@indigoai-us/hq-cli 5.323.0 → 5.325.0

package/dist/lib/install/claude-targets.d.ts

@@ -0,0 +1,47 @@
+/** Events master-hook.sh is registered for at user scope. */
+export declare const GLOBAL_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+/** Name of the HQ MCP server entry in ~/.claude.json. */
+export declare const HQ_MCP_SERVER_NAME = "hq";
+/** `_hqPack` provenance stamped on the HQ MCP server entry. */
+export declare const HQ_ANYWHERE_PACK = "hq-anywhere";
+/** PATH for the stdio MCP subprocess (policy hq-mcp-absolute-paths). */
+export declare const MCP_SUBPROCESS_PATH = "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin";
+/** Prefix for skill symlinks under ~/.claude/skills. */
+export declare const SKILL_LINK_PREFIX = "hq-";
+export declare const CLAUDE_MD_BEGIN = "<!-- hq-anywhere:begin (managed by `hq install --global`; remove with `hq uninstall --global`) -->";
+export declare const CLAUDE_MD_END = "<!-- hq-anywhere:end -->";
+export interface ClaudeTargets {
+    hqPointer: string;
+    claudeMd: string;
+    skillsDir: string;
+    settingsJson: string;
+    claudeJson: string;
+    stateFile: string;
+    hqConfigFile: string;
+}
+export declare function claudeTargets(home: string): ClaudeTargets;
+export declare function masterHookPath(hqRoot: string): string;
+export declare function charterPath(hqRoot: string): string;
+export declare function hqSkillsSource(hqRoot: string): string;
+/** The exact hook command registered for one event (absolute path, quoted). */
+export declare function hookCommand(hqRoot: string, event: string): string;
+export declare function claudeMdBlock(hqRoot: string): string;
+/** Append the block (replacing any prior HQ block). `null` input = file absent. */
+export declare function addClaudeMdBlock(current: string | null, hqRoot: string): string;
+/** Strip the HQ block, plus the separator `addClaudeMdBlock` put before it. */
+export declare function removeClaudeMdBlock(current: string): string;
+export declare function hasClaudeMdBlock(current: string | null): boolean;
+type Doc = Record<string, unknown>;
+/** Add one master-hook group per event; idempotent. Foreign hooks are untouched. */
+export declare function addHqHooks(doc: Doc, hqRoot: string): Doc;
+/** Remove only HQ master-hook entries; drop containers this left empty. */
+export declare function removeHqHooks(doc: Doc, hqRoot: string): Doc;
+export declare function hasAllHqHooks(doc: Doc, hqRoot: string): boolean;
+/**
+ * Minimal line diff (LCS) with -/+ prefixes. Only changed lines and `context`
+ * unchanged lines around them are shown, so a dry run never echoes a whole
+ * config file (which may hold unrelated tokens). Returns '(no changes)' when equal.
+ */
+export declare function lineDiff(before: string, after: string, context?: number): string;
+export {};
+//# sourceMappingURL=claude-targets.d.ts.map

package/dist/lib/install/claude-targets.js

@@ -0,0 +1,203 @@
+/**
+ * Claude Code user-scope targets for `hq install --global --runtime claude`
+ * (hq-anywhere-runtime US-005). Paths and PURE transforms only; the command in
+ * src/commands/install-global.ts does the IO through the mcp-registration
+ * safe-write substrate.
+ */
+import * as path from 'path';
+/** Events master-hook.sh is registered for at user scope. */
+export const GLOBAL_HOOK_EVENTS = [
+    'SessionStart',
+    'UserPromptSubmit',
+    'PreToolUse',
+    'PostToolUse',
+    'Stop',
+];
+/** Name of the HQ MCP server entry in ~/.claude.json. */
+export const HQ_MCP_SERVER_NAME = 'hq';
+/** `_hqPack` provenance stamped on the HQ MCP server entry. */
+export const HQ_ANYWHERE_PACK = 'hq-anywhere';
+/** PATH for the stdio MCP subprocess (policy hq-mcp-absolute-paths). */
+export const MCP_SUBPROCESS_PATH = '/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin';
+/** Prefix for skill symlinks under ~/.claude/skills. */
+export const SKILL_LINK_PREFIX = 'hq-';
+export const CLAUDE_MD_BEGIN = '<!-- hq-anywhere:begin (managed by `hq install --global`; remove with `hq uninstall --global`) -->';
+export const CLAUDE_MD_END = '<!-- hq-anywhere:end -->';
+export function claudeTargets(home) {
+    return {
+        hqPointer: path.join(home, '.hq', 'root'),
+        claudeMd: path.join(home, '.claude', 'CLAUDE.md'),
+        skillsDir: path.join(home, '.claude', 'skills'),
+        settingsJson: path.join(home, '.claude', 'settings.json'),
+        claudeJson: path.join(home, '.claude.json'),
+        stateFile: path.join(home, '.hq', 'anywhere', 'claude-install.json'),
+        hqConfigFile: path.join(home, '.hq', 'config.json'),
+    };
+}
+export function masterHookPath(hqRoot) {
+    return path.join(hqRoot, '.claude', 'hooks', 'master-hook.sh');
+}
+export function charterPath(hqRoot) {
+    return path.join(hqRoot, '.claude', 'CLAUDE.md');
+}
+export function hqSkillsSource(hqRoot) {
+    return path.join(hqRoot, '.claude', 'skills');
+}
+/** The exact hook command registered for one event (absolute path, quoted). */
+export function hookCommand(hqRoot, event) {
+    return `bash ${JSON.stringify(masterHookPath(hqRoot))} ${event}`;
+}
+// ---------------------------------------------------------------------------
+// CLAUDE.md block.
+// ---------------------------------------------------------------------------
+export function claudeMdBlock(hqRoot) {
+    return `${CLAUDE_MD_BEGIN}\n@${charterPath(hqRoot)}\n${CLAUDE_MD_END}\n`;
+}
+/** Append the block (replacing any prior HQ block). `null` input = file absent. */
+export function addClaudeMdBlock(current, hqRoot) {
+    const base = current === null ? '' : removeClaudeMdBlock(current);
+    const block = claudeMdBlock(hqRoot);
+    if (base === '')
+        return block;
+    return base.endsWith('\n') ? `${base}\n${block}` : `${base}\n\n${block}`;
+}
+/** Strip the HQ block, plus the separator `addClaudeMdBlock` put before it. */
+export function removeClaudeMdBlock(current) {
+    const begin = current.indexOf(CLAUDE_MD_BEGIN);
+    if (begin === -1)
+        return current;
+    const endIdx = current.indexOf(CLAUDE_MD_END, begin);
+    if (endIdx === -1)
+        return current;
+    let end = endIdx + CLAUDE_MD_END.length;
+    if (current[end] === '\n')
+        end += 1;
+    let start = begin;
+    // Undo the blank-line separator. (Exact bytes are restored by the caller from
+    // install state when the file is otherwise unchanged.)
+    if (start >= 2 && current.slice(start - 2, start) === '\n\n')
+        start -= 1;
+    return current.slice(0, start) + current.slice(end);
+}
+export function hasClaudeMdBlock(current) {
+    return current !== null && current.includes(CLAUDE_MD_BEGIN) && current.includes(CLAUDE_MD_END);
+}
+function isHqHookEntry(entry, hqRoot) {
+    if (!entry || typeof entry !== 'object')
+        return false;
+    const cmd = entry.command;
+    return typeof cmd === 'string' && cmd.includes(JSON.stringify(masterHookPath(hqRoot)));
+}
+/** Add one master-hook group per event; idempotent. Foreign hooks are untouched. */
+export function addHqHooks(doc, hqRoot) {
+    const hooks = { ...(doc.hooks ?? {}) };
+    let changed = false;
+    for (const event of GLOBAL_HOOK_EVENTS) {
+        const groups = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+        const present = groups.some((g) => Array.isArray(g?.hooks) && g.hooks.some((h) => isHqHookEntry(h, hqRoot)));
+        if (present)
+            continue;
+        groups.push({ hooks: [{ type: 'command', command: hookCommand(hqRoot, event), timeout: 300 }] });
+        hooks[event] = groups;
+        changed = true;
+    }
+    return changed ? { ...doc, hooks } : doc;
+}
+/** Remove only HQ master-hook entries; drop containers this left empty. */
+export function removeHqHooks(doc, hqRoot) {
+    if (!doc.hooks || typeof doc.hooks !== 'object' || Array.isArray(doc.hooks))
+        return doc;
+    const hooks = { ...doc.hooks };
+    let changed = false;
+    for (const [event, value] of Object.entries(hooks)) {
+        if (!Array.isArray(value))
+            continue;
+        const groups = [];
+        for (const g of value) {
+            if (!g || !Array.isArray(g.hooks)) {
+                groups.push(g);
+                continue;
+            }
+            const kept = g.hooks.filter((h) => !isHqHookEntry(h, hqRoot));
+            if (kept.length === g.hooks.length)
+                groups.push(g);
+            else {
+                changed = true;
+                if (kept.length > 0)
+                    groups.push({ ...g, hooks: kept });
+            }
+        }
+        if (groups.length === 0)
+            delete hooks[event];
+        else
+            hooks[event] = groups;
+    }
+    if (!changed)
+        return doc;
+    const next = { ...doc };
+    if (Object.keys(hooks).length === 0)
+        delete next.hooks;
+    else
+        next.hooks = hooks;
+    return next;
+}
+export function hasAllHqHooks(doc, hqRoot) {
+    return addHqHooks(doc, hqRoot) === doc;
+}
+// ---------------------------------------------------------------------------
+// Dry-run diff.
+// ---------------------------------------------------------------------------
+/**
+ * Minimal line diff (LCS) with -/+ prefixes. Only changed lines and `context`
+ * unchanged lines around them are shown, so a dry run never echoes a whole
+ * config file (which may hold unrelated tokens). Returns '(no changes)' when equal.
+ */
+export function lineDiff(before, after, context = 2) {
+    const a = before === '' ? [] : before.replace(/\n$/, '').split('\n');
+    const b = after === '' ? [] : after.replace(/\n$/, '').split('\n');
+    const n = a.length;
+    const m = b.length;
+    const lcs = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+        }
+    }
+    const ops = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (a[i] === b[j]) {
+            ops.push({ tag: ' ', line: a[i] });
+            i++;
+            j++;
+        }
+        else if (lcs[i + 1][j] >= lcs[i][j + 1])
+            ops.push({ tag: '-', line: a[i++] });
+        else
+            ops.push({ tag: '+', line: b[j++] });
+    }
+    while (i < n)
+        ops.push({ tag: '-', line: a[i++] });
+    while (j < m)
+        ops.push({ tag: '+', line: b[j++] });
+    const changed = ops.map((o, k) => (o.tag !== ' ' ? k : -1)).filter((k) => k >= 0);
+    if (changed.length === 0)
+        return '(no changes)';
+    const keep = new Set();
+    for (const k of changed)
+        for (let d = -context; d <= context; d++)
+            keep.add(k + d);
+    const out = [];
+    let last = -1;
+    ops.forEach((o, k) => {
+        if (!keep.has(k))
+            return;
+        if (last !== -1 && k !== last + 1)
+            out.push('  ...');
+        out.push(`${o.tag === ' ' ? ' ' : o.tag} ${o.line}`);
+        last = k;
+    });
+    return out.join('\n');
+}
+//# sourceMappingURL=claude-targets.js.map

package/dist/lib/install/codex-targets.d.ts

@@ -0,0 +1,57 @@
+/** Events the Codex hook adapter is registered for at user scope. */
+export declare const CODEX_HOOK_EVENTS: readonly ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop"];
+export declare const AGENTS_MD_BEGIN = "<!-- hq-anywhere:begin (managed by `hq install --global --runtime codex`; remove with `hq uninstall --global --runtime codex`) -->";
+export declare const AGENTS_MD_END = "<!-- hq-anywhere:end -->";
+/** Name of the legacy ad-hoc skills mirror (~/.codex/skills/hq). */
+export declare const LEGACY_SKILLS_NAME = "hq";
+/** A directory carrying this file is HQ-owned and may be replaced. */
+export declare const HQ_OWNED_MARKER = ".hq-anywhere-managed";
+/** Where an HQ-owned legacy directory is moved so uninstall can put it back. */
+export declare const LEGACY_BACKUP_NAME = ".hq-legacy-skills-backup";
+export interface CodexTargets {
+    codexHome: string;
+    agentsMd: string;
+    skillsDir: string;
+    hooksJson: string;
+    configToml: string;
+    stateFile: string;
+}
+export declare function codexTargets(home: string): CodexTargets;
+export declare function codexAdapterPath(hqRoot: string): string;
+/** HQ's Codex charter: AGENTS.md at the HQ root, else the Claude charter. */
+export declare function codexCharterSource(hqRoot: string): string;
+/**
+ * Hook command for every event. The adapter reads the event from
+ * `hook_event_name` and falls back to its own $PWD when Codex sends no `cwd`.
+ */
+export declare function codexHookCommand(hqRoot: string): string;
+export declare function agentsMdBlock(charter: string): string;
+/** Append the block (replacing any prior HQ block). `null` input = file absent. */
+export declare function addAgentsMdBlock(current: string | null, charter: string): string;
+/** Strip the HQ block, plus the separator `addAgentsMdBlock` put before it. */
+export declare function removeAgentsMdBlock(current: string): string;
+type Doc = Record<string, unknown>;
+/** Add one adapter group per event; idempotent. Foreign hooks are untouched. */
+export declare function addCodexHooks(doc: Doc, hqRoot: string): Doc;
+/** Remove only HQ adapter entries; drop containers this left empty. */
+export declare function removeCodexHooks(doc: Doc, hqRoot: string): Doc;
+export declare function hasAllCodexHooks(doc: Doc, hqRoot: string): boolean;
+export type LegacySkillsMirror = {
+    kind: 'absent';
+}
+/** HQ-owned symlink: its target resolves inside the HQ checkout. */
+ | {
+    kind: 'hq-symlink';
+    target: string;
+}
+/** HQ-owned directory: carries {@link HQ_OWNED_MARKER}. */
+ | {
+    kind: 'hq-dir';
+}
+/** Anything else. Left in place with a warning. */
+ | {
+    kind: 'foreign';
+};
+export declare function classifyLegacySkills(skillsDir: string, hqRoot: string): LegacySkillsMirror;
+export {};
+//# sourceMappingURL=codex-targets.d.ts.map

package/dist/lib/install/codex-targets.js

@@ -0,0 +1,187 @@
+/**
+ * Codex user-scope targets for `hq install --global --runtime codex`
+ * (hq-anywhere-runtime US-006). Paths and PURE transforms only; the command in
+ * src/commands/install-global.ts does the IO through the mcp-registration
+ * safe-write substrate.
+ *
+ * Codex has no @import, so the HQ charter is inlined into ~/.codex/AGENTS.md
+ * between markers. Hooks go to ~/.codex/hooks.json (same group shape as Claude's
+ * settings.json) and call the existing hq-core adapter by absolute path; this
+ * module never writes a second adapter.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** Events the Codex hook adapter is registered for at user scope. */
+export const CODEX_HOOK_EVENTS = [
+    'SessionStart',
+    'UserPromptSubmit',
+    'PreToolUse',
+    'PostToolUse',
+    'Stop',
+];
+export const AGENTS_MD_BEGIN = '<!-- hq-anywhere:begin (managed by `hq install --global --runtime codex`; remove with `hq uninstall --global --runtime codex`) -->';
+export const AGENTS_MD_END = '<!-- hq-anywhere:end -->';
+/** Name of the legacy ad-hoc skills mirror (~/.codex/skills/hq). */
+export const LEGACY_SKILLS_NAME = 'hq';
+/** A directory carrying this file is HQ-owned and may be replaced. */
+export const HQ_OWNED_MARKER = '.hq-anywhere-managed';
+/** Where an HQ-owned legacy directory is moved so uninstall can put it back. */
+export const LEGACY_BACKUP_NAME = '.hq-legacy-skills-backup';
+export function codexTargets(home) {
+    const codexHome = path.join(home, '.codex');
+    return {
+        codexHome,
+        agentsMd: path.join(codexHome, 'AGENTS.md'),
+        skillsDir: path.join(codexHome, 'skills'),
+        hooksJson: path.join(codexHome, 'hooks.json'),
+        configToml: path.join(codexHome, 'config.toml'),
+        stateFile: path.join(home, '.hq', 'anywhere', 'codex-install.json'),
+    };
+}
+export function codexAdapterPath(hqRoot) {
+    return path.join(hqRoot, '.codex', 'hooks', 'hq-codex-hook-adapter.sh');
+}
+/** HQ's Codex charter: AGENTS.md at the HQ root, else the Claude charter. */
+export function codexCharterSource(hqRoot) {
+    const agents = path.join(hqRoot, 'AGENTS.md');
+    return fs.existsSync(agents) ? agents : path.join(hqRoot, '.claude', 'CLAUDE.md');
+}
+/**
+ * Hook command for every event. The adapter reads the event from
+ * `hook_event_name` and falls back to its own $PWD when Codex sends no `cwd`.
+ */
+export function codexHookCommand(hqRoot) {
+    return `/bin/bash ${JSON.stringify(codexAdapterPath(hqRoot))}`;
+}
+// ---------------------------------------------------------------------------
+// AGENTS.md block.
+// ---------------------------------------------------------------------------
+export function agentsMdBlock(charter) {
+    const body = charter.endsWith('\n') ? charter : `${charter}\n`;
+    return `${AGENTS_MD_BEGIN}\n${body}${AGENTS_MD_END}\n`;
+}
+/** Append the block (replacing any prior HQ block). `null` input = file absent. */
+export function addAgentsMdBlock(current, charter) {
+    const base = current === null ? '' : removeAgentsMdBlock(current);
+    const block = agentsMdBlock(charter);
+    if (base === '')
+        return block;
+    return base.endsWith('\n') ? `${base}\n${block}` : `${base}\n\n${block}`;
+}
+/** Strip the HQ block, plus the separator `addAgentsMdBlock` put before it. */
+export function removeAgentsMdBlock(current) {
+    const begin = current.indexOf(AGENTS_MD_BEGIN);
+    if (begin === -1)
+        return current;
+    const endIdx = current.indexOf(AGENTS_MD_END, begin);
+    if (endIdx === -1)
+        return current;
+    let end = endIdx + AGENTS_MD_END.length;
+    if (current[end] === '\n')
+        end += 1;
+    let start = begin;
+    if (start >= 2 && current.slice(start - 2, start) === '\n\n')
+        start -= 1;
+    return current.slice(0, start) + current.slice(end);
+}
+function isAdapterEntry(entry, hqRoot) {
+    if (!entry || typeof entry !== 'object')
+        return false;
+    const cmd = entry.command;
+    return typeof cmd === 'string' && cmd.includes(JSON.stringify(codexAdapterPath(hqRoot)));
+}
+/** Add one adapter group per event; idempotent. Foreign hooks are untouched. */
+export function addCodexHooks(doc, hqRoot) {
+    const hooks = { ...(doc.hooks ?? {}) };
+    let changed = false;
+    for (const event of CODEX_HOOK_EVENTS) {
+        const groups = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+        const present = groups.some((g) => Array.isArray(g?.hooks) && g.hooks.some((h) => isAdapterEntry(h, hqRoot)));
+        if (present)
+            continue;
+        groups.push({ hooks: [{ type: 'command', command: codexHookCommand(hqRoot), timeout: 300 }] });
+        hooks[event] = groups;
+        changed = true;
+    }
+    return changed ? { ...doc, hooks } : doc;
+}
+/** Remove only HQ adapter entries; drop containers this left empty. */
+export function removeCodexHooks(doc, hqRoot) {
+    if (!doc.hooks || typeof doc.hooks !== 'object' || Array.isArray(doc.hooks))
+        return doc;
+    const hooks = { ...doc.hooks };
+    let changed = false;
+    for (const [event, value] of Object.entries(hooks)) {
+        if (!Array.isArray(value))
+            continue;
+        const groups = [];
+        for (const g of value) {
+            if (!g || !Array.isArray(g.hooks)) {
+                groups.push(g);
+                continue;
+            }
+            const kept = g.hooks.filter((h) => !isAdapterEntry(h, hqRoot));
+            if (kept.length === g.hooks.length)
+                groups.push(g);
+            else {
+                changed = true;
+                if (kept.length > 0)
+                    groups.push({ ...g, hooks: kept });
+            }
+        }
+        if (groups.length === 0)
+            delete hooks[event];
+        else
+            hooks[event] = groups;
+    }
+    if (!changed)
+        return doc;
+    const next = { ...doc };
+    if (Object.keys(hooks).length === 0)
+        delete next.hooks;
+    else
+        next.hooks = hooks;
+    return next;
+}
+export function hasAllCodexHooks(doc, hqRoot) {
+    return addCodexHooks(doc, hqRoot) === doc;
+}
+function within(child, parent) {
+    const rel = path.relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+export function classifyLegacySkills(skillsDir, hqRoot) {
+    const p = path.join(skillsDir, LEGACY_SKILLS_NAME);
+    let st;
+    try {
+        st = fs.lstatSync(p);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return { kind: 'absent' };
+        throw e;
+    }
+    if (st.isSymbolicLink()) {
+        const target = fs.readlinkSync(p);
+        const resolved = path.resolve(skillsDir, target);
+        let real = resolved;
+        try {
+            real = fs.realpathSync(resolved);
+        }
+        catch {
+            // Dangling link: judge by the literal target.
+        }
+        let root = hqRoot;
+        try {
+            root = fs.realpathSync(hqRoot);
+        }
+        catch {
+            // HQ root checked by the caller; keep the literal path.
+        }
+        return within(resolved, hqRoot) || within(real, root) ? { kind: 'hq-symlink', target } : { kind: 'foreign' };
+    }
+    if (st.isDirectory() && fs.existsSync(path.join(p, HQ_OWNED_MARKER)))
+        return { kind: 'hq-dir' };
+    return { kind: 'foreign' };
+}
+//# sourceMappingURL=codex-targets.js.map

package/dist/lib/mesh/live/session-seq.js

@@ -7,6 +7,9 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 10_000;
+const LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(4));
 export function sessionSeqDir(env = process.env) {
     return env.WORK_MESH_SEQ_DIR?.trim() || path.join(os.homedir(), ".hq", "work-mesh", "seq");
 }
@@ -17,17 +20,67 @@ export function reserveSessionSeq(sessionId, count, env = process.env) {
     const dir = sessionSeqDir(env);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const file = path.join(dir, sessionId);
-    let current = 0;
+    const lockFile = `${file}.lock`;
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let lockFd;
+    while (lockFd === undefined) {
+        try {
+            lockFd = fs.openSync(lockFile, "wx", 0o600);
+            fs.writeSync(lockFd, `${process.pid}\n`);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            let reclaim = false;
+            try {
+                const stat = fs.statSync(lockFile);
+                const rawPid = fs.readFileSync(lockFile, "utf8").trim();
+                const pid = /^\d+$/.test(rawPid) ? Number(rawPid) : null;
+                const age = Date.now() - stat.mtimeMs;
+                if (age > LOCK_STALE_MS) {
+                    if (pid === null)
+                        reclaim = true;
+                    else {
+                        try {
+                            process.kill(pid, 0);
+                        }
+                        catch (probeErr) {
+                            reclaim = probeErr.code === "ESRCH";
+                        }
+                    }
+                }
+                if (reclaim)
+                    fs.unlinkSync(lockFile);
+            }
+            catch (lockErr) {
+                if (lockErr.code !== "ENOENT")
+                    throw lockErr;
+            }
+            if (Date.now() >= deadline)
+                throw new Error(`timed out reserving mesh sequence for ${sessionId}`);
+            Atomics.wait(LOCK_SLEEP, 0, 0, 5);
+        }
+    }
     try {
-        const raw = fs.readFileSync(file, "utf8").trim();
-        if (/^\d+$/.test(raw))
-            current = Number(raw);
+        let current = 0;
+        try {
+            const raw = fs.readFileSync(file, "utf8").trim();
+            if (/^\d+$/.test(raw))
+                current = Number(raw);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        const first = current + 1;
+        const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        fs.writeFileSync(temp, `${current + Math.max(0, count)}\n`, { mode: 0o600 });
+        fs.renameSync(temp, file);
+        return first;
     }
-    catch {
-        current = 0;
+    finally {
+        fs.closeSync(lockFd);
+        fs.unlinkSync(lockFile);
     }
-    const first = current + 1;
-    fs.writeFileSync(file, `${current + Math.max(0, count)}\n`, { mode: 0o600 });
-    return first;
 }
 //# sourceMappingURL=session-seq.js.map

package/dist/lib/registry/normalize-remote.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Git remote URL normalisation for the repo-to-company registry (hq-anywhere US-004).
+ *
+ * Two clones of the same repo must produce the same key whether they were
+ * cloned over ssh or https, with or without a trailing `.git`, and in any
+ * letter case. The key drops scheme, user, and port, keeps host + path, and
+ * case-folds the result: `github.com/indigoai-us/hq-cli`.
+ */
+/**
+ * Normalise a git remote URL to `host/path`. Accepts scp-style
+ * (`git@host:owner/name.git`), `ssh://`, `git://`, `http(s)://`, and bare
+ * `host/owner/name`. Returns null when the input has no host or path.
+ */
+export declare function normalizeRemoteUrl(remoteUrl: string): string | null;
+/**
+ * Normalise a `companies/manifest.yaml` repos[] entry. URLs go through
+ * normalizeRemoteUrl; a bare `owner/name` is assumed to live on github.com,
+ * the only host HQ manifests list today.
+ */
+export declare function normalizeManifestRepo(entry: string): string | null;
+//# sourceMappingURL=normalize-remote.d.ts.map

package/dist/lib/registry/normalize-remote.js

@@ -0,0 +1,68 @@
+/**
+ * Git remote URL normalisation for the repo-to-company registry (hq-anywhere US-004).
+ *
+ * Two clones of the same repo must produce the same key whether they were
+ * cloned over ssh or https, with or without a trailing `.git`, and in any
+ * letter case. The key drops scheme, user, and port, keeps host + path, and
+ * case-folds the result: `github.com/indigoai-us/hq-cli`.
+ */
+const SCHEME = /^[a-z][a-z0-9+.-]*:\/\//i;
+const SCP = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
+/**
+ * Normalise a git remote URL to `host/path`. Accepts scp-style
+ * (`git@host:owner/name.git`), `ssh://`, `git://`, `http(s)://`, and bare
+ * `host/owner/name`. Returns null when the input has no host or path.
+ */
+export function normalizeRemoteUrl(remoteUrl) {
+    const raw = remoteUrl.trim();
+    if (!raw)
+        return null;
+    let host;
+    let pathname;
+    const scp = SCHEME.test(raw) ? null : SCP.exec(raw);
+    if (scp) {
+        host = scp[1];
+        pathname = scp[2];
+    }
+    else {
+        try {
+            const u = new URL(SCHEME.test(raw) ? raw : `https://${raw}`);
+            host = u.hostname;
+            pathname = decodeURIComponent(u.pathname);
+        }
+        catch {
+            return null;
+        }
+    }
+    const cleanPath = pathname
+        .replace(/\\/g, "/")
+        .replace(/\/+$/, "")
+        .replace(/\.git$/i, "")
+        .split("/")
+        .filter(Boolean)
+        .join("/");
+    const cleanHost = host.trim().replace(/\.$/, "");
+    if (!cleanHost || !cleanPath)
+        return null;
+    return `${cleanHost}/${cleanPath}`.toLowerCase();
+}
+/**
+ * Normalise a `companies/manifest.yaml` repos[] entry. URLs go through
+ * normalizeRemoteUrl; a bare `owner/name` is assumed to live on github.com,
+ * the only host HQ manifests list today.
+ */
+export function normalizeManifestRepo(entry) {
+    const trimmed = entry.trim();
+    if (!trimmed)
+        return null;
+    if (SCHEME.test(trimmed) || /^[^@/\s]+@[^:/\s]+:/.test(trimmed)) {
+        return normalizeRemoteUrl(trimmed);
+    }
+    const parts = trimmed.replace(/\.git$/i, "").split("/").filter(Boolean);
+    if (parts.length === 2)
+        return `github.com/${parts.join("/")}`.toLowerCase();
+    if (parts.length > 2 && parts[0].includes("."))
+        return normalizeRemoteUrl(trimmed);
+    return null;
+}
+//# sourceMappingURL=normalize-remote.js.map