@indigoai-us/hq-cli 5.314.0 → 5.315.0

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -0,0 +1,20 @@
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export declare const REFRESH_VAULT_ACCESS_HELP: string;
+export type HqResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    missing?: boolean;
+};
+export type RefreshVaultAccessDependencies = {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    hqAvailable: boolean;
+    runHq?: (args: string[], cwd: string) => HqResult;
+};
+export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
+export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
+//# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -0,0 +1,229 @@
+/** Native local manifest refresh for core/scripts/refresh-vault-access.sh. */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: \`hq files shared-with-me\` (explicit per-prefix grants)
+#   - role:   \`hq members --company <slug> list\` matched against the caller's
+#             email (from \`hq whoami\`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+`.replace(/^# ?/gm, "");
+function defaultHq(args, cwd, env) {
+    const result = spawnSync("hq", args, { cwd, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    if (result.error)
+        return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
+    return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
+}
+function executableOnPath(name, value) {
+    if (!value)
+        return false;
+    for (const directory of value.split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return true;
+        }
+        catch { /* keep checking the PATH */ }
+    }
+    return false;
+}
+function isHqRoot(root) {
+    const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
+    if (!candidate)
+        return false;
+    try {
+        return fs.statSync(path.join(candidate, "core")).isDirectory() && fs.statSync(path.join(candidate, ".claude")).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function parseOptions(args) {
+    let root = "";
+    const slugs = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (arg === "--root") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--root requires a value" };
+            root = args[i + 1];
+            i += 2;
+        }
+        else if (arg === "--company") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--company requires a value" };
+            slugs.push(args[i + 1]);
+            i += 2;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { root, slugs, help: true };
+        else
+            return { root, slugs, help: false, error: `unknown argument: ${arg}` };
+    }
+    return { root, slugs, help: false };
+}
+function resolveRoot(parsedRoot, deps) {
+    if (parsedRoot)
+        return parsedRoot;
+    if (isHqRoot(deps.env.CLAUDE_PROJECT_DIR ?? ""))
+        return deps.env.CLAUDE_PROJECT_DIR;
+    let current = path.resolve(deps.cwd);
+    while (current !== path.parse(current).root) {
+        if (isHqRoot(current))
+            return current;
+        current = path.dirname(current);
+    }
+    return "";
+}
+// eslint-disable-next-line no-control-regex -- strip ANSI SGR sequences printed by hq.
+function cleanAnsi(value) { return value.replace(/\u001b\[[0-9;]*m/g, ""); }
+function log(message) { return `refresh-vault-access: ${message}\n`; }
+function getEmail(output) {
+    const matches = cleanAnsi(output).match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g) ?? [];
+    return matches.find((email) => !email.includes("@outposts.")) ?? "";
+}
+function parseGrantTable(output) {
+    const grants = new Map();
+    for (let line of cleanAnsi(output).split(/\r?\n/)) {
+        line = line.replace(" (private folder)", "");
+        if (/^COMPANY\s/.test(line) || /^─/.test(line) || /^\s*$/.test(line) || /^Nothing is explicitly shared/.test(line))
+            continue;
+        const fields = line.trim().split(/\s+/);
+        if (fields.length < 3)
+            continue;
+        const permission = ["read", "write", "admin"].includes(fields[2]) ? fields[2]
+            : fields.length >= 4 && ["read", "write", "admin"].includes(fields[3]) ? fields[3] : "";
+        if (!permission)
+            continue;
+        const rows = grants.get(fields[0]) ?? [];
+        rows.push({ path: fields[1], permission });
+        grants.set(fields[0], rows);
+    }
+    return grants;
+}
+function roleFromTable(output, email) {
+    if (!email)
+        return "unknown";
+    for (const line of cleanAnsi(output).split(/\r?\n/)) {
+        const [candidate, role] = line.trim().split(/\s+/);
+        if (candidate === email && ["owner", "admin", "member", "guest"].includes(role ?? ""))
+            return role;
+        if (candidate === email)
+            return "unknown";
+    }
+    return "unknown";
+}
+function resolveEmail(deps, runHq) {
+    const override = deps.env.HQ_VAULT_ACCESS_EMAIL ?? "";
+    if (override)
+        return { email: override, stderr: "" };
+    const result = runHq(["whoami"], deps.cwd);
+    const email = getEmail(result.stdout);
+    return { email, stderr: email ? "" : log("could not determine caller email — roles will be 'unknown' (hook will not enforce)") };
+}
+export function runRefreshVaultAccess(args, deps) {
+    const parsed = parseOptions(args);
+    if (parsed.help)
+        return { code: 0, stdout: REFRESH_VAULT_ACCESS_HELP, stderr: "" };
+    if (parsed.error)
+        return { code: 1, stdout: "", stderr: log(parsed.error) };
+    const root = resolveRoot(parsed.root, deps);
+    if (!isHqRoot(root))
+        return { code: 1, stdout: "", stderr: log("could not resolve the HQ root (pass --root <hqRoot>)") };
+    if (!deps.hqAvailable)
+        return { code: 0, stdout: "", stderr: log("hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)") };
+    const runHq = deps.runHq ?? ((hqArgs, cwd) => defaultHq(hqArgs, cwd, deps.env));
+    const identity = resolveEmail(deps, runHq);
+    let stderr = identity.stderr;
+    const explicit = parsed.slugs;
+    const allGrants = new Map();
+    if (explicit.length > 0) {
+        for (const slug of explicit) {
+            const result = runHq(["files", "shared-with-me", "--company", slug], deps.cwd);
+            if (result.code !== 0) {
+                stderr += log(`skipping ${slug} — shared-with-me query failed`);
+                continue;
+            }
+            const rows = parseGrantTable(result.stdout);
+            for (const [company, grants] of rows)
+                allGrants.set(company, [...(allGrants.get(company) ?? []), ...grants]);
+        }
+    }
+    else {
+        const result = runHq(["files", "shared-with-me"], deps.cwd);
+        if (result.code !== 0)
+            return { code: 0, stdout: "", stderr: `${stderr}${log("shared-with-me roll-up failed — nothing refreshed")}` };
+        for (const [company, grants] of parseGrantTable(result.stdout))
+            allGrants.set(company, grants);
+    }
+    const companies = new Set(allGrants.keys());
+    for (const slug of explicit)
+        companies.add(slug);
+    const sortedSlugs = [...companies].sort();
+    if (sortedSlugs.length === 0)
+        stderr += log("no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)");
+    const companyData = {};
+    for (const slug of sortedSlugs) {
+        let role = "unknown";
+        if (identity.email) {
+            const result = runHq(["members", "--company", slug, "list"], deps.cwd);
+            role = result.code === 0 ? roleFromTable(result.stdout, identity.email) : "unknown";
+        }
+        const grants = (allGrants.get(slug) ?? []).map((grant) => ({ path: grant.path, permission: grant.permission }));
+        companyData[slug] = { role, grants };
+    }
+    const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: companyData };
+    const directory = path.join(root, ".hq");
+    fs.mkdirSync(directory, { recursive: true });
+    const target = path.join(directory, "vault-access.json");
+    const temp = `${target}.${process.pid}.${Math.random().toString(16).slice(2)}`;
+    fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    fs.chmodSync(temp, 0o600);
+    fs.renameSync(temp, target);
+    stderr += log(`wrote .hq/vault-access.json (${sortedSlugs.length} companies, identity: ${identity.email || "unknown"})`);
+    return { code: 0, stdout: "", stderr };
+}
+export function registerCoreRefreshVaultAccessNative(core) {
+    registerNativeUtility(core, {
+        name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
+        resolveRoot: (cwd) => cwd,
+        run: (args, context) => runRefreshVaultAccess(args, {
+            cwd: context.cwd, env: context.env, now: context.now,
+            hqAvailable: executableOnPath("hq", context.env.PATH),
+            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
+        }),
+    });
+}
+//# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core-register-project-native.d.ts

@@ -0,0 +1,30 @@
+/** Native implementation of core/scripts/register-project.sh. */
+import * as fs from "node:fs";
+import { spawnSync } from "node:child_process";
+export declare const REGISTER_PROJECT_ASSET = "core/scripts/register-project.sh";
+export type RegisterProjectDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    fs: typeof fs;
+    now: () => Date;
+    runHq: (args: string[], options: {
+        cwd: string;
+        env: NodeJS.ProcessEnv;
+        capture: boolean;
+    }) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+};
+export declare function createRegisterProjectHqRunner(spawn?: typeof spawnSync): RegisterProjectDeps["runHq"];
+type NativeResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export declare function runRegisterProject(args: readonly string[], deps: RegisterProjectDeps): NativeResult;
+export declare function runRegisterProjectFast(args: readonly string[], _stdin: string, cwd: string, root?: string): Promise<number>;
+export {};
+//# sourceMappingURL=core-register-project-native.d.ts.map

package/dist/commands/core-register-project-native.js

@@ -0,0 +1,347 @@
+/** Native implementation of core/scripts/register-project.sh. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { resolveBundledAsset } from "../utils/hq-roots.js";
+export const REGISTER_PROJECT_ASSET = "core/scripts/register-project.sh";
+const USAGE = "usage: register-project.sh <company> <project> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>";
+const MIN_HQ_CLI = "5.139.0";
+export function createRegisterProjectHqRunner(spawn = spawnSync) {
+    return (args, options) => {
+        const result = spawn("hq", args, {
+            cwd: options.cwd,
+            env: options.env,
+            encoding: "utf8",
+            // Shell hq children inherit fd 0 even when their output is captured or discarded.
+            stdio: options.capture ? ["inherit", "pipe", "pipe"] : ["inherit", "ignore", "ignore"],
+        });
+        return {
+            code: result.status ?? 127,
+            stdout: options.capture ? String(result.stdout ?? "") : "",
+            stderr: options.capture ? String(result.stderr ?? "") : "",
+        };
+    };
+}
+const defaultRunHq = createRegisterProjectHqRunner();
+function errorResult(message, code = 1) { return { code, stdout: "", stderr: `${message}\n` }; }
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function jqOr(value, fallback) { return value === null || value === undefined || value === false ? fallback : value; }
+function jqString(value) {
+    if (typeof value === "string")
+        return value;
+    if (value === null || value === undefined || value === false)
+        return "";
+    return typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function readJson(fileSystem, file) {
+    return JSON.parse(fileSystem.readFileSync(file, "utf8"));
+}
+function timestamp(deps) { return deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"); }
+function companyUid(company, deps) {
+    const direct = deps.env.HQ_COMPANY_UID ?? "";
+    if (direct)
+        return direct;
+    const file = path.join(deps.root, "companies", company, ".company-uid");
+    try {
+        return deps.fs.readFileSync(file, "utf8").replace(/[\s\u0085\u00a0]+/g, "");
+    }
+    catch {
+        return null;
+    }
+}
+function boardPath(company, deps) { return path.join(deps.root, "companies", company, "board.json"); }
+function runHelpProbe(deps) {
+    return deps.runHq(["mesh", "project", "ensure", "--help"], { cwd: deps.cwd, env: deps.env, capture: false }).code === 0;
+}
+function prdName(prd, deps) {
+    const value = readJson(deps.fs, prd);
+    return jqString(jqOr(asRecord(value)?.name, ""));
+}
+function boardData(company, board, deps) {
+    if (!deps.fs.existsSync(board))
+        return { company, projects: [] };
+    const value = asRecord(readJson(deps.fs, board));
+    if (!value)
+        throw new Error("board.json must contain an object");
+    return value;
+}
+function projectRows(board) {
+    const projects = jqOr(board.projects, []);
+    if (!Array.isArray(projects))
+        throw new Error("board.json projects must be an array");
+    return projects.map((item) => {
+        const record = asRecord(item);
+        if (!record)
+            throw new Error("board.json project must be an object");
+        return record;
+    });
+}
+function matchesProject(row, id, rel) {
+    return row.id === id || row.prd_path === rel || row.mesh_project_id === id;
+}
+function atomicJqWrite(target, value, deps, initialize = false) {
+    deps.fs.mkdirSync(path.dirname(target), { recursive: true });
+    if (initialize && !deps.fs.existsSync(target))
+        deps.fs.writeFileSync(target, serializeJqJson(value, "pretty"), { encoding: "utf8", mode: 0o666 });
+    const temporary = path.join(path.dirname(target), `.register-project.${process.pid}.${Math.random().toString(16).slice(2)}`);
+    deps.fs.writeFileSync(temporary, serializeJqJson(value, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    deps.fs.chmodSync(temporary, 0o600);
+    deps.fs.renameSync(temporary, target);
+}
+function markPending(company, project, deps) {
+    const board = boardPath(company, deps);
+    const prd = path.join(deps.root, "companies", company, "projects", project, "prd.json");
+    const rel = `companies/${company}/projects/${project}/prd.json`;
+    const now = timestamp(deps);
+    let title = "";
+    try {
+        title = prdName(prd, deps);
+    }
+    catch { /* shell suppresses title jq errors */ }
+    if (!title)
+        title = project;
+    const document = boardData(company, board, deps);
+    const rows = projectRows(document);
+    if (rows.some((row) => matchesProject(row, project, rel))) {
+        document.projects = rows.map((row) => matchesProject(row, project, rel)
+            ? { ...row, pending_registration: true, updated_at: now, prd_path: jqOr(row.prd_path, rel) }
+            : row);
+    }
+    else {
+        document.projects = [...rows, {
+                id: project, title, status: "prd_created", scope: "company", prd_path: rel,
+                pending_registration: true, created_at: now, updated_at: now,
+            }];
+    }
+    atomicJqWrite(board, document, deps, true);
+}
+function ensureOne(company, project, deps) {
+    const prd = path.join(deps.root, "companies", company, "projects", project, "prd.json");
+    if (!deps.fs.existsSync(prd))
+        return errorResult(`registration incomplete: missing ${prd}`);
+    if (!runHelpProbe(deps)) {
+        try {
+            markPending(company, project, deps);
+        }
+        catch { /* legacy jq/write errors remain a failed registration */ }
+        return errorResult(`hq-cli ${MIN_HQ_CLI} or newer is required; ${company}/${project} stays local until then`);
+    }
+    const ensure = deps.runHq(["mesh", "project", "ensure", project, "--company", company, "--stories-file", prd, "--json"], {
+        cwd: deps.cwd, env: deps.env, capture: true,
+    });
+    if (ensure.code !== 0)
+        return errorResult(`registration incomplete: hq mesh project ensure failed for ${company}/${project}`);
+    let result;
+    try {
+        result = asRecord(JSON.parse(ensure.stdout));
+    }
+    catch {
+        return errorResult("registration incomplete: ensure output missing threadId");
+    }
+    if (result?.threadId === null || result?.threadId === undefined || result?.threadId === false)
+        return errorResult("registration incomplete: ensure output missing threadId");
+    if (result?.channelId === null || result?.channelId === undefined || result?.channelId === false)
+        return errorResult("registration incomplete: ensure output missing channelId");
+    const thread = jqString(result.threadId);
+    const channel = jqString(result.channelId);
+    if (!thread)
+        return errorResult("registration incomplete: empty threadId");
+    if (!channel)
+        return errorResult("registration incomplete: empty channelId");
+    const board = boardPath(company, deps);
+    const rel = `companies/${company}/projects/${project}/prd.json`;
+    const now = timestamp(deps);
+    let title = prdName(prd, deps);
+    if (!title)
+        title = project;
+    const document = boardData(company, board, deps);
+    const rows = projectRows(document);
+    if (rows.some((row) => matchesProject(row, project, rel))) {
+        document.projects = rows.map((row) => {
+            if (!matchesProject(row, project, rel))
+                return row;
+            const updated = { ...row, threadId: thread, channelId: channel, updated_at: now, prd_path: jqOr(row.prd_path, rel), mesh_project_id: project };
+            delete updated.pending_registration;
+            return updated;
+        });
+    }
+    else {
+        document.projects = [...rows, {
+                id: project, title, status: "prd_created", scope: "company", prd_path: rel,
+                threadId: thread, channelId: channel, mesh_project_id: project, created_at: now, updated_at: now,
+            }];
+    }
+    try {
+        atomicJqWrite(board, document, deps, true);
+    }
+    catch {
+        return errorResult("registration incomplete: board.json write failed");
+    }
+    const written = boardData(company, board, deps);
+    const verified = projectRows(written).some((row) => matchesProject(row, project, rel) && row.threadId === thread && row.channelId === channel);
+    if (!verified)
+        return errorResult(`registration incomplete: board.json entry for ${project} did not verify`);
+    return { code: 0, stdout: `registered ${company}/${project} thread=${thread} channel=${channel}\n`, stderr: "" };
+}
+function audit(company, deps) {
+    if (!company)
+        return errorResult("usage: register-project.sh --audit <company>");
+    const directory = path.join(deps.root, "companies", company, "projects");
+    let projects;
+    try {
+        projects = deps.fs.readdirSync(directory).sort();
+    }
+    catch {
+        return { code: 0, stdout: "", stderr: "" };
+    }
+    let stderr = "";
+    const unregistered = projects.filter((project) => {
+        if (project.startsWith("."))
+            return false;
+        const prd = path.join(directory, project, "prd.json");
+        try {
+            if (!deps.fs.statSync(prd).isFile())
+                return false;
+            const uid = companyUid(company, deps);
+            if (uid === null) {
+                stderr += `no company uid for ${company} (set HQ_COMPANY_UID or companies/${company}/.company-uid)\n`;
+                return true;
+            }
+            return !deps.fs.existsSync(path.join(deps.env.HOME || os.homedir(), ".hq/work-mesh/cache/projects", uid, `${project}.json`));
+        }
+        catch {
+            return false;
+        }
+    });
+    return { code: 0, stdout: unregistered.length ? `${unregistered.join("\n")}\n` : "", stderr };
+}
+function storyNotDone(prd, deps, diagnostics) {
+    try {
+        const stories = asRecord(readJson(deps.fs, prd))?.userStories;
+        if (!Array.isArray(stories))
+            return false;
+        return stories.some((story) => jqOr(asRecord(story)?.status, "") !== "done");
+    }
+    catch {
+        const jq = spawnSync("jq", ["-e", '[.userStories[]? | select((.status // "") != "done")] | length > 0', prd], {
+            cwd: deps.cwd, env: deps.env, encoding: "utf8",
+        });
+        if (jq.stderr)
+            diagnostics.push(jq.stderr);
+        else if (jq.error?.code === "ENOENT") {
+            const script = resolveBundledAsset(REGISTER_PROJECT_ASSET);
+            diagnostics.push(`${script}: line 34: jq: command not found\n`);
+        }
+        return false;
+    }
+}
+function backfill(args, deps) {
+    let company = "", only = false, yes = false;
+    for (const arg of args) {
+        if (arg === "--only-active")
+            only = true;
+        else if (arg === "--yes")
+            yes = true;
+        else if (arg.startsWith("--"))
+            return errorResult(`unknown flag ${arg}`);
+        else
+            company = arg;
+    }
+    if (!company)
+        return errorResult("usage: register-project.sh --backfill <company> --only-active [--yes]");
+    if (!only)
+        return errorResult("--backfill requires --only-active");
+    const directory = path.join(deps.root, "companies", company, "projects");
+    let projects;
+    try {
+        projects = deps.fs.readdirSync(directory).sort();
+    }
+    catch {
+        return { code: 0, stdout: "", stderr: "" };
+    }
+    projects = projects.filter((project) => !project.startsWith("."));
+    const diagnostics = [];
+    const targets = projects.filter((project) => {
+        const pdir = path.join(directory, project);
+        const prd = path.join(pdir, "prd.json");
+        try {
+            if (!deps.fs.statSync(prd).isFile() || !storyNotDone(prd, deps, diagnostics))
+                return false;
+            return Math.floor(deps.now().getTime() / 1000) - Math.floor(deps.fs.statSync(pdir).mtimeMs / 1000) < 30 * 86400;
+        }
+        catch {
+            return false;
+        }
+    });
+    let stderr = diagnostics.join("");
+    if (!yes)
+        return { code: 0, stdout: targets.map((project) => `would register ${company}/${project}\n`).join(""), stderr };
+    let stdout = "";
+    for (const project of targets) {
+        const output = ensureOne(company, project, deps);
+        stdout += output.stdout;
+        stderr += output.stderr;
+        if (output.code !== 0)
+            return { ...output, stdout, stderr };
+    }
+    return { code: 0, stdout, stderr };
+}
+function retryPending(company, deps) {
+    if (!company)
+        return errorResult("usage: register-project.sh --retry-pending <company>");
+    if (!runHelpProbe(deps))
+        return { code: 0, stdout: "", stderr: "" };
+    const board = boardPath(company, deps);
+    if (!deps.fs.existsSync(board))
+        return { code: 0, stdout: "", stderr: "" };
+    let rows;
+    try {
+        rows = projectRows(boardData(company, board, deps));
+    }
+    catch {
+        return { code: 0, stdout: "", stderr: "" };
+    }
+    let stdout = "", stderr = "";
+    const ids = rows.filter((item) => item.pending_registration === true)
+        .map((row) => jqString(jqOr(row.id, ""))).filter(Boolean).slice(0, 3);
+    for (const id of ids) {
+        const result = ensureOne(company, id, deps);
+        stdout += result.stdout;
+        stderr += result.stderr;
+    }
+    return { code: 0, stdout, stderr };
+}
+export function runRegisterProject(args, deps) {
+    try {
+        const [mode, arg1, ...rest] = args;
+        if (mode === "--audit")
+            return audit(arg1 ?? "", deps);
+        if (mode === "--backfill")
+            return backfill([arg1 ?? "", ...rest].filter((value, index) => index > 0 || value !== ""), deps);
+        if (mode === "--retry-pending")
+            return retryPending(arg1 ?? "", deps);
+        if (args.length === 2)
+            return ensureOne(args[0], args[1], deps);
+        return errorResult(USAGE);
+    }
+    catch (err) {
+        return errorResult(err instanceof Error ? err.message : String(err));
+    }
+}
+export async function runRegisterProjectFast(args, _stdin, cwd, root) {
+    const chosenRoot = root || process.env.HQ_ROOT || cwd;
+    const result = runRegisterProject(args, {
+        root: chosenRoot, cwd, env: process.env, fs, now: () => new Date(),
+        runHq: (argv, opts) => defaultRunHq(argv, opts),
+    });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-register-project-native.js.map

package/dist/commands/core-resolve-company-command.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+/** Commander registration stays in the full graph; the native resolver is fast-path safe. */
+export declare function registerCoreResolveCompanyNativeCommand(core: Command): void;
+//# sourceMappingURL=core-resolve-company-command.d.ts.map

package/dist/commands/core-resolve-company-command.js

@@ -0,0 +1,42 @@
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { runBundledScript } from "../utils/run-bundled-script.js";
+import { describeCoreCommand } from "./core-command-catalog.js";
+import { coreNativeUtilitiesEnabled } from "./core-native-utilities-flag.js";
+import { RESOLVE_COMPANY_ASSET, resolveCompany } from "./core-resolve-company-native.js";
+/** Commander registration stays in the full graph; the native resolver is fast-path safe. */
+export function registerCoreResolveCompanyNativeCommand(core) {
+    const command = core.command("resolve-company")
+        .description("Resolve the active company for skills and routing")
+        .allowUnknownOption()
+        .allowExcessArguments()
+        .helpOption(false)
+        .argument("[args...]")
+        .action(async (args = [], _options, cmd) => {
+        const operands = cmd.args.length > 0 ? cmd.args : args;
+        if (!await coreNativeUtilitiesEnabled()) {
+            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
+            const { code } = runBundledScript({
+                asset: RESOLVE_COMPANY_ASSET,
+                args: operands,
+                cwd: root,
+                hqRoot: root,
+            });
+            if (code !== 0)
+                process.exit(code);
+            return;
+        }
+        const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
+        const result = await resolveCompany(operands, {
+            cwd: process.cwd(),
+            hqRoot: root,
+            stdinIsTty: process.stdin.isTTY === true,
+        });
+        process.stdout.write(result.stdout);
+        if (result.stderr.length)
+            process.stderr.write(result.stderr);
+        if (result.code !== 0)
+            process.exit(result.code);
+    });
+    describeCoreCommand(command, { execution: "native", asset: RESOLVE_COMPANY_ASSET, root: "live" });
+}
+//# sourceMappingURL=core-resolve-company-command.js.map