@indigoai-us/hq-cli 5.313.0 → 5.314.0

package/dist/lib/work-context/state.d.ts

@@ -4,7 +4,7 @@
  */
 import type { ClassificationState } from "./contract.js";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-type DecisionOptionKind = "bind_existing" | "create_project" | "create_task" | "untracked" | "keep_default" | "override_evidence";
+export type DecisionOptionKind = "bind_existing" | "create_project" | "create_task" | "untracked" | "keep_default" | "override_evidence";
 export interface SessionDecisionOption {
     optionId: string;
     label?: string;
@@ -27,9 +27,9 @@ export interface SessionDecision {
 /** Local-only origin of the session state writer (never sent on the wire). */
 export type SessionEventSource = "hook" | "transcript";
 /** Local-only harness label when network schema cannot carry it (US-018). */
-type LocalHarnessLabel = "claude-desktop" | "codex";
+export type LocalHarnessLabel = "claude-desktop" | "codex";
 /** Local tracking for an in-flight or completed cross-company migrate (US-017B). */
-interface SessionMigrationRecord {
+export interface SessionMigrationRecord {
     operationId: string;
     digest: string;
     sourceCompanyUid: string;
@@ -89,93 +89,19 @@ export interface SessionStateFile {
      * before SESSION_STATE sync (kept after AMEND-001).
      */
     transcriptMarker?: "from transcript";
-    /** Historical repair under device-default evidence is intentionally weak. */
-    companyConfidence?: "device_default";
-    /** Why the current project was chosen, or why the session is asking. */
-    projectBindReason?: string;
-    /** Ranked alternatives when the session is waiting for a project choice. */
-    projectCandidates?: Array<{
-        projectId: string;
-        title?: string;
-        score?: number;
-    }>;
-    /**
-     * When set, flush holds events instead of posting them.
-     * `choose` — the match was unclear. `missing_board` — the server 404'd the project.
-     */
-    projectGate?: "choose" | "missing_board";
-    /** Slug the session was trying to bind. Re-checked on the next prompt. */
-    projectHint?: string;
-    /**
-     * LOCAL-ONLY. Pending session_end against a company this session just left
-     * (US-047). Flush posts it to that companyUid, then clears the field.
-     */
-    presenceLeave?: {
-        companyUid: string;
-        companySlug?: string;
-        projectId?: string;
-        taskId?: string;
-        bindingEpisodeId?: string;
-    };
     updatedAt: string;
 }
-/**
- * Metadata from a register operation that the control plane has acknowledged.
- * Kept structural here so the state projection does not need a runtime
- * dependency on the outbox implementation.
- */
-export interface AcknowledgedRegisterBinding {
-    kind: "register";
-    sessionId: string;
-    companyUid?: string;
-    companySlug?: string;
-    projectId?: string;
-    taskId?: string;
-    receiptId: string;
-}
+/** Allowlisted keys that may appear in the durable state projection. */
+export declare const SESSION_STATE_ALLOWLIST: Set<string>;
 export declare function readSessionState(sessionId: string, root: string): SessionStateFile | null;
 export declare function writeSessionState(state: SessionStateFile, root: string): string;
+/** Strip any non-allowlisted fields before durable write. */
+export declare function projectSessionState(state: SessionStateFile): SessionStateFile;
 /**
- * Commit a state change only after inspecting the latest value under the same
- * lock used by ordinary session writers. Returning null declines the write.
- */
-export declare function updateSessionState(sessionId: string, root: string, update: (current: SessionStateFile | null) => SessionStateFile | null): SessionStateFile | null;
-/**
- * Merge prior local fields into a new state write so PostToolUse bumps and
- * reconcile updates do not clobber an acknowledged company binding.
- */
-export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null, options?: {
-    preserveBindingEpisode?: boolean;
-    preserveCompanyBinding?: boolean;
-}): SessionStateFile;
-/**
- * True when a stored bindingEpisodeId is a register receipt, not an episode.
- *
- * The server mints binding episodes as UUIDs, and only on bind / organize. A
- * register response carries no episode: its receipt is the operation id the
- * client generated (`op_...`). An id is treated as a receipt when it has that
- * shape or when it equals a receipt the caller knows about. A UUID is never
- * treated as a receipt by shape.
+ * Merge prior local-only counters into a new state write so PostToolUse bumps
+ * and reconcile updates do not clobber each other.
  */
-export declare function isRegisterReceiptEpisodeId(id: string | undefined, knownReceiptIds?: Iterable<string | undefined>): boolean;
-/**
- * Clear register receipts stored as a binding episode, on the session itself
- * and on its pending presenceLeave. Returns the same object when nothing
- * changed, so callers can detect a repair by identity.
- */
-export declare function stripRegisterReceiptEpisodes(state: SessionStateFile, knownReceiptIds?: Iterable<string | undefined>): SessionStateFile;
-/**
- * Upgrade the local projection after the server acknowledges a register.
- *
- * A receipt makes the operation's company authoritative, but it must never
- * erase an explicit untracked choice, a conflicting existing company, or a
- * more specific binding for the same company. This is also used to repair
- * state files created by older clients before this write-back existed.
- *
- * The read and the write happen under the session state lock, so a concurrent
- * writer (for example bind-project) is never overwritten from a stale snapshot.
- */
-export declare function writeAcknowledgedRegisterBinding(binding: AcknowledgedRegisterBinding, root: string, now?: () => Date): SessionStateFile | null;
+export declare function mergeLocalSessionFields(next: SessionStateFile, prior: SessionStateFile | null): SessionStateFile;
 /** True when a durable state file was written by the hook / reconcile path. */
 export declare function isHookWrittenSessionState(state: SessionStateFile | null): boolean;
 /** Authoritative prior scope usable for company precedence. */
@@ -183,13 +109,4 @@ export declare function authoritativeCompanyFromState(state: SessionStateFile |
     slug?: string;
     uid?: string;
 } | null;
-/**
- * Apply `hq mesh context bind-project`: an operator's local project choice.
- *
- * The server issues no binding episode for this local choice, so any prior
- * bindingEpisodeId (older clients stored a register receipt there) is cleared.
- * Carrying it forward makes the server drop every later session-event batch.
- */
-export declare function applyOperatorProjectBinding(state: SessionStateFile, projectId: string, now?: () => Date): SessionStateFile;
-export {};
 //# sourceMappingURL=state.d.ts.map

package/dist/lib/work-context/state.js

@@ -3,118 +3,32 @@
  * Written only by hq mesh context. Owner 0600. Metadata-only — never prompts/tokens.
  */
 import * as fs from "node:fs";
-import * as path from "node:path";
 import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-import { atomicWriteJson, ensureOwnerDir, resolveRealTarget } from "./atomic.js";
-import { NotTrackingError, UnsafeConfigPathError } from "./errors.js";
+import { atomicWriteJson, ensureOwnerDir } from "./atomic.js";
+import { NotTrackingError } from "./errors.js";
 import { isSafeWorkContextSegment, workContextSessionPath, workContextSessionsDir, } from "./paths.js";
-const SESSION_STATE_LOCK_TIMEOUT_MS = 5_000;
-const SESSION_STATE_LOCK_RETRY_MS = 10;
-function waitForSessionStateLock(ms) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function asPersistenceFailure(err) {
-    if (err instanceof NotTrackingError || err instanceof UnsafeConfigPathError)
-        throw err;
-    const message = err instanceof Error ? err.message : String(err);
-    throw new NotTrackingError(`Failed to persist session state: ${message}`, "NOT_TRACKING");
-}
-function reclaimStaleSessionStateLock(lockPath) {
-    const claim = `${lockPath}.reclaim.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
-    try {
-        fs.renameSync(lockPath, claim);
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return false;
-        throw err;
-    }
-    try {
-        return true;
-    }
-    finally {
-        try {
-            fs.unlinkSync(claim);
-        }
-        catch { /* private claim cannot block writers */ }
-    }
-}
-/**
- * Serialize a session-state read/modify/write with every state writer. Atomic
- * rename protects readers from torn files, but only this shared lock protects
- * a writer that has to verify the current binding before changing it.
- */
-function withSessionStateLock(sessionId, root, fn) {
-    if (!isSafeWorkContextSegment(sessionId)) {
-        throw new NotTrackingError(`Unsafe session id for state file: ${sessionId}`, "NOT_TRACKING");
-    }
-    try {
-        ensureOwnerDir(workContextSessionsDir(root));
-    }
-    catch (err) {
-        asPersistenceFailure(err);
-    }
-    const statePath = resolveRealTarget(workContextSessionPath(sessionId, root));
-    const lockPath = `${statePath}.lock`;
-    const token = `${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}`;
-    const deadline = Date.now() + SESSION_STATE_LOCK_TIMEOUT_MS;
-    let fd;
-    while (fd === undefined) {
-        try {
-            fd = fs.openSync(lockPath, "wx", 0o600);
-            fs.writeSync(fd, JSON.stringify({ pid: process.pid, token }));
-        }
-        catch (err) {
-            if (err.code !== "EEXIST")
-                asPersistenceFailure(err);
-            let ownerPid = 0;
-            try {
-                const raw = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-                ownerPid = typeof raw.pid === "number" && Number.isInteger(raw.pid) ? raw.pid : 0;
-            }
-            catch {
-                // A malformed lock cannot safely protect the state.
-            }
-            let ownerAlive = false;
-            if (ownerPid > 0) {
-                try {
-                    process.kill(ownerPid, 0);
-                    ownerAlive = true;
-                }
-                catch {
-                    // Dead owners do not retain the lock.
-                }
-            }
-            if (!ownerAlive) {
-                try {
-                    reclaimStaleSessionStateLock(lockPath);
-                }
-                catch (err) {
-                    asPersistenceFailure(err);
-                }
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                throw new NotTrackingError(`Timed out waiting for session state lock: ${path.basename(statePath)}`, "NOT_TRACKING");
-            }
-            waitForSessionStateLock(SESSION_STATE_LOCK_RETRY_MS);
-        }
-    }
-    try {
-        return fn();
-    }
-    finally {
-        fs.closeSync(fd);
-        try {
-            const current = JSON.parse(fs.readFileSync(lockPath, "utf8"));
-            if (current.token === token)
-                fs.unlinkSync(lockPath);
-        }
-        catch {
-            // A stale-lock reclaimer or replacement owner has already retired it.
-        }
-    }
-}
+/** Allowlisted keys that may appear in the durable state projection. */
+export const SESSION_STATE_ALLOWLIST = new Set([
+    "contractVersion",
+    "sessionId",
+    "companyUid",
+    "companySlug",
+    "contextStatus",
+    "projectId",
+    "taskId",
+    "bindingEpisodeId",
+    "version",
+    "decision",
+    "migration",
+    "untrackedReceipt",
+    "toolWrites",
+    "startedAt",
+    "hasTurn",
+    "source",
+    "localHarness",
+    "transcriptMarker",
+    "updatedAt",
+]);
 export function readSessionState(sessionId, root) {
     if (!isSafeWorkContextSegment(sessionId))
         return null;
@@ -135,9 +49,6 @@ export function writeSessionState(state, root) {
     if (!isSafeWorkContextSegment(state.sessionId)) {
         throw new NotTrackingError(`Unsafe session id for state file: ${state.sessionId}`, "NOT_TRACKING");
     }
-    return withSessionStateLock(state.sessionId, root, () => writeSessionStateUnlocked(state, root));
-}
-function writeSessionStateUnlocked(state, root) {
     const projected = projectSessionState(state);
     try {
         ensureOwnerDir(workContextSessionsDir(root));
@@ -149,22 +60,8 @@ function writeSessionStateUnlocked(state, root) {
         throw new NotTrackingError(`Failed to persist session state: ${err instanceof Error ? err.message : String(err)}`, "NOT_TRACKING");
     }
 }
-/**
- * Commit a state change only after inspecting the latest value under the same
- * lock used by ordinary session writers. Returning null declines the write.
- */
-export function updateSessionState(sessionId, root, update) {
-    return withSessionStateLock(sessionId, root, () => {
-        const current = readSessionState(sessionId, root);
-        const next = update(current);
-        if (!next)
-            return null;
-        writeSessionStateUnlocked(next, root);
-        return next;
-    });
-}
 /** Strip any non-allowlisted fields before durable write. */
-function projectSessionState(state) {
+export function projectSessionState(state) {
     const out = {
         contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
         sessionId: state.sessionId,
@@ -203,48 +100,16 @@ function projectSessionState(state) {
         out.localHarness = state.localHarness;
     if (state.transcriptMarker)
         out.transcriptMarker = state.transcriptMarker;
-    if (state.companyConfidence)
-        out.companyConfidence = state.companyConfidence;
-    if (state.projectBindReason)
-        out.projectBindReason = state.projectBindReason;
-    if (state.projectCandidates?.length)
-        out.projectCandidates = state.projectCandidates;
-    if (state.projectGate)
-        out.projectGate = state.projectGate;
-    if (state.projectHint && !state.projectId)
-        out.projectHint = state.projectHint;
-    if (state.presenceLeave?.companyUid)
-        out.presenceLeave = state.presenceLeave;
     return out;
 }
 /**
- * Merge prior local fields into a new state write so PostToolUse bumps and
- * reconcile updates do not clobber an acknowledged company binding.
+ * Merge prior local-only counters into a new state write so PostToolUse bumps
+ * and reconcile updates do not clobber each other.
  */
-export function mergeLocalSessionFields(next, prior, options = {}) {
+export function mergeLocalSessionFields(next, prior) {
     if (!prior)
         return next;
     const out = { ...next };
-    // Hook observations commonly carry only tool-write/session metadata. Those
-    // writes must not erase a company that an acknowledged register already
-    // projected locally; losing it causes held events and repeat registrations.
-    // A caller that carries either company field is intentionally changing the
-    // binding and remains authoritative.
-    if (options.preserveCompanyBinding !== false &&
-        !out.companyUid &&
-        !out.companySlug &&
-        (prior.companyUid || prior.companySlug)) {
-        out.companyUid = prior.companyUid;
-        out.companySlug = prior.companySlug;
-        out.contextStatus = prior.contextStatus;
-        if (!out.projectId && prior.projectId)
-            out.projectId = prior.projectId;
-        if (!out.taskId && prior.taskId)
-            out.taskId = prior.taskId;
-        if (out.version === undefined && prior.version !== undefined) {
-            out.version = prior.version;
-        }
-    }
     if (out.toolWrites === undefined && typeof prior.toolWrites === "number") {
         out.toolWrites = prior.toolWrites;
     }
@@ -266,165 +131,11 @@ export function mergeLocalSessionFields(next, prior, options = {}) {
     if (!out.transcriptMarker && prior.transcriptMarker) {
         out.transcriptMarker = prior.transcriptMarker;
     }
-    const sameCompanyBinding = Boolean(prior.companyUid && out.companyUid && prior.companyUid === out.companyUid) ||
-        Boolean(prior.companySlug &&
-            out.companySlug &&
-            prior.companySlug.toLowerCase() === out.companySlug.toLowerCase());
-    if (!out.companyConfidence && prior.companyConfidence && sameCompanyBinding) {
-        out.companyConfidence = prior.companyConfidence;
-    }
-    if (!out.projectId &&
-        !out.projectHint &&
-        prior.projectHint &&
-        sameCompanyBinding) {
-        out.projectHint = prior.projectHint;
-    }
-    if (!out.presenceLeave && prior.presenceLeave) {
-        out.presenceLeave = prior.presenceLeave;
-    }
-    if (out.projectId)
-        out.projectHint = undefined;
-    const sameBinding = prior.companyUid === out.companyUid &&
-        prior.companySlug === out.companySlug &&
-        prior.projectId === out.projectId &&
-        prior.taskId === out.taskId;
-    if (options.preserveBindingEpisode !== false &&
-        !out.bindingEpisodeId &&
-        prior.bindingEpisodeId &&
-        sameBinding) {
+    if (!out.bindingEpisodeId && prior.bindingEpisodeId) {
         out.bindingEpisodeId = prior.bindingEpisodeId;
     }
     return out;
 }
-function acknowledgedStatus(binding) {
-    if (!binding.companyUid)
-        return null;
-    if (binding.projectId && binding.taskId)
-        return "bound";
-    if (binding.projectId)
-        return "needs_task";
-    return "needs_project";
-}
-function bindingStrength(state) {
-    if (state.contextStatus === "bound" && state.projectId && state.taskId)
-        return 3;
-    if (state.contextStatus === "needs_task" && state.projectId)
-        return 2;
-    if (state.contextStatus === "needs_project")
-        return 1;
-    return 0;
-}
-const SERVER_EPISODE_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/**
- * True when a stored bindingEpisodeId is a register receipt, not an episode.
- *
- * The server mints binding episodes as UUIDs, and only on bind / organize. A
- * register response carries no episode: its receipt is the operation id the
- * client generated (`op_...`). An id is treated as a receipt when it has that
- * shape or when it equals a receipt the caller knows about. A UUID is never
- * treated as a receipt by shape.
- */
-export function isRegisterReceiptEpisodeId(id, knownReceiptIds = []) {
-    if (!id)
-        return false;
-    for (const receiptId of knownReceiptIds) {
-        if (receiptId && receiptId === id)
-            return true;
-    }
-    if (SERVER_EPISODE_SHAPE.test(id))
-        return false;
-    return id.startsWith("op_");
-}
-/**
- * Clear register receipts stored as a binding episode, on the session itself
- * and on its pending presenceLeave. Returns the same object when nothing
- * changed, so callers can detect a repair by identity.
- */
-export function stripRegisterReceiptEpisodes(state, knownReceiptIds = []) {
-    const known = [...knownReceiptIds];
-    const ownIsReceipt = isRegisterReceiptEpisodeId(state.bindingEpisodeId, known);
-    const leaveIsReceipt = isRegisterReceiptEpisodeId(state.presenceLeave?.bindingEpisodeId, known);
-    if (!ownIsReceipt && !leaveIsReceipt)
-        return state;
-    const out = { ...state };
-    if (ownIsReceipt)
-        out.bindingEpisodeId = undefined;
-    if (leaveIsReceipt && state.presenceLeave) {
-        const { bindingEpisodeId: _receipt, ...leave } = state.presenceLeave;
-        out.presenceLeave = leave;
-    }
-    return out;
-}
-/**
- * Upgrade the local projection after the server acknowledges a register.
- *
- * A receipt makes the operation's company authoritative, but it must never
- * erase an explicit untracked choice, a conflicting existing company, or a
- * more specific binding for the same company. This is also used to repair
- * state files created by older clients before this write-back existed.
- *
- * The read and the write happen under the session state lock, so a concurrent
- * writer (for example bind-project) is never overwritten from a stale snapshot.
- */
-export function writeAcknowledgedRegisterBinding(binding, root, now = () => new Date()) {
-    const acknowledged = acknowledgedStatus(binding);
-    if (!acknowledged || !isSafeWorkContextSegment(binding.sessionId))
-        return null;
-    let result = null;
-    updateSessionState(binding.sessionId, root, (current) => {
-        // Reconcile always writes the local projection before network delivery. Do
-        // not manufacture session files when replay sees an orphaned legacy outbox
-        // record with no corresponding tracked session.
-        if (!current)
-            return null;
-        // A register response never carries a server episode, bound or not. The
-        // server mints episodes only on bind / organize, and drops session-event
-        // batches whose episode it does not recognise. Older clients stored the
-        // register receipt as the episode, so clear it wherever it is found. This
-        // repair is independent of the binding decision below and therefore also
-        // applies to untracked and different-company states.
-        const prior = stripRegisterReceiptEpisodes(current, [binding.receiptId]);
-        const repaired = prior !== current;
-        if (prior.contextStatus === "untracked" ||
-            (prior.companyUid && prior.companyUid !== binding.companyUid)) {
-            result = prior;
-            return repaired ? prior : null;
-        }
-        const acknowledgementStrength = acknowledged === "bound" ? 3 : acknowledged === "needs_task" ? 2 : 1;
-        const priorStrength = bindingStrength(prior);
-        const preservePriorBinding = Boolean(prior.companyUid === binding.companyUid && priorStrength > acknowledgementStrength);
-        const sameBindingAsPrior = prior.companyUid === binding.companyUid &&
-            prior.projectId === binding.projectId &&
-            prior.taskId === binding.taskId;
-        const next = mergeLocalSessionFields({
-            contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
-            sessionId: binding.sessionId,
-            companyUid: binding.companyUid,
-            companySlug: binding.companySlug ?? prior.companySlug,
-            contextStatus: preservePriorBinding ? prior.contextStatus : acknowledged,
-            projectId: preservePriorBinding ? prior.projectId : binding.projectId,
-            taskId: preservePriorBinding ? prior.taskId : binding.taskId,
-            // Keep a server-issued episode only while the binding it was issued
-            // for is unchanged. Never derive one from the receipt.
-            bindingEpisodeId: preservePriorBinding || sameBindingAsPrior
-                ? prior.bindingEpisodeId
-                : undefined,
-            updatedAt: now().toISOString(),
-        }, prior, { preserveBindingEpisode: false });
-        if (prior.companyUid === next.companyUid &&
-            prior.companySlug === next.companySlug &&
-            prior.contextStatus === next.contextStatus &&
-            prior.projectId === next.projectId &&
-            prior.taskId === next.taskId &&
-            prior.bindingEpisodeId === next.bindingEpisodeId) {
-            result = prior;
-            return repaired ? prior : null;
-        }
-        result = next;
-        return next;
-    });
-    return result;
-}
 /** True when a durable state file was written by the hook / reconcile path. */
 export function isHookWrittenSessionState(state) {
     if (!state)
@@ -435,10 +146,6 @@ export function isHookWrittenSessionState(state) {
 export function authoritativeCompanyFromState(state) {
     if (!state)
         return null;
-    // A binding created only from the device default is deliberately weak. A
-    // later /startwork meta designation or remembered repo choice may replace it.
-    if (state.companyConfidence === "device_default")
-        return null;
     const writable = new Set([
         "unresolved",
         "needs_project",
@@ -452,24 +159,4 @@ export function authoritativeCompanyFromState(state) {
         return null;
     return { slug: state.companySlug, uid: state.companyUid };
 }
-/**
- * Apply `hq mesh context bind-project`: an operator's local project choice.
- *
- * The server issues no binding episode for this local choice, so any prior
- * bindingEpisodeId (older clients stored a register receipt there) is cleared.
- * Carrying it forward makes the server drop every later session-event batch.
- */
-export function applyOperatorProjectBinding(state, projectId, now = () => new Date()) {
-    return {
-        ...state,
-        contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
-        contextStatus: state.taskId ? "bound" : "needs_task",
-        projectId,
-        bindingEpisodeId: undefined,
-        projectGate: undefined,
-        projectCandidates: undefined,
-        projectBindReason: `operator selected ${projectId}`,
-        updatedAt: now().toISOString(),
-    };
-}
 //# sourceMappingURL=state.js.map

package/dist/lib/workers-registry/index.js

@@ -18,26 +18,10 @@ function isFile(target) {
         return false;
     }
 }
-/**
- * A sorted `find -L … -name worker.yaml -type f` equivalent, including
- * symlinked pack workers.
- *
- * Excluded subtrees are pruned at the descent, not filtered from the result.
- * That distinction is the whole cost of this scan: a tenant's `repos/` holds
- * source checkouts, so filtering afterwards means reading every `node_modules`
- * and `.git` directory inside them — tens of thousands of directories on a real
- * root — to produce matches that are discarded a moment later.
- *
- * Directory entries carry their own type, so the common case costs one
- * `readdir` per directory instead of an extra `stat` per entry. Symlinks are
- * the exception: their dirent type describes the link, so resolving one still
- * needs a `stat`, which is what keeps this faithful to `find -L`.
- */
+/** A sorted `find -L … -name worker.yaml -type f` equivalent, including symlinked pack workers. */
 function workerYamlFiles(root, relativeRoot) {
     const output = [];
     const walk = (relative, ancestors) => {
-        if (isExcludedWorkerDirectory(relative))
-            return;
         const absolute = path.join(root, relative);
         if (!isDirectory(absolute))
             return;
@@ -51,23 +35,20 @@ function workerYamlFiles(root, relativeRoot) {
         if (ancestors.has(physical))
             return; // `find -L` reports loops; a bounded walk is safer here.
         const nextAncestors = new Set(ancestors).add(physical);
-        let entries;
+        let names;
         try {
-            entries = fs.readdirSync(absolute, { withFileTypes: true });
+            names = fs.readdirSync(absolute).sort();
         }
         catch {
             return;
         }
-        entries.sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
-        for (const entry of entries) {
-            const childRelative = path.join(relative, entry.name);
+        for (const name of names) {
+            const childRelative = path.join(relative, name);
             const child = path.join(root, childRelative);
-            if (entry.name === 'worker.yaml' && (entry.isFile() || isFile(child))) {
+            if (name === 'worker.yaml' && isFile(child))
                 output.push(childRelative);
-            }
-            else if (entry.isDirectory() || (entry.isSymbolicLink() && isDirectory(child))) {
+            else if (isDirectory(child))
                 walk(childRelative, nextAncestors);
-            }
         }
     };
     walk(relativeRoot, new Set());
@@ -143,41 +124,6 @@ function registryText(now, entries) {
 function withoutTimestamp(content) {
     return content.split('\n').filter((line) => !line.startsWith('generated_at:')).join('\n');
 }
-/**
- * Worker roots hold two kinds of `worker.yaml` that must never reach the
- * registry.
- *
- * The `_template` company and any `_overrides` directory are scaffolding —
- * copies kept so a new tenant or a pack override can be stamped out from them.
- *
- * A checkout nested under a tenant's `repos/` is a source repository that tenant
- * happens to keep inside HQ, and when that repository is HQ itself, its own
- * `core/workers` and template trees are full of worker.yaml files. Indexing them
- * treats product source as deployed workers: they claim ids real workers already
- * own, and because duplicates resolve by path order — a tenant path sorts before
- * both `core` and `personal` — the checkout wins. The operator's actual worker
- * then silently vanishes from the registry every skill reads.
- */
-function isExcludedWorkerDirectory(relativeDirectory) {
-    const normalized = relativeDirectory.replaceAll('\\', '/');
-    const [root, tenant, nested] = normalized.split('/');
-    if (root !== 'companies')
-        return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
-    if (tenant === '_template')
-        return true;
-    if (nested === 'repos')
-        return true;
-    return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
-}
-/**
- * Every exclusion is a property of the directory holding the `worker.yaml`, so
- * the file rule is the directory rule applied to its parent. Deriving it keeps
- * the pruned descent and this final filter from ever disagreeing — a drift that
- * would either resurrect a shadowing copy or silently drop a real worker.
- */
-function isExcludedWorkerPath(relativeFile) {
-    return isExcludedWorkerDirectory(path.dirname(relativeFile));
-}
 /**
  * Generate core/workers/registry.yaml from worker.yaml files. Invalid workers
  * are quarantined but do not prevent all valid workers from being registered.
@@ -192,7 +138,7 @@ export function generateWorkersRegistry(hqRoot, options = {}) {
         ...workerYamlFiles(hqRoot, 'personal/workers'),
     ].sort();
     for (const relativeFile of files) {
-        if (isExcludedWorkerPath(relativeFile))
+        if (relativeFile.startsWith('companies/_template/') || /(?:^|[/\\])_overrides(?:[/\\]|$)/.test(relativeFile))
             continue;
         const fields = readWorkerFields(path.join(hqRoot, relativeFile));
         const missing = ['id', 'type', 'description'].filter((key) => !fields[key]);