@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/assets/scaffold/core/scripts/rebuild-projects-index.sh

@@ -11,12 +11,11 @@ set -euo pipefail
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
+COMPANIES_DIR="companies"
 PROJECTS_DIR="personal/projects"
 OUT="${PROJECTS_DIR}/INDEX.md"
 DATE=$(date -u +%Y-%m-%d)
 
-[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
-
 sanitize_cell() {
   printf '%s' "$1" | tr '\n' ' ' | sed -e 's/|/\\|/g' -e 's/  */ /g' -e 's/^ *//' -e 's/ *$//'
 }
@@ -29,17 +28,23 @@ trunc() {
 project_status() {
   local project="$1"
   local prd="$2"
+  local fallback="${3:-—}"
+  local expected_prd="${4:-}"
   local state="workspace/orchestrator/${project}/state.json"
   if [[ -f "$state" ]]; then
-    local raw
-    raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
-    case "$raw" in
-      completed|complete) echo "complete" ;;
-      in_progress|active|started) echo "active" ;;
-      archived) echo "archived" ;;
-      *) echo "$raw" ;;
-    esac
-    return
+    local state_prd
+    state_prd=$(jq -r '.prd_path // ""' "$state" 2>/dev/null || echo "")
+    if [[ -z "$expected_prd" || "$state_prd" == "$expected_prd" ]]; then
+      local raw
+      raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
+      case "$raw" in
+        completed|complete) echo "complete" ;;
+        in_progress|active|started) echo "active" ;;
+        archived) echo "archived" ;;
+        *) echo "$raw" ;;
+      esac
+      return
+    fi
   fi
   if [[ -f "$prd" ]]; then
     local total passes
@@ -50,9 +55,91 @@ project_status() {
       return
     fi
   fi
-  echo "—"
+  echo "$fallback"
+}
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
 }
 
+stamp_generated() {
+  local input="$1" output="$2" normalized hash
+  normalized=$(mktemp)
+  sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$input" > "$normalized"
+  hash=$(sha256_file "$normalized")
+  rm -f "$normalized"
+  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$output"
+}
+
+company_title() {
+  printf '%s\n' "$1" | awk -F'-' '{ for (i=1; i<=NF; i++) { $i = toupper(substr($i,1,1)) substr($i,2) } print }' OFS=' '
+}
+
+write_company_projects_index() {
+  local company="$1" company_root project_dir output tmp name prd description status
+  company_root="${COMPANIES_DIR}/${company}"
+  project_dir="${company_root}/projects"
+  output="${project_dir}/INDEX.md"
+  tmp=$(mktemp)
+  {
+    printf '# %s Projects\n\n' "$(company_title "$company")"
+    printf '> Auto-generated. Updated: %s\n\n' "$DATE"
+    echo '| Project | Status | Description |'
+    echo '|---------|--------|-------------|'
+    while IFS= read -r project; do
+      name=$(basename "$project")
+      [[ "$name" == _* ]] && continue
+      [[ "$name" == .* ]] && continue
+      prd="${project}/prd.json"
+      description=""
+      if [[ -f "$prd" ]]; then description=$(jq -r '.description // ""' "$prd" 2>/dev/null || echo ""); fi
+      status=$(project_status "$name" "$prd" "active" "$prd")
+      description=$(sanitize_cell "$description")
+      description=$(trunc "$description" 110)
+      [[ -z "$description" ]] && description="—"
+      printf '| `%s` | %s | %s |\n' "$name" "$status" "$description"
+    done < <(find "$project_dir" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+  } > "$tmp"
+  local existing=0 stored actual normalized
+  [[ -e "$output" ]] && existing=1
+  if [[ "$existing" == 1 ]]; then
+    if grep -q '<!-- hq:keep -->' "$output" || ! grep -q '^> Auto-generated. Updated: ' "$output"; then
+      echo "rebuild-projects-index: refused to overwrite ${output} (hand-written or kept)" >&2
+      rm -f "$tmp"
+      return 0
+    fi
+    stored=$(sed -n 's/^<!-- hq-generated-sha256: \([a-f0-9]*\) -->$/\1/p' "$output" | head -n 1)
+    if [[ -n "$stored" ]]; then
+      normalized=$(mktemp)
+      sed -e '/^<!-- hq-generated-sha256: [a-f0-9]* -->$/d' -e 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$output" > "$normalized"
+      actual=$(sha256_file "$normalized")
+      rm -f "$normalized"
+      if [[ "$stored" != "$actual" ]]; then
+        echo "rebuild-projects-index: refused to overwrite ${output} (generated content was edited)" >&2
+        rm -f "$tmp"
+        return 0
+      fi
+    fi
+  fi
+  stamp_generated "$tmp" "$output"
+  rm -f "$tmp"
+  echo "rebuild-projects-index: wrote ${output}" >&2
+}
+
+while IFS= read -r dir; do
+  co=$(basename "$dir")
+  [[ "$co" == _* ]] && continue
+  [[ "$co" == .* ]] && continue
+  project_dir="${COMPANIES_DIR}/${co}/projects"
+  [[ -d "$project_dir" ]] && write_company_projects_index "$co"
+done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+
+[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
+
 {
   echo "# Projects"
   echo ""

package/assets/scaffold/core/scripts/refresh-vault-access.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: `hq files shared-with-me` (explicit per-prefix grants)
+#   - role:   `hq members --company <slug> list` matched against the caller's
+#             email (from `hq whoami`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+# With no --company, refreshes every company that appears in the
+# `hq files shared-with-me` cross-company roll-up.
+
+set -uo pipefail
+
+log() { printf 'refresh-vault-access: %s\n' "$*" >&2; }
+
+ROOT=""
+SLUGS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --root)
+      ROOT="${2:-}"
+      shift 2 || { log "--root requires a value"; exit 1; }
+      ;;
+    --company)
+      SLUGS[${#SLUGS[@]}]="${2:-}"
+      shift 2 || { log "--company requires a value"; exit 1; }
+      ;;
+    -h|--help)
+      sed -n '2,33p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      log "unknown argument: $1"
+      exit 1
+      ;;
+  esac
+done
+
+is_hq_root() { [ -n "${1:-}" ] && [ -d "${1%/}/core" ] && [ -d "${1%/}/.claude" ]; }
+
+if [ -z "$ROOT" ]; then
+  if is_hq_root "${CLAUDE_PROJECT_DIR:-}"; then
+    ROOT="$CLAUDE_PROJECT_DIR"
+  else
+    dir="$PWD"
+    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
+      if is_hq_root "$dir"; then ROOT="$dir"; break; fi
+      dir="$(dirname "$dir")"
+    done
+  fi
+fi
+if ! is_hq_root "$ROOT"; then
+  log "could not resolve the HQ root (pass --root <hqRoot>)"
+  exit 1
+fi
+
+command -v jq >/dev/null 2>&1 || { log "jq is required"; exit 1; }
+if ! command -v hq >/dev/null 2>&1; then
+  log "hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)"
+  exit 0
+fi
+
+strip_ansi() { sed -e 's/\x1b\[[0-9;]*m//g'; }
+
+# ── caller email (for role lookup) ─────────────────────────────────────────
+EMAIL="${HQ_VAULT_ACCESS_EMAIL:-}"
+if [ -z "$EMAIL" ]; then
+  EMAIL="$(hq whoami 2>/dev/null | strip_ansi \
+    | grep -Eo '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' \
+    | grep -v '@outposts\.' | head -1 || true)"
+fi
+[ -n "$EMAIL" ] || log "could not determine caller email — roles will be 'unknown' (hook will not enforce)"
+
+# ── explicit grants via shared-with-me ─────────────────────────────────────
+# Table columns: COMPANY  PATH  PERMISSION  SOURCE (header + ─── separator).
+fetch_grants_tsv() {
+  # $1 = optional slug filter; prints "slug<TAB>path<TAB>permission" rows.
+  local slug="${1:-}" out
+  if [ -n "$slug" ]; then
+    out="$(hq files shared-with-me --company "$slug" 2>/dev/null | strip_ansi)" || return 1
+  else
+    out="$(hq files shared-with-me 2>/dev/null | strip_ansi)" || return 1
+  fi
+  # hq-cli >= 5.142 renders a private-folder row as "foo/ (private folder)";
+  # drop the label so the PATH column stays the verbatim `foo/` pattern.
+  printf '%s\n' "$out" | awk '
+    { sub(/ \(private folder\)/, "") }
+    /^COMPANY[[:space:]]/ { next }
+    /^─/ { next }
+    /^[[:space:]]*$/ { next }
+    /^Nothing is explicitly shared/ { next }
+    NF >= 3 {
+      perm = ""
+      if ($3 == "read" || $3 == "write" || $3 == "admin") perm = $3
+      else if (NF >= 4 && ($4 == "read" || $4 == "write" || $4 == "admin")) perm = $4
+      if (perm != "") printf "%s\t%s\t%s\n", $1, $2, perm
+    }'
+}
+
+# ── role lookup ────────────────────────────────────────────────────────────
+fetch_role() {
+  # $1 = slug; prints role or "unknown". Never fails.
+  local slug="$1" out role=""
+  if [ -n "$EMAIL" ]; then
+    # --company is declared on the parent `members` group, so it goes first.
+    out="$(hq members --company "$slug" list 2>/dev/null | strip_ansi)" || out=""
+    if [ -n "$out" ]; then
+      role="$(printf '%s\n' "$out" | awk -v email="$EMAIL" '$1 == email { print $2; exit }')"
+    fi
+  fi
+  case "$role" in
+    owner|admin|member|guest) printf '%s' "$role" ;;
+    *) printf 'unknown' ;;
+  esac
+}
+
+GRANTS_TSV=""
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  for slug in "${SLUGS[@]}"; do
+    rows="$(fetch_grants_tsv "$slug")" || { log "skipping $slug — shared-with-me query failed"; continue; }
+    GRANTS_TSV="${GRANTS_TSV}${rows}
+"
+  done
+else
+  GRANTS_TSV="$(fetch_grants_tsv)" || { log "shared-with-me roll-up failed — nothing refreshed"; exit 0; }
+fi
+
+# Companies to include = every slug present in the grant rows (plus any
+# explicitly requested slugs, so a company with zero explicit grants still
+# gets a role entry when asked for by name).
+ALL_SLUGS="$(printf '%s\n' "$GRANTS_TSV" | awk -F'\t' 'NF { print $1 }' | sort -u)"
+if [ "${#SLUGS[@]}" -gt 0 ]; then
+  ALL_SLUGS="$(printf '%s\n%s\n' "$ALL_SLUGS" "$(printf '%s\n' "${SLUGS[@]}")" | awk 'NF' | sort -u)"
+fi
+
+if [ -z "$ALL_SLUGS" ]; then
+  log "no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)"
+fi
+
+COMPANIES_JSON="{}"
+while IFS= read -r slug; do
+  [ -n "$slug" ] || continue
+  role="$(fetch_role "$slug")"
+  grants_json="$(printf '%s\n' "$GRANTS_TSV" \
+    | awk -F'\t' -v s="$slug" '$1 == s { printf "%s\t%s\n", $2, $3 }' \
+    | jq -Rn '[inputs | split("\t") | select(length == 2) | {path: .[0], permission: .[1]}]')"
+  COMPANIES_JSON="$(printf '%s' "$COMPANIES_JSON" \
+    | jq --arg slug "$slug" --arg role "$role" --argjson grants "$grants_json" \
+        '. + {($slug): {role: $role, grants: $grants}}')"
+done <<EOF
+$ALL_SLUGS
+EOF
+
+mkdir -p "$ROOT/.hq"
+TMP_OUT="$(mktemp "$ROOT/.hq/vault-access.json.XXXXXX")"
+jq -n --argjson companies "$COMPANIES_JSON" \
+  --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+  '{version: 1, generatedAt: $ts, companies: $companies}' > "$TMP_OUT"
+mv "$TMP_OUT" "$ROOT/.hq/vault-access.json"
+
+N_COMPANIES="$(printf '%s\n' "$ALL_SLUGS" | awk 'NF' | wc -l | tr -d ' ')"
+log "wrote .hq/vault-access.json ($N_COMPANIES companies, identity: ${EMAIL:-unknown})"
+exit 0

package/assets/scaffold/core/scripts/register-project.sh

@@ -0,0 +1,262 @@
+#!/usr/bin/env bash
+# Register one local PRD on the Work Mesh Board and record threadId/channelId
+# on the company board.json. Audit and backfill never run unless asked.
+set -euo pipefail
+
+ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+resolve_uid() {
+  local company="$1"
+  if [ -n "${HQ_COMPANY_UID:-}" ]; then
+    printf '%s\n' "$HQ_COMPANY_UID"
+    return
+  fi
+  local file="$ROOT/companies/$company/.company-uid"
+  if [ -f "$file" ]; then
+    tr -d '[:space:]' < "$file"
+    return
+  fi
+  die "no company uid for $company (set HQ_COMPANY_UID or companies/$company/.company-uid)"
+}
+
+has_board() {
+  local company="$1" project="$2" uid
+  uid="$(resolve_uid "$company")"
+  [ -f "${HOME}/.hq/work-mesh/cache/projects/${uid}/${project}.json" ]
+}
+
+story_not_done() {
+  jq -e '[.userStories[]? | select((.status // "") != "done")] | length > 0' "$1" >/dev/null
+}
+
+recent_dir() {
+  local path="$1" mtime now age
+  case "$(uname -s)" in
+    Darwin) mtime="$(stat -f %m "$path")" ;;
+    *) mtime="$(stat -c %Y "$path")" ;;
+  esac
+  now="$(date +%s)"
+  age=$((now - mtime))
+  if [ "$age" -lt $((30 * 86400)) ]; then
+    printf 'yes\n'
+  else
+    printf 'no\n'
+  fi
+}
+
+# hq mesh project ensure shipped in hq-cli 5.139.0. Probe the subcommand,
+# not the version string: a laptop can be one release behind the supply-chain
+# install guard for up to 24h.
+MIN_HQ_CLI="5.139.0"
+
+cli_has_project_ensure() {
+  hq mesh project ensure --help >/dev/null 2>&1
+}
+
+board_path() {
+  printf '%s\n' "$ROOT/companies/$1/board.json"
+}
+
+mark_pending() {
+  local company="$1" project="$2"
+  local board prd rel now title tmp
+  board="$(board_path "$company")"
+  prd="$ROOT/companies/$company/projects/$project/prd.json"
+  rel="companies/$company/projects/$project/prd.json"
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  title="$(jq -r '.name // empty' "$prd" 2>/dev/null || true)"
+  [ -n "$title" ] || title="$project"
+  mkdir -p "$(dirname "$board")"
+  if [ ! -f "$board" ]; then
+    jq -n --arg company "$company" '{company:$company, projects:[]}' > "$board"
+  fi
+  tmp="$(mktemp)"
+  jq \
+    --arg id "$project" \
+    --arg path "$rel" \
+    --arg now "$now" \
+    --arg title "$title" \
+    '
+      .projects = (.projects // []) |
+      if any(.projects[]; .id == $id or .prd_path == $path or .mesh_project_id == $id) then
+        .projects |= map(
+          if .id == $id or .prd_path == $path or .mesh_project_id == $id then
+            . + {pending_registration:true, updated_at:$now, prd_path:(.prd_path // $path)}
+          else . end
+        )
+      else
+        .projects += [{
+          id:$id,
+          title:$title,
+          status:"prd_created",
+          scope:"company",
+          prd_path:$path,
+          pending_registration:true,
+          created_at:$now,
+          updated_at:$now
+        }]
+      end
+    ' "$board" > "$tmp"
+  mv "$tmp" "$board"
+}
+
+register_one() {
+  local company="$1" project="$2"
+  local prd="$ROOT/companies/$company/projects/$project/prd.json"
+  [ -f "$prd" ] || die "registration incomplete: missing $prd"
+  if ! cli_has_project_ensure; then
+    mark_pending "$company" "$project"
+    die "hq-cli ${MIN_HQ_CLI} or newer is required; ${company}/${project} stays local until then"
+  fi
+  local ensure_json
+  if ! ensure_json="$(hq mesh project ensure "$project" --company "$company" --stories-file "$prd" --json)"; then
+    echo "registration incomplete: hq mesh project ensure failed for $company/$project" >&2
+    exit 1
+  fi
+  local thread channel
+  thread="$(printf '%s' "$ensure_json" | jq -er '.threadId // empty')" || die "registration incomplete: ensure output missing threadId"
+  channel="$(printf '%s' "$ensure_json" | jq -er '.channelId // empty')" || die "registration incomplete: ensure output missing channelId"
+  [ -n "$thread" ] || die "registration incomplete: empty threadId"
+  [ -n "$channel" ] || die "registration incomplete: empty channelId"
+
+  local board="$ROOT/companies/$company/board.json"
+  local rel="companies/$company/projects/$project/prd.json"
+  local now title tmp
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  title="$(jq -r '.name // empty' "$prd")"
+  [ -n "$title" ] || title="$project"
+  mkdir -p "$(dirname "$board")"
+  if [ ! -f "$board" ]; then
+    jq -n --arg company "$company" '{company:$company, projects:[]}' > "$board"
+  fi
+  tmp="$(mktemp)"
+  jq \
+    --arg id "$project" \
+    --arg path "$rel" \
+    --arg thread "$thread" \
+    --arg channel "$channel" \
+    --arg now "$now" \
+    --arg title "$title" \
+    '
+      .projects = (.projects // []) |
+      if any(.projects[]; .id == $id or .prd_path == $path or .mesh_project_id == $id) then
+        .projects |= map(
+          if .id == $id or .prd_path == $path or .mesh_project_id == $id then
+            . + {threadId:$thread, channelId:$channel, updated_at:$now, prd_path:(.prd_path // $path), mesh_project_id:$id} | del(.pending_registration)
+          else . end
+        )
+      else
+        .projects += [{
+          id:$id,
+          title:$title,
+          status:"prd_created",
+          scope:"company",
+          prd_path:$path,
+          threadId:$thread,
+          channelId:$channel,
+          mesh_project_id:$id,
+          created_at:$now,
+          updated_at:$now
+        }]
+      end
+    ' "$board" > "$tmp"
+  mv "$tmp" "$board"
+  jq -e \
+    --arg id "$project" \
+    --arg path "$rel" \
+    --arg thread "$thread" \
+    --arg channel "$channel" \
+    'any(.projects[]?; (.id == $id or .prd_path == $path or .mesh_project_id == $id) and .threadId == $thread and .channelId == $channel)' \
+    "$board" >/dev/null \
+    || die "registration incomplete: board.json entry for $project did not verify"
+  echo "registered $company/$project thread=$thread channel=$channel"
+}
+
+audit() {
+  local company="$1"
+  [ -n "$company" ] || die "usage: register-project.sh --audit <company>"
+  local dir="$ROOT/companies/$company/projects"
+  [ -d "$dir" ] || return 0
+  local prd name
+  for prd in "$dir"/*/prd.json; do
+    [ -f "$prd" ] || continue
+    name="$(basename "$(dirname "$prd")")"
+    if ! has_board "$company" "$name"; then
+      printf '%s\n' "$name"
+    fi
+  done | sort
+}
+
+backfill() {
+  local company="" only=0 yes=0
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --only-active) only=1 ;;
+      --yes) yes=1 ;;
+      --*) die "unknown flag $1" ;;
+      *) company="$1" ;;
+    esac
+    shift
+  done
+  [ -n "$company" ] || die "usage: register-project.sh --backfill <company> --only-active [--yes]"
+  [ "$only" -eq 1 ] || die "--backfill requires --only-active"
+  local dir="$ROOT/companies/$company/projects"
+  [ -d "$dir" ] || return 0
+  local prd name recent
+  local -a targets=()
+  for prd in "$dir"/*/prd.json; do
+    [ -f "$prd" ] || continue
+    name="$(basename "$(dirname "$prd")")"
+    story_not_done "$prd" || continue
+    recent="$(recent_dir "$(dirname "$prd")")"
+    [ "$recent" = "yes" ] || continue
+    targets+=("$name")
+  done
+  IFS=$'\n' targets=($(printf '%s\n' "${targets[@]+"${targets[@]}"}" | sed '/^$/d' | sort))
+  unset IFS
+  if [ "$yes" -ne 1 ]; then
+    local item
+    for item in "${targets[@]+"${targets[@]}"}"; do
+      echo "would register $company/$item"
+    done
+    return 0
+  fi
+  local item
+  for item in "${targets[@]+"${targets[@]}"}"; do
+    register_one "$company" "$item"
+  done
+}
+
+retry_pending() {
+  local company="${1:-}"
+  [ -n "$company" ] || die "usage: register-project.sh --retry-pending <company>"
+  cli_has_project_ensure || return 0
+  local board
+  board="$(board_path "$company")"
+  [ -f "$board" ] || return 0
+  local id count=0
+  while IFS= read -r id; do
+    [ -n "$id" ] || continue
+    count=$((count + 1))
+    [ "$count" -le 3 ] || break
+    ( register_one "$company" "$id" ) || true
+  done < <(jq -r '[.projects[]? | select(.pending_registration == true) | .id // empty] | .[]' "$board" 2>/dev/null || true)
+}
+
+if [ "${1:-}" = "--audit" ]; then
+  audit "${2:-}"
+elif [ "${1:-}" = "--backfill" ]; then
+  shift
+  backfill "$@"
+elif [ "${1:-}" = "--retry-pending" ]; then
+  retry_pending "${2:-}"
+elif [ $# -eq 2 ]; then
+  register_one "$1" "$2"
+else
+  die "usage: register-project.sh <company> <project> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>"
+fi