@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/commands/sync-narrow.js

@@ -103,31 +103,6 @@ export async function resolveNarrowTarget(input) {
         syncConfig,
     };
 }
-/**
- * Normalize one ACL row for the local pull scope used by `sync narrow`.
- *
- * A trailing slash is a private-folder row, not a recursive read prefix. It
- * lets its grantee create a new direct child, but existing children remain
- * creator-only. Dropping that row from the prospective shared scope keeps the
- * narrow plan from retaining private children merely because their parent
- * happens to end in `/`. A creator's exact/child grant is still retained by
- * the normal `grantPathToPrefix` path below.
- */
-function narrowPrefixForGrant(grant, companySlug) {
-    let path = (grant.path ?? "").replace(/^\/+/, "");
-    const companyAnchor = `companies/${companySlug}/`;
-    const slugAnchor = `${companySlug}/`;
-    if (path.startsWith(companyAnchor)) {
-        path = path.slice(companyAnchor.length);
-    }
-    else if (path.startsWith(slugAnchor)) {
-        path = path.slice(slugAnchor.length);
-    }
-    if (path.length > 0 && path.endsWith("/") && !path.endsWith("/*")) {
-        return null;
-    }
-    return grantPathToPrefix(grant.path, companySlug);
-}
 /**
  * Compute the narrow plan for one company: fetch explicit grants, coalesce,
  * read the per-company journal, walk the local tree, classify.
@@ -143,17 +118,11 @@ export async function computeNarrowPlan(input) {
     // (grantPathToPrefix, hq-cloud ≥5.42.0): real grants are anchored
     // (`companies/<slug>/x/*`, `<slug>/x/*`) and glob-style (`x/*`, bare `*`),
     // none of which startsWith-match the company-relative local-tree keys
-    // buildNarrowPlan emits. Private-folder rows (`x/`) are deliberately
-    // excluded: they do not grant read/list access to existing children, so
-    // treating them as recursive prefixes would leave private files on disk
-    // after an all → shared migration. A wildcard grant normalizes to ""
-    // (everything); coalescePrefixes drops empties, so guard it explicitly to
-    // `[""]` (which isCoveredByAny treats as covering everything → nothing
-    // orphaned) rather than letting it collapse to "nothing" and propose
-    // deleting the tree.
-    const normalizedPrefixes = grants
-        .map((g) => narrowPrefixForGrant(g, companySlug))
-        .filter((p) => p !== null);
+    // buildNarrowPlan emits. A wildcard grant normalizes to "" (everything);
+    // coalescePrefixes drops empties, so guard it explicitly to `[""]` (which
+    // isCoveredByAny treats as covering everything → nothing orphaned) rather
+    // than letting it collapse to "nothing" and propose deleting the tree.
+    const normalizedPrefixes = grants.map((g) => grantPathToPrefix(g.path, companySlug));
     const prospectivePrefixSet = normalizedPrefixes.some((p) => p === "")
         ? [""]
         : coalescePrefixes(normalizedPrefixes);

package/dist/commands/team-sync.js

@@ -16,7 +16,6 @@ import chalk from 'chalk';
 import simpleGit from 'simple-git';
 import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { readCompaniesManifestMap } from '../lib/work-context/repo-remote.js';
 // ─── API helpers ────────────────────────────────────────────────────────────
 const API_BASE = 'https://example.com/api';
 async function apiGet(urlPath, token) {
@@ -138,38 +137,15 @@ function getTrackedFiles(repoDir) {
 function discoverTeamDirs(hqRoot) {
     const companiesDir = path.join(hqRoot, 'companies');
     if (!fs.existsSync(companiesDir)) {
-        return {
-            teams: [],
-            cloudSyncedCompanyNames: [],
-            nonCloudBackedCompanyNames: [],
-            diagnostics: [`companies directory ${companiesDir}: missing`],
-        };
-    }
-    let entries;
-    try {
-        entries = fs.readdirSync(companiesDir, { withFileTypes: true });
-    }
-    catch (error) {
-        return {
-            teams: [],
-            cloudSyncedCompanyNames: [],
-            nonCloudBackedCompanyNames: [],
-            diagnostics: [
-                `companies directory ${companiesDir}: could not read (${error instanceof Error ? error.message : 'unknown error'})`,
-            ],
-        };
+        return [];
     }
-    const companyDirs = entries.filter((entry) => entry.isDirectory());
     const results = [];
-    const missingTeamJson = [];
-    const invalidTeamJson = [];
-    const companiesManifest = readCompaniesManifestMap(hqRoot) ?? {};
-    for (const entry of companyDirs) {
+    for (const entry of fs.readdirSync(companiesDir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
         const teamJsonPath = path.join(companiesDir, entry.name, 'team.json');
-        if (!fs.existsSync(teamJsonPath)) {
-            missingTeamJson.push(teamJsonPath);
+        if (!fs.existsSync(teamJsonPath))
             continue;
-        }
         try {
             const raw = fs.readFileSync(teamJsonPath, 'utf-8');
             const meta = JSON.parse(raw);
@@ -179,31 +155,12 @@ function discoverTeamDirs(hqRoot) {
                     meta,
                 });
             }
-            else {
-                invalidTeamJson.push(teamJsonPath);
-            }
         }
         catch {
-            invalidTeamJson.push(teamJsonPath);
+            // Skip malformed team.json
         }
     }
-    const missingTeamJsonCompanyNames = missingTeamJson.map((file) => path.basename(path.dirname(file)));
-    const isCloudBacked = (name) => {
-        const cloudUid = companiesManifest[name]?.cloud_uid;
-        return typeof cloudUid === 'string' && cloudUid.trim().length > 0;
-    };
-    return {
-        teams: results,
-        cloudSyncedCompanyNames: missingTeamJsonCompanyNames.filter(isCloudBacked),
-        nonCloudBackedCompanyNames: missingTeamJsonCompanyNames.filter((name) => !isCloudBacked(name)),
-        diagnostics: [
-            `HQ root resolver: resolveDefaultHqRoot() returned ${hqRoot}`,
-            `companies directory ${companiesDir}: present; ${companyDirs.length} direct company directories found`,
-            `team.json discovery: ${results.length} valid, ${missingTeamJson.length} missing, ${invalidTeamJson.length} unreadable or invalid`,
-            ...missingTeamJson.map((file) => `${file}: missing`),
-            ...invalidTeamJson.map((file) => `${file}: unreadable or invalid`),
-        ],
-    };
+    return results;
 }
 /**
  * Sync a single team directory:
@@ -351,27 +308,9 @@ export function registerTeamSyncCommand(program) {
         try {
             const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
             // 1. Discover team directories
-            const discovery = discoverTeamDirs(hqRoot);
-            let teamDirs = discovery.teams;
+            let teamDirs = discoverTeamDirs(hqRoot);
             if (teamDirs.length === 0) {
-                console.log(chalk.yellow('No joined team directories found; no team sync ran.'));
-                if (discovery.cloudSyncedCompanyNames.length > 0) {
-                    const companyNames = discovery.cloudSyncedCompanyNames
-                        .map((name) => `"${name}"`)
-                        .join(', ');
-                    console.log(chalk.yellow(`Companies ${companyNames} are cloud-synced and do not have team.json. ` +
-                        'hq team-sync only handles git team repositories with team.json.'));
-                    console.log(chalk.dim('Use `hq sync pull --all` to sync company vault files and `hq sync status` to check their local sync state.'));
-                }
-                if (discovery.nonCloudBackedCompanyNames.length > 0) {
-                    const companyNames = discovery.nonCloudBackedCompanyNames
-                        .map((name) => `"${name}"`)
-                        .join(', ');
-                    console.log(`Companies ${companyNames} have no team.json and are not cloud-backed.`);
-                }
-                for (const diagnostic of discovery.diagnostics) {
-                    console.log(chalk.dim(`  ${diagnostic}`));
-                }
+                console.log(chalk.yellow('No team directories found. Join a team first with: npx create-hq'));
                 return;
             }
             // Filter to specific team if requested
@@ -379,7 +318,7 @@ export function registerTeamSyncCommand(program) {
                 teamDirs = teamDirs.filter((t) => t.meta.team_slug === options.team);
                 if (teamDirs.length === 0) {
                     console.log(chalk.red(`Team "${options.team}" not found. Available teams:`));
-                    for (const t of discoverTeamDirs(hqRoot).teams) {
+                    for (const t of discoverTeamDirs(hqRoot)) {
                         console.log(`  - ${t.meta.team_slug} (${t.meta.team_name})`);
                     }
                     process.exit(1);

package/dist/commands/update.js

@@ -5,7 +5,6 @@
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir } from '../utils/manifest.js';
 import { fetchRepo, pullRepo, getCurrentCommit, isRepo } from '../utils/git.js';
-import { restartDaemonServiceIfInstalled } from "../lib/mesh/live/daemon/install.js";
 export function registerUpdateCommand(program) {
     program
         .command('update [module-name]')
@@ -50,11 +49,6 @@ export function registerUpdateCommand(program) {
                 }
             }
             writeLock(hqRoot, lock);
-            // An installed daemon is a separate Node process. Refresh it
-            // best-effort after a successful update without making the update fail.
-            const restart = restartDaemonServiceIfInstalled({ hqRoot });
-            if (restart.message)
-                console.log(restart.message);
             console.log('\nLock file updated.');
         }
         catch (error) {

package/dist/commands/whoami.d.ts

@@ -2,27 +2,5 @@
  * hq whoami — displays current user or 'not logged in'
  */
 import { Command } from 'commander';
-import { type PlanLimitStatus } from "../lib/billing/plan-lock.js";
-export declare const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
-export interface WhoamiTokenIdentity {
-    email?: string;
-    sub?: string;
-    delegatedEmail?: string;
-    delegatedSub?: string;
-    entityType?: string;
-    entityUid?: string;
-}
-export interface WhoamiDisplayIdentity {
-    email?: string;
-    sub?: string;
-}
-/**
- * Resolves the person represented by an ID token without pairing a delegated
- * email with the token subject of the delegating machine.
- */
-export declare function resolveWhoamiIdentity(identity: WhoamiTokenIdentity): WhoamiDisplayIdentity;
-export declare function renderWhoamiPlanBlock(status: PlanLimitStatus, opts?: {
-    inviteTeammateEnabled?: boolean;
-}): string | null;
 export declare function registerWhoamiCommand(program: Command): void;
 //# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.js

@@ -4,38 +4,12 @@
 import chalk from 'chalk';
 import { loadCachedTokens, isExpiring, loadMachineCreds, } from '@indigoai-us/hq-cloud';
 import { peekIdToken as decodeIdToken } from "../utils/id-token.js";
-import { ensureCognitoToken, loadMachineCachedTokens, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
-import { colorizePlanLimitNotice, fetchPlanLimitStatus, renderPlanLine, renderPlanLimitNotice, } from "../lib/billing/plan-lock.js";
-import { resolveCompanyFlagGate, } from "../lib/flag-registry.js";
-import { queuePlanLimitInviteTeammateExposure } from "../utils/cli-telemetry.js";
-export const CLI_LIMIT_INVITE_TEAMMATE_FLAG = "cli.limit-invite-teammate-v1";
-/**
- * Resolves the person represented by an ID token without pairing a delegated
- * email with the token subject of the delegating machine.
- */
-export function resolveWhoamiIdentity(identity) {
-    if (identity.email !== undefined && identity.sub !== undefined) {
-        return { email: identity.email, sub: identity.sub };
-    }
-    if (identity.delegatedEmail !== undefined && identity.delegatedSub !== undefined) {
-        return { email: identity.delegatedEmail, sub: identity.delegatedSub };
-    }
-    if (identity.email !== undefined || identity.sub !== undefined) {
-        return { email: identity.email, sub: identity.sub };
-    }
-    return {};
-}
+import { resolveCognitoTokenSource } from "../utils/cognito-session.js";
 function peekIdToken(idToken) {
     const decoded = decodeIdToken(idToken);
     return {
         email: typeof decoded.email === "string" ? decoded.email : undefined,
         sub: typeof decoded.sub === "string" ? decoded.sub : undefined,
-        delegatedEmail: typeof decoded["custom:delegatedEmail"] === "string"
-            ? decoded["custom:delegatedEmail"]
-            : undefined,
-        delegatedSub: typeof decoded["custom:delegatedSub"] === "string"
-            ? decoded["custom:delegatedSub"]
-            : undefined,
         entityType: typeof decoded["custom:entityType"] === "string"
             ? decoded["custom:entityType"]
             : undefined,
@@ -44,122 +18,17 @@ function peekIdToken(idToken) {
             : undefined,
     };
 }
-/**
- * starter-plan-hard-limits / US-011 — read the workspace plan-limit nag for
- * `--company <slug>` (the bind notice).
- *
- * hq-pro owns the numbers (`GET /v1/billing/usage-limits`); this only reads
- * them. Best-effort by construction: no session, a network failure, or a
- * company the caller is not a member of all resolve to null — reported as
- * UNKNOWN and rendered as nothing, never as a guessed over-limit or a guessed
- * all-clear, and never as a command failure. The command exists to answer
- * "who am I"; the plan line is decoration on top.
- */
-async function readPlanLimits(company) {
-    const slug = company?.trim();
-    if (!slug)
-        return null;
-    try {
-        // NEVER interactive: this runs inside `--json` (before the authenticated
-        // check) and inside hq-core's per-turn plan-limit refresh hook. With the
-        // default `interactive: true`, a box with no cached session would launch a
-        // browser sign-in and block the caller instead of resolving to UNKNOWN.
-        const token = await ensureCognitoToken({ interactive: false });
-        const status = await fetchPlanLimitStatus(token, slug);
-        if (!status)
-            return null;
-        return {
-            status,
-            idToken: loadCachedTokens()?.idToken,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Human rendering of the plan state: the full over-limit block when the
- * workspace is over its Starter limits, the one-line `Plan: Starter — …`
- * orientation when it is Starter and healthy, and nothing at all otherwise.
- */
-function shouldOfferInviteTeammateSuggestion(status) {
-    if (!status.over ||
-        status.plan !== "free" ||
-        status.members?.used !== 1 ||
-        !status.companyUid) {
-        return false;
-    }
-    return true;
-}
-async function inviteTeammateSuggestionEnabled(status, idToken) {
-    if (!shouldOfferInviteTeammateSuggestion(status) || !status.companyUid) {
-        return false;
-    }
-    return resolveCompanyFlagGate(status.companyUid, idToken ?? "", CLI_LIMIT_INVITE_TEAMMATE_FLAG, { fallback: false }, () => false);
-}
-export function renderWhoamiPlanBlock(status, opts = {}) {
-    if (status.over) {
-        const inviteTeammateEnabled = opts.inviteTeammateEnabled === true;
-        return colorizePlanLimitNotice(renderPlanLimitNotice(status, { inviteTeammateEnabled }));
-    }
-    return renderPlanLine(status);
-}
-async function printPlanBlock(company) {
-    const planLimits = await readPlanLimits(company);
-    if (!planLimits)
-        return;
-    const { status, idToken } = planLimits;
-    const inviteTeammateEnabled = await inviteTeammateSuggestionEnabled(status, idToken);
-    const block = renderWhoamiPlanBlock(status, { inviteTeammateEnabled });
-    if (!block)
-        return;
-    console.log(block);
-    if (inviteTeammateEnabled && status.companyUid) {
-        queuePlanLimitInviteTeammateExposure(status.companyUid);
-    }
-}
 export function registerWhoamiCommand(program) {
     program
         .command('whoami')
         .description('Show the currently authenticated user')
-        .option('--json', 'Output identity metadata as JSON (never tokens)')
-        .option('--company <slug>', 'Also report this company\'s workspace plan state (Starter nag)')
-        .action(async (opts) => {
+        .action(async () => {
         try {
             // Effective source (same as auth status / ensureCognitoToken): env
             // opt-in, fresh-box default-creds when no usable person session, or
             // after a definitive person-refresh rejection marked the session rejected.
             const machine = resolveCognitoTokenSource() === "machine";
             const cached = loadCachedTokens();
-            if (opts.json) {
-                const machineCreds = machine ? loadMachineCreds() : null;
-                const identityCache = machine ? loadMachineCachedTokens() : cached;
-                const identity = identityCache ? peekIdToken(identityCache.idToken) : {};
-                const displayedIdentity = resolveWhoamiIdentity(identity);
-                const claims = identityCache ? decodeIdToken(identityCache.idToken) : {};
-                // Modern credentials carry the canonical UID. Legacy caches may only
-                // supply a UID when their subject is bound to the selected username.
-                const boundLegacyAgent = machineCreds && identity.entityType === 'agent'
-                    && (claims['cognito:username'] === machineCreds.username
-                        || claims.username === machineCreds.username || claims.sub === machineCreds.username)
-                    ? identity.entityUid ?? null : null;
-                const agentUid = machineCreds?.entityUid !== undefined
-                    ? (machineCreds.entityUid.startsWith('agt_') ? machineCreds.entityUid : null)
-                    : boundLegacyAgent;
-                // planLimits is additive: absent-or-null means UNKNOWN.
-                const planLimits = await readPlanLimits(opts.company);
-                console.log(JSON.stringify({
-                    schemaVersion: 1,
-                    authenticated: machine ? Boolean(machineCreds) : Boolean(cached && !isExpiring(cached, 0)),
-                    tokenSource: machine ? 'machine' : 'person',
-                    email: machine ? null : displayedIdentity.email ?? null,
-                    personUid: !machine && identity.entityType === 'person' ? identity.entityUid ?? null : null,
-                    agentUid,
-                    username: machineCreds?.username ?? null,
-                    planLimits,
-                }, null, 2));
-                return;
-            }
             if (machine) {
                 // Machine identities (company agents) mint sessions on demand from
                 // long-lived creds — report the machine identity honestly even when
@@ -170,7 +39,6 @@ export function registerWhoamiCommand(program) {
                     : undefined;
                 console.log(`Machine identity ${username}${entityUid ? ` (agent ${entityUid})` : ''} — sessions mint automatically`);
                 console.log(`token source: machine`);
-                await printPlanBlock(opts.company);
                 return;
             }
             if (!cached) {
@@ -178,13 +46,12 @@ export function registerWhoamiCommand(program) {
                 return;
             }
             if (isExpiring(cached, 0)) {
-                const who = resolveWhoamiIdentity(peekIdToken(cached.idToken)).email ?? 'unknown';
+                const who = peekIdToken(cached.idToken).email ?? 'unknown';
                 console.log(chalk.yellow(`Session expired for ${who}. Run 'hq login' to re-authenticate.`));
                 return;
             }
-            const { email, sub } = resolveWhoamiIdentity(peekIdToken(cached.idToken));
+            const { email, sub } = peekIdToken(cached.idToken);
             console.log(`Logged in as ${email ?? 'unknown'}${sub ? ` (${sub})` : ''}`);
-            await printPlanBlock(opts.company);
         }
         catch (error) {
             console.error(chalk.red('Error:'), error instanceof Error ? error.message : 'Unknown error');

package/dist/commands/workers.d.ts

@@ -1,6 +1,18 @@
 import { Command } from "commander";
-export { readWorkerRegistry, type RegistryWorker } from "../lib/workers-registry/read.js";
-import { type RegistryWorker } from "../lib/workers-registry/read.js";
+export interface RegistryWorker {
+    id: string;
+    path: string;
+    type: string;
+    visibility: string;
+    company?: string;
+    team?: string;
+    status?: string;
+    description?: string;
+    triggers?: string;
+    grants?: string;
+}
+/** Read + parse the worker registry. Empty array if it does not exist. */
+export declare function readWorkerRegistry(hqRoot: string): RegistryWorker[];
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.

package/dist/commands/workers.js

@@ -5,10 +5,16 @@ import * as yaml from "js-yaml";
 import { parseUserYaml } from "../utils/user-yaml-error.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "./secrets.js";
-import { GROUP_ID_PATTERN, EMAIL_PATTERN, toSharedFolderGlob } from "./_patterns.js";
+import { GROUP_ID_PATTERN, EMAIL_PATTERN, normalizeFilePrefix } from "./_patterns.js";
 import { findHqRoot } from "../utils/manifest.js";
-export { readWorkerRegistry } from "../lib/workers-registry/read.js";
-import { readWorkerRegistry } from "../lib/workers-registry/read.js";
+/** Read + parse the worker registry. Empty array if it does not exist. */
+export function readWorkerRegistry(hqRoot) {
+    const p = path.join(hqRoot, "core/workers/registry.yaml");
+    if (!fs.existsSync(p))
+        return [];
+    const doc = parseUserYaml(fs.readFileSync(p, "utf8"), p);
+    return doc?.workers ?? [];
+}
 /**
  * Best-effort active company: workspace/sessions/.current -> meta.yaml
  * company_slug. Undefined when no session context is set. Pure/read-only.
@@ -56,10 +62,7 @@ export function workerVaultPrefix(w) {
     const rel = w.path.startsWith(companyRoot)
         ? w.path.slice(companyRoot.length)
         : w.path;
-    // Worker sharing intentionally covers every child in the generated worker
-    // directory. Keep that conversion explicit: a user-supplied trailing slash
-    // on an ACL command instead means a private folder.
-    return toSharedFolderGlob(rel);
+    return normalizeFilePrefix(rel);
 }
 /** Classify a share principal (@all | email | grp_*) — null when invalid. */
 export function classifyPrincipal(principal) {

package/dist/fast-core.d.ts

@@ -1,15 +1,16 @@
 /**
- * Fast-path dispatcher for selected core commands.
+ * Fast-path dispatcher for relocated scaffold scripts.
  *
  * Reached from the entrypoint BEFORE `main.ts` (and its heavy command graph) is
- * ever imported, so hot hook commands avoid the full commander graph. Shell
- * entries use the bundled-script runner; native entries import their one handler
- * module. The registration in `core.ts` remains the complete fallback path.
+ * ever imported, so a hot `hq core hq-session` / `hq core checkpoint-stop-gate`
+ * dispatches in roughly node's own startup time. It imports only the light root
+ * resolver and the bundled-script runner. The slower commander registration in
+ * `core.ts` remains the complete path for any invocation this does not match.
  */
 /**
- * Run the fast-path core command named in `argv` and exit with its code.
+ * Run the fast-path scaffold script named in `argv` and exit with its code.
  * Only call when {@link isFastCoreRequest} is true; a non-match returns without
  * doing anything.
  */
-export declare function runFastCore(argv: readonly string[]): Promise<void>;
+export declare function runFastCore(argv: readonly string[]): void;
 //# sourceMappingURL=fast-core.d.ts.map

package/dist/fast-core.js

@@ -1,110 +1,47 @@
 /**
- * Fast-path dispatcher for selected core commands.
+ * Fast-path dispatcher for relocated scaffold scripts.
  *
  * Reached from the entrypoint BEFORE `main.ts` (and its heavy command graph) is
- * ever imported, so hot hook commands avoid the full commander graph. Shell
- * entries use the bundled-script runner; native entries import their one handler
- * module. The registration in `core.ts` remains the complete fallback path.
+ * ever imported, so a hot `hq core hq-session` / `hq core checkpoint-stop-gate`
+ * dispatches in roughly node's own startup time. It imports only the light root
+ * resolver and the bundled-script runner. The slower commander registration in
+ * `core.ts` remains the complete path for any invocation this does not match.
  */
 import { resolveLiveRoot } from "./utils/hq-roots.js";
 import { runBundledScript } from "./utils/run-bundled-script.js";
-import { parseFastCore } from "./fast-scaffold.js";
+import { parseFastCore } from "./commands/scaffold-fast.js";
 /**
- * Run the fast-path core command named in `argv` and exit with its code.
+ * Run the fast-path scaffold script named in `argv` and exit with its code.
  * Only call when {@link isFastCoreRequest} is true; a non-match returns without
  * doing anything.
  */
-export async function runFastCore(argv) {
+export function runFastCore(argv) {
     const parsed = parseFastCore(argv);
     if (!parsed)
         return;
-    const entry = parsed.entry;
-    // The full graph's process gate accepts textual true/false overrides. It ignores
-    // numeric env values, so preserve that behavior for family flags here too.
-    let familyEnabled = true;
-    if (entry.kind === "native" && entry.familyFlagKey) {
-        const envOverride = localBooleanFlagOverride(entry.familyFlagKey, process.env);
-        familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
-    }
-    const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
-    const shouldInjectRoot = useShell
-        ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
-            !parsed.args.includes("--hq-root") && !parsed.args.includes("--help") && !parsed.args.includes("-h"))
-        : entry.kind === "shell"
-            ? true
-            : entry.root === "live";
-    // `root: "live"` — resolve the live HQ root using the same resolver as the
-    // full command graph. Existing shell fast entries keep their historical
-    // fail-soft behavior; newly routed commands fall back to the full graph so
-    // its expected-user-error formatting remains authoritative.
+    // `root: "live"` — resolve the live HQ root and run the script in it, exactly
+    // as core.ts's runEntry does. Fail soft: if no root can be resolved, run the
+    // script anyway with the inherited environment (the hook already carries
+    // CLAUDE_PROJECT_DIR, and each script has its own root fallback) rather than
+    // crashing a Stop hook on a resolution error.
     let hqRoot;
-    if (shouldInjectRoot) {
-        try {
-            hqRoot = resolveLiveRoot(parsed.hqRootArg ? { hqRoot: parsed.hqRootArg } : {});
-        }
-        catch {
-            if (entry.kind === "native") {
-                const { runCli } = await import("./main.js");
-                await runCli();
-                return;
-            }
-            hqRoot = undefined;
-        }
+    try {
+        hqRoot = resolveLiveRoot(parsed.hqRootArg ? { hqRoot: parsed.hqRootArg } : {});
     }
-    if (entry.kind === "native" && !useShell) {
-        const { installFastPathStreamErrorHandlers } = await import("./utils/fast-stream-errors.js");
-        installFastPathStreamErrorHandlers();
-        const handlerModule = await import(entry.modulePath);
-        const handler = handlerModule[entry.exportName];
-        if (typeof handler !== "function") {
-            throw new Error(`Native fast handler ${entry.exportName} was not exported`);
-        }
-        const readsStdin = entry.readsStdinFor?.(parsed.args) ?? entry.readsStdin ?? false;
-        const chunks = [];
-        if (readsStdin) {
-            for await (const chunk of process.stdin)
-                chunks.push(chunk);
-        }
-        const code = await handler(parsed.args, readsStdin ? Buffer.concat(chunks).toString("utf8") : "", process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg);
-        // Let Node drain handler output before terminating. The timeout guard's
-        // stderr message must survive the native route's process boundary.
-        process.exitCode = code;
-        return;
+    catch {
+        hqRoot = undefined;
     }
-    const asset = entry.asset;
-    if (!asset)
-        throw new Error(`Fast route ${entry.name} has no shell companion`);
-    // Some historical registrations run from the live root, others preserve the
-    // caller cwd and only inject HQ_ROOT. Keep those choices explicit per entry.
-    const cwd = entry.kind === "native" && entry.shellCwd === "live"
-        ? hqRoot ?? process.cwd()
-        : process.cwd();
-    const injectRoot = entry.kind === "shell" || entry.kind === "native" &&
-        (entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
-    const childEnv = {
-        ...(entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : {}),
-        ...(entry.name === "migrate-policy-triggers"
-            ? { CLAUDE_PROJECT_DIR: process.env.CLAUDE_PROJECT_DIR || process.cwd() }
-            : {}),
-    };
+    // Keep the CHILD in the caller's cwd, unlike the generic "live" dispatch. The
+    // relocated scripts read their data tree from the injected root, not cwd, and
+    // hq-session's Work Mesh registration serializes $PWD — so changing directory
+    // to the HQ root would mislabel a bind made from inside a project/worktree.
     const { code } = runBundledScript({
-        asset,
+        asset: parsed.asset,
         args: parsed.args,
-        cwd,
-        ...(injectRoot ? { hqRoot } : {}),
-        ...(Object.keys(childEnv).length ? { env: childEnv } : {}),
+        cwd: process.cwd(),
+        hqRoot,
     });
     // Propagate verbatim: these scripts use their exit code as their interface.
     process.exit(code);
 }
-/** Match hq-flags-client's literal true/false env override without loading its module. */
-function localBooleanFlagOverride(flagKey, env) {
-    const envKey = `HQ_FLAG_${flagKey.replace(/[.-]/g, "_").toUpperCase()}`;
-    const value = env[envKey];
-    if (value === "true")
-        return true;
-    if (value === "false")
-        return false;
-    return null;
-}
 //# sourceMappingURL=fast-core.js.map

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import "./node-preflight.js";
-import "./node-network-compat-fast.js";
-import { isVersionRequest } from "./version-request.js";
-import { isFastCoreRequest } from "./fast-scaffold.js";
+import "./node-network-compat.js";
+import { isFastCoreRequest } from "./commands/scaffold-fast.js";
+declare function isVersionRequest(argv: readonly string[]): boolean;
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;
     isFastCoreRequest: typeof isFastCoreRequest;
 };
+export {};
 //# sourceMappingURL=index.d.ts.map