@indigoai-us/hq-cli 5.33.1 → 5.34.0

package/dist/commands/master-sync.d.ts

@@ -0,0 +1,11 @@
+/**
+ * hq master-sync — surface namespaced skills, mirror the personal overlay into
+ * core/, and regenerate the workers registry.
+ *
+ * Thin wrapper over @indigoai-us/hq-cloud's masterSync(), which execs the
+ * bundled scripts/master-sync.sh against the HQ root. This command is what the
+ * hq-core master-sync hook shim calls on Stop / PostToolUse.
+ */
+import { Command } from 'commander';
+export declare function registerMasterSyncCommand(program: Command): void;
+//# sourceMappingURL=master-sync.d.ts.map

package/dist/commands/master-sync.js

@@ -0,0 +1,15 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c5486cda-a7fa-5274-ab0a-a61e1958aac7")}catch(e){}}();
+import { masterSync } from '@indigoai-us/hq-cloud';
+export function registerMasterSyncCommand(program) {
+    program
+        .command('master-sync')
+        .description('Surface namespaced skills, mirror the personal overlay into core/, and regenerate the workers registry')
+        .option('--repo-root <path>', 'HQ root to operate on (defaults to the current directory)')
+        .action((opts) => {
+        const { status } = masterSync({ repoRoot: opts.repoRoot });
+        process.exit(status);
+    });
+}
+//# sourceMappingURL=master-sync.js.map
+//# debugId=c5486cda-a7fa-5274-ab0a-a61e1958aac7

package/dist/commands/rescue.d.ts

@@ -0,0 +1,33 @@
+/**
+ * hq rescue — re-sync the local HQ core to an upstream hq-core release (or the
+ * staging branch) WITHOUT destroying local edits ("drift").
+ *
+ * Thin driver over @indigoai-us/hq-cloud's `rescue()`, which execs the bundled
+ * scripts/replace-rescue.sh against the HQ root. This is the CLI sibling of the
+ * HQ Sync menubar app's "Update / Restore" pill — both drive the exact same
+ * rescue script, just resolved from the shared hq-cloud package.
+ *
+ * Prod (default): resolves the latest `indigoai-us/hq-core` release tag and
+ * pins the three-way history floor to the commit of the user's currently
+ * installed version (read from core/core.yaml). Staging (`--staging`): targets
+ * `indigoai-us/hq-core-staging@main` and lets the script read its on-disk
+ * sync stamp for the floor.
+ */
+import { Command } from 'commander';
+export interface RescueTarget {
+    source: string;
+    /** undefined → let the script apply its own default ref (`main`). */
+    ref?: string;
+}
+/**
+ * Resolve the source repo + ref from the user's flags. Pure + exported for
+ * tests. `latestTag` is the resolved latest release tag (prod only); ignored
+ * for staging and when an explicit `--ref` is given.
+ */
+export declare function resolveRescueTarget(opts: {
+    staging?: boolean;
+    source?: string;
+    ref?: string;
+}, latestTag?: string): RescueTarget;
+export declare function registerRescueCommand(program: Command): void;
+//# sourceMappingURL=rescue.d.ts.map

package/dist/commands/rescue.js

@@ -0,0 +1,161 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e0da62c9-7fd5-5514-b2d0-1b5b76ebcd21")}catch(e){}}();
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+import chalk from 'chalk';
+import { rescue } from '@indigoai-us/hq-cloud';
+import { findHqRoot } from '../utils/manifest.js';
+const PROD_SOURCE = 'indigoai-us/hq-core';
+const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
+/**
+ * Resolve the source repo + ref from the user's flags. Pure + exported for
+ * tests. `latestTag` is the resolved latest release tag (prod only); ignored
+ * for staging and when an explicit `--ref` is given.
+ */
+export function resolveRescueTarget(opts, latestTag) {
+    if (opts.staging) {
+        return { source: opts.source ?? STAGING_SOURCE, ref: opts.ref };
+    }
+    return { source: opts.source ?? PROD_SOURCE, ref: opts.ref ?? latestTag };
+}
+/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
+function resolveGhToken() {
+    try {
+        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+        if (res.status === 0) {
+            const tok = res.stdout.trim();
+            if (tok)
+                return tok;
+        }
+    }
+    catch {
+        // gh not installed — fall through to env.
+    }
+    return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
+}
+function ghHeaders(token) {
+    const headers = {
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'hq-cli-rescue',
+        'X-GitHub-Api-Version': '2022-11-28',
+    };
+    if (token)
+        headers.Authorization = `Bearer ${token}`;
+    return headers;
+}
+/** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
+async function getLatestReleaseTag(repo, token) {
+    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+        headers: ghHeaders(token),
+    });
+    if (!res.ok) {
+        throw new Error(`GitHub releases/latest for ${repo}: HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    if (!body.tag_name)
+        throw new Error(`no tag_name in latest release for ${repo}`);
+    return body.tag_name;
+}
+/** Resolve a tag to its commit SHA, dereferencing annotated tags. */
+async function resolveTagSha(repo, tag, token) {
+    const refRes = await fetch(`https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`, { headers: ghHeaders(token) });
+    if (!refRes.ok)
+        throw new Error(`git/ref/tags/${tag} for ${repo}: HTTP ${refRes.status}`);
+    const ref = (await refRes.json());
+    const obj = ref.object;
+    if (!obj?.sha)
+        throw new Error(`no object.sha for tag ${tag} in ${repo}`);
+    if (obj.type !== 'tag')
+        return obj.sha; // lightweight tag → already a commit
+    // Annotated tag → dereference to the commit it points at.
+    const tagRes = await fetch(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, {
+        headers: ghHeaders(token),
+    });
+    if (!tagRes.ok)
+        throw new Error(`git/tags/${obj.sha} for ${repo}: HTTP ${tagRes.status}`);
+    const annotated = (await tagRes.json());
+    if (!annotated.object?.sha)
+        throw new Error(`annotated tag ${tag} has no target sha`);
+    return annotated.object.sha;
+}
+/** Read the installed HQ core version from `{hqRoot}/core/core.yaml`. */
+function readInstalledVersion(hqRoot) {
+    const file = path.join(hqRoot, 'core', 'core.yaml');
+    if (!fs.existsSync(file))
+        return undefined;
+    try {
+        const doc = yaml.load(fs.readFileSync(file, 'utf8'));
+        const v = doc?.hqVersion;
+        return typeof v === 'string' ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function registerRescueCommand(program) {
+    program
+        .command('rescue')
+        .description('Re-sync your HQ core to the latest release, preserving your local edits (drift)')
+        .option('--hq-root <path>', 'HQ root to operate on (defaults to auto-detected root)')
+        .option('--ref <ref>', 'Target tag/branch (default: latest hq-core release)')
+        .option('--source <repo>', 'Source repo (default: indigoai-us/hq-core)')
+        .option('--staging', 'Use the staging channel (indigoai-us/hq-core-staging@main)')
+        .option('--floor-sha <sha>', 'Pin the three-way history floor to a 40-char commit SHA')
+        .option('--paths <list>', 'Comma-separated top-level paths to narrow the rescue to')
+        .option('--check', 'Plan only — classify and report, change nothing on disk (--dry-run)')
+        .option('-y, --yes', 'Skip the confirmation prompt')
+        .option('--no-backup', 'Skip the pre-op safety snapshot under ~/.hq/backups')
+        .option('--cloud-update', 'Cloud-update mode')
+        .action(async (opts) => {
+        try {
+            const hqRoot = opts.hqRoot ?? findHqRoot();
+            const token = resolveGhToken();
+            let { source, ref } = resolveRescueTarget(opts);
+            let floorSha = opts.floorSha;
+            if (!opts.staging) {
+                // Prod: resolve the latest release tag when no explicit ref, and
+                // pin the floor to the installed version's commit when possible.
+                if (!ref) {
+                    ref = await getLatestReleaseTag(source, token);
+                }
+                if (!floorSha) {
+                    const installed = readInstalledVersion(hqRoot);
+                    if (installed) {
+                        try {
+                            floorSha = await resolveTagSha(source, `v${installed}`, token);
+                        }
+                        catch (err) {
+                            console.warn(chalk.yellow(`Warning: couldn't resolve the floor commit for v${installed} ` +
+                                `(${err instanceof Error ? err.message : 'unknown error'}); ` +
+                                `falling back to the on-disk sync stamp.`));
+                        }
+                    }
+                }
+            }
+            console.log(chalk.dim(`Rescuing ${hqRoot} from ${source}${ref ? `@${ref}` : ''}` +
+                `${floorSha ? ` (floor ${floorSha.slice(0, 12)})` : ''}` +
+                `${opts.check ? ' [dry-run]' : ''}`));
+            const { status } = rescue({
+                hqRoot,
+                source,
+                ref,
+                floorSha,
+                paths: opts.paths ? opts.paths.split(',').map((p) => p.trim()).filter(Boolean) : undefined,
+                dryRun: opts.check,
+                assumeYes: opts.yes,
+                noBackup: opts.backup === false,
+                cloudUpdate: opts.cloudUpdate,
+                ghToken: token,
+            });
+            process.exit(status);
+        }
+        catch (error) {
+            console.error(chalk.red('Error:'), error instanceof Error ? error.message : 'Unknown error');
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=rescue.js.map
+//# debugId=e0da62c9-7fd5-5514-b2d0-1b5b76ebcd21

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83d8729b-5b5c-50b8-8785-372d61feb425")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="004dc716-c660-5745-94db-988ac49d102e")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -39,6 +39,8 @@ import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
 import { registerSourcesCommand } from "./commands/sources.js";
 import { registerSignalsCommand } from "./commands/signals.js";
+import { registerMasterSyncCommand } from "./commands/master-sync.js";
+import { registerRescueCommand } from "./commands/rescue.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { maybeWarnNewVersion, refreshVersionCache, } from "./utils/version-check.js";
 import { enforceVersionGate, shouldSkipGate, } from "./utils/version-gate.js";
@@ -137,6 +139,14 @@ registerMeetingsCommand(program);
 registerSourcesCommand(program);
 // Signals read surface (subcommand group — hq signals list|get|types|entities)
 registerSignalsCommand(program);
+// Skill/personal-overlay mirroring + workers-registry regen. Internal command
+// invoked by the hq-core master-sync hook shim (formerly the master-sync.sh
+// hook body). Implementation lives in @indigoai-us/hq-cloud.
+registerMasterSyncCommand(program);
+// Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
+// the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
+// shipped from @indigoai-us/hq-cloud.
+registerRescueCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -163,4 +173,4 @@ registerSignalsCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=83d8729b-5b5c-50b8-8785-372d61feb425
+//# debugId=004dc716-c660-5745-94db-988ac49d102e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.33.1",
+  "version": "5.34.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -15,7 +15,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@indigoai-us/hq-cloud": "~5.47.0",
+    "@indigoai-us/hq-cloud": "~5.48.0",
     "@indigoai-us/hq-onboarding": "^0.1.0",
     "@sentry/node": "^10.49.0",
     "chalk": "^5.3.0",

package/src/commands/master-sync.ts

@@ -0,0 +1,23 @@
+/**
+ * hq master-sync — surface namespaced skills, mirror the personal overlay into
+ * core/, and regenerate the workers registry.
+ *
+ * Thin wrapper over @indigoai-us/hq-cloud's masterSync(), which execs the
+ * bundled scripts/master-sync.sh against the HQ root. This command is what the
+ * hq-core master-sync hook shim calls on Stop / PostToolUse.
+ */
+import { Command } from 'commander';
+import { masterSync } from '@indigoai-us/hq-cloud';
+
+export function registerMasterSyncCommand(program: Command): void {
+  program
+    .command('master-sync')
+    .description(
+      'Surface namespaced skills, mirror the personal overlay into core/, and regenerate the workers registry'
+    )
+    .option('--repo-root <path>', 'HQ root to operate on (defaults to the current directory)')
+    .action((opts: { repoRoot?: string }) => {
+      const { status } = masterSync({ repoRoot: opts.repoRoot });
+      process.exit(status);
+    });
+}

package/src/commands/rescue.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { resolveRescueTarget } from './rescue.js';
+
+describe('resolveRescueTarget', () => {
+  it('defaults to prod hq-core at the resolved latest tag', () => {
+    expect(resolveRescueTarget({}, 'v12.3.0')).toEqual({
+      source: 'indigoai-us/hq-core',
+      ref: 'v12.3.0',
+    });
+  });
+
+  it('lets an explicit --ref override the latest tag', () => {
+    expect(resolveRescueTarget({ ref: 'v11.0.0' }, 'v12.3.0')).toEqual({
+      source: 'indigoai-us/hq-core',
+      ref: 'v11.0.0',
+    });
+  });
+
+  it('uses the staging source and leaves ref to the script default', () => {
+    expect(resolveRescueTarget({ staging: true })).toEqual({
+      source: 'indigoai-us/hq-core-staging',
+      ref: undefined,
+    });
+  });
+
+  it('honors an explicit --source override', () => {
+    expect(resolveRescueTarget({ source: 'acme/hq-core-fork' }, 'v1.0.0')).toEqual({
+      source: 'acme/hq-core-fork',
+      ref: 'v1.0.0',
+    });
+  });
+
+  it('honors --ref on the staging channel', () => {
+    expect(resolveRescueTarget({ staging: true, ref: 'feature-branch' })).toEqual({
+      source: 'indigoai-us/hq-core-staging',
+      ref: 'feature-branch',
+    });
+  });
+});

package/src/commands/rescue.ts

@@ -0,0 +1,210 @@
+/**
+ * hq rescue — re-sync the local HQ core to an upstream hq-core release (or the
+ * staging branch) WITHOUT destroying local edits ("drift").
+ *
+ * Thin driver over @indigoai-us/hq-cloud's `rescue()`, which execs the bundled
+ * scripts/replace-rescue.sh against the HQ root. This is the CLI sibling of the
+ * HQ Sync menubar app's "Update / Restore" pill — both drive the exact same
+ * rescue script, just resolved from the shared hq-cloud package.
+ *
+ * Prod (default): resolves the latest `indigoai-us/hq-core` release tag and
+ * pins the three-way history floor to the commit of the user's currently
+ * installed version (read from core/core.yaml). Staging (`--staging`): targets
+ * `indigoai-us/hq-core-staging@main` and lets the script read its on-disk
+ * sync stamp for the floor.
+ */
+import { Command } from 'commander';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'js-yaml';
+import chalk from 'chalk';
+import { rescue } from '@indigoai-us/hq-cloud';
+import { findHqRoot } from '../utils/manifest.js';
+
+const PROD_SOURCE = 'indigoai-us/hq-core';
+const STAGING_SOURCE = 'indigoai-us/hq-core-staging';
+
+export interface RescueTarget {
+  source: string;
+  /** undefined → let the script apply its own default ref (`main`). */
+  ref?: string;
+}
+
+/**
+ * Resolve the source repo + ref from the user's flags. Pure + exported for
+ * tests. `latestTag` is the resolved latest release tag (prod only); ignored
+ * for staging and when an explicit `--ref` is given.
+ */
+export function resolveRescueTarget(
+  opts: { staging?: boolean; source?: string; ref?: string },
+  latestTag?: string
+): RescueTarget {
+  if (opts.staging) {
+    return { source: opts.source ?? STAGING_SOURCE, ref: opts.ref };
+  }
+  return { source: opts.source ?? PROD_SOURCE, ref: opts.ref ?? latestTag };
+}
+
+/** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
+function resolveGhToken(): string | undefined {
+  try {
+    const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+    if (res.status === 0) {
+      const tok = res.stdout.trim();
+      if (tok) return tok;
+    }
+  } catch {
+    // gh not installed — fall through to env.
+  }
+  return process.env.GH_TOKEN || process.env.GITHUB_TOKEN || undefined;
+}
+
+function ghHeaders(token?: string): Record<string, string> {
+  const headers: Record<string, string> = {
+    Accept: 'application/vnd.github+json',
+    'User-Agent': 'hq-cli-rescue',
+    'X-GitHub-Api-Version': '2022-11-28',
+  };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+
+/** Latest release tag for a repo, e.g. `v12.3.0`. Throws on failure. */
+async function getLatestReleaseTag(repo: string, token?: string): Promise<string> {
+  const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+    headers: ghHeaders(token),
+  });
+  if (!res.ok) {
+    throw new Error(`GitHub releases/latest for ${repo}: HTTP ${res.status}`);
+  }
+  const body = (await res.json()) as { tag_name?: string };
+  if (!body.tag_name) throw new Error(`no tag_name in latest release for ${repo}`);
+  return body.tag_name;
+}
+
+/** Resolve a tag to its commit SHA, dereferencing annotated tags. */
+async function resolveTagSha(repo: string, tag: string, token?: string): Promise<string> {
+  const refRes = await fetch(
+    `https://api.github.com/repos/${repo}/git/ref/tags/${encodeURIComponent(tag)}`,
+    { headers: ghHeaders(token) }
+  );
+  if (!refRes.ok) throw new Error(`git/ref/tags/${tag} for ${repo}: HTTP ${refRes.status}`);
+  const ref = (await refRes.json()) as { object?: { type?: string; sha?: string } };
+  const obj = ref.object;
+  if (!obj?.sha) throw new Error(`no object.sha for tag ${tag} in ${repo}`);
+  if (obj.type !== 'tag') return obj.sha; // lightweight tag → already a commit
+  // Annotated tag → dereference to the commit it points at.
+  const tagRes = await fetch(`https://api.github.com/repos/${repo}/git/tags/${obj.sha}`, {
+    headers: ghHeaders(token),
+  });
+  if (!tagRes.ok) throw new Error(`git/tags/${obj.sha} for ${repo}: HTTP ${tagRes.status}`);
+  const annotated = (await tagRes.json()) as { object?: { sha?: string } };
+  if (!annotated.object?.sha) throw new Error(`annotated tag ${tag} has no target sha`);
+  return annotated.object.sha;
+}
+
+/** Read the installed HQ core version from `{hqRoot}/core/core.yaml`. */
+function readInstalledVersion(hqRoot: string): string | undefined {
+  const file = path.join(hqRoot, 'core', 'core.yaml');
+  if (!fs.existsSync(file)) return undefined;
+  try {
+    const doc = yaml.load(fs.readFileSync(file, 'utf8')) as { hqVersion?: unknown } | null;
+    const v = doc?.hqVersion;
+    return typeof v === 'string' ? v : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function registerRescueCommand(program: Command): void {
+  program
+    .command('rescue')
+    .description(
+      'Re-sync your HQ core to the latest release, preserving your local edits (drift)'
+    )
+    .option('--hq-root <path>', 'HQ root to operate on (defaults to auto-detected root)')
+    .option('--ref <ref>', 'Target tag/branch (default: latest hq-core release)')
+    .option('--source <repo>', 'Source repo (default: indigoai-us/hq-core)')
+    .option('--staging', 'Use the staging channel (indigoai-us/hq-core-staging@main)')
+    .option('--floor-sha <sha>', 'Pin the three-way history floor to a 40-char commit SHA')
+    .option('--paths <list>', 'Comma-separated top-level paths to narrow the rescue to')
+    .option('--check', 'Plan only — classify and report, change nothing on disk (--dry-run)')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .option('--no-backup', 'Skip the pre-op safety snapshot under ~/.hq/backups')
+    .option('--cloud-update', 'Cloud-update mode')
+    .action(
+      async (opts: {
+        hqRoot?: string;
+        ref?: string;
+        source?: string;
+        staging?: boolean;
+        floorSha?: string;
+        paths?: string;
+        check?: boolean;
+        yes?: boolean;
+        backup?: boolean; // --no-backup → false
+        cloudUpdate?: boolean;
+      }) => {
+        try {
+          const hqRoot = opts.hqRoot ?? findHqRoot();
+          const token = resolveGhToken();
+
+          let { source, ref } = resolveRescueTarget(opts);
+          let floorSha = opts.floorSha;
+
+          if (!opts.staging) {
+            // Prod: resolve the latest release tag when no explicit ref, and
+            // pin the floor to the installed version's commit when possible.
+            if (!ref) {
+              ref = await getLatestReleaseTag(source, token);
+            }
+            if (!floorSha) {
+              const installed = readInstalledVersion(hqRoot);
+              if (installed) {
+                try {
+                  floorSha = await resolveTagSha(source, `v${installed}`, token);
+                } catch (err) {
+                  console.warn(
+                    chalk.yellow(
+                      `Warning: couldn't resolve the floor commit for v${installed} ` +
+                        `(${err instanceof Error ? err.message : 'unknown error'}); ` +
+                        `falling back to the on-disk sync stamp.`
+                    )
+                  );
+                }
+              }
+            }
+          }
+
+          console.log(
+            chalk.dim(
+              `Rescuing ${hqRoot} from ${source}${ref ? `@${ref}` : ''}` +
+                `${floorSha ? ` (floor ${floorSha.slice(0, 12)})` : ''}` +
+                `${opts.check ? ' [dry-run]' : ''}`
+            )
+          );
+
+          const { status } = rescue({
+            hqRoot,
+            source,
+            ref,
+            floorSha,
+            paths: opts.paths ? opts.paths.split(',').map((p) => p.trim()).filter(Boolean) : undefined,
+            dryRun: opts.check,
+            assumeYes: opts.yes,
+            noBackup: opts.backup === false,
+            cloudUpdate: opts.cloudUpdate,
+            ghToken: token,
+          });
+          process.exit(status);
+        } catch (error) {
+          console.error(
+            chalk.red('Error:'),
+            error instanceof Error ? error.message : 'Unknown error'
+          );
+          process.exit(1);
+        }
+      }
+    );
+}

package/src/index.ts

@@ -39,6 +39,8 @@ import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
 import { registerSourcesCommand } from "./commands/sources.js";
 import { registerSignalsCommand } from "./commands/signals.js";
+import { registerMasterSyncCommand } from "./commands/master-sync.js";
+import { registerRescueCommand } from "./commands/rescue.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import {
   maybeWarnNewVersion,
@@ -174,6 +176,16 @@ registerSourcesCommand(program);
 // Signals read surface (subcommand group — hq signals list|get|types|entities)
 registerSignalsCommand(program);
 
+// Skill/personal-overlay mirroring + workers-registry regen. Internal command
+// invoked by the hq-core master-sync hook shim (formerly the master-sync.sh
+// hook body). Implementation lives in @indigoai-us/hq-cloud.
+registerMasterSyncCommand(program);
+
+// Drift-preserving HQ-core re-sync (top-level — `hq rescue`). CLI sibling of
+// the HQ Sync app's "Update / Restore" pill; drives the same replace-rescue.sh
+// shipped from @indigoai-us/hq-cloud.
+registerRescueCommand(program);
+
 (async () => {
   try {
     Sentry.addBreadcrumb({