@indigoai-us/hq-cli 5.323.0 → 5.325.0

package/dist/lib/core-utils/timeout-guard.js

@@ -222,8 +222,9 @@ export async function timeoutGuardCommand(stdin, deps = {}) {
     if (!verdict.block)
         return 0;
     // Rollout gate: only act for @getindigo.ai identities.
+    const flagReader = deps.flagReader ?? await deps.getFlagReader?.();
     const getEmail = deps.getEmail ?? defaultEmail;
-    if (!await isGatedUser(await getEmail(), deps.flagReader))
+    if (!await isGatedUser(await getEmail(), flagReader))
         return 0;
     err.write(`${BLOCK_MESSAGE(verdict.reason ?? "declared timeout exceeds the harness ceiling")}\n`);
     return 2;

package/dist/lib/daemon/convergence.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Daemon version convergence (hq-anywhere US-012).
+ *
+ * After `hq update` (or /update-hq) installs a new hq-cli, the resident
+ * daemon still runs the old code until it restarts. This module asks the
+ * running hqd for its version and compares it with the version now installed
+ * on disk. Policy hq-self-updater-must-verify-convergence-after-install: the
+ * caller reports a mismatch as a failure; it is never swallowed.
+ */
+export declare const CONVERGENCE_TIMEOUT_MS = 10000;
+export declare const CONVERGENCE_POLL_MS = 500;
+export interface ConvergenceResult {
+    converged: boolean;
+    expected: string;
+    /** The version hqd reported last, or null when it never answered. */
+    running: string | null;
+    /** The last ping error when hqd never answered. */
+    error?: string;
+}
+export interface ConvergenceDeps {
+    /** Ask hqd for its version; rejects when hqd is unreachable. */
+    ping?: () => Promise<string>;
+    timeoutMs?: number;
+    pollMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+/** Ping hqd over its socket and return the version it reports. */
+export declare function pingHqdVersion(socketPath?: string, timeoutMs?: number): Promise<string>;
+/**
+ * The hq-cli version installed on PATH. The process running `hq update` is
+ * the old CLI, so its own CLI_VERSION is not the installed version.
+ */
+export declare function installedCliVersion(run?: (cmd: string, args: string[]) => {
+    status: number | null;
+    stdout: string;
+}): string | null;
+/** Poll hqd until it reports `expected` or the budget runs out. */
+export declare function verifyDaemonConvergence(expected: string, deps?: ConvergenceDeps): Promise<ConvergenceResult>;
+/** One-line description of a non-converged result, with the remediation. */
+export declare function describeNonConvergence(result: ConvergenceResult): string;
+//# sourceMappingURL=convergence.d.ts.map

package/dist/lib/daemon/convergence.js

@@ -0,0 +1,66 @@
+/**
+ * Daemon version convergence (hq-anywhere US-012).
+ *
+ * After `hq update` (or /update-hq) installs a new hq-cli, the resident
+ * daemon still runs the old code until it restarts. This module asks the
+ * running hqd for its version and compares it with the version now installed
+ * on disk. Policy hq-self-updater-must-verify-convergence-after-install: the
+ * caller reports a mismatch as a failure; it is never swallowed.
+ */
+import { spawnSync } from "node:child_process";
+import { hqdRequest } from "./protocol.js";
+export const CONVERGENCE_TIMEOUT_MS = 10_000;
+export const CONVERGENCE_POLL_MS = 500;
+/** Ping hqd over its socket and return the version it reports. */
+export async function pingHqdVersion(socketPath, timeoutMs = 2_000) {
+    const result = (await hqdRequest("ping", {}, { socketPath, timeoutMs }));
+    if (typeof result?.version !== "string")
+        throw new Error("hqd ping did not return a version");
+    return result.version;
+}
+/**
+ * The hq-cli version installed on PATH. The process running `hq update` is
+ * the old CLI, so its own CLI_VERSION is not the installed version.
+ */
+export function installedCliVersion(run = defaultRun) {
+    const out = run("hq", ["--version"]);
+    if (out.status !== 0)
+        return null;
+    const match = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/.exec(out.stdout);
+    return match ? match[0] : null;
+}
+function defaultRun(cmd, args) {
+    const result = spawnSync(cmd, args, { encoding: "utf8", timeout: 10_000 });
+    return { status: result.status, stdout: typeof result.stdout === "string" ? result.stdout : "" };
+}
+/** Poll hqd until it reports `expected` or the budget runs out. */
+export async function verifyDaemonConvergence(expected, deps = {}) {
+    const ping = deps.ping ?? (() => pingHqdVersion());
+    const timeoutMs = deps.timeoutMs ?? CONVERGENCE_TIMEOUT_MS;
+    const pollMs = deps.pollMs ?? CONVERGENCE_POLL_MS;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
+    const deadline = now() + timeoutMs;
+    let running = null;
+    let error;
+    for (;;) {
+        try {
+            running = await ping();
+            error = undefined;
+            if (running === expected)
+                return { converged: true, expected, running };
+        }
+        catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+        }
+        if (now() >= deadline)
+            return { converged: false, expected, running, ...(error ? { error } : {}) };
+        await sleep(pollMs);
+    }
+}
+/** One-line description of a non-converged result, with the remediation. */
+export function describeNonConvergence(result) {
+    const seen = result.running ? `hqd is still running ${result.running}` : `hqd did not answer (${result.error ?? "no response"})`;
+    return `Daemon did not converge on hq-cli ${result.expected}: ${seen}. Run: hq daemon restart && hq doctor --only anywhere`;
+}
+//# sourceMappingURL=convergence.js.map

package/dist/lib/daemon/heartbeat.d.ts

@@ -0,0 +1,43 @@
+/**
+ * hqd heartbeat (hq-anywhere US-012).
+ *
+ * Every 60s the daemon records a host-local beat in ~/.hq/hqd-heartbeat.json so `hq doctor` can tell a live daemon
+ * from a stale one offline. A device with no beat for 5 minutes is
+ * "daemon stale".
+ */
+export declare const HEARTBEAT_INTERVAL_MS = 60000;
+export declare const HEARTBEAT_STALE_MS: number;
+export declare const HEARTBEAT_FILE = "hqd-heartbeat.json";
+export declare const DAEMON_STALE_LABEL = "daemon stale";
+export interface HeartbeatState {
+    at: string;
+    version: string;
+    sessions: number;
+    device: string;
+}
+export declare function heartbeatFile(home?: string, env?: NodeJS.ProcessEnv): string;
+/** Mesh session id for this device's daemon; only characters the spool accepts. */
+export declare function heartbeatSessionId(hostname?: string): string;
+export declare function readHeartbeat(file: string): HeartbeatState | null;
+/** Presence label for a device given its last beat: "daemon stale" after 5 minutes of silence. */
+export declare function daemonPresenceLabel(state: HeartbeatState | null, now?: Date): "daemon live" | typeof DAEMON_STALE_LABEL;
+export interface HeartbeatOptions {
+    version: string;
+    sessionCount: () => number;
+    file?: string;
+    hostname?: string;
+    now?: () => Date;
+    intervalMs?: number;
+    /** Optional host event publisher. The daemon does not publish to Work Mesh without an explicit company-bound session. */
+    publish?: (state: HeartbeatState, sessionId: string) => void;
+    log?: (level: "info" | "warn" | "error", message: string) => void;
+}
+/** Publish one heartbeat. Errors are logged and returned, never thrown into the daemon loop. */
+export declare function beatOnce(opts: HeartbeatOptions): {
+    ok: boolean;
+    state: HeartbeatState;
+    error?: string;
+};
+/** Beat now and every interval until stopped. The timer does not hold the process open. */
+export declare function startHeartbeat(opts: HeartbeatOptions): () => void;
+//# sourceMappingURL=heartbeat.d.ts.map

package/dist/lib/daemon/heartbeat.js

@@ -0,0 +1,70 @@
+/**
+ * hqd heartbeat (hq-anywhere US-012).
+ *
+ * Every 60s the daemon records a host-local beat in ~/.hq/hqd-heartbeat.json so `hq doctor` can tell a live daemon
+ * from a stale one offline. A device with no beat for 5 minutes is
+ * "daemon stale".
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+export const HEARTBEAT_INTERVAL_MS = 60_000;
+export const HEARTBEAT_STALE_MS = 5 * 60_000;
+export const HEARTBEAT_FILE = "hqd-heartbeat.json";
+export const DAEMON_STALE_LABEL = "daemon stale";
+export function heartbeatFile(home = os.homedir(), env = process.env) {
+    const dir = env.HQ_REGISTRY_DIR?.trim() ? path.resolve(env.HQ_REGISTRY_DIR.trim()) : path.join(home, ".hq");
+    return path.join(dir, HEARTBEAT_FILE);
+}
+/** Mesh session id for this device's daemon; only characters the spool accepts. */
+export function heartbeatSessionId(hostname = os.hostname()) {
+    return `hqd-${hostname.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").slice(0, 48) || "device"}`;
+}
+export function readHeartbeat(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.at !== "string" || typeof parsed.version !== "string")
+        throw new Error(`${file} is not a heartbeat record`);
+    return { at: parsed.at, version: parsed.version, sessions: Number(parsed.sessions ?? 0), device: String(parsed.device ?? "") };
+}
+/** Presence label for a device given its last beat: "daemon stale" after 5 minutes of silence. */
+export function daemonPresenceLabel(state, now = new Date()) {
+    if (!state)
+        return DAEMON_STALE_LABEL;
+    const age = now.getTime() - Date.parse(state.at);
+    return Number.isFinite(age) && age <= HEARTBEAT_STALE_MS ? "daemon live" : DAEMON_STALE_LABEL;
+}
+/** Publish one heartbeat. Errors are logged and returned, never thrown into the daemon loop. */
+export function beatOnce(opts) {
+    const now = (opts.now ?? (() => new Date()))();
+    const sessionId = heartbeatSessionId(opts.hostname);
+    const state = { at: now.toISOString(), version: opts.version, sessions: opts.sessionCount(), device: sessionId };
+    try {
+        const file = opts.file ?? heartbeatFile();
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+        opts.publish?.(state, sessionId);
+        return { ok: true, state };
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        opts.log?.("warn", `hqd heartbeat failed: ${error}`);
+        return { ok: false, state, error };
+    }
+}
+/** Beat now and every interval until stopped. The timer does not hold the process open. */
+export function startHeartbeat(opts) {
+    beatOnce(opts);
+    const timer = setInterval(() => beatOnce(opts), opts.intervalMs ?? HEARTBEAT_INTERVAL_MS);
+    timer.unref();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=heartbeat.js.map

package/dist/lib/daemon/ops/journal.d.ts

@@ -0,0 +1,29 @@
+/**
+ * journal.append op (hq-anywhere US-009).
+ *
+ * Follows `.claude/skills/_shared/journal.sh append` semantics: the entry goes
+ * into the project's active journal (frontmatter `status: active`, `project:`
+ * = the project folder) as "- <ISO8601> <text>" on the line after the section
+ * header, or under a new header at EOF when the header is missing. A daemon
+ * has no per-session pointer, so the newest active journal in
+ * <project>/journal/ is used, and one is opened (same template as
+ * `journal.sh open`) when none exists.
+ */
+export declare const JOURNAL_SECTIONS: Record<string, string>;
+export declare class JournalOpError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface JournalAppendArgs {
+    company: string;
+    project: string;
+    section: string;
+    text: string;
+}
+export interface JournalAppendResult {
+    path: string;
+    line: string;
+    opened: boolean;
+}
+export declare function journalAppend(args: JournalAppendArgs, hqRoot: string, now?: Date): JournalAppendResult;
+//# sourceMappingURL=journal.d.ts.map

package/dist/lib/daemon/ops/journal.js

@@ -0,0 +1,141 @@
+/**
+ * journal.append op (hq-anywhere US-009).
+ *
+ * Follows `.claude/skills/_shared/journal.sh append` semantics: the entry goes
+ * into the project's active journal (frontmatter `status: active`, `project:`
+ * = the project folder) as "- <ISO8601> <text>" on the line after the section
+ * header, or under a new header at EOF when the header is missing. A daemon
+ * has no per-session pointer, so the newest active journal in
+ * <project>/journal/ is used, and one is opened (same template as
+ * `journal.sh open`) when none exists.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+const SLUG_RE = /^[A-Za-z0-9_][A-Za-z0-9._-]*$/;
+export const JOURNAL_SECTIONS = {
+    decisions: "## Decisions",
+    open: "## Open threads",
+    findings: "## Findings",
+    rejected: "## Rejected",
+};
+export class JournalOpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "JournalOpError";
+    }
+}
+function isoSeconds(d) {
+    return `${d.toISOString().slice(0, 19)}Z`;
+}
+function frontmatterValue(text, key) {
+    const m = new RegExp(`^${key}: (.*)$`, "m").exec(text);
+    return m ? m[1] : null;
+}
+function findActiveJournal(projectDir) {
+    const dir = path.join(projectDir, "journal");
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    for (const name of names.filter((n) => n.endsWith(".md")).sort().reverse()) {
+        const file = path.join(dir, name);
+        const text = fs.readFileSync(file, "utf8");
+        if (frontmatterValue(text, "status") !== "active")
+            continue;
+        const project = frontmatterValue(text, "project");
+        if (!project)
+            continue;
+        let real;
+        try {
+            real = fs.realpathSync(project);
+        }
+        catch {
+            continue;
+        }
+        if (real === projectDir)
+            return file;
+    }
+    return null;
+}
+function openJournal(projectDir, now) {
+    const dir = path.join(projectDir, "journal");
+    fs.mkdirSync(dir, { recursive: true });
+    const iso = now.toISOString();
+    const stamp = `${iso.slice(0, 10)}-${iso.slice(11, 13)}${iso.slice(14, 16)}`;
+    const base = `${stamp}-hqd-adhoc`;
+    let file = path.join(dir, `${base}.md`);
+    let suffix = 2;
+    while (fs.existsSync(file))
+        file = path.join(dir, `${base}-${suffix++}.md`);
+    fs.writeFileSync(file, [
+        "---",
+        "skill: hqd",
+        `started_at: ${isoSeconds(now)}`,
+        "thread_id: adhoc",
+        `project: ${projectDir}`,
+        "status: active",
+        "auto_capture: true",
+        'summary: ""',
+        "---",
+        "",
+        "## Decisions",
+        "## Open threads",
+        "## Findings",
+        "## Rejected",
+        "## Auto-capture",
+        "",
+    ].join("\n"));
+    return file;
+}
+export function journalAppend(args, hqRoot, now = new Date()) {
+    if (!SLUG_RE.test(args.company))
+        throw new JournalOpError("bad_args", "company must be a company slug");
+    if (!SLUG_RE.test(args.project))
+        throw new JournalOpError("bad_args", "project must be a project folder name");
+    const header = JOURNAL_SECTIONS[args.section];
+    if (!header)
+        throw new JournalOpError("bad_args", `section must be one of ${Object.keys(JOURNAL_SECTIONS).join(", ")}`);
+    const text = args.text.replace(/\s*[\r\n]+\s*/g, " ").trim();
+    if (!text)
+        throw new JournalOpError("bad_args", "text must be non-empty");
+    const rawDir = path.join(hqRoot, "companies", args.company, "projects", args.project);
+    let projectDir;
+    try {
+        projectDir = fs.realpathSync(rawDir);
+    }
+    catch {
+        throw new JournalOpError("unknown_project", `no project folder at companies/${args.company}/projects/${args.project}`);
+    }
+    const companyRoot = fs.realpathSync(path.join(hqRoot, "companies", args.company));
+    if (!projectDir.startsWith(companyRoot + path.sep)) {
+        throw new JournalOpError("bad_args", "project folder resolves outside its company");
+    }
+    let file = findActiveJournal(projectDir);
+    const opened = file === null;
+    if (!file)
+        file = openJournal(projectDir, now);
+    const line = `- ${isoSeconds(now)} ${text}`;
+    const body = fs.readFileSync(file, "utf8");
+    const lines = body.split("\n");
+    const at = lines.indexOf(header);
+    let next;
+    if (at !== -1) {
+        lines.splice(at + 1, 0, line);
+        next = lines.join("\n");
+    }
+    else {
+        next = `${body}${body.endsWith("\n") || body === "" ? "" : "\n"}\n${header}\n${line}\n`;
+    }
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, next);
+    fs.renameSync(tmp, file);
+    return { path: file, line, opened };
+}
+//# sourceMappingURL=journal.js.map

package/dist/lib/daemon/ops/memory.d.ts

@@ -0,0 +1,20 @@
+/**
+ * memory.get / memory.put ops (hq-anywhere US-009): session-scoped notes
+ * persisted at workspace/sessions/<sid>/hqd-memory.json under HQ_ROOT.
+ */
+export declare const MEMORY_FILE = "hqd-memory.json";
+export declare class MemoryOpError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function memoryPath(hqRoot: string, sessionId: string): string;
+export declare function memoryPut(hqRoot: string, sessionId: string, key: string, value: unknown, now?: Date): {
+    key: string;
+    updatedAt: string;
+};
+export declare function memoryGet(hqRoot: string, sessionId: string, key?: string): {
+    value: unknown;
+} | {
+    entries: Record<string, unknown>;
+};
+//# sourceMappingURL=memory.d.ts.map

package/dist/lib/daemon/ops/memory.js

@@ -0,0 +1,65 @@
+/**
+ * memory.get / memory.put ops (hq-anywhere US-009): session-scoped notes
+ * persisted at workspace/sessions/<sid>/hqd-memory.json under HQ_ROOT.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+const SESSION_RE = /^[A-Za-z0-9._-]+$/;
+export const MEMORY_FILE = "hqd-memory.json";
+const MAX_VALUE_BYTES = 256 * 1024;
+export class MemoryOpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MemoryOpError";
+    }
+}
+export function memoryPath(hqRoot, sessionId) {
+    if (!SESSION_RE.test(sessionId) || sessionId === "." || sessionId === "..") {
+        throw new MemoryOpError("bad_args", "sessionId may only contain letters, digits, '.', '_' and '-'");
+    }
+    return path.join(hqRoot, "workspace", "sessions", sessionId, MEMORY_FILE);
+}
+function readAll(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw err;
+    }
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new MemoryOpError("corrupt_memory", `${file} is not a JSON object`);
+    }
+    return parsed;
+}
+export function memoryPut(hqRoot, sessionId, key, value, now = new Date()) {
+    if (!key.trim())
+        throw new MemoryOpError("bad_args", "key must be non-empty");
+    const serialized = JSON.stringify(value ?? null);
+    if (Buffer.byteLength(serialized, "utf8") > MAX_VALUE_BYTES)
+        throw new MemoryOpError("too_large", `value is over ${MAX_VALUE_BYTES} bytes`);
+    const file = memoryPath(hqRoot, sessionId);
+    const all = readAll(file);
+    const updatedAt = now.toISOString();
+    if (value === null || value === undefined)
+        delete all[key];
+    else
+        all[key] = { value, updatedAt };
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(all, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return { key, updatedAt };
+}
+export function memoryGet(hqRoot, sessionId, key) {
+    const all = readAll(memoryPath(hqRoot, sessionId));
+    if (key !== undefined)
+        return { value: all[key]?.value ?? null };
+    return { entries: Object.fromEntries(Object.entries(all).map(([k, e]) => [k, e.value])) };
+}
+//# sourceMappingURL=memory.js.map

package/dist/lib/daemon/ops/mesh.d.ts

@@ -0,0 +1,38 @@
+/**
+ * mesh.presence op (hq-anywhere US-009).
+ *
+ * Writes one schema-valid session event to the Work Mesh Live spool through
+ * the same enqueue path as `hq mesh session … --enqueue`. The daemon's mesh
+ * drainer service already flushes that spool, so presence from a session in a
+ * foreign cwd reaches Work Mesh Live without any new transport.
+ */
+export declare class MeshOpError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface MeshPresenceArgs {
+    sessionId: string;
+    harness: string;
+    kind: string;
+    cwd?: string;
+    company?: string;
+    project?: string;
+    task?: string;
+    taskId?: string;
+    status?: string;
+    summary?: string;
+    reason?: string;
+}
+export interface MeshPresenceDeps {
+    hqRoot?: string;
+    /** Work-mesh root override (tests); defaults to ~/.hq/work-mesh or HQ_WORK_MESH_ROOT. */
+    workMeshRoot?: string;
+    env?: NodeJS.ProcessEnv;
+    now?: () => Date;
+}
+export declare function meshPresence(args: MeshPresenceArgs, deps?: MeshPresenceDeps): {
+    eventId: string;
+    seq: number;
+    spoolPath: string;
+};
+//# sourceMappingURL=mesh.d.ts.map

package/dist/lib/daemon/ops/mesh.js

@@ -0,0 +1,70 @@
+/**
+ * mesh.presence op (hq-anywhere US-009).
+ *
+ * Writes one schema-valid session event to the Work Mesh Live spool through
+ * the same enqueue path as `hq mesh session … --enqueue`. The daemon's mesh
+ * drainer service already flushes that spool, so presence from a session in a
+ * foreign cwd reaches Work Mesh Live without any new transport.
+ */
+import { CLI_VERSION } from "../../../cli-version.js";
+import { CLI_KIND_TO_SCHEMA, EnqueueValidationError, enqueueSessionEvent } from "../../mesh/live/enqueue.js";
+import { reserveSessionSeq } from "../../mesh/live/session-seq.js";
+const HARNESSES = ["claude-code", "claude-desktop", "codex", "grok", "hq-sessions", "agent-box", "agents-v2"];
+const SCHEMA_KINDS = new Set(Object.values(CLI_KIND_TO_SCHEMA));
+const STATUSES = new Set(["queued", "in_progress", "review", "done"]);
+export class MeshOpError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MeshOpError";
+    }
+}
+export function meshPresence(args, deps = {}) {
+    const env = deps.env ?? process.env;
+    if (!HARNESSES.includes(args.harness)) {
+        throw new MeshOpError("bad_args", `harness must be one of ${HARNESSES.join(", ")}`);
+    }
+    const kind = (CLI_KIND_TO_SCHEMA[args.kind] ?? (SCHEMA_KINDS.has(args.kind) ? args.kind : undefined));
+    if (!kind)
+        throw new MeshOpError("bad_args", `kind must be one of ${Object.keys(CLI_KIND_TO_SCHEMA).join(", ")}`);
+    if (args.status !== undefined && !STATUSES.has(args.status))
+        throw new MeshOpError("bad_args", "status must be queued, in_progress, review or done");
+    let seq;
+    try {
+        seq = reserveSessionSeq(args.sessionId, 1, env);
+    }
+    catch (err) {
+        throw new MeshOpError("bad_args", `sessionId rejected: ${err.message}`);
+    }
+    let result;
+    try {
+        result = enqueueSessionEvent({
+            kind,
+            sessionId: args.sessionId,
+            harness: args.harness,
+            adapterVersion: CLI_VERSION,
+            source: "hooks",
+            seq,
+            cwd: args.cwd,
+            hqRoot: deps.hqRoot,
+            companySlug: args.company,
+            project: args.project,
+            task: args.task,
+            taskId: args.taskId,
+            status: args.status,
+            summary: args.summary,
+            reason: args.reason,
+            root: deps.workMeshRoot,
+            env,
+            now: deps.now,
+        });
+    }
+    catch (err) {
+        if (err instanceof EnqueueValidationError)
+            throw new MeshOpError("bad_args", err.message);
+        throw err;
+    }
+    return { eventId: result.event.eventId, seq, spoolPath: result.spoolPath };
+}
+//# sourceMappingURL=mesh.js.map

package/dist/lib/daemon/ops/policy.d.ts

@@ -0,0 +1,78 @@
+/**
+ * policy.check and policy.index ops (hq-anywhere US-009).
+ *
+ * Verdicts come from the hq-core hook scripts under HQ_ROOT, run as child
+ * processes with a synthesized hook payload, so hookless hosts and sub-agents
+ * get the same answer a hook-dispatching session would. No rule is
+ * reimplemented here:
+ *   - .claude/hooks/mandatory-scope-authorizer.sh decides allow/block
+ *     (exit 2 = block, reason on stderr).
+ *   - .claude/hooks/inject-policy-on-trigger.sh supplies additionalContext.
+ *
+ * The policy index (which policy files exist for a company) is cached
+ * in-process and invalidated by fs.watch on core/policies, personal/policies
+ * and companies/<co>/policies.
+ */
+export declare const SCOPE_AUTHORIZER = ".claude/hooks/mandatory-scope-authorizer.sh";
+export declare const POLICY_TRIGGER = ".claude/hooks/inject-policy-on-trigger.sh";
+export declare class PolicyOpError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface PolicyEntry {
+    slug: string;
+    path: string;
+    scope: "core" | "personal" | "company";
+    company?: string;
+}
+/** Cached list of policy files under HQ_ROOT, invalidated by fs.watch. */
+export declare class PolicyIndex {
+    readonly hqRoot: string;
+    private readonly log;
+    private entries;
+    private watchers;
+    private closed;
+    /** Bumped on every invalidation; lets callers see that the cache was rebuilt. */
+    version: number;
+    constructor(hqRoot: string, log?: (level: "info" | "warn" | "error", message: string) => void);
+    /** Policies visible to `company`: core, personal, and that company only. */
+    list(company?: string): PolicyEntry[];
+    invalidate(): void;
+    close(): void;
+    private rebuild;
+    private rewatch;
+}
+export interface PolicyCheckArgs {
+    company: string;
+    event?: string;
+    tool: string;
+    input?: Record<string, unknown>;
+    sessionId?: string;
+    cwd?: string;
+}
+export interface PolicyCheckResult {
+    decision: "allow" | "block";
+    reasons: string[];
+    additionalContext: string;
+    session: string;
+    policies: {
+        count: number;
+        version: number;
+    };
+}
+/**
+ * The scope authorizer reads the session's company from
+ * workspace/sessions/<sid>/meta.yaml (or scope-capability.json). hqd binds a
+ * session id of its own per company + caller, so a check never borrows the
+ * binding of an unrelated session.
+ */
+export declare function bindCheckSession(hqRoot: string, company: string, callerSession: string | undefined, now: Date): string;
+export interface PolicyCheckDeps {
+    hqRoot: string;
+    index: PolicyIndex;
+    env?: NodeJS.ProcessEnv;
+    now?: () => Date;
+    timeoutMs?: number;
+}
+export declare function policyCheck(args: PolicyCheckArgs, deps: PolicyCheckDeps): Promise<PolicyCheckResult>;
+//# sourceMappingURL=policy.d.ts.map