@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/assets/scaffold/core/scripts/rebuild-projects-index.sh

@@ -11,11 +11,12 @@ set -euo pipefail
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
-COMPANIES_DIR="companies"
 PROJECTS_DIR="personal/projects"
 OUT="${PROJECTS_DIR}/INDEX.md"
 DATE=$(date -u +%Y-%m-%d)
 
+[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
+
 sanitize_cell() {
   printf '%s' "$1" | tr '\n' ' ' | sed -e 's/|/\\|/g' -e 's/  */ /g' -e 's/^ *//' -e 's/ *$//'
 }
@@ -28,23 +29,17 @@ trunc() {
 project_status() {
   local project="$1"
   local prd="$2"
-  local fallback="${3:-—}"
-  local expected_prd="${4:-}"
   local state="workspace/orchestrator/${project}/state.json"
   if [[ -f "$state" ]]; then
-    local state_prd
-    state_prd=$(jq -r '.prd_path // ""' "$state" 2>/dev/null || echo "")
-    if [[ -z "$expected_prd" || "$state_prd" == "$expected_prd" ]]; then
-      local raw
-      raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
-      case "$raw" in
-        completed|complete) echo "complete" ;;
-        in_progress|active|started) echo "active" ;;
-        archived) echo "archived" ;;
-        *) echo "$raw" ;;
-      esac
-      return
-    fi
+    local raw
+    raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
+    case "$raw" in
+      completed|complete) echo "complete" ;;
+      in_progress|active|started) echo "active" ;;
+      archived) echo "archived" ;;
+      *) echo "$raw" ;;
+    esac
+    return
   fi
   if [[ -f "$prd" ]]; then
     local total passes
@@ -55,91 +50,9 @@ project_status() {
       return
     fi
   fi
-  echo "$fallback"
-}
-
-sha256_file() {
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$1" | awk '{print $1}'
-  else
-    shasum -a 256 "$1" | awk '{print $1}'
-  fi
+  echo "—"
 }
 
-stamp_generated() {
-  local input="$1" output="$2" normalized hash
-  normalized=$(mktemp)
-  sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$input" > "$normalized"
-  hash=$(sha256_file "$normalized")
-  rm -f "$normalized"
-  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$output"
-}
-
-company_title() {
-  printf '%s\n' "$1" | awk -F'-' '{ for (i=1; i<=NF; i++) { $i = toupper(substr($i,1,1)) substr($i,2) } print }' OFS=' '
-}
-
-write_company_projects_index() {
-  local company="$1" company_root project_dir output tmp name prd description status
-  company_root="${COMPANIES_DIR}/${company}"
-  project_dir="${company_root}/projects"
-  output="${project_dir}/INDEX.md"
-  tmp=$(mktemp)
-  {
-    printf '# %s Projects\n\n' "$(company_title "$company")"
-    printf '> Auto-generated. Updated: %s\n\n' "$DATE"
-    echo '| Project | Status | Description |'
-    echo '|---------|--------|-------------|'
-    while IFS= read -r project; do
-      name=$(basename "$project")
-      [[ "$name" == _* ]] && continue
-      [[ "$name" == .* ]] && continue
-      prd="${project}/prd.json"
-      description=""
-      if [[ -f "$prd" ]]; then description=$(jq -r '.description // ""' "$prd" 2>/dev/null || echo ""); fi
-      status=$(project_status "$name" "$prd" "active" "$prd")
-      description=$(sanitize_cell "$description")
-      description=$(trunc "$description" 110)
-      [[ -z "$description" ]] && description="—"
-      printf '| `%s` | %s | %s |\n' "$name" "$status" "$description"
-    done < <(find "$project_dir" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
-  } > "$tmp"
-  local existing=0 stored actual normalized
-  [[ -e "$output" ]] && existing=1
-  if [[ "$existing" == 1 ]]; then
-    if grep -q '<!-- hq:keep -->' "$output" || ! grep -q '^> Auto-generated. Updated: ' "$output"; then
-      echo "rebuild-projects-index: refused to overwrite ${output} (hand-written or kept)" >&2
-      rm -f "$tmp"
-      return 0
-    fi
-    stored=$(sed -n 's/^<!-- hq-generated-sha256: \([a-f0-9]*\) -->$/\1/p' "$output" | head -n 1)
-    if [[ -n "$stored" ]]; then
-      normalized=$(mktemp)
-      sed -e '/^<!-- hq-generated-sha256: [a-f0-9]* -->$/d' -e 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$output" > "$normalized"
-      actual=$(sha256_file "$normalized")
-      rm -f "$normalized"
-      if [[ "$stored" != "$actual" ]]; then
-        echo "rebuild-projects-index: refused to overwrite ${output} (generated content was edited)" >&2
-        rm -f "$tmp"
-        return 0
-      fi
-    fi
-  fi
-  stamp_generated "$tmp" "$output"
-  rm -f "$tmp"
-  echo "rebuild-projects-index: wrote ${output}" >&2
-}
-
-while IFS= read -r dir; do
-  co=$(basename "$dir")
-  [[ "$co" == _* ]] && continue
-  [[ "$co" == .* ]] && continue
-  project_dir="${COMPANIES_DIR}/${co}/projects"
-  [[ -d "$project_dir" ]] && write_company_projects_index "$co"
-done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
-
-[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
-
 {
   echo "# Projects"
   echo ""

package/assets/scaffold/core/scripts/token-usage-report.sh

@@ -5,15 +5,13 @@
 #   scripts/token-usage-report.sh --last 14      # last 14 days
 #   scripts/token-usage-report.sh --since 2026-05-01
 #   scripts/token-usage-report.sh --json         # machine-readable
-#   scripts/token-usage-report.sh --project-dir <path> # read one activity folder
 #
 # Effective tokens weighting (matches weekly rate-limit volume):
 #   input + 5×output + 1.25×cache_creation + 0.1×cache_read
 
 set -euo pipefail
 
-PROJECT_DIR=""
-PROJECT_DIR_SET=0
+PROJECT_DIR="${CLAUDE_PROJECTS_DIR:-$HOME/.claude/projects/-Users-{your-name}-Documents-HQ}"
 LAST_DAYS=7
 SINCE=""
 JSON_MODE=0
@@ -26,15 +24,6 @@ while [ $# -gt 0 ]; do
     --last) LAST_DAYS="$2"; shift 2 ;;
     --since) SINCE="$2"; shift 2 ;;
     --json) JSON_MODE=1; shift ;;
-    --project-dir)
-      if [ "$#" -lt 2 ] || [ -z "$2" ]; then
-        echo "token-usage-report: --project-dir requires a path" >&2
-        exit 1
-      fi
-      PROJECT_DIR="$2"
-      PROJECT_DIR_SET=1
-      shift 2
-      ;;
     --compare-windows) shift ;;   # flag, presence triggers compare mode via --before/--after
     --before) COMPARE_BEFORE="$2"; shift 2 ;;
     --after)  COMPARE_AFTER="$2"; shift 2 ;;
@@ -49,47 +38,14 @@ done
 
 command -v node >/dev/null 2>&1 || { echo "token-usage-report: node is required" >&2; exit 1; }
 
-# Resolve roots in the same precedence order as the native command. Explicit
-# project directories and environment overrides select one exact activity root;
-# otherwise include standard, desktop-saved, and discovered Claude roots.
-PROJECT_DIRS=("")
-add_project_dir() {
-  local candidate="$1" existing
-  [ -d "$candidate" ] || return 0
-  for existing in "${PROJECT_DIRS[@]}"; do [ "$existing" = "$candidate" ] && return 0; done
-  PROJECT_DIRS+=("$candidate")
-}
-trim_env_path() {
-  local value="$1"
-  value="${value#"${value%%[![:space:]]*}"}"
-  value="${value%"${value##*[![:space:]]}"}"
-  printf '%s' "$value"
-}
-if [ "$PROJECT_DIR_SET" -eq 1 ]; then
-  if [ ! -d "$PROJECT_DIR" ]; then echo "Project dir not found: $PROJECT_DIR" >&2; exit 1; fi
-  add_project_dir "$PROJECT_DIR"
-elif [ -n "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")" ]; then
-  add_project_dir "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")"
-elif [ -n "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")" ]; then
-  add_project_dir "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")/projects"
-else
-  add_project_dir "$HOME/.claude/projects"
-  SAVED_PROJECT_DIR="$(node -e 'try { const value = require(process.argv[1]).claudeProjectsDir; if (typeof value === "string" && value.trim()) process.stdout.write(value.trim()); } catch {}' "$HOME/.hq/menubar.json")"
-  [ -z "$SAVED_PROJECT_DIR" ] || add_project_dir "$SAVED_PROJECT_DIR"
-  for candidate in "$HOME"/.claude-*; do
-    [ -d "$candidate/projects" ] && add_project_dir "$candidate/projects"
-  done
-fi
-if [ "${#PROJECT_DIRS[@]}" -le 1 ]; then echo "Claude activity folders not found" >&2; exit 1; fi
-
 # --- Compare-windows mode (US-011) ---
 # Format: --before YYYY-MM-DD:YYYY-MM-DD --after YYYY-MM-DD:YYYY-MM-DD
 if [ -n "$COMPARE_BEFORE" ] && [ -n "$COMPARE_AFTER" ]; then
-  node - "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
+  node - "$PROJECT_DIR" "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [before, after, minHoursS, jsonModeS, ...projectDirs] = process.argv.slice(2);
+const [proj, before, after, minHoursS, jsonModeS] = process.argv.slice(2);
 const minHours = parseFloat(minHoursS);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -98,24 +54,13 @@ const [bStart, bEnd] = parseRange(before);
 const [aStart, aEnd] = parseRange(after);
 
 const fmt = (n) => n.toLocaleString("en-US");
-const listJsonl = (projectDir) => {
-  const found = [];
-  const visit = (current, relative) => {
-    let entries;
-    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return; }
-    for (const entry of entries) {
-      const nextRelative = path.join(relative, entry.name);
-      if (entry.isDirectory() && entry.name !== "subagents") visit(path.join(current, entry.name), nextRelative);
-      else if (entry.isFile() && entry.name.endsWith(".jsonl")) found.push(nextRelative);
-    }
-  };
-  visit(projectDir, "");
-  return found.sort();
+const listJsonl = () => {
+  try { return fs.readdirSync(proj).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { return []; }
 };
 
 function collect(windowStart, windowEnd) {
   const rows = [];
-  for (const proj of projectDirs) for (const name of listJsonl(proj)) {
+  for (const name of listJsonl()) {
     const f = path.join(proj, name);
     let cr = 0, firstTs = null, lastTs = null;
     const sid = name.replace(/\.jsonl$/, "");
@@ -176,11 +121,16 @@ JS
   exit 0
 fi
 
-node - "$LAST_DAYS" "$SINCE" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
+if [ ! -d "$PROJECT_DIR" ]; then
+  echo "Project dir not found: $PROJECT_DIR" >&2
+  exit 1
+fi
+
+node - "$PROJECT_DIR" "$LAST_DAYS" "$SINCE" "$JSON_MODE" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [lastDaysS, sinceS, jsonModeS, ...projectDirs] = process.argv.slice(2);
+const [projectDir, lastDaysS, sinceS, jsonModeS] = process.argv.slice(2);
 const lastDays = parseInt(lastDaysS, 10);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -197,20 +147,11 @@ const fmt = (n) => n.toLocaleString("en-US");
 const dayTotals = {};
 const sessionTotals = {};
 
-// Parent sessions only; listJsonl skips each session's subagents/ tree.
-for (const projectDir of projectDirs) {
-  const listJsonl = (current, relative = "") => {
-    let entries;
-    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return []; }
-    return entries.flatMap((entry) => {
-      const nextRelative = path.join(relative, entry.name);
-      if (entry.isDirectory() && entry.name !== "subagents") return listJsonl(path.join(current, entry.name), nextRelative);
-      if (entry.isFile() && entry.name.endsWith(".jsonl")) return [nextRelative];
-      return [];
-    }).sort();
-  };
-  const names = listJsonl(projectDir);
-  for (const name of names) {
+let names;
+try { names = fs.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { names = []; }
+
+// Parent sessions only (top-level *.jsonl)
+for (const name of names) {
   const f = path.join(projectDir, name);
   let mtime;
   try { mtime = fs.statSync(f).mtime; } catch (e) { continue; }
@@ -220,7 +161,6 @@ for (const projectDir of projectDirs) {
   let firstTs = null, lastTs = null, firstUser = "";
   let subCount = 0;
   const sid = name.replace(/\.jsonl$/, "");
-  const sessionId = path.basename(path.dirname(projectDir)) + "/" + sid;
   let content;
   try { content = fs.readFileSync(f, "utf8"); } catch (e) { continue; }
   for (const line of content.split(/\r?\n/)) {
@@ -247,16 +187,15 @@ for (const projectDir of projectDirs) {
   if (!day) day = mt;
   if (day < cutoff) continue;
   if (!dayTotals[day]) dayTotals[day] = { sessions: new Set(), inp: 0, out: 0, cc: 0, cr: 0 };
-  dayTotals[day].sessions.add(sessionId);
+  dayTotals[day].sessions.add(sid);
   dayTotals[day].inp += inp;
   dayTotals[day].out += out;
   dayTotals[day].cc += cc;
   dayTotals[day].cr += cr;
-  sessionTotals[sessionId] = {
+  sessionTotals[sid] = {
     day: day, inp: inp, out: out, cc: cc, cr: cr,
     eff: Math.trunc(eff), subagents: subCount, first_user: firstUser.split("\n").join(" "),
   };
-  }
 }
 
 const sortedDays = Object.keys(dayTotals).sort();

package/dist/bin/hq-auth-refresh.d.ts

@@ -12,6 +12,4 @@
  */
 import "../node-preflight.js";
 import "../node-network-compat.js";
-import { refreshCachedSession } from "../utils/cognito-session.js";
-export declare function runAuthRefresh(refreshSession?: typeof refreshCachedSession): Promise<number>;
 //# sourceMappingURL=hq-auth-refresh.d.ts.map

package/dist/bin/hq-auth-refresh.js

@@ -14,14 +14,13 @@
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "../node-preflight.js";
 import "../node-network-compat.js";
-import { fileURLToPath } from "node:url";
-import path from "node:path";
-import { finishSentrySession, initSentry, Sentry } from "../sentry.js";
+import { initSentry, Sentry } from "../sentry.js";
 import { refreshCachedSession } from "../utils/cognito-session.js";
-export async function runAuthRefresh(refreshSession = refreshCachedSession) {
+initSentry();
+(async () => {
     let exitCode = 1;
     try {
-        const result = await refreshSession();
+        const result = await refreshCachedSession();
         if (result.refreshed) {
             exitCode = 0;
         }
@@ -36,13 +35,8 @@ export async function runAuthRefresh(refreshSession = refreshCachedSession) {
         process.stderr.write(`hq-auth-refresh: ${err instanceof Error ? err.message : String(err)}\n`);
     }
     finally {
-        finishSentrySession();
         await Sentry.flush(2000);
+        process.exit(exitCode);
     }
-    return exitCode;
-}
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-    initSentry();
-    void runAuthRefresh().then((exitCode) => process.exit(exitCode));
-}
+})();
 //# sourceMappingURL=hq-auth-refresh.js.map

package/dist/commands/__fixtures__/access-vault.d.ts

@@ -82,8 +82,6 @@ export interface MakeAccessFixtureOptions {
      * without read on the prefix — the server refuses to enumerate.
      */
     listDenied?: boolean;
-    /** present-denied only: let a test isolate list denial from vend denial. */
-    vendDenied?: boolean;
     /** Deny only the ROOT (prefix "") list — the caller can read the prefix but not enumerate the bucket. */
     rootListDenied?: boolean;
 }

package/dist/commands/__fixtures__/access-vault.js

@@ -93,7 +93,7 @@ export function makeAccessFixture(opts) {
         if (opts.state === "missing") {
             throw attachStatus(new Error("not found (404)"), 404);
         }
-        if (opts.state === "present-denied" && opts.vendDenied !== false) {
+        if (opts.state === "present-denied") {
             throw attachStatus(new Error("caller lacks read on this prefix (403)"), 403);
         }
         return FAKE_VEND;

package/dist/commands/_patterns.d.ts

@@ -1,21 +1,5 @@
 export declare const SECRET_NAME_PATTERN: RegExp;
 export declare const GROUP_ID_PATTERN: RegExp;
 export declare const EMAIL_PATTERN: RegExp;
-/**
- * Keep an ACL pattern exactly as the caller supplied it.
- *
- * `foo/` is a private folder row: it authorizes creating a direct child, but
- * does not grant access to any child. `foo/*` is the distinct shared-folder
- * glob. The server owns validation (including the conflict between them), so
- * the CLI must never silently turn one into the other.
- */
 export declare function normalizeFilePrefix(prefix: string): string;
-/**
- * Make a recursive folder glob only where the caller intentionally asks for
- * one. This is not an ACL-input normalizer: callers must opt in because a
- * trailing slash has private-folder semantics on ACL routes.
- */
-export declare function toSharedFolderGlob(prefix: string): string;
-/** A non-root trailing slash is the private-folder ACL pattern. */
-export declare function isPrivateFolderPattern(prefix: string): boolean;
 //# sourceMappingURL=_patterns.d.ts.map

package/dist/commands/_patterns.js

@@ -1,27 +1,10 @@
 export const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*$/;
 export const GROUP_ID_PATTERN = /^grp_[A-Za-z0-9_-]+$/;
 export const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
-/**
- * Keep an ACL pattern exactly as the caller supplied it.
- *
- * `foo/` is a private folder row: it authorizes creating a direct child, but
- * does not grant access to any child. `foo/*` is the distinct shared-folder
- * glob. The server owns validation (including the conflict between them), so
- * the CLI must never silently turn one into the other.
- */
 export function normalizeFilePrefix(prefix) {
+    if (prefix.endsWith("/")) {
+        return prefix + "*";
+    }
     return prefix;
 }
-/**
- * Make a recursive folder glob only where the caller intentionally asks for
- * one. This is not an ACL-input normalizer: callers must opt in because a
- * trailing slash has private-folder semantics on ACL routes.
- */
-export function toSharedFolderGlob(prefix) {
-    return prefix.endsWith("/") ? `${prefix}*` : prefix;
-}
-/** A non-root trailing slash is the private-folder ACL pattern. */
-export function isPrivateFolderPattern(prefix) {
-    return prefix.length > 1 && prefix.endsWith("/");
-}
 //# sourceMappingURL=_patterns.js.map

package/dist/commands/access.d.ts

@@ -122,8 +122,7 @@ export interface RunAccessResult {
     outcome: AccessOutcome;
     path: string;
     company: string;
-    /** Omitted when an authorization denial leaves vault existence unknown. */
-    exists?: boolean;
+    exists: boolean;
     grantor?: AccessGrantor;
     candidates?: string[];
     steps: string[];

package/dist/commands/access.js

@@ -52,7 +52,7 @@ export function formatAccessOutcome(result) {
             lines.push(result.path);
             break;
         case "no-access":
-            lines.push(`You do not have read access to this path.`);
+            lines.push(`The file exists in the vault, but you do not have read access.`);
             lines.push(result.path);
             break;
         case "pending-confirmation":
@@ -236,81 +236,72 @@ export async function runAccess(input) {
     const bucket = entity?.bucketName ?? `hq-vault-cmp-${slug}`;
     const s3 = deps.companyClient({ companyUid: deps.companyUid });
     let listDenied = false;
+    const prefixList = await listKeys(s3, bucket, relative);
+    const exact = prefixList.keys.find((k) => k === relative);
     let key;
-    if (vendDenied) {
-        // The caller is denied at the company boundary. Do not use list results to
-        // resolve or disclose matching keys, even if a separate listing succeeds.
+    if (prefixList.denied) {
+        // The server refused to enumerate — the caller has no read on this
+        // prefix. Keep the target as the key so the request rung can still name
+        // it for the grantor.
         listDenied = true;
         key = relative;
-        steps.push("list: skipped after vend 403 (no-access)");
+        steps.push("list: 403 (no-access)");
+    }
+    else if (exact) {
+        key = exact;
+        steps.push("resolve: exact key");
+        steps.push("list: 1 hit");
     }
     else {
-        const prefixList = await listKeys(s3, bucket, relative);
-        const exact = prefixList.keys.find((k) => k === relative);
-        if (prefixList.denied) {
-            // The server refused to enumerate — the caller has no read on this
-            // prefix. Keep the target as the key so the request rung can still name
-            // it for the grantor.
+        const allList = await listKeys(s3, bucket, "");
+        const q = relative.toLowerCase();
+        // A root-list 403 only says the caller cannot enumerate the WHOLE bucket.
+        // The prefix list above succeeded, so fuzzy-match within it first; the
+        // root denial is the verdict only when the readable prefix has no match.
+        const pool = allList.denied ? prefixList.keys : allList.keys;
+        const fuzzy = pool.filter((k) => k.toLowerCase().includes(q));
+        if (allList.denied && fuzzy.length === 0) {
             listDenied = true;
             key = relative;
             steps.push("list: 403 (no-access)");
         }
-        else if (exact) {
-            key = exact;
-            steps.push("resolve: exact key");
+        else if (fuzzy.length === 0) {
+            steps.push("list: 0 hits");
+            const result = finish("never-existed", {
+                path: anchored(relative) || input.target,
+                company: slug,
+                exists: false,
+                steps,
+            }, finishCtx);
+            emit(input, result, log);
+            return result;
+        }
+        else if (fuzzy.length === 1) {
+            key = fuzzy[0];
+            steps.push("resolve: fuzzy (1 hit)");
             steps.push("list: 1 hit");
         }
         else {
-            const allList = await listKeys(s3, bucket, "");
-            const q = relative.toLowerCase();
-            // A root-list 403 only says the caller cannot enumerate the WHOLE bucket.
-            // The prefix list above succeeded, so fuzzy-match within it first; the
-            // root denial is the verdict only when the readable prefix has no match.
-            const pool = allList.denied ? prefixList.keys : allList.keys;
-            const fuzzy = pool.filter((k) => k.toLowerCase().includes(q));
-            if (allList.denied && fuzzy.length === 0) {
-                listDenied = true;
-                key = relative;
-                steps.push("list: 403 (no-access)");
+            const candidates = fuzzy.map(anchored);
+            steps.push(`list: ${fuzzy.length} hits`);
+            let picked = null;
+            if (deps.pick) {
+                picked = await deps.pick(candidates);
             }
-            else if (fuzzy.length === 0) {
-                steps.push("list: 0 hits");
-                const result = finish("never-existed", {
-                    path: anchored(relative) || input.target,
+            if (!picked) {
+                const result = finish("ambiguous", {
+                    path: input.target,
                     company: slug,
                     exists: false,
+                    candidates,
                     steps,
                 }, finishCtx);
                 emit(input, result, log);
                 return result;
             }
-            else if (fuzzy.length === 1) {
-                key = fuzzy[0];
-                steps.push("resolve: fuzzy (1 hit)");
-                steps.push("list: 1 hit");
-            }
-            else {
-                const candidates = fuzzy.map(anchored);
-                steps.push(`list: ${fuzzy.length} hits`);
-                let picked = null;
-                if (deps.pick) {
-                    picked = await deps.pick(candidates);
-                }
-                if (!picked) {
-                    const result = finish("ambiguous", {
-                        path: input.target,
-                        company: slug,
-                        exists: false,
-                        candidates,
-                        steps,
-                    }, finishCtx);
-                    emit(input, result, log);
-                    return result;
-                }
-                const stripped = normalizeTarget(picked, slug);
-                key = stripped;
-                steps.push("resolve: pick");
-            }
+            const stripped = normalizeTarget(picked, slug);
+            key = stripped;
+            steps.push("resolve: pick");
         }
     }
     const resolvedKey = key;
@@ -533,7 +524,7 @@ export async function runAccess(input) {
     const result = finish(outcome, {
         path: resolvedPath,
         company: slug,
-        ...(vendDenied || listDenied ? {} : { exists: true }),
+        exists: true,
         steps,
         ...(fixed ? { fixed, localPath } : {}),
         ...(grantor ? { grantor } : {}),
@@ -550,7 +541,7 @@ function emit(input, result, log) {
             outcome: result.outcome,
             path: result.path,
             company: result.company,
-            ...(result.exists !== undefined ? { exists: result.exists } : {}),
+            exists: result.exists,
             steps: result.steps,
         };
         if (result.grantor)