@indigoai-us/hq-cli 5.335.1-beta.0 → 5.336.0

package/CHANGELOG.md

@@ -2,8 +2,12 @@
 
 ## [Unreleased]
 
-## [5.335.1-beta.0] — 2026-10-03
+## [5.336.0] — 2026-10-03
 - Client-health refresh failures now retain the bounded Cognito OAuth error class for accurate auth diagnostics.
+- Fix macOS Bash 3.2 service PATH generation when nounset is enabled.
+- Parse policy creation dates at midnight UTC and reject calendar-invalid dates consistently across the shell and native report.
+- Classify missing hidden references by basename-scoped extension siblings, and escape C1 bytes in session journal YAML on every platform.
+- Match BSD awk diagnostics for company resolution and policy frontmatter.
 - CI: Run main-push Linux ARM checks on the reserved self-hosted runner pool.
 
 ## [5.335.0] — 2026-10-03

package/assets/scaffold/core/scripts/outpost-jobs-reconcile.sh

@@ -413,7 +413,7 @@ unit_service_path() { printf '%s/hq-job-%s.service' "$UNIT_DIR" "$1"; }
 unit_timer_path() { printf '%s/hq-job-%s.timer' "$UNIT_DIR" "$1"; }
 
 normalize_service_path() {
-  local remaining="$1" entry existing normalized="" has_more seen
+  local remaining="$1" entry existing normalized="" has_more seen entry_count=0 index
   local -a entries=()
   while :; do
     if [[ "$remaining" == *:* ]]; then
@@ -428,7 +428,8 @@ normalize_service_path() {
     case "$entry" in
       /*)
         seen=0
-        for existing in "${entries[@]}"; do
+        for ((index = 0; index < entry_count; index++)); do
+          existing="${entries[index]}"
           if [ "$existing" = "$entry" ]; then
             seen=1
             break
@@ -436,12 +437,13 @@ normalize_service_path() {
         done
         if [ "$seen" -eq 0 ]; then
           entries+=("$entry")
+          entry_count=$((entry_count + 1))
         fi
         ;;
     esac
     [ "$has_more" -eq 1 ] || break
   done
-  if [ "${#entries[@]}" -gt 0 ]; then
+  if [ "$entry_count" -gt 0 ]; then
     local IFS=:
     normalized="${entries[*]}"
   fi

package/assets/scaffold/core/scripts/policy-age-report.sh

@@ -100,7 +100,12 @@ else
 fi
 
 to_epoch() { # YYYY-MM-DD -> epoch (0 on failure)
-  date -u -d "$1" +%s 2>/dev/null || date -u -j -f %Y-%m-%d "$1" +%s 2>/dev/null || echo 0
+  local epoch normalized
+  epoch="$(date -u -d "$1 00:00:00" +%s 2>/dev/null || date -u -j -f '%Y-%m-%d %H:%M:%S' "$1 00:00:00" +%s 2>/dev/null)" || { echo 0; return; }
+  [ -n "$epoch" ] || { echo 0; return; }
+  normalized="$(date -u -d "@$epoch" +%Y-%m-%d 2>/dev/null || date -u -r "$epoch" +%Y-%m-%d 2>/dev/null)" || { echo 0; return; }
+  [ "$normalized" = "$1" ] || { echo 0; return; }
+  echo "$epoch"
 }
 
 for dir in "${DIRS[@]}"; do
@@ -144,7 +149,18 @@ for dir in "${DIRS[@]}"; do
       if [ ! -e "$HQ_ROOT/$ref" ]; then
         # A sibling with the same stem (renamed extension: foo.sh -> foo.mjs) means
         # the subject still exists and the rule needs a fix, not retirement.
-        stem="${ref%.*}"
+        ref_for_stem="${ref%/}"
+        ref_basename="${ref_for_stem##*/}"
+        case "$ref_basename" in
+          .* )
+            case "${ref_basename#.}" in
+              *.*) stem="${ref_for_stem%.*}" ;;
+              *) stem="$ref_for_stem" ;;
+            esac
+            ;;
+          *.*) stem="${ref_for_stem%.*}" ;;
+          *) stem="$ref_for_stem" ;;
+        esac
         if ls "$HQ_ROOT/$stem".* >/dev/null 2>&1; then renamed="${renamed:+$renamed,}$ref"; else stale="${stale:+$stale,}$ref"; fi
       fi
     done < <(awk '/^## Rule/{r=1;next} r&&/^## /{r=0} r' "$f" \

package/assets/scaffold/core/scripts/session-journal.sh

@@ -44,15 +44,49 @@ slugify() {
 }
 
 yaml_double_quoted() {
-  local value="$1" output='"' character next codepoint hex
+  local value="$1" output='"' character next pair hex
   local LC_ALL=C index
   for ((index = 0; index < ${#value}; index++)); do
     character="${value:index:1}"
     if [[ "$character" == $'\xc2' ]] && (( index + 1 < ${#value} )); then
       next="${value:index+1:1}"
-      printf -v codepoint '%d' "'${next}"
-      if (( codepoint >= 128 && codepoint <= 159 )); then
-        printf -v hex '%04x' "$codepoint"
+      pair="$character$next"
+      case "$pair" in
+        $'\xc2\x80') hex=0080 ;;
+        $'\xc2\x81') hex=0081 ;;
+        $'\xc2\x82') hex=0082 ;;
+        $'\xc2\x83') hex=0083 ;;
+        $'\xc2\x84') hex=0084 ;;
+        $'\xc2\x85') hex=0085 ;;
+        $'\xc2\x86') hex=0086 ;;
+        $'\xc2\x87') hex=0087 ;;
+        $'\xc2\x88') hex=0088 ;;
+        $'\xc2\x89') hex=0089 ;;
+        $'\xc2\x8a') hex=008a ;;
+        $'\xc2\x8b') hex=008b ;;
+        $'\xc2\x8c') hex=008c ;;
+        $'\xc2\x8d') hex=008d ;;
+        $'\xc2\x8e') hex=008e ;;
+        $'\xc2\x8f') hex=008f ;;
+        $'\xc2\x90') hex=0090 ;;
+        $'\xc2\x91') hex=0091 ;;
+        $'\xc2\x92') hex=0092 ;;
+        $'\xc2\x93') hex=0093 ;;
+        $'\xc2\x94') hex=0094 ;;
+        $'\xc2\x95') hex=0095 ;;
+        $'\xc2\x96') hex=0096 ;;
+        $'\xc2\x97') hex=0097 ;;
+        $'\xc2\x98') hex=0098 ;;
+        $'\xc2\x99') hex=0099 ;;
+        $'\xc2\x9a') hex=009a ;;
+        $'\xc2\x9b') hex=009b ;;
+        $'\xc2\x9c') hex=009c ;;
+        $'\xc2\x9d') hex=009d ;;
+        $'\xc2\x9e') hex=009e ;;
+        $'\xc2\x9f') hex=009f ;;
+        *) hex= ;;
+      esac
+      if [[ -n "$hex" ]]; then
         output+="\\u$hex"
         index=$((index + 1))
         continue

package/dist/commands/core-policy-frontmatter.d.ts

@@ -4,5 +4,5 @@ export type FrontmatterResult = {
     stderr: Buffer;
 };
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
-export declare function runPolicyFrontmatter(args: readonly string[], cwd: string): FrontmatterResult;
+export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, pathValue?: string | undefined, platform?: NodeJS.Platform): FrontmatterResult;
 //# sourceMappingURL=core-policy-frontmatter.d.ts.map

package/dist/commands/core-policy-frontmatter.js

@@ -1,8 +1,9 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { usesGnuAwk } from '../lib/core-utils/awk-diagnostics.js';
 const USAGE = Buffer.from('USAGE: read-policy-frontmatter.sh <policy-file>\n');
 /** Byte-preserving port of core/scripts/read-policy-frontmatter.sh. */
-export function runPolicyFrontmatter(args, cwd) {
+export function runPolicyFrontmatter(args, cwd, pathValue = process.env.PATH, platform = process.platform) {
     const first = args[0];
     if (first === undefined)
         return { code: 1, stdout: Buffer.alloc(0), stderr: USAGE };
@@ -18,7 +19,9 @@ export function runPolicyFrontmatter(args, cwd) {
             return {
                 code: 0,
                 stdout: Buffer.alloc(0),
-                stderr: Buffer.from(`awk: warning: command line argument \`${first}' is a directory: skipped\n`),
+                stderr: Buffer.from(usesGnuAwk(pathValue, platform)
+                    ? `awk: warning: command line argument \`${first}' is a directory: skipped\n`
+                    : ''),
             };
         }
         if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EACCES' || code === 'ELOOP') {

package/dist/commands/core-policy.d.ts

@@ -5,8 +5,8 @@ export type CorePolicyResult = {
     stdout: Buffer;
     stderr: Buffer;
 };
-export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number): CorePolicyResult;
-export declare function runPolicyFrontmatter(args: readonly string[], cwd: string): FrontmatterResult;
+export declare function runPolicyAgeReport(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, nowEpoch?: number, platform?: NodeJS.Platform): CorePolicyResult;
+export declare function runPolicyFrontmatter(args: readonly string[], cwd: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): FrontmatterResult;
 export declare function runPolicyRetire(args: readonly string[], root: string, cwd: string, env?: NodeJS.ProcessEnv, now?: Date): CorePolicyResult;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runPolicyFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;

package/dist/commands/core-policy.js

@@ -206,8 +206,11 @@ function extractRulePaths(file) {
     return [...paths].sort();
 }
 function shellReferenceStem(reference) {
-    const lastDot = reference.lastIndexOf('.');
-    return lastDot === -1 ? reference : reference.slice(0, lastDot);
+    const normalized = reference.replace(/\/$/, '');
+    const slash = normalized.lastIndexOf('/');
+    const basename = normalized.slice(slash + 1);
+    const lastDot = basename.lastIndexOf('.');
+    return lastDot <= 0 ? normalized : normalized.slice(0, slash + 1 + lastDot);
 }
 function shellLsExtensionGlobHasMatch(root, stem) {
     const patternPath = path.join(root, `${stem}.*`);
@@ -223,8 +226,8 @@ function shellLsExtensionGlobHasMatch(root, stem) {
             return false;
         throw error;
     }
-    // Bash 5.2 enables globskipdots by default, so `.*` only matches when the
-    // directory has an actual hidden entry. readdir omits `.` and `..`.
+    // The shell checks extension siblings only within the reference basename's
+    // directory, so directory dot-components never count as sibling files.
     return entries.some((entry) => entry.startsWith(literalPrefix));
 }
 function refSummary(file, root) {
@@ -260,12 +263,17 @@ function refSummary(file, root) {
     return { stale, renamed, judged: judged.length };
 }
 function epochFromDate(value) {
-    if (!value)
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
         return 0;
-    const parsed = Date.parse(`${value}T00:00:00Z`);
-    if (!Number.isFinite(parsed) || new Date(parsed).toISOString().slice(0, 10) !== value)
+    const year = Number(value.slice(0, 4));
+    const month = Number(value.slice(5, 7));
+    const day = Number(value.slice(8, 10));
+    if (month < 1 || month > 12 || day < 1 || day > 31)
         return 0;
-    return Math.floor(parsed / 1000);
+    const parsed = new Date(Date.UTC(year, month - 1, day));
+    if (parsed.getUTCFullYear() !== year || parsed.getUTCMonth() + 1 !== month || parsed.getUTCDate() !== day)
+        return 0;
+    return Math.floor(parsed.getTime() / 1000);
 }
 function countLedgerRows(directory, withMtime, recursive, awkPath) {
     const counts = new Map();
@@ -380,7 +388,7 @@ function bashTestGreaterOrEqual(left, right, scriptPath, line) {
     }
     return { value: BigInt(left) >= parsed, stderr: '' };
 }
-export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000)) {
+export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Math.floor(Date.now() / 1000), platform = process.platform) {
     const parsed = parseAgeOptions(args, resolveBundledAsset(POLICY_AGE_REPORT_ASSET));
     if (parsed.kind === 'help')
         return policyResult(0, AGE_HELP);
@@ -440,13 +448,13 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             const singleIncident = ['user-correction', 'session-learning', 'back-pressure-failure'].includes(source) && (version || '1') === '1';
             const classes = [];
             if (fired === 0) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 157);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.minAge, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 173);
                 stderr += comparison.stderr;
                 if (comparison.value && usage.anyFiles)
                     classes.push('never-fired');
             }
             if (fired > 0) {
-                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 158);
+                const comparison = bashTestGreaterOrEqual(lastAge, parsed.dormantDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 174);
                 stderr += comparison.stderr;
                 if (comparison.value)
                     classes.push('dormant');
@@ -456,7 +464,7 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
             if (refs.renamed.length > 0)
                 classes.push('renamed-refs');
             if (singleIncident) {
-                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 162);
+                const comparison = bashTestGreaterOrEqual(ageDays, parsed.incidentDays, resolveBundledAsset(POLICY_AGE_REPORT_ASSET), 178);
                 stderr += comparison.stderr;
                 if (comparison.value && fired <= 1)
                     classes.push('single-incident-old');
@@ -496,8 +504,8 @@ export function runPolicyAgeReport(args, root, env = process.env, nowEpoch = Mat
     }
     return policyResult(0, stdout, stderr);
 }
-export function runPolicyFrontmatter(args, cwd) {
-    return runPolicyFrontmatterImpl(args, cwd);
+export function runPolicyFrontmatter(args, cwd, env = process.env, platform = process.platform) {
+    return runPolicyFrontmatterImpl(args, cwd, env.PATH, platform);
 }
 function parseRetireOptions(args, scriptPath, env) {
     const value = {

package/dist/commands/core-resolve-company-native.js

@@ -47,7 +47,7 @@ function readManifest(filePath, fileSystem, pathValue) {
             return {
                 code: 0,
                 stdout: Buffer.from('{"company":"","source":"none"}\n'),
-                stderr: Buffer.from(awkCannotOpenFileDiagnostic(filePath, "Permission denied", 1, process.platform, pathValue)),
+                stderr: Buffer.from(awkCannotOpenFileDiagnostic(filePath, "Permission denied", 11, process.platform, pathValue)),
             };
         }
         if (code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP")

package/dist/commands/core-session-journal-native.js

@@ -202,7 +202,7 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
                 fs.writeFileSync(counter, `${readCounter(counter) + 1}\n`);
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 312);
+                reportDirectoryWriteFailure(error, 346);
             }
         });
     }
@@ -215,7 +215,7 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
                 fs.writeFileSync(counter, "0\n");
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 320);
+                reportDirectoryWriteFailure(error, 354);
             }
         });
     }

package/dist/lib/core-utils/awk-diagnostics.d.ts

@@ -1,2 +1,9 @@
+/**
+ * The bundled shell companions emit awk's open-file diagnostic. GNU awk and
+ * the BSD awk shipped by macOS format that diagnostic differently. Prefer
+ * the executable selected by PATH; macOS runners can put GNU awk ahead of the
+ * system awk.
+ */
+export declare function usesGnuAwk(pathValue: string | undefined, platform: NodeJS.Platform): boolean;
 export declare function awkCannotOpenFileDiagnostic(filename: string, reason: string, sourceLine?: number, platform?: NodeJS.Platform, pathValue?: string | undefined): string;
 //# sourceMappingURL=awk-diagnostics.d.ts.map

package/dist/lib/core-utils/awk-diagnostics.js

@@ -6,7 +6,7 @@ import * as path from "node:path";
  * the executable selected by PATH; macOS runners can put GNU awk ahead of the
  * system awk.
  */
-function usesGnuAwk(pathValue, platform) {
+export function usesGnuAwk(pathValue, platform) {
     for (const directory of (pathValue ?? "/usr/bin:/bin").split(path.delimiter)) {
         if (!directory)
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.335.1-beta.0",
+  "version": "5.336.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {