withFileTypes: true });
-    }
-    catch { /* A missing companies tree is empty. */ }
-    for (const company of companyEntries) {
-        if (!company.isDirectory())
-            continue;
-        files.push(...addYamlFilesAtDepth(path.join(companies, company.name, "jobs"), 1));
-    }
-    return files
-        .filter((file) => !file.includes(".conflict-") && !file.includes(`${path.sep}.conflicts${path.sep}`))
-        .sort(compareReconcilePaths);
-}
-function readJobValue(file) {
-    try {
-        const parsed = parseJobFile(fs.readFileSync(file, "utf8"));
-        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
-            ? parsed
-            : {};
-    }
-    catch {
-        return {};
-    }
-}
-function reconcileJobIsValid(file) {
-    const errors = [];
-    try {
-        validateJob(file, parseJobFile(fs.readFileSync(file, "utf8")), [], (_path, _field, message) => errors.push(message));
-        return errors.length === 0;
-    }
-    catch {
-        return false;
-    }
-}
-function parseData(contents) {
-    return load(contents, { schema: JSON_SCHEMA, json: true });
-}
-function recordOf(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function writeReadinessCache(cacheDir, id, readiness, source, options) {
-    const filename = path.join(cacheDir, `${id}.json`);
-    const updatedAt = (options.now?.() ?? new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
-    fs.writeFileSync(filename, serializeJqJson({ job_id: id, readiness, updated_at: updatedAt, source }, "compact"));
-    try {
-        fs.chmodSync(filename, 0o600);
-    }
-    catch { /* The shell ignores chmod failure. */ }
-}
-function cachedReadiness(cacheDir, home, id) {
-    try {
-        const record = recordOf(parseData(fs.readFileSync(path.join(cacheDir, `${id}.json`), "utf8")));
-        const value = record?.readiness;
-        if (value !== undefined && value !== null && value !== false)
-            return shellText(value);
-        if (value === false)
-            return "unknown";
-    }
-    catch { /* The shell falls through to the probe marker. */ }
-    try {
-        const marker = JSON.parse(fs.readFileSync(path.join(home, ".hq", "jobs", "probes", id, "last-attempt.json"), "utf8"));
-        const reported = marker.reported_readiness;
-        if (reported !== undefined && reported !== null && reported !== false && reported !== "")
-            return shellText(reported);
-    }
-    catch { /* No successful prior probe marker. */ }
-    return "unknown";
-}
-async function liveReadiness(id, cacheDir, options) {
-    if (process.env.HQ_JOB_DISABLE_LIVE_READINESS === "1")
-        return undefined;
-    const token = process.env.HQ_ACCESS_TOKEN;
-    if (!token)
-        return undefined;
-    const api = process.env.HQ_PRO_API_URL || process.env.HQ_API_URL || process.env.HQ_VAULT_API_URL || "https://hqapi.hq.computer";
-    const url = `${api.replace(/\/$/, "")}/outpost/jobs/status/${id}`;
-    try {
-        const response = await (options.fetcher ?? fetch)(url, {
-            method: "GET",
-            headers: { authorization: `Bearer ${token}`, accept: "application/json" },
-            signal: AbortSignal.timeout(15_000),
-        });
-        if (!response.ok)
-            return undefined;
-        const body = recordOf(await response.json());
-        const status = recordOf(body?.status);
-        const readiness = status?.readiness !== undefined && status.readiness !== null && status.readiness !== false
-            ? status.readiness
-            : body?.readiness;
-        if (readiness === undefined || readiness === null || readiness === false || readiness === "")
-            return undefined;
-        const result = shellText(readiness);
-        writeReadinessCache(cacheDir, id, result, "api-get", options);
-        return result;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function jobReadiness(id, cacheDir, home, options) {
-    return await liveReadiness(id, cacheDir, options) ?? cachedReadiness(cacheDir, home, id);
-}
-function probeValue(output, field) {
-    try {
-        const record = recordOf(JSON.parse(output));
-        const value = record?.[field];
-        return value === undefined || value === null ? "" : shellText(value);
-    }
-    catch {
-        return "";
-    }
-}
-function cronDowNumber(value) {
-    const names = { "0": "Sun", "1": "Mon", "2": "Tue", "3": "Wed", "4": "Thu", "5": "Fri", "6": "Sat", "7": "Sun" };
-    return names[value];
-}
-function cronDowTokenToSystemd(token) {
-    if (/^[0-7]+-[0-7]+$/.test(token)) {
-        const [from, to] = token.split("-");
-        const start = cronDowNumber(from ?? "");
-        const end = cronDowNumber(to ?? "");
-        return start && end ? `${start}..${end}` : undefined;
-    }
-    const lower = token.toLowerCase();
-    const names = {
-        sun: "Sun", "0": "Sun", "7": "Sun", mon: "Mon", "1": "Mon",
-        tue: "Tue", "2": "Tue", wed: "Wed", "3": "Wed", thu: "Thu", "4": "Thu",
-        fri: "Fri", "5": "Fri", sat: "Sat", "6": "Sat", "mon..fri": "Mon..Fri", "1-5": "Mon..Fri",
-    };
-    return names[lower];
-}
-function cronDowToSystemd(field) {
-    if (field === "*" || field === "*/1")
-        return "";
-    const mapped = [];
-    for (const part of field.split(/[\s,]+/)) {
-        const value = cronDowTokenToSystemd(part);
-        if (!value)
-            return undefined;
-        mapped.push(value);
-    }
-    return mapped.join(",");
-}
-function padCronField(value) {
-    return value.length === 1 ? `0${value}` : value;
-}
-function cronTimeField(field) {
-    if (field === "*")
-        return "";
-    if (field.includes("/"))
-        return `*/${field.slice(field.indexOf("/") + 1)}`;
-    if (field.includes("-"))
-        return field;
-    return /^\d+$/.test(field) ? padCronField(field) : field;
-}
-function cronToOnCalendar(fields) {
-    const [minute = "", hour = "", dom = "", month = "", dow = ""] = fields;
-    const dowValue = cronDowToSystemd(dow) ?? "";
-    const monthValue = month === "*" ? "*" : padCronField(month);
-    const dayValue = dom === "*" ? "*" : padCronField(dom);
-    const date = `*-${monthValue}-${dayValue}`;
-    const minuteValue = cronTimeField(minute) || "00";
-    const hourValue = cronTimeField(hour) || "*";
-    let time;
-    if (hourValue === "*")
-        time = `*:${minuteValue}:00`;
-    else if (hourValue.includes("/"))
-        time = `0/${hourValue.slice(hourValue.indexOf("/") + 1)}:${minuteValue}:00`;
-    else
-        time = `${hourValue}:${minuteValue}:00`;
-    return dowValue ? `${dowValue} ${date} ${time}` : `${date} ${time}`;
-}
-function normalizeServicePath(value) {
-    const entries = [];
-    for (const entry of value.split(":")) {
-        if (entry.startsWith("/") && !entries.includes(entry))
-            entries.push(entry);
-    }
-    return entries.join(":");
-}
-function servicePathValue() {
-    let servicePath = normalizeServicePath(process.env.PATH || "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin");
-    const hq = findExecutable("hq", servicePath);
-    if (hq) {
-        let binDirectory = "";
-        try {
-            binDirectory = fs.realpathSync(path.dirname(hq));
-        }
-        catch { /* `pwd -P` failed in the shell equivalent. */ }
-        if (binDirectory && !servicePath.split(":").includes(binDirectory))
-            servicePath = [binDirectory, servicePath].filter(Boolean).join(":");
-    }
-    return servicePath;
-}
-function systemdQuote(value) {
-    return `"${value.replace(/%/g, "%%").replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
-}
-function serviceUnit(root, runner, id) {
-    const pathValue = systemdQuote(`PATH=${servicePathValue()}`);
-    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironment=HQ_ROOT=${root}\nEnvironment=${pathValue}\nExecStart=${runner} --hq-root ${root} --job-id ${id}\nNice=10\n\n[Install]\nWantedBy=default.target\n`;
-}
-function timerUnit(id, onCalendar, randomize, root) {
-    return `# Generated by outpost-jobs-reconcile.sh — disposable derived state. Do not edit.\n[Unit]\nDescription=HQ Outpost scheduled job timer: ${id}\nDocumentation=file://${root}/core/knowledge/public/hq-core/outpost-jobs-spec.md\n\n[Timer]\nOnCalendar=${onCalendar}\nPersistent=true\nRandomizedDelaySec=${randomize}\nUnit=hq-job-${id}.service\n\n[Install]\nWantedBy=timers.target\n`;
-}
-function systemctlResult(args, dryRun, command, options) {
-    if (dryRun) {
-        process.stderr.write(`outpost-jobs-reconcile: dry-run systemctl --user ${args.join(" ")}\n`);
-        return { status: 0, stdout: "", stderr: "" };
-    }
-    if (command === ":" || command === "true")
-        return { status: 0, stdout: "", stderr: "" };
-    if (!options.schedulerRunner && !findExecutable(command, process.env.PATH ?? "")) {
-        process.stderr.write(`outpost-jobs-reconcile: systemctl not available — units written but not enabled (${args.join(" ")})\n`);
-        return { status: 0, stdout: "", stderr: "" };
-    }
-    if (process.env.HQ_JOB_TEST_SCHEDULER_STUB === "1" && !options.schedulerRunner) {
-        return { status: 127, stdout: "", stderr: "scheduler stub was requested but no injected runner was supplied" };
-    }
-    try {
-        const runner = options.schedulerRunner ?? commandResult;
-        return runner(command, ["--user", ...args]);
-    }
-    catch (error) {
-        return { status: 127, stdout: "", stderr: error instanceof Error ? error.message : String(error) };
-    }
-}
-function installSyncHook(root) {
-    const directory = path.join(root, "personal", "hooks", "Stop");
-    const filename = path.join(directory, "90-outpost-jobs-reconcile.sh");
-    fs.mkdirSync(directory, { recursive: true });
-    const contents = [
-        "#!/usr/bin/env bash",
-        "# Auto-installed by outpost-jobs-reconcile.sh --ensure-hook (US-004).",
-        "# hq-sync-runner executes personal/hooks/Stop/* after each sync cycle.",
-        "set -u",
-        'HQ_ROOT="${OUTPOST_HQ_ROOT:-${HQ_ROOT:-/home/ec2-user/hq}}"',
-        'RECONCILE="$HQ_ROOT/core/scripts/outpost-jobs-reconcile.sh"',
-        'if [ -x "$RECONCILE" ] || [ -f "$RECONCILE" ]; then',
-        '  bash "$RECONCILE" --hq-root "$HQ_ROOT" --after-sync >>"${HOME}/.hq/jobs/reconcile/after-sync.log" 2>&1 || true',
-        "fi",
-        "",
-    ].join("\n");
-    fs.writeFileSync(filename, contents);
-    fs.chmodSync(filename, 0o755);
-    process.stderr.write(`outpost-jobs-reconcile: installed sync Stop hook: ${filename}\n`);
-}
-function disableRemoveUnits(id, unitDir, command, dryRun, options) {
-    for (const args of [["disable", "--now", `hq-job-${id}.timer`], ["stop", `hq-job-${id}.service`]]) {
-        const result = systemctlResult(args, dryRun, command, options);
-        if (result.stdout)
-            process.stdout.write(result.stdout);
-    }
-    fs.rmSync(path.join(unitDir, `hq-job-${id}.service`), { force: true });
-    fs.rmSync(path.join(unitDir, `hq-job-${id}.timer`), { force: true });
-}
-function jobEnabled(job) {
-    return job.enabled === undefined ? "true" : shellText(job.enabled);
-}
-function isCompanyJobPath(file) {
-    return file.split(path.sep).join("/").includes("/companies/");
-}
-function reconcileDie(message) {
-    process.stderr.write(`outpost-jobs-reconcile: ${message}\n`);
-    return 2;
-}
-export async function runReconcile(argv, rootArg, options = {}) {
-    let root = rootArg ?? process.env.HQ_ROOT ?? "";
-    let dryRun = false;
-    let noProbe = false;
-    let probeOnly = false;
-    let ensureHook = false;
-    const args = [...argv];
-    for (let index = 0; index < args.length;) {
-        const arg = args[index];
-        if (arg === "--hq-root") {
-            const value = args[index + 1] ?? "";
-            if (!value)
-                return reconcileDie("--hq-root requires a directory");
-            root = value;
-            index += 2;
-        }
-        else if (arg === "--dry-run") {
-            dryRun = true;
-            index += 1;
-        }
-        else if (arg === "--no-probe") {
-            noProbe = true;
-            index += 1;
-        }
-        else if (arg === "--probe-only") {
-            probeOnly = true;
-            index += 1;
-        }
-        else if (arg === "--ensure-hook") {
-            ensureHook = true;
-            index += 1;
-        }
-        else if (arg === "--after-sync") {
-            index += 1;
-        }
-        else if (arg === "-h" || arg === "--help") {
-            process.stdout.write(`${RECONCILE_USAGE}\n`);
-            return 0;
-        }
-        else if (arg?.startsWith("-")) {
-            return reconcileDie(`unknown option: ${arg}`);
-        }
-        else if (arg !== undefined) {
-            return reconcileDie(`unexpected argument: ${arg}`);
-        }
-    }
-    if (!root)
-        root = resolveLiveRoot();
-    const validator = path.join(root, "core", "scripts", "jobs-validate.sh");
-    const runner = path.join(root, "core", "scripts", "hq-job-run.sh");
-    const probe = path.join(root, "core", "scripts", "hq-job-probe.sh");
-    if (!fs.existsSync(validator))
-        return reconcileDie("missing jobs-validate.sh");
-    if (!fs.existsSync(runner))
-        return reconcileDie("missing hq-job-run.sh");
-    if (!fs.existsSync(probe))
-        return reconcileDie("missing hq-job-probe.sh");
-    const home = process.env.HOME ?? "";
-    const unitDir = process.env.HQ_JOB_UNIT_DIR || path.join(home, ".config", "systemd", "user");
-    const cacheDir = process.env.HQ_JOB_STATUS_CACHE_DIR || path.join(home, ".hq", "jobs", "status-cache");
-    const stateDir = process.env.HQ_JOB_RECONCILE_STATE || path.join(home, ".hq", "jobs", "reconcile");
-    const systemctl = process.env.HQ_JOB_SYSTEMCTL || "systemctl";
-    const randomize = process.env.HQ_JOB_RANDOMIZE_SEC || "60";
-    for (const directory of [unitDir, cacheDir, stateDir])
-        fs.mkdirSync(directory, { recursive: true });
-    const log = (message) => {
-        process.stderr.write(`outpost-jobs-reconcile: ${message}\n`);
-    };
-    const commandRunner = options.commandRunner ?? commandResult;
-    const owners = resolveBoxOwners(options);
-    let errors = 0;
-    let armed = 0;
-    let skipped = 0;
-    let removed = 0;
-    let probed = 0;
-    const desired = new Set();
-    if (ensureHook)
-        installSyncHook(root);
-    if (!noProbe) {
-        for (const file of collectReconcileJobs(root)) {
-            if (!reconcileJobIsValid(file))
-                continue;
-            const job = readJobValue(file);
-            const id = shellText(job.id);
-            if (!id)
-                continue;
-            if (isCompanyJobPath(file) && !ownerMatches(shellText(job.owner), owners))
-                continue;
-            const readiness = await jobReadiness(id, cacheDir, home, options);
-            if (readiness === "ready")
-                continue;
-            log(`probe ${id} (cached readiness=${readiness})`);
-            const result = commandRunner("bash", [probe, "--hq-root", root, file]);
-            probed += 1;
-            const probeReadiness = probeValue(result.stdout, "readiness");
-            if (probeReadiness) {
-                const ingest = probeValue(result.stdout, "ingest");
-                if (ingest === "ok" || ingest === "dry_run")
-                    writeReadinessCache(cacheDir, id, probeReadiness, "probe", options);
-                else if (probeReadiness === "blocked")
-                    writeReadinessCache(cacheDir, id, "blocked", "probe-local", options);
-            }
-            if (result.status >= 2 && result.status !== 3)
-                errors += 1;
-        }
-    }
-    if (probeOnly) {
-        log(`probe-only done (probed=${probed} errors=${errors})`);
-        return errors === 0 ? 0 : 1;
-    }
-    for (const file of collectReconcileJobs(root)) {
-        const job = readJobValue(file);
-        const idHint = shellText(job.id);
-        const timezone = shellText(job.timezone);
-        if (timezone && !/^[A-Za-z0-9/_+-]+$/.test(timezone)) {
-            log(`skip ${idHint || "unknown"} — invalid timezone contains unsafe characters`);
-            errors += 1;
-            continue;
-        }
-        if (!reconcileJobIsValid(file)) {
-            log(`skip invalid job YAML: ${file}`);
-            errors += 1;
-            continue;
-        }
-        const id = idHint;
-        const name = shellText(job.name);
-        const owner = shellText(job.owner);
-        const schedule = shellText(job.schedule);
-        const companyJob = isCompanyJobPath(file);
-        const timerPath = path.join(unitDir, `hq-job-${id}.timer`);
-        const servicePath = path.join(unitDir, `hq-job-${id}.service`);
-        if (companyJob && !ownerMatches(owner, owners)) {
-            log(`skip company job ${id} — owner '${owner}' does not match this Outpost`);
-            skipped += 1;
-            if (fs.existsSync(timerPath)) {
-                disableRemoveUnits(id, unitDir, systemctl, dryRun, options);
-                removed += 1;
-            }
-            continue;
-        }
-        const enabled = jobEnabled(job);
-        if (enabled === "false" || enabled === "False" || enabled === "0") {
-            log(`remove units for disabled job ${id}`);
-            if (fs.existsSync(timerPath) || fs.existsSync(servicePath)) {
-                disableRemoveUnits(id, unitDir, systemctl, dryRun, options);
-                removed += 1;
-            }
-            continue;
-        }
-        const readiness = await jobReadiness(id, cacheDir, home, options);
-        if (readiness !== "ready") {
-            log(`skip arming ${id} — readiness=${readiness} (need ready)`);
-            skipped += 1;
-            if (fs.existsSync(timerPath)) {
-                disableRemoveUnits(id, unitDir, systemctl, dryRun, options);
-                removed += 1;
-                log(`stopped timer for non-ready job ${id}`);
-            }
-            continue;
-        }
-        const cron = schedule.trim().split(/\s+/);
-        if (cron.length !== 5) {
-            log(`skip ${id} — schedule not 5-field cron: ${schedule}`);
-            errors += 1;
-            continue;
-        }
-        let onCalendar = cronToOnCalendar(cron);
-        if (timezone && !` ${onCalendar} `.includes(` ${timezone} `))
-            onCalendar = `${onCalendar} ${timezone}`;
-        desired.add(id);
-        const service = serviceUnit(root, runner, id);
-        const timer = timerUnit(id, onCalendar, randomize, root);
-        const unchanged = fs.existsSync(servicePath) && fs.existsSync(timerPath)
-            && fs.readFileSync(servicePath, "utf8") === service
-            && fs.readFileSync(timerPath, "utf8") === timer;
-        if (unchanged) {
-            log(`noop ${id} — units unchanged (${name})`);
-            const reload = systemctlResult(["daemon-reload"], dryRun, systemctl, options);
-            if (reload.stdout)
-                process.stdout.write(reload.stdout);
-            if (reload.stderr)
-                process.stderr.write(reload.stderr);
-            const enabledResult = systemctlResult(["enable", "--now", `hq-job-${id}.timer`], dryRun, systemctl, options);
-            const output = `${enabledResult.stdout}${enabledResult.stderr}`.replace(/\n+$/, "");
-            if (enabledResult.status !== 0) {
-                log(`systemctl enable timer failed for job ${id} exit=${enabledResult.status}: ${output || "no error message"}`);
-                skipped += 1;
-                errors += 1;
-            }
-            else {
-                if (output)
-                    process.stderr.write(`${output}\n`);
-                armed += 1;
-            }
-            continue;
-        }
-        fs.writeFileSync(servicePath, service);
-        fs.writeFileSync(timerPath, timer);
-        const reload = systemctlResult(["daemon-reload"], dryRun, systemctl, options);
-        if (reload.stdout)
-            process.stdout.write(reload.stdout);
-        if (reload.stderr)
-            process.stderr.write(reload.stderr);
-        const enabledResult = systemctlResult(["enable", "--now", `hq-job-${id}.timer`], dryRun, systemctl, options);
-        const output = `${enabledResult.stdout}${enabledResult.stderr}`.replace(/\n+$/, "");
-        if (enabledResult.status === 0) {
-            if (output)
-                process.stderr.write(`${output}\n`);
-            if (!dryRun)
-                log(`armed ${id} OnCalendar=${onCalendar} readiness=ready`);
-            armed += 1;
-        }
-        else {
-            log(`systemctl enable timer failed for job ${id} exit=${enabledResult.status}: ${output || "no error message"}`);
-            skipped += 1;
-            errors += 1;
-        }
-    }
-    let unitNames = [];
-    try {
-        unitNames = fs.readdirSync(unitDir);
-    }
-    catch { /* The shell's unmatched glob is ignored. */ }
-    for (const unitName of unitNames) {
-        const match = /^hq-job-(.+)\.timer$/.exec(unitName);
-        if (!match)
-            continue;
-        const id = match[1];
-        if (desired.has(id))
-            continue;
-        log(`remove orphaned units for deleted/unarmed job ${id}`);
-        disableRemoveUnits(id, unitDir, systemctl, dryRun, options);
-        removed += 1;
-    }
-    const timestamp = (options.now?.() ?? new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
-    fs.writeFileSync(path.join(stateDir, "last-reconcile.json"), serializeJqJson({
-        armed, skipped, removed, probed, errors, dry_run: dryRun, at: timestamp,
-    }, "compact"));
-    log(`done armed=${armed} skipped=${skipped} removed=${removed} probed=${probed} errors=${errors}`);
-    return errors === 0 ? 0 : 1;
-}
-export function registerCoreJobsNativeCommand(core) {
-    const jobs = core.command("jobs").description("Scheduled jobs helpers");
-    const register = (name, asset, summary, run) => {
-        const command = jobs.command(name)
-            .description(summary)
-            .helpOption(false)
-            .allowUnknownOption()
-            .allowExcessArguments(true)
-            .argument("[args...]", "Arguments passed to the scaffold helper")
-            .action(async (args, _options, current) => {
-            const argv = rawArgumentsForCommand(current, args);
-            const groupHqRoot = core.opts().hqRoot;
-            const { coreNativeJobsEnabled } = await import("./core-native-jobs-flag.js");
-            if (!await coreNativeJobsEnabled()) {
-                const hqRoot = asset === RECONCILE_ASSET && !argv.includes("--hq-root")
-                    && !argv.includes("--help") && !argv.includes("-h")
-                    ? resolveLiveRoot({ hqRoot: groupHqRoot })
-                    : undefined;
-                const result = runBundledScript({ asset, args: argv, cwd: process.cwd(), ...(hqRoot ? { hqRoot } : {}) });
-                if (result.code !== 0)
-                    process.exit(result.code);
-                return;
-            }
-            const result = await run(argv, groupHqRoot ?? process.env.HQ_ROOT);
-            if (result !== 0)
-                process.exit(result);
-        });
-        describeCoreCommand(command, { execution: "native", asset, root: "live" });
-    };
-    register("schedule-parse", SCHEDULE_PARSE_ASSET, "Resolve natural-language or raw cron schedules", runScheduleParse);
-    register("validate", VALIDATE_ASSET, "Validate scheduled-job YAML files", validateJobs);
-    register("reconcile", RECONCILE_ASSET, "Materialize scheduled jobs on this outpost", runReconcile);
-}
-export function rawArgumentsForCommand(command, fallback, raw = process.argv) {
-    const names = [];
-    for (let current = command; current?.parent; current = current.parent) {
-        names.unshift(current.name());
-    }
-    let start = -1;
-    let cursor = 0;
-    for (const name of names) {
-        const index = raw.indexOf(name, cursor);
-        if (index < 0)
-            return command.args.length ? command.args : fallback;
-        cursor = index + 1;
-        start = cursor;
-    }
-    return start >= 0 ? raw.slice(start) : (command.args.length ? command.args : fallback);
-}
-/** Fast-entry adapter; the shared family flag is resolved before this module loads. */
-export async function runJobsFast(args, _stdin, _cwd, _liveRoot, commandName, hqRootArg) {
-    if (commandName === "schedule-parse")
-        return runScheduleParse([...args]);
-    if (commandName === "validate")
-        return validateJobs([...args]);
-    return runReconcile([...args], hqRootArg ?? process.env.HQ_ROOT);
-}
-//# sourceMappingURL=core-jobs-native.js.map