@indigoai-us/hq-cli 5.314.0 → 5.316.0

package/dist/commands/core-share-suggestion-state-native.js

@@ -0,0 +1,445 @@
+/** Native port of share-suggestion-state.sh; kept dependency-light for hooks. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export const SHARE_SUGGESTION_STATE_ASSET = "core/scripts/share-suggestion-state.sh";
+const isObj = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+const sortKeys = (value) => Array.isArray(value) ? value.map(sortKeys)
+    : (value && typeof value === "object")
+        ? Object.keys(value).sort().reduce((out, key) => { out[key] = sortKeys(value[key]); return out; }, {})
+        : value;
+const sanitizeValue = (value) => typeof value === "string" ? value.trim() : value;
+function stripComments(line) {
+    let single = false, double = false;
+    const chars = [];
+    for (const char of line) {
+        if (char === "'" && !double)
+            single = !single;
+        else if (char === '"' && !single)
+            double = !double;
+        else if (char === "#" && !single && !double)
+            break;
+        chars.push(char);
+    }
+    return chars.join("").replace(/\s+$/, "");
+}
+function parseScalar(raw) {
+    const value = raw.trim();
+    if (!value)
+        return "";
+    const lower = value.toLowerCase();
+    if (lower === "true")
+        return true;
+    if (lower === "false")
+        return false;
+    if (lower === "null" || lower === "~")
+        return null;
+    if (value === "{}")
+        return {};
+    if (value === "[]")
+        return [];
+    if (value.startsWith("[") && value.endsWith("]")) {
+        const inner = value.slice(1, -1).trim();
+        return inner ? inner.split(",").map((part) => parseScalar(part.trim())) : [];
+    }
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))
+        return value.slice(1, -1);
+    if (/^-?\d+$/.test(value))
+        return Number.parseInt(value, 10);
+    return value;
+}
+function parseYamlTokens(tokens, index = 0, indent = null) {
+    if (index >= tokens.length)
+        return [{}, index];
+    indent ??= tokens[index][0];
+    if (tokens[index][1].startsWith("- ")) {
+        const items = [];
+        while (index < tokens.length) {
+            const [current, content] = tokens[index];
+            if (current !== indent || !content.startsWith("- "))
+                break;
+            const value = content.slice(2).trim();
+            if (!value) {
+                const [child, next] = parseYamlTokens(tokens, index + 1);
+                items.push(child);
+                index = next;
+            }
+            else {
+                items.push(parseScalar(value));
+                index += 1;
+            }
+        }
+        return [items, index];
+    }
+    const result = {};
+    while (index < tokens.length) {
+        const [current, content] = tokens[index];
+        if (current !== indent || content.startsWith("- "))
+            break;
+        const sep = content.indexOf(":");
+        const key = (sep < 0 ? content : content.slice(0, sep)).trim();
+        const remainder = (sep < 0 ? "" : content.slice(sep + 1)).trim();
+        if (!remainder) {
+            if (index + 1 < tokens.length && tokens[index + 1][0] > current) {
+                const [child, next] = parseYamlTokens(tokens, index + 1, tokens[index + 1][0]);
+                result[key] = child;
+                index = next;
+            }
+            else {
+                result[key] = {};
+                index += 1;
+            }
+        }
+        else {
+            result[key] = parseScalar(remainder);
+            index += 1;
+        }
+    }
+    return [result, index];
+}
+function loadYaml(file, fileSystem) {
+    if (!file || !fileSystem.existsSync(file))
+        return {};
+    try {
+        const tokens = [];
+        for (const raw of fileSystem.readFileSync(file, "utf8").split(/\r?\n/)) {
+            const line = stripComments(raw);
+            if (!line.trim())
+                continue;
+            const content = line.replace(/^ +/, "");
+            tokens.push([line.length - content.length, content]);
+        }
+        if (!tokens.length)
+            return {};
+        const [value] = parseYamlTokens(tokens);
+        return isObj(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+function lookupNested(data, dotted) {
+    let current = data;
+    for (const part of dotted.split(".")) {
+        if (!isObj(current) || !(part in current))
+            return null;
+        current = current[part];
+    }
+    return current;
+}
+function makeContext(deps) {
+    const fileSystem = deps.fs ?? fs;
+    const env = deps.env ?? process.env;
+    const now = deps.now ?? (() => new Date());
+    const isoNow = () => {
+        const d = now();
+        const pad = (n) => String(n).padStart(2, "0");
+        return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())}T${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}Z`;
+    };
+    return { fileSystem, env, isoNow };
+}
+export function runShareSuggestionState(args, stdin, deps) {
+    const cmd = args[0] ?? "";
+    const rawSession = args[1] ?? "";
+    const argDecision = args[2] ?? "";
+    const failFromShellMain = (message) => ({ code: 0, stdout: "", stderr: `${message}share-suggestion-state: internal error\n` });
+    if (!cmd)
+        return failFromShellMain("share-suggestion-state: missing subcommand\n");
+    const root = deps.root;
+    if (!root)
+        return failFromShellMain("share-suggestion-state: unable to resolve HQ root\n");
+    const { fileSystem: f, env, isoNow } = makeContext(deps);
+    const stateHome = path.join(root, "workspace/orchestrator/share-suggestions");
+    const historyPath = path.join(stateHome, "history.jsonl");
+    const suppressionsPath = path.join(stateHome, "suppressions.jsonl");
+    try {
+        f.mkdirSync(stateHome, { recursive: true });
+    }
+    catch (error) {
+        const code = error.code;
+        let blockedPath = stateHome;
+        let current = root;
+        for (const piece of path.relative(root, stateHome).split(path.sep)) {
+            current = path.join(current, piece);
+            try {
+                if (!f.statSync(current).isDirectory()) {
+                    blockedPath = current;
+                    break;
+                }
+            }
+            catch { /* locate the first existing non-directory parent when present */ }
+        }
+        const reason = code === "ENOTDIR" ? "Not a directory" : code === "EACCES" || code === "EPERM" ? "Permission denied" : code === "EEXIST" ? "File exists" : (error instanceof Error ? error.message : String(error));
+        return failFromShellMain(`mkdir: cannot create directory ‘${blockedPath}’: ${reason}\nshare-suggestion-state: unable to create state directory\n`);
+    }
+    const sessionBytes = Buffer.from(rawSession, "utf8");
+    const sessionId = Array.from(sessionBytes, (byte) => byte === 45 || byte === 95 || (byte >= 48 && byte <= 57) || (byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) ? String.fromCharCode(byte) : "_").join("") || "unknown";
+    const pendingPath = path.join(stateHome, `${sessionId}.json`);
+    // Bash command substitution removes every trailing LF before exporting the payload.
+    const payloadRaw = deps.stdinIsTty ? "" : stdin.replace(/\n+$/, "");
+    let payload = {};
+    if (payloadRaw) {
+        try {
+            const parsed = JSON.parse(payloadRaw);
+            if (isObj(parsed))
+                payload = parsed;
+        }
+        catch {
+            payload = {};
+        }
+    }
+    const readJson = (file, fallback) => {
+        if (!f.existsSync(file))
+            return fallback;
+        try {
+            return JSON.parse(f.readFileSync(file, "utf8"));
+        }
+        catch {
+            return fallback;
+        }
+    };
+    const writeJson = (file, value) => {
+        f.writeFileSync(`${file}.tmp`, `${JSON.stringify(sortKeys(value), null, 2)}\n`);
+        f.renameSync(`${file}.tmp`, file);
+    };
+    const appendJsonl = (file, value) => f.appendFileSync(file, `${JSON.stringify(sortKeys(value))}\n`);
+    const uniquePeople = (items) => {
+        const seen = new Set(), result = [];
+        for (const item of items || []) {
+            if (!isObj(item))
+                continue;
+            const personId = sanitizeValue(item.id || item.slug || ""), name = sanitizeValue(item.name || ""), role = sanitizeValue(item.role || "");
+            const cleaned = {};
+            if (personId)
+                cleaned.id = personId;
+            if (name)
+                cleaned.name = name;
+            if (role)
+                cleaned.role = role;
+            if (!Object.keys(cleaned).length)
+                continue;
+            const key = `${cleaned.id || ""}|${cleaned.name || ""}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                result.push(cleaned);
+            }
+        }
+        return result;
+    };
+    const sanitizeSources = (items) => {
+        const seen = new Set(), result = [];
+        for (const item of items || []) {
+            if (typeof item !== "string")
+                continue;
+            const value = item.trim();
+            if (value && !seen.has(value)) {
+                seen.add(value);
+                result.push(value);
+            }
+        }
+        return result;
+    };
+    const sanitizeArtifact = (body) => {
+        if (!isObj(body))
+            body = {};
+        let artifact = body.artifact;
+        if (!isObj(artifact))
+            artifact = body;
+        const cleaned = {};
+        for (const key of ["path", "fingerprint", "class", "surface", "permission", "app_id", "label"]) {
+            const value = sanitizeValue(artifact[key]);
+            if (typeof value === "string" && value)
+                cleaned[key] = value;
+        }
+        if (!("permission" in cleaned))
+            cleaned.permission = "read";
+        return cleaned;
+    };
+    const sanitizeCandidateHints = (body) => {
+        let hints = body.candidate_hints;
+        if (!isObj(hints))
+            hints = {};
+        const cleaned = {
+            sources: sanitizeSources(hints.sources || body.candidate_sources || []),
+            local_people: uniquePeople(hints.local_people || body.local_people || []),
+            needs_assistant_resolution: Boolean("needs_assistant_resolution" in hints ? hints.needs_assistant_resolution : body.needs_assistant_resolution),
+        };
+        const projects = sanitizeSources(hints.project_recipient_hints || body.project_recipient_hints || []);
+        if (projects.length)
+            cleaned.project_recipient_hints = projects;
+        return cleaned;
+    };
+    const sanitizeSuggestion = (body) => {
+        const artifact = sanitizeArtifact(body), fingerprint = artifact.fingerprint || "";
+        const company = sanitizeValue(body.company || ""), project = sanitizeValue(body.project || "");
+        const suggestion = {
+            session_id: sessionId, company, project, artifact,
+            trigger: sanitizeValue(body.trigger || ""), action_kind: sanitizeValue(body.action_kind || "share-suggestion"),
+            suggested_permission: sanitizeValue(body.suggested_permission || artifact.permission || "read"),
+            recommended_surface: sanitizeValue(body.recommended_surface || artifact.surface || ""),
+            recipients: uniquePeople(body.recipients || []), candidate_hints: sanitizeCandidateHints(body),
+            created_at: body.created_at || isoNow(), updated_at: isoNow(), shown_at: body.shown_at === undefined ? null : body.shown_at,
+        };
+        return !company || !fingerprint ? null : suggestion;
+    };
+    const sanitizeHistory = (body) => {
+        const artifact = sanitizeArtifact(body);
+        const entry = {
+            session_id: sessionId, company: sanitizeValue(body.company || ""), project: sanitizeValue(body.project || ""),
+            trigger: sanitizeValue(body.trigger || ""), action_kind: sanitizeValue(body.action_kind || "share-suggestion"),
+            decision: sanitizeValue(body.decision || ""), event: sanitizeValue(body.event || ""), artifact,
+            recipients: uniquePeople(body.recipients || []), recorded_at: isoNow(),
+        };
+        return artifact.fingerprint ? entry : null;
+    };
+    const sanitizeSuppression = (body) => {
+        const artifact = sanitizeArtifact(body), scope = sanitizeValue(body.scope || "");
+        const record = {
+            kind: scope ? "scope" : "artifact", scope,
+            company: sanitizeValue(body.company || ""), project: sanitizeValue(body.project || ""),
+            artifact_class: sanitizeValue(body.artifact_class || artifact.class || ""), artifact: {},
+            reason: sanitizeValue(body.reason || "suppressed"), created_at: isoNow(),
+        };
+        if (artifact.fingerprint)
+            record.artifact.fingerprint = artifact.fingerprint;
+        if (artifact.path)
+            record.artifact.path = artifact.path;
+        if (scope) {
+            if (!["global", "company", "project"].includes(scope))
+                return null;
+            return record;
+        }
+        return record.artifact.fingerprint ? record : null;
+    };
+    const configPaths = (company, project) => ({
+        global: path.join(root, "personal/settings/auto-share-preferences.yaml"),
+        company: company ? path.join(root, "companies", company, "settings/auto-share.yaml") : null,
+        project: company && project ? path.join(root, "companies", company, "projects", project, "share-policy.yaml") : null,
+    });
+    const isSuppressedByConfig = (company, project, artifactClass) => {
+        const paths = configPaths(company, project), projectCfg = loadYaml(paths.project, f), companyCfg = loadYaml(paths.company, f), globalCfg = loadYaml(paths.global, f);
+        const has = (v) => Object.keys(v).length > 0;
+        let enabled = has(projectCfg) ? (typeof lookupNested(projectCfg, "enabled") === "boolean" ? lookupNested(projectCfg, "enabled") : null) : null;
+        if (enabled === null)
+            enabled = has(companyCfg) && typeof lookupNested(companyCfg, "defaults.enabled") === "boolean" ? lookupNested(companyCfg, "defaults.enabled") : null;
+        if (enabled === null)
+            enabled = typeof lookupNested(globalCfg, "defaults.enabled") === "boolean" ? lookupNested(globalCfg, "defaults.enabled") : null;
+        if (enabled === false)
+            return true;
+        const key = `artifact_classes.${artifactClass}`;
+        let cls = has(projectCfg) && typeof lookupNested(projectCfg, key) === "boolean" ? lookupNested(projectCfg, key) : null;
+        if (cls === null)
+            cls = has(companyCfg) && typeof lookupNested(companyCfg, key) === "boolean" ? lookupNested(companyCfg, key) : null;
+        if (cls === null)
+            cls = typeof lookupNested(globalCfg, key) === "boolean" ? lookupNested(globalCfg, key) : null;
+        return cls === false;
+    };
+    const suppressionMatch = (record, company, project, cls, fingerprint) => {
+        if (!isObj(record))
+            return false;
+        const artifact = isObj(record.artifact) ? record.artifact : {};
+        if (fingerprint && artifact.fingerprint === fingerprint)
+            return true;
+        if (record.kind !== "scope")
+            return false;
+        if (record.artifact_class && cls && record.artifact_class !== cls)
+            return false;
+        if (record.scope === "global")
+            return true;
+        if (record.scope === "company")
+            return Boolean(company) && record.company === company;
+        if (record.scope === "project")
+            return Boolean(company && project) && record.company === company && record.project === project;
+        return false;
+    };
+    try {
+        if (cmd === "enqueue") {
+            const suggestion = sanitizeSuggestion(payload);
+            if (!suggestion)
+                return { code: 0, stdout: "", stderr: "" };
+            const existing = readJson(pendingPath, {});
+            if (isObj(existing) && Object.keys(existing).length && !existing.resolved_at)
+                return { code: 0, stdout: "", stderr: "" };
+            writeJson(pendingPath, suggestion);
+            const entry = sanitizeHistory(Object.assign({}, suggestion, { event: "enqueued" }));
+            if (entry)
+                appendJsonl(historyPath, entry);
+        }
+        else if (cmd === "peek") {
+            const pending = readJson(pendingPath, {});
+            if (isObj(pending) && Object.keys(pending).length && !pending.resolved_at)
+                return { code: 0, stdout: JSON.stringify(sortKeys(pending)), stderr: "" };
+        }
+        else if (cmd === "mark-shown") {
+            const pending = readJson(pendingPath, {});
+            if (isObj(pending) && Object.keys(pending).length && !pending.resolved_at && !pending.shown_at) {
+                pending.shown_at = isoNow();
+                pending.updated_at = isoNow();
+                writeJson(pendingPath, pending);
+                const entry = sanitizeHistory(Object.assign({}, pending, { event: "shown" }));
+                if (entry)
+                    appendJsonl(historyPath, entry);
+            }
+        }
+        else if (cmd === "record-decision") {
+            const pending = readJson(pendingPath, {}), decision = argDecision || env.SHARE_SUGGESTION_DECISION || sanitizeValue(payload.decision || "");
+            if (!isObj(pending) || !Object.keys(pending).length || pending.resolved_at || !decision)
+                return { code: 0, stdout: "", stderr: "" };
+            pending.decision = decision;
+            pending.decision_at = isoNow();
+            pending.resolved_at = isoNow();
+            pending.updated_at = isoNow();
+            if (payload.recipients)
+                pending.recipients = uniquePeople(payload.recipients);
+            const entry = sanitizeHistory(Object.assign({}, pending, { event: "decision", decision }));
+            if (entry)
+                appendJsonl(historyPath, entry);
+            if (["never", "never-again", "never_again"].includes(decision)) {
+                const suppression = sanitizeSuppression({ company: pending.company, project: pending.project, artifact_class: (pending.artifact || {}).class, artifact: pending.artifact, reason: "never-again" });
+                if (suppression)
+                    appendJsonl(suppressionsPath, suppression);
+            }
+            try {
+                f.unlinkSync(pendingPath);
+            }
+            catch { /* shell ignores a missing pending file */ }
+        }
+        else if (cmd === "append-history") {
+            const entry = sanitizeHistory(payload);
+            if (entry)
+                appendJsonl(historyPath, entry);
+        }
+        else if (cmd === "suppress") {
+            const record = sanitizeSuppression(payload);
+            if (record)
+                appendJsonl(suppressionsPath, record);
+        }
+        else if (cmd === "is-suppressed") {
+            const artifact = sanitizeArtifact(payload), company = sanitizeValue(payload.company || ""), project = sanitizeValue(payload.project || "");
+            const cls = sanitizeValue(payload.artifact_class || artifact.class || ""), fingerprint = sanitizeValue(artifact.fingerprint || "");
+            if (isSuppressedByConfig(company, project, cls))
+                return { code: 0, stdout: "true", stderr: "" };
+            if (f.existsSync(suppressionsPath)) {
+                for (let raw of f.readFileSync(suppressionsPath, "utf8").split(/\r?\n/)) {
+                    raw = raw.trim();
+                    if (!raw)
+                        continue;
+                    let record;
+                    try {
+                        record = JSON.parse(raw);
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (suppressionMatch(record, company, project, cls, fingerprint))
+                        return { code: 0, stdout: "true", stderr: "" };
+                }
+            }
+        }
+        return { code: 0, stdout: "", stderr: "" };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+        return { code: 0, stdout: "", stderr: `share-suggestion-state: internal error\n${detail}\n` };
+    }
+}
+//# sourceMappingURL=core-share-suggestion-state-native.js.map

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -0,0 +1,32 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export declare const WORK_MESH_BIND_TRUSTED_HELP = "hq-core: public\nUS-011 \u2014 write session meta + reconcile with observation.trustedContext.\nNo --trusted CLI flag in hq-cli; trusted bind is the observation field.\nset -euo pipefail\n\nROOT=\"${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}\"\nif [ -z \"$ROOT\" ]; then\n";
+export type WorkMeshBindDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    fs: typeof fs;
+    runHq: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    spawnHq: (args: string[], env: NodeJS.ProcessEnv) => void;
+    pid: number;
+    tmpDir: string;
+    ulid: (now: Date) => string;
+};
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
+export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
+export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -0,0 +1,190 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { generateUlid } from "../lib/mesh/live/ulid.js";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
+US-011 — write session meta + reconcile with observation.trustedContext.
+No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+`;
+export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+    root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    runHq: (args, childEnv) => {
+        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    runHqSession: (scriptRoot, args, childEnv) => {
+        const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    spawnHq: (args, childEnv) => {
+        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
+        child.unref();
+    },
+});
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
+        const value = (env[key] ?? "").replace(/\s/g, "");
+        if (value)
+            return value;
+    }
+    try {
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+        return value;
+    }
+    catch {
+        return "";
+    }
+}
+function hasExecutable(deps, command) {
+    for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        try {
+            const stat = deps.fs.statSync(path.join(directory, command));
+            if (stat.isFile() && (stat.mode & 0o111) !== 0)
+                return true;
+        }
+        catch { /* PATH entry is absent */ }
+    }
+    return false;
+}
+function workMeshJsonQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
+}
+function workMeshObservationJson(observation) {
+    const identity = observation.identity;
+    const trusted = observation.trustedContext;
+    let json = `{"contractVersion":1,"clientOperationId":${workMeshJsonQuote(String(observation.clientOperationId))},"identity":{"sessionId":${workMeshJsonQuote(identity.sessionId)},"harness":${workMeshJsonQuote(identity.harness)},"adapterVersion":${workMeshJsonQuote(identity.adapterVersion)}},"cwd":${workMeshJsonQuote(String(observation.cwd))},"hqRoot":${workMeshJsonQuote(String(observation.hqRoot))}`;
+    if (trusted) {
+        json += ',"trustedContext":{';
+        let first = true;
+        for (const [key, value] of Object.entries(trusted)) {
+            if (!first)
+                json += ",";
+            first = false;
+            json += `${workMeshJsonQuote(key)}:${workMeshJsonQuote(value)}`;
+        }
+        json += "}";
+    }
+    return `${json}}`;
+}
+export function runWorkMeshBindTrusted(args, deps) {
+    let root = deps.env.HQ_ROOT || deps.env.CLAUDE_PROJECT_DIR || deps.root;
+    let company = "", project = "", task = "", sid = "", noReconcile = false;
+    const output = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (["--company", "--company-slug", "--project", "--task", "--session", "--session-id", "--root"].includes(arg)) {
+            const value = args[i + 1] ?? "";
+            if (arg === "--company" || arg === "--company-slug")
+                company = value;
+            else if (arg === "--project")
+                project = value;
+            else if (arg === "--task")
+                task = value;
+            else if (arg === "--session" || arg === "--session-id")
+                sid = value;
+            else
+                root = value;
+            i += 2;
+        }
+        else if (arg === "--no-reconcile") {
+            noReconcile = true;
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { code: 0, stdout: WORK_MESH_BIND_TRUSTED_HELP.replace(/^# ?/gm, ""), stderr: "" };
+        else
+            i += 1;
+    }
+    if (!sid) {
+        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
+        if (!sid) {
+            try {
+                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+            }
+            catch {
+                sid = "";
+            }
+        }
+    }
+    const childEnv = { ...deps.env, HQ_ROOT: root };
+    const pin = sid ? ["--session-id", sid] : [];
+    let stderr = "";
+    for (const [key, value] of [["company_slug", company], ["project", project], ["task", task]]) {
+        if (!value)
+            continue;
+        const result = deps.runHqSession(root, [...pin, "set", key, value], deps.env);
+        output.push(result.stdout);
+        stderr += result.stderr;
+        if (result.code !== 0)
+            return { code: result.code, stdout: output.join(""), stderr };
+    }
+    if (noReconcile || !sid)
+        return { code: 0, stdout: output.join(""), stderr };
+    let harness = deps.env.HQ_HARNESS || deps.env.HQ_WORK_MESH_HARNESS || "claude-code";
+    if (["claude", "Claude", "ClaudeCode"].includes(harness))
+        harness = "claude-code";
+    else if (harness === "Codex")
+        harness = "codex";
+    else if (harness === "Grok")
+        harness = "grok";
+    const adapter = deps.env.HQ_ADAPTER_CONTRACT_VERSION || "1.0.0";
+    const clientOperationId = deps.ulid(deps.now());
+    const observation = {
+        contractVersion: 1,
+        clientOperationId,
+        identity: { sessionId: sid, harness, adapterVersion: adapter },
+        cwd: deps.env.PWD ?? "",
+        hqRoot: root,
+    };
+    if (company || project || task) {
+        const trusted = {};
+        if (company)
+            trusted.companySlug = company;
+        if (project)
+            trusted.project = project;
+        if (task)
+            trusted.task = task;
+        observation.trustedContext = trusted;
+    }
+    const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");
+    try {
+        deps.fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        deps.fs.chmodSync(directory, 0o700);
+    }
+    catch { /* legacy mkdir/chmod are best effort */ }
+    const observationFile = path.join(directory, `${sid}.bind.${deps.pid}.json`);
+    try {
+        deps.fs.writeFileSync(observationFile, `${workMeshObservationJson(observation)}\n`);
+    }
+    catch { /* legacy printf redirection failure is non-fatal */ }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_LOG) {
+        try {
+            deps.fs.appendFileSync(deps.env.HQ_WORK_MESH_RECONCILE_LOG, `reconcile-trusted ${observationFile}\n`);
+        }
+        catch { /* legacy log write is best effort */ }
+    }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
+        return { code: 0, stdout: output.join(""), stderr };
+    if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
+        deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
+    }
+    return { code: 0, stdout: output.join(""), stderr };
+}
+export function registerCoreWorkMeshBindTrustedNative(core) {
+    registerNativeUtility(core, {
+        name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+    });
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map