@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/commands/core-job-run-native.js

@@ -0,0 +1,1215 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { JSON_SCHEMA, load } from "js-yaml";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { resolveLiveRoot, resolveBundledAsset } from "../utils/hq-roots.js";
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { describeCoreCommand } from "./core-command-catalog.js";
+import { coreNativeJobsEnabled } from "./core-native-jobs-flag.js";
+const RUN_ASSET = "core/scripts/hq-job-run.sh";
+const RUNNER_NAME = "hq-job-run";
+export const OUTPOST_IDENTITY_FILE = "/etc/outpost/codex-identity.env";
+export const OUTPOST_RUNNER_FILE = "/usr/local/bin/outpost-runner.sh";
+const REMOTE_LAUNCHER = fileURLToPath(new URL("./core-job-remote-launcher.js", import.meta.url));
+const USAGE = `hq-job-run.sh — serialized Outpost scheduled-job executor (US-004 + US-006).
+
+Invoked by systemd user units (hq-job-{id}.service) or on demand:
+  core/scripts/hq-job-run.sh --job-id <id>
+  core/scripts/hq-job-run.sh <job.yaml>
+
+Behavior:
+  - Global file lock (~/.hq/jobs/run.lock) — serialized-only (US-001)
+  - Enforces job timeout_seconds (default 600; schema 60–14400)
+  - Credentials only via \`hq secrets exec\` (requirements.secrets[]) or
+    the box's cached CLI auth — never env vars / unit-file secrets
+  - Trust model (7A): injects ONLY requirements.secrets[] — no static prompt scan
+  - Appends stdout/stderr + exit to ~/.hq/jobs/logs/{id}/
+  - Emits a compute-meter attribution marker (scheduled vs interactive)
+  - Classifies failures (auth|secrets|timeout|agent_error|infra), writes
+    failure_class to hq-pro jobs status (kind=run), bounded self-remediate,
+    then dm-notify via hq-job-notify.sh (collapse 1/24h; never create-thread)
+  - Missing runtime CLI auth: classify auth, notify re-login, exit 0 (unit OK)
+
+Runtime dispatch (US-001 spike flags):
+  claude → claude -p … --output-format text --permission-mode bypassPermissions
+  codex  → codex exec -s workspace-write --skip-git-repo-check …
+
+Env / overrides (tests):
+  HQ_ROOT, HOME, HQ_JOB_LOCK, HQ_JOB_LOG_DIR, HQ_JOB_METER_DIR
+  HQ_JOB_TIMEOUT_BIN, HQ_JOB_FLOCK_BIN, HQ_JOB_NOW
+  HQ_JOB_PROBE_CLAUDE_CRED, HQ_JOB_PROBE_CODEX_AUTH (auth paths; shared with probe)
+  HQ_JOB_RUN_SKIP_EXEC=1  — acquire lock + write marker/logs without calling CLI
+  HQ_JOB_NOTIFY_BIN, HQ_JOB_REMEDIATE_BIN, HQ_JOB_RUN_NO_NOTIFY=1, HQ_JOB_RUN_NO_INGEST=1
+  HQ_JOB_RUN_CURL, HQ_PRO_API_URL, OUTPOST_USER_ID, OUTPOST_INSTANCE_TOKEN
+
+Exit: 0 success or intentional auth/cwd skip; 1 agent/job failure; 2 usage/config;
+      124 timeout (GNU timeout convention when available).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+HQ_ROOT="\${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+`;
+class JobYamlParseFailure extends Error {
+    source;
+    parseError;
+    constructor(source, parseError) {
+        super("job YAML parse failed");
+        this.source = source;
+        this.parseError = parseError;
+    }
+}
+const LOCK_HOLDER = "process.stdout.write('HQ_LOCK_READY\\n'); process.stdin.resume();";
+const SIGNAL_NUMBER = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
+function numericSignal(signal) {
+    return signal ? SIGNAL_NUMBER[signal] ?? 0 : 0;
+}
+function appendLog(file, chunk) {
+    fs.appendFileSync(file, chunk);
+}
+function appendArgvRecord(file, executable, args) {
+    if (!file)
+        return;
+    const fields = [executable, ...args].map((value) => Buffer.from(`${value}\0`));
+    fs.appendFileSync(file, Buffer.concat(fields));
+}
+function signalProcessTree(child, signal, processGroup) {
+    if (processGroup && process.platform !== "win32" && child.pid !== undefined && child.pid > 0) {
+        try {
+            process.kill(-child.pid, signal);
+            return;
+        }
+        catch (error) {
+            if (error.code === "ESRCH")
+                return;
+            child.kill(signal);
+            throw error;
+        }
+    }
+    child.kill(signal);
+}
+function runtimeArgv(file, args) {
+    if (file === "claude" || file === "codex")
+        return { runtime: file, args };
+    let command = args;
+    if (file === "hq") {
+        const separator = args.lastIndexOf("--");
+        if (separator < 0)
+            return undefined;
+        command = args.slice(separator + 1);
+    }
+    if (command[0] === "timeout" || command[0] === "gtimeout")
+        command = command.slice(4);
+    const runtime = command[0];
+    return runtime === "claude" || runtime === "codex" ? { runtime, args: command.slice(1) } : undefined;
+}
+function pathExecutable(name, env) {
+    if (name.includes(path.sep)) {
+        try {
+            fs.accessSync(name, fs.constants.X_OK);
+            return name;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const pathValue = env.PATH ?? "";
+    for (const directory of pathValue.split(path.delimiter)) {
+        const candidate = path.join(directory || ".", name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return candidate;
+        }
+        catch { /* keep searching PATH */ }
+    }
+    return undefined;
+}
+export async function spawnProcess(request) {
+    if (request.env.HQ_JOB_RUN_STUBS === "1") {
+        const recordFile = request.env.HQ_JOB_RUN_PROCESS_RECORD;
+        if (recordFile) {
+            appendLog(recordFile, `${JSON.stringify({ file: request.file, args: request.args, cwd: request.cwd })}\n`);
+        }
+        const nestedAgent = runtimeArgv(request.file, request.args);
+        if (nestedAgent)
+            appendArgvRecord(request.env.HQ_JOB_RUN_AGENT_ARGV_RECORD, nestedAgent.runtime, nestedAgent.args);
+        if (request.file === "bash") {
+            const helperArgs = request.args.slice(1);
+            const helper = path.basename(request.args[0] ?? "");
+            if (helper === "notify.sh" || helper === "hq-job-notify.sh")
+                appendArgvRecord(request.env.HQ_JOB_RUN_NOTIFY_ARGV_RECORD, "hq-job-notify.sh", helperArgs);
+            if (helper === "remediate.sh" || helper === "hq-job-remediate.sh")
+                appendArgvRecord(request.env.HQ_JOB_RUN_REMEDIATE_ARGV_RECORD, "hq-job-remediate.sh", helperArgs);
+        }
+        if (request.file === "tmux" && request.args[0] === "new-session") {
+            const doneFile = request.env.HQ_JOB_RUN_REMOTE_DONE_FILE;
+            const exitFile = request.env.HQ_JOB_RUN_REMOTE_EXIT_FILE;
+            if (doneFile)
+                fs.writeFileSync(doneFile, "");
+            if (exitFile)
+                fs.writeFileSync(exitFile, `EXIT=${request.env.HQ_JOB_RUN_STUB_EXIT_CODE ?? "0"}\n`);
+        }
+        const diagnostic = request.env.HQ_JOB_RUN_STUB_DIAGNOSTIC || "";
+        if (nestedAgent && request.logPath && diagnostic)
+            appendLog(request.logPath, `${diagnostic}\n`);
+        const response = request.env.HQ_JOB_RUN_STUB_REMEDIATE_OUTPUT
+            ?? '{"retry_recommended":false,"attempted":false,"notes":"stubbed"}';
+        const code = nestedAgent ? Number(request.env.HQ_JOB_RUN_STUB_EXIT_CODE ?? "0") : 0;
+        const helperName = path.basename(request.args[0] ?? "");
+        const isRemediation = request.file === "bash" && (helperName === "remediate.sh" || helperName === "hq-job-remediate.sh");
+        const stdout = isRemediation ? Buffer.from(response) : Buffer.alloc(0);
+        return { code: Number.isInteger(code) ? code : 0, stdout, stderr: Buffer.alloc(0) };
+    }
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let timedOut = false;
+        let forceTimer;
+        let timeout;
+        const stdout = [];
+        const stderr = [];
+        let logWriteError;
+        let processSignalError;
+        const processGroup = Boolean(request.timeoutMs && request.timeoutMs > 0 && process.platform !== "win32");
+        const child = spawn(request.file, request.args, {
+            cwd: request.cwd,
+            env: request.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: processGroup,
+        });
+        child.once("error", reject);
+        child.stdout.on("data", (chunk) => {
+            if (request.logPath) {
+                try {
+                    appendLog(request.logPath, chunk);
+                }
+                catch (error) {
+                    logWriteError = error;
+                }
+            }
+            else
+                stdout.push(Buffer.from(chunk));
+        });
+        child.stderr.on("data", (chunk) => {
+            if (request.logPath) {
+                try {
+                    appendLog(request.logPath, chunk);
+                }
+                catch (error) {
+                    logWriteError = error;
+                }
+            }
+            else
+                stderr.push(Buffer.from(chunk));
+        });
+        if (request.timeoutMs && request.timeoutMs > 0) {
+            timeout = setTimeout(() => {
+                timedOut = true;
+                try {
+                    signalProcessTree(child, "SIGTERM", processGroup);
+                }
+                catch (error) {
+                    processSignalError = error;
+                }
+                forceTimer = setTimeout(() => {
+                    try {
+                        signalProcessTree(child, "SIGKILL", processGroup);
+                    }
+                    catch (error) {
+                        processSignalError ??= error;
+                    }
+                }, 15_000);
+            }, request.timeoutMs);
+            timeout.unref?.();
+        }
+        child.once("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            if (forceTimer)
+                clearTimeout(forceTimer);
+            if (processSignalError) {
+                reject(processSignalError);
+                return;
+            }
+            if (logWriteError) {
+                reject(logWriteError);
+                return;
+            }
+            resolve({
+                code: timedOut ? 124 : code ?? 128 + numericSignal(signal),
+                stdout: Buffer.concat(stdout),
+                stderr: Buffer.concat(stderr),
+            });
+        });
+    });
+}
+/** Holds the same kernel flock(2) lock used by the shell companion. */
+export async function acquireFlock(file, env = process.env) {
+    const binary = env.HQ_JOB_FLOCK_BIN || pathExecutable("flock", env);
+    if (!binary)
+        throw new Error("Outpost/Linux requires util-linux flock(1) for serialized job runs");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    return await new Promise((resolve, reject) => {
+        const child = spawn(binary, ["-x", file, process.execPath, "-e", LOCK_HOLDER], {
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let released = false;
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => { stdout += chunk; });
+        child.stderr.on("data", (chunk) => { stderr += chunk; });
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (released)
+                return;
+            released = true;
+            if (!stdout.includes("HQ_LOCK_READY\n")) {
+                reject(new Error(stderr.trim() || `failed to acquire global run lock: ${file} (flock exit ${code ?? 1})`));
+            }
+        });
+        const readyTimer = setInterval(() => {
+            if (!stdout.includes("HQ_LOCK_READY\n"))
+                return;
+            clearInterval(readyTimer);
+            let done = false;
+            resolve({
+                release: async () => {
+                    if (done)
+                        return;
+                    done = true;
+                    child.stdin.end();
+                    await new Promise((complete) => child.once("close", () => complete()));
+                    released = true;
+                },
+            });
+        }, 5);
+        readyTimer.unref?.();
+    });
+}
+function defaultDependencies(env) {
+    const stubbed = env.HQ_JOB_RUN_STUBS === "1";
+    return {
+        env,
+        cwd: process.cwd(),
+        home: env.HOME || os.homedir(),
+        now: () => stubbed && env.HQ_JOB_RUN_STUB_DATE ? new Date(env.HQ_JOB_RUN_STUB_DATE) : new Date(),
+        epochNow: () => stubbed && env.HQ_JOB_RUN_STUB_EPOCH
+            ? Number(env.HQ_JOB_RUN_STUB_EPOCH)
+            : Math.floor(Date.now() / 1000),
+        readFile: (file) => fs.readFileSync(file),
+        stat: (file) => fs.statSync(file),
+        mkdir: (directory) => fs.mkdirSync(directory, { recursive: true }),
+        writeFile: (file, content) => fs.writeFileSync(file, content),
+        appendFile: (file, content) => fs.appendFileSync(file, content),
+        chmod: (file, mode) => fs.chmodSync(file, mode),
+        remove: (file) => fs.rmSync(file, { force: true }),
+        fetch: stubbed
+            ? async (input, init) => {
+                const recordFile = env.HQ_JOB_RUN_FETCH_RECORD;
+                if (recordFile)
+                    appendLog(recordFile, `${JSON.stringify({ input, method: init.method, headers: init.headers, body: init.body })}\n`);
+                if (env.HQ_JOB_RUN_REQUEST_BODY_RECORD && init.body !== undefined) {
+                    appendLog(env.HQ_JOB_RUN_REQUEST_BODY_RECORD, `${String(init.body)}\n`);
+                }
+                if (env.HQ_JOB_RUN_AUTH_HEADER_RECORD) {
+                    const token = new Headers(init.headers).get("x-outpost-instance-token") ?? "";
+                    appendLog(env.HQ_JOB_RUN_AUTH_HEADER_RECORD, `x-outpost-instance-token: ${token}\n`);
+                }
+                const scenario = env.HQ_JOB_RUN_FETCH_SCENARIO || "200";
+                if (scenario === "transport-error")
+                    throw new Error("synthetic transport error");
+                if (scenario === "timeout")
+                    throw Object.assign(new Error("synthetic timeout"), { name: "AbortError" });
+                const status = Number(scenario);
+                return new Response("", { status: Number.isInteger(status) && status >= 200 && status <= 599 ? status : 200 });
+            }
+            : (input, init) => globalThis.fetch(input, init),
+        runProcess: spawnProcess,
+        acquireLock: stubbed && env.HQ_JOB_RUN_LOCK_REAL !== "1"
+            ? async (file) => {
+                fs.mkdirSync(path.dirname(file), { recursive: true });
+                fs.writeFileSync(file, "");
+                return { release: async () => undefined };
+            }
+            : (file) => acquireFlock(file, env),
+        sleep: stubbed ? async () => undefined : (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+        scriptPath: resolveBundledAsset(RUN_ASSET),
+    };
+}
+function yqText(value, fallback = "") {
+    if (value === undefined || value === null)
+        return fallback;
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "boolean" || typeof value === "number")
+        return String(value);
+    return JSON.stringify(value);
+}
+function parseYamlJob(file, deps) {
+    const source = deps.readFile(file).toString("utf8");
+    let value;
+    try {
+        value = load(source, { schema: JSON_SCHEMA });
+    }
+    catch (error) {
+        throw new JobYamlParseFailure(source, error);
+    }
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function malformedYamlDiagnostic(file, source, error) {
+    if (!error || typeof error !== "object" || !("reason" in error))
+        return undefined;
+    const reason = String(error.reason ?? "");
+    if (reason !== "unexpected end of the stream within a flow collection")
+        return undefined;
+    const flowSequence = source.lastIndexOf("[") > source.lastIndexOf("]");
+    const flowMapping = source.lastIndexOf("{") > source.lastIndexOf("}");
+    if (!flowSequence && !flowMapping)
+        return undefined;
+    const flow = flowSequence ? "flow sequence" : "flow mapping";
+    const closer = flowSequence ? "]" : "}";
+    const lineCount = Math.max(1, source.split(/\r\n|\n/).length - (source.endsWith("\n") ? 1 : 0));
+    return `Error: bad file '${file}': yaml: while parsing a ${flow} at <unknown position>: line ${lineCount}: did not find expected ',' or '${closer}'\n`;
+}
+function yamlReason(error) {
+    if (!error || typeof error !== "object" || !("reason" in error))
+        return "invalid YAML document";
+    const reason = String(error.reason ?? "");
+    return reason || "invalid YAML document";
+}
+function findJobFileById(id, root, deps) {
+    const files = [];
+    const personal = path.join(root, "personal", "jobs");
+    try {
+        for (const entry of fs.readdirSync(personal, { withFileTypes: true })) {
+            if (entry.isFile() && /\.ya?ml$/.test(entry.name))
+                files.push(path.join(personal, entry.name));
+        }
+    }
+    catch { /* The shell find ignores a missing job registry. */ }
+    const companies = path.join(root, "companies");
+    try {
+        for (const company of fs.readdirSync(companies, { withFileTypes: true })) {
+            if (!company.isDirectory())
+                continue;
+            const jobs = path.join(companies, company.name, "jobs");
+            try {
+                for (const entry of fs.readdirSync(jobs, { withFileTypes: true })) {
+                    if (entry.isFile() && /\.ya?ml$/.test(entry.name))
+                        files.push(path.join(jobs, entry.name));
+                }
+            }
+            catch { /* The shell find ignores a company without jobs. */ }
+        }
+    }
+    catch { /* The shell find ignores a missing company registry. */ }
+    const candidates = files.filter((file) => !/\.conflict-|\/\.conflicts\//.test(file)).sort();
+    let found;
+    for (const file of candidates) {
+        let value;
+        try {
+            value = load(deps.readFile(file).toString("utf8"), { schema: JSON_SCHEMA });
+        }
+        catch {
+            continue;
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            continue;
+        if (yqText(value.id) !== id)
+            continue;
+        if (found)
+            throw new Error(`duplicate job id '${id}' in registry: ${found} and ${file}`);
+        found = file;
+    }
+    return found;
+}
+function parseArgs(argv) {
+    let jobTarget = "";
+    let jobId = "";
+    let hqRoot = "";
+    for (let index = 0; index < argv.length;) {
+        const argument = argv[index];
+        if (argument === "--hq-root" || argument === "--job-id") {
+            const value = argv[index + 1] ?? "";
+            if (argument === "--hq-root") {
+                if (!value)
+                    return { jobTarget, jobId, hqRoot, error: "--hq-root requires a directory", help: false };
+                hqRoot = value;
+            }
+            else {
+                if (!value)
+                    return { jobTarget, jobId, hqRoot, error: "--job-id requires a value", help: false };
+                jobId = value;
+            }
+            index += 2;
+        }
+        else if (argument === "-h" || argument === "--help") {
+            return { jobTarget, jobId, hqRoot, help: true };
+        }
+        else if (argument === "--") {
+            break;
+        }
+        else if (argument.startsWith("-")) {
+            return { jobTarget, jobId, hqRoot, error: `unknown option: ${argument}`, help: false };
+        }
+        else {
+            if (jobTarget)
+                return { jobTarget, jobId, hqRoot, error: `unexpected argument: ${argument}`, help: false };
+            jobTarget = argument;
+            index += 1;
+        }
+    }
+    return { jobTarget, jobId, hqRoot, help: false };
+}
+function emitUsage() { process.stdout.write(USAGE); }
+function emitLog(message) { process.stderr.write(`${RUNNER_NAME}: ${message}\n`); }
+function emitDie(message) { process.stderr.write(`${RUNNER_NAME}: ${message}\n`); return 2; }
+function getPath(job, dotted) {
+    let cursor = job;
+    for (const piece of dotted.split(".")) {
+        if (!cursor || typeof cursor !== "object" || Array.isArray(cursor))
+            return undefined;
+        cursor = cursor[piece];
+    }
+    return cursor;
+}
+function isPlainRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function resolveJobPath(target, jobId, root, deps) {
+    if (jobId) {
+        const found = findJobFileById(jobId, root, deps);
+        if (!found)
+            throw new Error(`job id not found: ${jobId}`);
+        return found;
+    }
+    if (!target)
+        throw new Error("usage: hq-job-run.sh --job-id <id> | <job.yaml>");
+    if (fs.existsSync(target) && fs.statSync(target).isFile())
+        return target;
+    const underRoot = path.join(root, target);
+    if (fs.existsSync(underRoot) && fs.statSync(underRoot).isFile())
+        return underRoot;
+    const found = findJobFileById(target, root, deps);
+    if (!found)
+        throw new Error(`job not found: ${target}`);
+    return found;
+}
+function compactJson(value) {
+    return serializeJqJson(value, "compact").replace(/\n$/, "");
+}
+function buildPrompt(job, file) {
+    const prompt = yqText(getPath(job, "exec.prompt"));
+    const skill = yqText(getPath(job, "exec.skill"));
+    if (prompt && prompt !== "null")
+        return prompt;
+    if (skill && skill !== "null") {
+        let args = getPath(job, "exec.args");
+        if (args === undefined || args === null)
+            args = {};
+        return `Execute the HQ skill "${skill}" unattended with these args (JSON): ${compactJson(args)}. Follow the skill instructions exactly and produce a concise completion summary.`;
+    }
+    throw new Error(`job missing exec.prompt and exec.skill: ${file}`);
+}
+function jobSecretNames(job) {
+    const raw = getPath(job, "requirements.secrets");
+    if (raw === undefined || raw === null)
+        return [];
+    if (Array.isArray(raw))
+        return raw.map((value) => yqText(value)).filter((value) => value !== "" && value !== "null");
+    if (typeof raw === "string")
+        return [...raw].filter((value) => value !== "" && value !== "null");
+    return [];
+}
+function isoNow(deps) {
+    const override = deps.env.HQ_JOB_NOW;
+    return override ? override : deps.now().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function runStamp(deps) {
+    const value = deps.now();
+    return value.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+function elapsed(start, deps) {
+    return Math.max(0, deps.epochNow() - start);
+}
+function appendMeterMarker(jobId, runtime, started, ended, exitStatus, duration, skipReason, deps) {
+    const directory = deps.env.HQ_JOB_METER_DIR || path.join(deps.home, ".hq/jobs/meters");
+    deps.mkdir(directory);
+    const value = {
+        schema: "hq.outpost.job-run/v1",
+        kind: "scheduled-job-run",
+        job_id: jobId,
+        runtime,
+        started_at: started,
+        ended_at: ended,
+        exit_status: exitStatus,
+        duration_seconds: duration,
+        ...(deps.env.OUTPOST_ID ? { outpost_id: deps.env.OUTPOST_ID } : {}),
+        ...(skipReason ? { skip_reason: skipReason } : {}),
+    };
+    const meter = path.join(directory, "runs.jsonl");
+    deps.appendFile(meter, `${compactJson(value)}\n`);
+    try {
+        deps.chmod(meter, 0o600);
+    }
+    catch { /* The shell ignores chmod failure. */ }
+}
+function apiBase(env) {
+    return (env.HQ_PRO_API_URL || env.HQ_API_URL || env.HQ_VAULT_API_URL || "https://hqapi.hq.computer").replace(/\/$/, "");
+}
+function assignmentValue(value) {
+    if (value.length >= 2 && ((value[0] === "'" && value.at(-1) === "'") || (value[0] === '"' && value.at(-1) === '"'))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function parseIdentityEnvironment(contents) {
+    const identity = {};
+    for (const line of contents.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?(OUTPOST_USER_ID|OUTPOST_INSTANCE_TOKEN|OUTPOST_ID)\s*=\s*(.*?)\s*$/.exec(line);
+        if (!match)
+            continue;
+        const value = assignmentValue(match[2] ?? "");
+        if (match[1] === "OUTPOST_USER_ID")
+            identity.userId = value;
+        else if (match[1] === "OUTPOST_INSTANCE_TOKEN")
+            identity.instanceToken = value;
+        else
+            identity.outpostId = value;
+    }
+    return identity;
+}
+function parseRunnerAssignments(contents) {
+    const identity = {};
+    for (const line of contents.split(/\r?\n/)) {
+        const match = /^(USER_ID|INSTANCE_TOKEN|OUTPOST_ID)="(.*)"$/.exec(line);
+        if (!match)
+            continue;
+        if (match[1] === "USER_ID" && identity.userId === undefined)
+            identity.userId = match[2] ?? "";
+        else if (match[1] === "INSTANCE_TOKEN" && identity.instanceToken === undefined)
+            identity.instanceToken = match[2] ?? "";
+        else if (match[1] === "OUTPOST_ID" && identity.outpostId === undefined)
+            identity.outpostId = match[2] ?? "";
+    }
+    return identity;
+}
+function readOptionalIdentity(file, parser, deps) {
+    try {
+        return parser(deps.readFile(file).toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function resolveBoxIdentity(env, deps) {
+    let userId = env.OUTPOST_USER_ID || "";
+    let instanceToken = env.OUTPOST_INSTANCE_TOKEN || "";
+    let outpostId = env.OUTPOST_ID || "";
+    if (userId && instanceToken)
+        return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
+    const stubIdentityFile = env.HQ_JOB_RUN_STUBS === "1" ? env.HQ_JOB_RUN_STUB_IDENTITY_FILE : undefined;
+    const identityFile = readOptionalIdentity(stubIdentityFile || OUTPOST_IDENTITY_FILE, parseIdentityEnvironment, deps);
+    if (identityFile.userId !== undefined)
+        userId = identityFile.userId;
+    if (identityFile.instanceToken !== undefined)
+        instanceToken = identityFile.instanceToken;
+    if (identityFile.outpostId !== undefined)
+        outpostId = identityFile.outpostId;
+    if (userId && instanceToken)
+        return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
+    const runnerFile = env.HQ_JOB_PROBE_RUNNER || OUTPOST_RUNNER_FILE;
+    const runner = readOptionalIdentity(runnerFile, parseRunnerAssignments, deps);
+    userId ||= runner.userId || "";
+    instanceToken ||= runner.instanceToken || "";
+    outpostId ||= runner.outpostId || "";
+    if (!userId || !instanceToken)
+        return undefined;
+    return { userId, instanceToken, ...(outpostId ? { outpostId } : {}) };
+}
+async function ingestRunStatus(jobId, runAt, runId, exit, failureClass, actions, logFile, deps) {
+    if (deps.env.HQ_JOB_RUN_NO_INGEST === "1") {
+        emitLog("ingest skipped (HQ_JOB_RUN_NO_INGEST=1)");
+        return;
+    }
+    const identity = resolveBoxIdentity(deps.env, deps);
+    if (!identity) {
+        emitLog("run status ingest skipped — missing Outpost identity");
+        return;
+    }
+    const payload = {
+        userId: identity.userId,
+        jobId,
+        kind: "run",
+        run_at: runAt,
+        event_id: runId,
+        run_id: runId,
+        last_exit: exit,
+        failure_class: failureClass ? failureClass : null,
+        next_actions: actions,
+        ...(identity.outpostId ? { outpostId: identity.outpostId } : {}),
+    };
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 20_000);
+    let status = 0;
+    try {
+        const response = await deps.fetch(`${apiBase(deps.env)}/outpost/internal/jobs-status`, {
+            method: "POST",
+            redirect: "manual",
+            headers: {
+                "content-type": "application/json",
+                "x-outpost-instance-token": identity.instanceToken,
+            },
+            body: compactJson(payload),
+            signal: controller.signal,
+        });
+        status = response.status;
+    }
+    catch {
+        status = 0;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (status >= 200 && status < 300)
+        emitLog(`run status ingested job=${jobId} failure_class=${failureClass || "null"} http=${status}`);
+    else
+        emitLog(`run status ingest failed job=${jobId} http=${status} (logged; not failing run)`);
+    void logFile;
+}
+async function runHelper(binary, args, cwd, env, deps, logPath, timeoutMs) {
+    return await deps.runProcess({ file: binary, args, cwd, env, ...(logPath ? { logPath } : {}), ...(timeoutMs ? { timeoutMs } : {}) });
+}
+async function callNotify(jobId, jobName, outcome, summary, duration, logPath, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps) {
+    if (deps.env.HQ_JOB_RUN_NO_NOTIFY === "1") {
+        emitLog("notify skipped (HQ_JOB_RUN_NO_NOTIFY=1)");
+        return;
+    }
+    try {
+        const info = deps.stat(notifyBin);
+        if (!(info.mode & 0o111)) {
+            try {
+                deps.chmod(notifyBin, info.mode | 0o111);
+            }
+            catch { /* shell ignores chmod failure */ }
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            emitLog(`notify skipped — missing ${notifyBin}`);
+            return;
+        }
+        throw error;
+    }
+    const args = [notifyBin,
+        "--hq-root", hqRoot,
+        "--job-id", jobId,
+        "--job-name", jobName,
+        "--outcome", outcome,
+        "--summary", summary,
+        "--duration", String(duration),
+        "--log-path", logPath,
+        "--failure-class", failureClass,
+        "--next-action", nextAction,
+        "--owner", owner,
+        "--notify", notifyMode,
+    ];
+    const result = await runHelper("bash", args, deps.cwd, { ...deps.env, HQ_ROOT: hqRoot }, deps, logPath);
+    if (result.code !== 0)
+        emitLog(`notify helper exited ${result.code} (ignored)`);
+}
+async function callRemediate(failureClass, jobId, company, hqRoot, remediateBin, logFile, deps) {
+    try {
+        const info = deps.stat(remediateBin);
+        if (!(info.mode & 0o111)) {
+            try {
+                deps.chmod(remediateBin, info.mode | 0o111);
+            }
+            catch { /* shell ignores chmod failure */ }
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return '{"retry_recommended":false,"attempted":false,"notes":"remediate missing"}';
+        throw error;
+    }
+    const args = [remediateBin, "--hq-root", hqRoot, "--failure-class", failureClass, "--job-id", jobId, "--company", company];
+    const result = await runHelper("bash", args, deps.cwd, { ...deps.env, HQ_ROOT: hqRoot, HQ_JOB_REMEDIATE_LOG: logFile }, deps);
+    if (result.stderr.length)
+        deps.appendFile(logFile, result.stderr);
+    const output = result.stdout.toString("utf8").replace(/\n+$/, "");
+    return result.code !== 0 || !output ? '{"retry_recommended":false,"attempted":false,"notes":"remediate failed"}' : output;
+}
+function nextActionForClass(failureClass, runtime) {
+    switch (failureClass) {
+        case "auth": return `re-login on Outpost (device code) for ${runtime || "the runtime CLI"}`;
+        case "secrets": return "share the missing secret to this Outpost (hq secrets share KEY) then re-probe";
+        case "timeout": return "raise timeout_seconds or split the job work";
+        case "infra": return "check Outpost disk/network; job will self-retry once on transient infra";
+        case "agent_error": return "inspect the job log and fix the prompt/skill";
+        default: return "";
+    }
+}
+function classifyFailure(exitCode, logFile, authHint = "", deps) {
+    if (authHint && authHint !== "ok")
+        return "auth";
+    if (exitCode === 124 || exitCode === 137)
+        return "timeout";
+    let text = "";
+    try {
+        const lines = deps.readFile(logFile).toString("utf8").split(/\r?\n/);
+        if (lines[lines.length - 1] === "")
+            lines.pop();
+        text = lines.slice(-80).join("\n");
+    }
+    catch { /* tail ignores a missing log */ }
+    const lower = text.toLowerCase();
+    if (/not logged in|please log in|authentication (failed|required)|unauthorized|401|invalid.*(token|credential)|credentials? (missing|expired|invalid)|device.?code|login required/.test(lower))
+        return "auth";
+    if (/secret.*(not found|missing|denied|not visible|not shared)|hq secrets.*(fail|error|denied)|missing vault|access denied.*secret/.test(lower))
+        return "secrets";
+    if (/(^|[^_])timed out|command timed out|deadline exceeded|killed by timeout|exit[=:][\s]*124\b/.test(lower))
+        return "timeout";
+    if (/connection (refused|reset|timed out)|network is unreachable|temporary failure|econnreset|enotfound|no space left|i\/o error|transport error|dns (fail|error)|http[/ ]*(502|503|504)|statusingesterror|api unreachable/.test(lower))
+        return "infra";
+    return exitCode === 0 ? "" : "agent_error";
+}
+function canonicalPath(candidate) {
+    const absolute = path.resolve(candidate);
+    let cursor = absolute;
+    const suffix = [];
+    while (!fs.existsSync(cursor)) {
+        const parent = path.dirname(cursor);
+        if (parent === cursor)
+            return absolute;
+        suffix.unshift(path.basename(cursor));
+        cursor = parent;
+    }
+    try {
+        return path.join(fs.realpathSync(cursor), ...suffix);
+    }
+    catch {
+        return absolute;
+    }
+}
+function cwdSkip(cwdRel, hqRoot) {
+    if (!cwdRel || cwdRel === "null")
+        return undefined;
+    if (cwdRel.startsWith("/"))
+        return { reason: `cwd absolute not allowed: ${cwdRel} — skip`, action: "fix job cwd to an HQ-root-relative path (no absolute, no '..')" };
+    if (cwdRel.split("/").includes(".."))
+        return { reason: `cwd contains '..': ${cwdRel} — skip`, action: "fix job cwd to an HQ-root-relative path without '..'" };
+    const root = canonicalPath(hqRoot);
+    const runCwd = canonicalPath(path.join(hqRoot, cwdRel));
+    if (runCwd !== root && !runCwd.startsWith(`${root}${path.sep}`))
+        return { reason: `cwd escapes HQ_ROOT: ${cwdRel} → ${runCwd} — skip`, action: "fix job cwd to stay under HQ root" };
+    if (!fs.existsSync(runCwd) || !fs.statSync(runCwd).isDirectory())
+        return { reason: `cwd missing: ${runCwd} — skip`, action: `create missing cwd on Outpost: ${runCwd}` };
+    return undefined;
+}
+function readAuthStatus(runtime, env, home, deps) {
+    if (runtime !== "claude" && runtime !== "codex")
+        return "unknown_runtime";
+    if (env.HQ_JOB_RUN_STUBS !== "1" && !pathExecutable(runtime, env))
+        return "no_cli";
+    if (env.HQ_JOB_RUN_STUBS === "1" && env.HQ_JOB_RUN_STUB_MISSING_CLI === runtime)
+        return "no_cli";
+    const file = runtime === "claude"
+        ? env.HQ_JOB_PROBE_CLAUDE_CRED || path.join(home, ".claude/.credentials.json")
+        : env.HQ_JOB_PROBE_CODEX_AUTH || path.join(home, ".codex/auth.json");
+    try {
+        return deps.stat(file).size > 0 ? "ok" : "missing";
+    }
+    catch {
+        return "missing";
+    }
+}
+function statusText(exit, started, ended, duration, failureClass, retried) {
+    return `exit=${exit}\nstarted_at=${started}\nended_at=${ended}\nduration_seconds=${duration}\nfailure_class=${failureClass}\nretried=${retried}\n`;
+}
+function resolveNumber(value, fallback) {
+    const raw = yqText(value, String(fallback));
+    if (!/^\d+$/.test(raw))
+        return fallback;
+    return Math.max(60, Math.min(14_400, Number(raw)));
+}
+function bashPrintfQuote(value) {
+    const safe = /^[A-Za-z0-9_@%+=:,./-]+$/;
+    if (value.length === 0)
+        return "''";
+    if (safe.test(value))
+        return value;
+    const hasControlCharacter = [...value].some((character) => {
+        const code = character.codePointAt(0);
+        return code < 0x20 || code === 0x7f;
+    });
+    if (hasControlCharacter) {
+        const encoded = [...value].map((character) => {
+            if (character === "\\")
+                return "\\\\";
+            if (character === "'")
+                return "\\'";
+            if (character === "\n")
+                return "\\n";
+            if (character === "\r")
+                return "\\r";
+            if (character === "\t")
+                return "\\t";
+            if (character === "\v")
+                return "\\v";
+            if (character === "\f")
+                return "\\f";
+            const code = character.codePointAt(0);
+            if (code < 0x20 || code === 0x7f)
+                return `\\x${code.toString(16).padStart(2, "0")}`;
+            return character;
+        }).join("");
+        return `$'${encoded}'`;
+    }
+    return [...value].map((character) => safe.test(character) ? character : `\\${character}`).join("");
+}
+async function runRemoteClaude(jobId, runtime, prompt, runCwd, timeoutSeconds, stamp, logDir, logFile, deps) {
+    if (!pathExecutable("tmux", deps.env) && deps.env.HQ_JOB_RUN_STUBS !== "1") {
+        deps.appendFile(logFile, "remote surface requested but tmux missing — falling back to headless\n");
+        return 99;
+    }
+    const session = `hq-job-${jobId}-${stamp}`;
+    const remoteName = `schedule/${jobId}`;
+    const deadline = timeoutSeconds + 30;
+    const exitFile = path.join(logDir, `${stamp}.remote-exit`);
+    const doneFile = path.join(logDir, `${stamp}.remote-done`);
+    try {
+        deps.remove(doneFile);
+    }
+    catch { /* rm -f */ }
+    const remotePrompt = `${prompt}\n\nWhen ALL work above is fully finished (success or failure), create this exact empty file with a shell tool (and do not create it earlier):\n  touch ${bashPrintfQuote(doneFile)}\nThen stop.`;
+    if (deps.env.HQ_JOB_RUN_STUBS === "1") {
+        appendArgvRecord(deps.env.HQ_JOB_RUN_AGENT_ARGV_RECORD, "claude", ["--remote-control", remoteName, "--permission-mode", "bypassPermissions", "--dangerously-skip-permissions", remotePrompt]);
+    }
+    deps.appendFile(logFile, `surface=remote remote_name=${remoteName} tmux_session=${session} done_file=${doneFile}\n`);
+    const remoteArgs = ["--remote-control", remoteName, "--permission-mode", "bypassPermissions", "--dangerously-skip-permissions", remotePrompt];
+    const tmuxCommand = [process.execPath, REMOTE_LAUNCHER, exitFile, ...remoteArgs].map(bashPrintfQuote).join(" ");
+    const tmuxEnv = deps.env.HQ_JOB_RUN_STUBS === "1"
+        ? { ...deps.env, HQ_JOB_RUN_REMOTE_DONE_FILE: doneFile, HQ_JOB_RUN_REMOTE_EXIT_FILE: exitFile }
+        : deps.env;
+    const runTmux = async (args) => await runHelper("tmux", args, deps.cwd, tmuxEnv, deps);
+    await runTmux(["kill-session", "-t", session]);
+    await runTmux(["new-session", "-d", "-s", session, "-x", "120", "-y", "40", "-c", runCwd, tmuxCommand]);
+    let elapsedSeconds = 0;
+    let code = 0;
+    while (elapsedSeconds < deadline) {
+        await deps.sleep(2_000);
+        elapsedSeconds += 2;
+        let pane = (await runTmux(["capture-pane", "-t", session, "-p", "-S", "-120"])).stdout.toString("utf8");
+        if (pane.includes("Yes, I accept")) {
+            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
+            continue;
+        }
+        if (pane.includes("Try the new fullscreen renderer")) {
+            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
+            continue;
+        }
+        if (pane.includes("Do you want to proceed")) {
+            await runTmux(["send-keys", "-t", session, "2", "Enter"]);
+            deps.appendFile(logFile, "auto-accepted tool permission prompt\n");
+            continue;
+        }
+        if (fs.existsSync(doneFile)) {
+            deps.appendFile(logFile, "remote done sentinel present\n");
+            await deps.sleep(2_000);
+            pane = (await runTmux(["capture-pane", "-t", session, "-p", "-S", "-300"])).stdout.toString("utf8");
+            code = 0;
+            break;
+        }
+        if (fs.existsSync(exitFile)) {
+            const raw = deps.readFile(exitFile).toString("utf8").replace(/[^0-9]/g, "").slice(0, 3);
+            code = Number(raw || "0");
+            break;
+        }
+    }
+    if (elapsedSeconds >= deadline) {
+        deps.appendFile(logFile, `remote surface timed out after ${timeoutSeconds}s\n`);
+        code = 124;
+    }
+    const capture = await runTmux(["capture-pane", "-t", session, "-p", "-S", "-300"]);
+    deps.appendFile(logFile, `=== remote pane capture ===\n${capture.stdout.toString("utf8")}`);
+    deps.appendFile(logFile, `tearing down remote session ${remoteName} (review under Desktop Archived)\n`);
+    await runTmux(["kill-session", "-t", session]);
+    return code;
+}
+async function runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps) {
+    if (deps.env.HQ_JOB_RUN_SKIP_EXEC === "1") {
+        deps.appendFile(logFile, "(HQ_JOB_RUN_SKIP_EXEC=1 — not invoking runtime CLI)\n");
+        return 0;
+    }
+    if (runtime === "claude" && surface === "remote") {
+        const remoteCode = await runRemoteClaude(jobId, runtime, prompt, runCwd, timeoutSeconds, stamp, logDir, logFile, deps);
+        if (remoteCode !== 99)
+            return remoteCode;
+    }
+    if (runtime === "codex" && surface === "remote")
+        deps.appendFile(logFile, "surface=remote ignored for codex — using headless\n");
+    let agentArgs;
+    if (runtime === "claude")
+        agentArgs = ["-p", prompt, "--output-format", "text", "--permission-mode", "bypassPermissions"];
+    else if (runtime === "codex")
+        agentArgs = ["exec", "-s", "workspace-write", "--skip-git-repo-check", "-C", runCwd, prompt];
+    else {
+        deps.appendFile(logFile, `unknown runtime: ${runtime}\n`);
+        return 2;
+    }
+    const wrap = deps.env.HQ_JOB_TIMEOUT_BIN
+        || (pathExecutable("timeout", deps.env) ? "timeout" : pathExecutable("gtimeout", deps.env) ? "gtimeout" : "");
+    const timeoutMs = wrap ? timeoutSeconds * 1000 : undefined;
+    let file = runtime;
+    let args = agentArgs;
+    if (secretNames.length > 0 && (deps.env.HQ_JOB_RUN_STUBS === "1" || pathExecutable("hq", deps.env))) {
+        const only = secretNames.join(",");
+        args = ["secrets", ...(company && company !== "null" ? ["--company", company] : ["--personal"]), "exec", "--only", only, "--script", deps.scriptPath, "--", ...(wrap ? [wrap, "--signal=TERM", "--kill-after=15s", `${timeoutSeconds}s`] : []), runtime, ...agentArgs];
+        file = "hq";
+    }
+    else if (secretNames.length > 0) {
+        deps.appendFile(logFile, "warning: requirements.secrets set but hq CLI missing — running without secrets exec\n");
+    }
+    const result = await runHelper(file, args, runCwd, deps.env, deps, logFile, timeoutMs);
+    return result.code;
+}
+async function recordSkip(jobId, jobName, runtime, skipReason, failureClass, action, statusSuffix, notifyOutcome, owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps, authStatus = "") {
+    deps.appendFile(logFile, `skip_reason=${skipReason}\n${authStatus ? `auth_status=${authStatus}\n` : ""}failure_class=${failureClass}\n`);
+    emitLog(skipReason);
+    const endedAt = isoNow(deps);
+    const duration = elapsed(startedEpoch, deps);
+    deps.writeFile(statusFile, `exit=0\nskip_reason=${skipReason}\nfailure_class=${failureClass}\nstarted_at=${startedAt}\nended_at=${endedAt}\n`);
+    appendMeterMarker(jobId, runtime, startedAt, endedAt, 0, duration, skipReason, deps);
+    let nextAction = action;
+    if (failureClass === "auth") {
+        const remediate = await callRemediate("auth", jobId, company, hqRoot, remediateBin, logFile, deps);
+        deps.appendFile(logFile, `remediate=${remediate}\n`);
+        try {
+            nextAction = yqText(JSON.parse(remediate).next_action);
+        }
+        catch {
+            nextAction = "";
+        }
+        if (!nextAction)
+            nextAction = nextActionForClass("auth", runtime);
+    }
+    const actions = nextAction ? [nextAction] : [];
+    const runId = `run-${jobId}-${stamp}-${statusSuffix}`;
+    await ingestRunStatus(jobId, endedAt, runId, 1, failureClass, actions, logFile, deps);
+    await callNotify(jobId, jobName, notifyOutcome, skipReason, duration, logFile, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps);
+    void logDir;
+    return 0;
+}
+export async function runJob(argv, hqRootOverride, injected) {
+    const env = injected?.env ?? process.env;
+    const deps = { ...defaultDependencies(env), ...injected };
+    const args = parseArgs(argv);
+    if (args.help) {
+        emitUsage();
+        return 0;
+    }
+    if (args.error)
+        return emitDie(args.error);
+    const explicitRoot = hqRootOverride || args.hqRoot || env.HQ_ROOT;
+    const hqRoot = resolveLiveRoot({ hqRoot: explicitRoot });
+    let jobFile;
+    try {
+        jobFile = resolveJobPath(args.jobTarget, args.jobId, hqRoot, deps);
+    }
+    catch (error) {
+        return emitDie(error instanceof Error ? error.message : String(error));
+    }
+    if (!fs.existsSync(jobFile))
+        return emitDie(`job file missing: ${jobFile}`);
+    let job;
+    try {
+        job = parseYamlJob(jobFile, deps);
+    }
+    catch (error) {
+        if (error instanceof JobYamlParseFailure) {
+            const diagnostic = malformedYamlDiagnostic(jobFile, error.source, error.parseError)
+                ?? `Error: bad file '${jobFile}': yaml: ${yamlReason(error.parseError)}\n`;
+            process.stderr.write(diagnostic);
+            return 1;
+        }
+        return emitDie(error instanceof Error ? error.message : String(error));
+    }
+    const jobId = yqText(job.id);
+    const runtime = yqText(job.runtime);
+    const jobName = yqText(job.name, jobId) || jobId;
+    const timeoutSeconds = resolveNumber(job.timeout_seconds, 600);
+    const cwdRel = yqText(job.cwd ?? getPath(job, "requirements.cwd"));
+    const company = yqText(getPath(job, "requirements.company"));
+    const owner = yqText(job.owner);
+    const notifyMode = yqText(job.notify, "profile") || "profile";
+    const enabledValue = Object.hasOwn(job, "enabled") ? yqText(job.enabled) : "true";
+    let surface = yqText(getPath(job, "exec.surface"));
+    if (!surface || surface === "null") {
+        const alertsFile = env.HQ_JOB_ALERTS_FILE || path.join(hqRoot, "personal/settings/schedule-alerts.yaml");
+        try {
+            const alerts = load(deps.readFile(alertsFile).toString("utf8"), { schema: JSON_SCHEMA });
+            if (isPlainRecord(alerts))
+                surface = yqText(alerts.execution_surface);
+        }
+        catch { /* Optional alerts file. */ }
+    }
+    surface = surface === "remote" ? "remote" : "headless";
+    if (!jobId || jobId === "null")
+        return emitDie(`job missing id: ${jobFile}`);
+    if (!runtime || runtime === "null")
+        return emitDie(`job missing runtime: ${jobFile}`);
+    if (!jobName) {
+        // yq's `.name // .id // ""` returns the id when name is null or absent.
+    }
+    if (enabledValue === "false" || enabledValue === "False" || enabledValue === "0") {
+        emitLog(`skip job ${jobId} — enabled=false`);
+        return 0;
+    }
+    const logBase = env.HQ_JOB_LOG_DIR || path.join(deps.home, ".hq/jobs/logs");
+    const logDir = path.join(logBase, jobId);
+    deps.mkdir(logDir);
+    const lockPath = env.HQ_JOB_LOCK || path.join(deps.home, ".hq/jobs/run.lock");
+    deps.mkdir(path.dirname(lockPath));
+    const stamp = runStamp(deps);
+    const logFile = path.join(logDir, `${stamp}.log`);
+    const statusFile = path.join(logDir, `${stamp}.status`);
+    let lease;
+    try {
+        lease = await deps.acquireLock(lockPath);
+    }
+    catch (error) {
+        return emitDie(`failed to acquire global run lock: ${lockPath}${error instanceof Error && error.message.includes("flock") ? ` (${error.message})` : ""}`);
+    }
+    try {
+        const startedAt = isoNow(deps);
+        const startedEpoch = deps.epochNow();
+        deps.appendFile(logFile, `=== hq-job-run ${jobId} ===\nstarted_at=${startedAt}\nruntime=${runtime}\ntimeout_seconds=${timeoutSeconds}\nsurface=${surface}\njob_file=${jobFile}\nhq_root=${hqRoot}\n`);
+        const notifyBin = env.HQ_JOB_NOTIFY_BIN || path.join(path.dirname(deps.scriptPath), "hq-job-notify.sh");
+        const remediateBin = env.HQ_JOB_REMEDIATE_BIN || path.join(path.dirname(deps.scriptPath), "hq-job-remediate.sh");
+        const authStatus = readAuthStatus(runtime, env, deps.home, deps);
+        if (authStatus !== "ok") {
+            const reason = authStatus === "no_cli"
+                ? `runtime CLI '${runtime}' not installed on PATH — skip (re-login/install on Outpost)`
+                : authStatus === "missing"
+                    ? `runtime CLI '${runtime}' not authenticated on Outpost (cached credentials missing) — skip`
+                    : `unsupported or unknown runtime '${runtime}' — skip`;
+            return await recordSkip(jobId, jobName, runtime, reason, "auth", "", "authskip", "failed", owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps, authStatus);
+        }
+        const cwdProblem = cwdSkip(cwdRel, hqRoot);
+        if (cwdProblem)
+            return await recordSkip(jobId, jobName, runtime, cwdProblem.reason, "infra", cwdProblem.action, "cwd", "blocked", owner, notifyMode, company, hqRoot, logFile, statusFile, startedAt, startedEpoch, logDir, stamp, notifyBin, remediateBin, deps);
+        const runCwd = cwdRel && cwdRel !== "null" ? canonicalPath(path.join(hqRoot, cwdRel)) : hqRoot;
+        let prompt;
+        try {
+            prompt = buildPrompt(job, jobFile);
+        }
+        catch (error) {
+            return emitDie(error instanceof Error ? error.message : String(error));
+        }
+        const secretNames = jobSecretNames(job);
+        let exitCode = await runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps);
+        let failureClass = "";
+        let nextAction = "";
+        let retried = 0;
+        if (exitCode !== 0) {
+            failureClass = classifyFailure(exitCode, logFile, "", deps);
+            deps.appendFile(logFile, `failure_class=${failureClass}\n`);
+            const remediation = await callRemediate(failureClass, jobId, company, hqRoot, remediateBin, logFile, deps);
+            deps.appendFile(logFile, `remediate=${remediation}\n`);
+            let retryRecommended = false;
+            try {
+                const parsed = JSON.parse(remediation);
+                nextAction = yqText(parsed.next_action);
+                retryRecommended = yqText(parsed.retry_recommended, "false") === "true";
+            }
+            catch { /* Invalid helper output follows the shell's jq path; it cannot recommend retry. */ }
+            if (!nextAction)
+                nextAction = nextActionForClass(failureClass, runtime);
+            if (retryRecommended && retried === 0) {
+                retried = 1;
+                deps.appendFile(logFile, "remediate_retry=1\n");
+                emitLog(`self-remediate recommended retry for ${failureClass} — retrying once`);
+                exitCode = await runAgent(runtime, surface, prompt, runCwd, timeoutSeconds, secretNames, company, logFile, stamp, jobId, logDir, deps);
+                if (exitCode !== 0) {
+                    failureClass = classifyFailure(exitCode, logFile, "", deps);
+                    deps.appendFile(logFile, `failure_class_after_retry=${failureClass}\n`);
+                    nextAction = nextActionForClass(failureClass, runtime);
+                }
+                else {
+                    failureClass = "";
+                    nextAction = "";
+                }
+            }
+        }
+        const endedAt = isoNow(deps);
+        const endedEpoch = deps.epochNow();
+        const duration = Math.max(0, endedEpoch - startedEpoch);
+        deps.appendFile(logFile, `ended_at=${endedAt}\nexit=${exitCode}\nduration_seconds=${duration}\nretried=${retried}\n${failureClass ? `failure_class=${failureClass}\n` : ""}`);
+        deps.writeFile(statusFile, statusText(exitCode, startedAt, endedAt, duration, failureClass, retried));
+        appendMeterMarker(jobId, runtime, startedAt, endedAt, exitCode, duration, "", deps);
+        const runId = `run-${jobId}-${stamp}`;
+        if (exitCode === 0) {
+            await ingestRunStatus(jobId, endedAt, runId, 0, "", [], logFile, deps);
+            const summary = retried === 1 ? "completed ok after self-remediation retry" : "completed ok";
+            await callNotify(jobId, jobName, "ok", summary, duration, logFile, "", "", owner, notifyMode, hqRoot, notifyBin, deps);
+            emitLog(`job ${jobId} completed ok (${duration}s)`);
+            return 0;
+        }
+        await ingestRunStatus(jobId, endedAt, runId, Math.max(0, Math.min(255, exitCode)), failureClass, nextAction ? [nextAction] : [], logFile, deps);
+        const summary = `exit=${exitCode} class=${failureClass}`;
+        await callNotify(jobId, jobName, "failed", summary, duration, logFile, failureClass, nextAction, owner, notifyMode, hqRoot, notifyBin, deps);
+        emitLog(`job ${jobId} failed exit=${exitCode} class=${failureClass} (${duration}s) log=${logFile}`);
+        return exitCode;
+    }
+    finally {
+        await lease.release();
+    }
+}
+export function registerCoreJobRunCommand(job) {
+    const command = job.command("run")
+        .description("Run a scheduled job")
+        .helpOption(false)
+        .allowUnknownOption()
+        .allowExcessArguments(true)
+        .argument("[args...]", "Arguments passed to the scaffold helper")
+        .action(async (args, _options, current) => {
+        const argv = rawArgumentsForCommand(current, args);
+        const root = current.parent?.parent?.opts().hqRoot ?? process.env.HQ_ROOT;
+        if (!await coreNativeJobsEnabled()) {
+            const resolvedRoot = resolveLiveRoot({ hqRoot: root });
+            const result = runBundledScript({ asset: RUN_ASSET, args: argv, cwd: process.cwd(), hqRoot: resolvedRoot });
+            if (result.code !== 0)
+                process.exit(result.code);
+            return;
+        }
+        const result = await runJob(argv, root);
+        if (result !== 0)
+            process.exit(result);
+    });
+    describeCoreCommand(command, { execution: "native", asset: RUN_ASSET, root: "live" });
+}
+function rawArgumentsForCommand(command, fallback, raw = process.argv) {
+    const names = [];
+    for (let current = command; current?.parent; current = current.parent)
+        names.unshift(current.name());
+    let cursor = 0;
+    let start = -1;
+    for (const name of names) {
+        const index = raw.indexOf(name, cursor);
+        if (index < 0)
+            return command.args.length ? command.args : fallback;
+        cursor = index + 1;
+        start = cursor;
+    }
+    return start >= 0 ? raw.slice(start) : command.args.length ? command.args : fallback;
+}
+//# sourceMappingURL=core-job-run-native.js.map