@indigoai-us/hq-cli 5.345.11 → 5.345.13

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.13] — 2026-10-06
+- Stream provider transcript scans and account-move comparisons so large session files do not require whole-file reads.
+
+## [5.345.12] — 2026-10-06
+- Route rebuild-index, pin, scheduled-job commands, and worker-skill lint through the fast CLI entry path to reduce command startup time.
+- `hq daemon` on desktop machines no longer starts a lane reconcile process every 15 seconds when no lane needs it. It checks the lane store first: live lanes, keep-alive lanes, pending resumes and pending questions keep the 15-second cadence; a store with only settled lanes is reconciled once a minute, as before 15-second polling; an HQ folder with no lanes, questions, lead registry or lanes config is not reconciled at all. Outposts and self-hosted machines are unchanged.
+- Fixed Windows shell/native parity for jq output and Git Bash path display in hook-state and worktree helpers.
+- Fixed Windows parity for clipboard command shims and CRLF output from bundled scaffold scripts.
+- Made the repo-run-registry clock fixture deterministic and stripped jq.exe carriage returns before writing registry state files.
+
 ## [5.345.11] — 2026-10-05
 - Fix Windows parity for delegate, scheduled job, and session helpers.
 

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -65,11 +65,11 @@ done
 [ -f "$MANIFEST" ] || die "manifest not found: $MANIFEST"
 jq -e . "$MANIFEST" >/dev/null 2>&1 || die "manifest is not valid JSON: $MANIFEST"
 
-COMPANY="$(jq -r '.company // empty' "$MANIFEST")"
-PROJECT="$(jq -r '.project.name // empty' "$MANIFEST")"
-PRINCIPAL="$(jq -r '.to.principal // empty' "$MANIFEST")"
-DISPLAY="$(jq -r '.to.displayName // .to.principal // empty' "$MANIFEST")"
-STATUS="$(jq -r '.status // empty' "$MANIFEST")"
+COMPANY="$(jq -r '.company // empty' "$MANIFEST" | tr -d '\r')"
+PROJECT="$(jq -r '.project.name // empty' "$MANIFEST" | tr -d '\r')"
+PRINCIPAL="$(jq -r '.to.principal // empty' "$MANIFEST" | tr -d '\r')"
+DISPLAY="$(jq -r '.to.displayName // .to.principal // empty' "$MANIFEST" | tr -d '\r')"
+STATUS="$(jq -r '.status // empty' "$MANIFEST" | tr -d '\r')"
 [ -n "$COMPANY" ]   || die "manifest has no company"
 [ -n "$PROJECT" ]   || die "manifest has no project.name"
 [ -n "$PRINCIPAL" ] || die "manifest has no to.principal"
@@ -96,7 +96,7 @@ case "$PRINCIPAL" in
     TAIL="$(printf '%s' "$PRINCIPAL" | tail -c 9 | tr '[:upper:]' '[:lower:]')"
     LEGACY_GROUP="grp_dlg-$TAIL"
     NEXT_GROUP="$(agent_group_id "$PRINCIPAL")"
-    RECORDED_GROUP="$(jq -r '.grantPrincipal // empty' "$MANIFEST")"
+    RECORDED_GROUP="$(jq -r '.grantPrincipal // empty' "$MANIFEST" | tr -d '\r')"
     case "$RECORDED_GROUP" in
       "$LEGACY_GROUP"|"$NEXT_GROUP") GRANT_PRINCIPAL="$RECORDED_GROUP" ;;
       *) GRANT_PRINCIPAL="$NEXT_GROUP" ;;
@@ -109,7 +109,7 @@ case "$STATUS" in
   *) die "manifest status is '$STATUS' — grants run from 'building' (or re-run from 'granted'), not from there" ;;
 esac
 
-PREFIX_COUNT="$(jq '.vaultPrefixes | length' "$MANIFEST")"
+PREFIX_COUNT="$(jq '.vaultPrefixes | length' "$MANIFEST" | tr -d '\r')"
 [ "$PREFIX_COUNT" -gt 0 ] || die "manifest has no vaultPrefixes"
 
 # --- validate every prefix BEFORE touching anything --------------------------
@@ -118,7 +118,7 @@ PREFIX_COUNT="$(jq '.vaultPrefixes | length' "$MANIFEST")"
 # not exist in the bucket. Either is a hard error, never a silent grant.
 
 BAD="$(jq -r '.vaultPrefixes[] | .prefix
-  | select((endswith("/") | not) or startswith("companies/") or startswith("/"))' "$MANIFEST")"
+  | select((endswith("/") | not) or startswith("companies/") or startswith("/"))' "$MANIFEST" | tr -d '\r')"
 if [ -n "$BAD" ]; then
   die "prefix violates the hq-files prefix conventions (must be company-relative folder form ending in '/'): $BAD"
 fi
@@ -130,8 +130,8 @@ if [ "$GRANT_PRINCIPAL" != "$PRINCIPAL" ]; then
   echo "  0. Agent recipient: grants flow through group $GRANT_PRINCIPAL (created if absent, containing exactly $DISPLAY)"
 fi
 echo "  1. Push companies/$COMPANY/projects/$PROJECT/ to the vault (on-conflict keep)"
-jq -r '.vaultPrefixes[] | "  2. Grant \(.permission) on \(.prefix) — \(.reason // "")"' "$MANIFEST"
-WRITE_PREFIXES="$(jq -r '.vaultPrefixes[] | select(.permission == "write") | .prefix' "$MANIFEST")"
+jq -r '.vaultPrefixes[] | "  2. Grant \(.permission) on \(.prefix) — \(.reason // "")"' "$MANIFEST" | tr -d '\r'
+WRITE_PREFIXES="$(jq -r '.vaultPrefixes[] | select(.permission == "write") | .prefix' "$MANIFEST" | tr -d '\r')"
 if [ -n "$WRITE_PREFIXES" ]; then
   echo
   echo "NOTE: granting 'write' is a privilege escalation. The recipient will be able"
@@ -155,7 +155,7 @@ hq sync push "companies/$COMPANY/projects/$PROJECT/" --company "$COMPANY" --on-c
 
 jq -r --arg co "$COMPANY" \
   '((.knowledge // []) + (.policies // []))[] | select(startswith("companies/" + $co + "/"))' \
-  "$MANIFEST" | while IFS= read -r kpath; do
+  "$MANIFEST" | tr -d '\r' | while IFS= read -r kpath; do
   if [ -e "$HQ_ROOT/$kpath" ]; then
     hq sync push "$kpath" --company "$COMPANY" --on-conflict keep \
       || die "vault push failed for referenced knowledge: $kpath"
@@ -195,8 +195,8 @@ case "$GRANT_PRINCIPAL" in
     if printf '%s' "$RESOLVED" | jq -e '.status == "found" and (.person.personUid | type == "string") and (.person.companyUid | type == "string")' >/dev/null; then
       [ "$RESOLVE_RC" -eq 0 ] || die "recipient resolution failed"
       EXPECTED_TYPE=person
-      EXPECTED_ID="$(printf '%s' "$RESOLVED" | jq -r '.person.personUid')"
-      EXPECTED_COMPANY="$(printf '%s' "$RESOLVED" | jq -r '.person.companyUid')"
+      EXPECTED_ID="$(printf '%s' "$RESOLVED" | jq -r '.person.personUid' | tr -d '\r')"
+      EXPECTED_COMPANY="$(printf '%s' "$RESOLVED" | jq -r '.person.companyUid' | tr -d '\r')"
     elif printf '%s' "$RESOLVED" | jq -e '.status == "not_found"' >/dev/null; then
       case "$PRINCIPAL" in *@*) EXPECTED_TYPE=email; EXPECTED_ID="$(printf '%s' "$PRINCIPAL" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" ;; *) die "unresolved recipient" ;; esac
     else
@@ -223,15 +223,15 @@ read_acl() {
 NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 i=0
 while [ "$i" -lt "$PREFIX_COUNT" ]; do
-  PFX="$(jq -r ".vaultPrefixes[$i].prefix" "$MANIFEST")"
-  PERM="$(jq -r ".vaultPrefixes[$i].permission" "$MANIFEST")"
+  PFX="$(jq -r ".vaultPrefixes[$i].prefix" "$MANIFEST" | tr -d '\r')"
+  PERM="$(jq -r ".vaultPrefixes[$i].permission" "$MANIFEST" | tr -d '\r')"
   # Always address the recursive "folder/*" pattern explicitly. Since hq-pro
   # #3662 (2026-09-23) the server echoes the raw pattern back on read, and a
   # bare trailing "/" can mean a PRIVATE folder pattern when that flag is on.
   # A delegation grant is always the recursive share, never a private folder.
   ACL_PATTERN="${PFX}*"
   BEFORE="$(read_acl "$ACL_PATTERN")" || die "ACL preflight failed; no share attempted for $PFX"
-  EXPECTED_COMPANY="$(printf '%s' "$BEFORE" | jq -r '.companyUid')"
+  EXPECTED_COMPANY="$(printf '%s' "$BEFORE" | jq -r '.companyUid' | tr -d '\r')"
   SHARE_RC=0
   hq files share "$ACL_PATTERN" --with "$GRANT_PRINCIPAL" --permission "$PERM" --company "$COMPANY" || SHARE_RC=$?
   [ "$SHARE_RC" -eq 0 ] || echo "hq-delegate-grant: share reported an error on $PFX; checking exact grant" >&2

package/assets/scaffold/core/scripts/register-project.sh

@@ -73,7 +73,7 @@ mark_pending() {
   [ -n "$title" ] || title="$project"
   mkdir -p "$(dirname "$board")"
   if [ ! -f "$board" ]; then
-    jq -n --arg company "$company" '{company:$company, projects:[]}' > "$board"
+    jq -n --arg company "$company" '{company:$company, projects:[]}' | tr -d '\r' > "$board"
   fi
   tmp="$(mktemp)"
   jq \
@@ -101,7 +101,7 @@ mark_pending() {
           updated_at:$now
         }]
       end
-    ' "$board" > "$tmp"
+    ' "$board" | tr -d '\r' > "$tmp"
   mv "$tmp" "$board"
 }
 
@@ -132,7 +132,7 @@ register_one() {
   [ -n "$title" ] || title="$project"
   mkdir -p "$(dirname "$board")"
   if [ ! -f "$board" ]; then
-    jq -n --arg company "$company" '{company:$company, projects:[]}' > "$board"
+    jq -n --arg company "$company" '{company:$company, projects:[]}' | tr -d '\r' > "$board"
   fi
   tmp="$(mktemp)"
   jq \
@@ -164,7 +164,7 @@ register_one() {
           updated_at:$now
         }]
       end
-    ' "$board" > "$tmp"
+    ' "$board" | tr -d '\r' > "$tmp"
   mv "$tmp" "$board"
   jq -e \
     --arg id "$project" \
@@ -245,7 +245,7 @@ retry_pending() {
     count=$((count + 1))
     [ "$count" -le 3 ] || break
     ( register_one "$company" "$id" ) || true
-  done < <(jq -r '[.projects[]? | select(.pending_registration == true) | .id // empty] | .[]' "$board" 2>/dev/null || true)
+  done < <(jq -r '[.projects[]? | select(.pending_registration == true) | .id // empty] | .[]' "$board" 2>/dev/null | tr -d '\r' || true)
 }
 
 if [ "${1:-}" = "--audit" ]; then

package/assets/scaffold/core/scripts/repo-run-registry.sh

@@ -219,7 +219,7 @@ _prune_stale() {
       kept=$(echo "$kept" | jq --argjson e "$entry" '. + [$e]')
     done <<< "$runs"
   fi
-  jq --argjson runs "$kept" '.runs = $runs' "$REG_FILE" > "$tmp"
+  jq --argjson runs "$kept" '.runs = $runs' "$REG_FILE" | tr -d '\r' > "$tmp"
   mv "$tmp" "$REG_FILE"
   [[ $pruned -gt 0 ]] && _log "pruned $pruned stale entries"
   return 0
@@ -277,7 +277,7 @@ _cmd_register() {
        host: $host,
        started_at: $now,
        heartbeat_at: $now
-     }]' "$REG_FILE" > "$tmp"
+     }]' "$REG_FILE" | tr -d '\r' > "$tmp"
   mv "$tmp" "$REG_FILE"
   _unlock
   trap - EXIT
@@ -297,7 +297,7 @@ _cmd_deregister() {
   trap '_unlock' EXIT
   _ensure_reg
   local tmp="$REG_FILE.tmp.$$"
-  jq --arg run_id "$run_id" '.runs |= map(select(.run_id != $run_id))' "$REG_FILE" > "$tmp"
+  jq --arg run_id "$run_id" '.runs |= map(select(.run_id != $run_id))' "$REG_FILE" | tr -d '\r' > "$tmp"
   mv "$tmp" "$REG_FILE"
   _unlock
   trap - EXIT
@@ -320,7 +320,7 @@ _cmd_heartbeat() {
   local tmp="$REG_FILE.tmp.$$"
   jq --arg run_id "$run_id" --arg now "$now" \
     '.runs |= map(if .run_id == $run_id then .heartbeat_at = $now else . end)' \
-    "$REG_FILE" > "$tmp"
+    "$REG_FILE" | tr -d '\r' > "$tmp"
   mv "$tmp" "$REG_FILE"
   _unlock
   trap - EXIT
@@ -329,7 +329,7 @@ _cmd_heartbeat() {
 _cmd_list() {
   _ensure_reg
   _prune_stale_locked
-  jq '.runs' "$REG_FILE"
+  jq '.runs' "$REG_FILE" | tr -d '\r'
 }
 
 _cmd_clean_stale() {
@@ -371,14 +371,14 @@ _cmd_owner_of() {
          ($entry.scope == "repo" and $entry.repo_path == $repo)
          or (($entry.scope | startswith("worktree:")) and
              worktree_covers($target; $entry.scope))
-       ) | $entry]' "$REG_FILE"
+       ) | $entry]' "$REG_FILE" | tr -d '\r'
   else
     jq --arg repo "$repo" --arg target "$(_abs_path "$path")" \
       '[.runs[] | select(
          (.scope == "repo" and .repo_path == $repo)
          or (.scope | startswith("worktree:")) and
             ($target | startswith(.scope | sub("^worktree:"; "")))
-       )]' "$REG_FILE"
+       )]' "$REG_FILE" | tr -d '\r'
   fi
 }
 
@@ -451,7 +451,7 @@ _cmd_check() {
 
   # Emit one summary line per owner to stderr for the calling hook
   echo "$matches" | jq -r '.[] |
-    "run_id=\(.run_id) pid=\(.pid) command=\(.command) project=\(.project) scope=\(.scope) repo=\(.repo_path) started=\(.started_at) heartbeat=\(.heartbeat_at)"' >&2
+    "run_id=\(.run_id) pid=\(.pid) command=\(.command) project=\(.project) scope=\(.scope) repo=\(.repo_path) started=\(.started_at) heartbeat=\(.heartbeat_at)"' | tr -d '\r' >&2
   return 2
 }
 

package/assets/scaffold/core/scripts/resume-thread-lock.sh

@@ -138,7 +138,7 @@ emit_unlocked() {
   jq -cn \
     --arg thread_id "$thread_id" \
     --arg lock_path "$relative_lock_path" \
-    '{status:"unlocked", thread_id:$thread_id, lock_path:$lock_path}'
+    '{status:"unlocked", thread_id:$thread_id, lock_path:$lock_path}' | tr -d '\r'
 }
 
 emit_stale() {
@@ -152,7 +152,7 @@ emit_stale() {
     --arg resumed_at "$resumed_at" \
     --arg lock_generation "$generation" \
     --arg prompt "$prompt" \
-    '{status:"stale", thread_id:$thread_id, lock_path:$lock_path, stale_reason:$stale_reason, session_id:$session_id, resumed_at:$resumed_at, lock_generation:$lock_generation, prompt:$prompt}'
+    '{status:"stale", thread_id:$thread_id, lock_path:$lock_path, stale_reason:$stale_reason, session_id:$session_id, resumed_at:$resumed_at, lock_generation:$lock_generation, prompt:$prompt}' | tr -d '\r'
 }
 
 emit_locked() {
@@ -165,7 +165,7 @@ emit_locked() {
     --arg resumed_at "$resumed_at" \
     --arg lock_generation "$generation" \
     --arg prompt "$prompt" \
-    '{status:"locked", thread_id:$thread_id, lock_path:$lock_path, session_id:$session_id, resumed_at:$resumed_at, lock_generation:$lock_generation, prompt:$prompt}'
+    '{status:"locked", thread_id:$thread_id, lock_path:$lock_path, session_id:$session_id, resumed_at:$resumed_at, lock_generation:$lock_generation, prompt:$prompt}' | tr -d '\r'
 }
 
 # Print the existing lock's state. A damaged or expired marker is deliberately
@@ -244,7 +244,7 @@ emit_acquired() {
     --arg lock_path "$relative_lock_path" \
     --arg session_id "$session_id" \
     --arg lock_generation "$generation" \
-    '{status:"acquired", thread_id:$thread_id, lock_path:$lock_path, session_id:$session_id, lock_generation:$lock_generation}'
+    '{status:"acquired", thread_id:$thread_id, lock_path:$lock_path, session_id:$session_id, lock_generation:$lock_generation}' | sed 's/\r$//'
 }
 
 case "$subcommand" in

package/assets/scaffold/core/scripts/verify-story-deliverables.sh

@@ -123,7 +123,7 @@ while IFS= read -r d; do
 done < <(jq_capture -r '.[]' <<<"$REFS_JSON")
 
 if [ "$JSON" = 1 ]; then
-  jq -cn --arg s "$STORY" \
+  jq_capture -cn --arg s "$STORY" \
     --argjson m "$(printf '%s\n' "${missing[@]:-}" | jq_capture -R . | jq_capture -s 'map(select(. != ""))')" \
     --argjson p "$(printf '%s\n' "${present[@]:-}" | jq_capture -R . | jq_capture -s 'map(select(. != ""))')" \
     '{story:$s, status:(if ($m|length)==0 then "present" else "missing" end), missing:$m, present:$p}'

package/assets/scaffold/core/scripts/worktree-gc.sh

@@ -350,7 +350,7 @@ if [[ "$JSON" -eq 1 ]]; then
       skipped_by_reason: ([$records[] | select(.action=="skipped") | .reason]
                           | group_by(.) | map({(.[0]): length}) | add // {}),
       records: $records
-    }'
+    }' | tr -d '\r'
 else
   if [[ "$APPLY" -eq 1 ]]; then
     echo "worktree-gc [apply]: examined $examined · removed $removed · reclaimed ${reclaimed_gb} GB · skipped ${skip_total} (retention ${DAYS}d)"

package/dist/commands/core-delegate-w1b.js

@@ -7,7 +7,7 @@ import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
 import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
-import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
+import { commandExists, delegateDiagnosticPath, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { ACL_SOURCE_DISPLAY_LABELS } from "../utils/files-browse-acl.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
@@ -179,11 +179,16 @@ function bashPath(value) {
     const drivePath = /^([A-Za-z]):\/(.*)$/u.exec(normalized);
     return drivePath ? `/${drivePath[1].toLowerCase()}/${drivePath[2]}` : normalized;
 }
+function shellFallbackArgs(args) {
+    if (process.platform !== "win32")
+        return args;
+    return args.map((arg, index) => args[index - 1] === "--manifest" && /^[a-z]:[\\/]/i.test(arg) ? bashPath(arg) : arg);
+}
 function runShellFallback(name, args, context) {
     const root = context.root ?? context.cwd;
     const result = runBundledScript({
         asset: ASSETS[name],
-        args,
+        args: shellFallbackArgs(args),
         cwd: context.cwd,
         hqRoot: bashPath(root),
         captureOutput: true,
@@ -404,16 +409,16 @@ function runGrant(args, context) {
     if (!manifestPath)
         return fail("grant", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("grant", `manifest not found: ${shellDisplayPath(manifestPath)}`);
+        return fail("grant", `manifest not found: ${delegateDiagnosticPath(manifestPath)}`);
     let manifest;
     try {
         manifest = readJsonFile(manifestPath);
     }
     catch {
-        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
+        return fail("grant", `manifest is not valid JSON: ${delegateDiagnosticPath(manifestPath)}`);
     }
     if (manifest === null || manifest === false)
-        return fail("grant", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
+        return fail("grant", `manifest is not valid JSON: ${delegateDiagnosticPath(manifestPath)}`);
     if (!isRecord(manifest))
         return fail("grant", "manifest has no company");
     const company = jqRawPath(manifest, "company");
@@ -790,10 +795,10 @@ function runSend(args, context) {
     if (!manifestPath)
         return fail("send", "--manifest is required");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("send", `manifest not found: ${shellDisplayPath(manifestPath)}`);
+        return fail("send", `manifest not found: ${delegateDiagnosticPath(manifestPath)}`);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("send", `manifest is not valid JSON: ${shellDisplayPath(manifestPath)}`);
+        return fail("send", `manifest is not valid JSON: ${delegateDiagnosticPath(manifestPath)}`);
     if (send) {
         const publishedPath = path.join(context.root ?? context.cwd, jqRawPath(manifest, "publication.manifestPath"));
         if (malformedJsonFile(publishedPath)) {
@@ -1047,12 +1052,12 @@ function runVerify(args, context) {
     if (!manifestPath)
         return fail("verify", "--manifest is required (or --dry-run with --company/--project/--to)");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
-        return fail("verify", `manifest not found: ${shellDisplayPath(manifestPath)}`);
+        return fail("verify", `manifest not found: ${delegateDiagnosticPath(manifestPath)}`);
     if (malformedJsonFile(manifestPath))
         return runShellFallback("verify", args, context);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
-        return fail("verify", `jq: error: ${shellDisplayPath(manifestPath)}: Invalid JSON`);
+        return fail("verify", `jq: error: ${delegateDiagnosticPath(manifestPath)}: Invalid JSON`);
     const lock = `${manifestPath}.send-lock`;
     try {
         fs.mkdirSync(lock);

package/dist/commands/core-delegate.d.ts

@@ -40,6 +40,7 @@ export declare function jqRawPaths(value: unknown, dottedPaths: string[], fallba
 export declare function requireRecord(value: unknown, property: string): JsonRecord;
 export declare function moveFile(source: string, target: string): void;
 export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean): void;
+export declare function delegateDiagnosticPath(argument: string): string;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runDelegateFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 /** Register the Wave 1a delegate commands and preserve the shell rollback path. */

package/dist/commands/core-delegate.js

@@ -188,6 +188,7 @@ export function moveFile(source, target) {
 }
 export function writeJsonAtomically(target, value, siblingTemp = false) {
     const serialized = serializeJqJson(value, "pretty");
+    // Native delegate JSON writers use LF on every platform.
     if (siblingTemp) {
         const temporary = `${target}.tmp`;
         fs.writeFileSync(temporary, serialized);
@@ -557,6 +558,13 @@ function parseStandard(name, args) {
     }
     return { values };
 }
+export function delegateDiagnosticPath(argument) {
+    // Git Bash receives drive-qualified native paths in MSYS spelling. Preserve
+    // relative and already-MSYS path arguments exactly as supplied.
+    if (process.platform === "win32" && /^[a-z]:[\\/]/i.test(argument))
+        return shellDisplayPath(argument);
+    return argument;
+}
 function existingManifest(name, args, context) {
     const prefix = `hq-delegate-${name}:`;
     const parsed = parseStandard(name, args);
@@ -575,11 +583,11 @@ function existingManifest(name, args, context) {
     }
     const file = path.resolve(context.cwd, manifestArg);
     if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
-        writeErr(`${prefix} manifest not found: ${shellDisplayPath(manifestArg)}\n`);
+        writeErr(`${prefix} manifest not found: ${delegateDiagnosticPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     if (!jqValid(file)) {
-        writeErr(`${prefix} manifest is not valid JSON: ${shellDisplayPath(manifestArg)}\n`);
+        writeErr(`${prefix} manifest is not valid JSON: ${delegateDiagnosticPath(manifestArg)}\n`);
         return { code: 1, parsed };
     }
     return { file, parsed, document: readJsonFile(file) };

package/dist/commands/core-handoff.js

@@ -12,6 +12,7 @@ import { defaultBackgroundDependencies, runBackgroundLauncher, } from "../lib/se
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 import { compactJson, isRecord, jqTruthy, prettyJson, runHandoffOpenSteps, shellDate, } from "./core-handoff-open-steps.js";
 export { runHandoffOpenSteps };
 const ASSETS = {
@@ -113,16 +114,20 @@ function git(args, cwd) {
 }
 function commandAvailable(name) {
     for (const entry of (process.env.PATH ?? "").split(path.delimiter)) {
-        const candidate = path.resolve(entry || ".", name);
-        try {
-            fs.accessSync(candidate, fs.constants.X_OK);
-            if (fs.statSync(candidate).isFile())
-                return true;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES")
-                throw error;
+        const candidates = process.platform === "win32" && path.extname(name) === ""
+            ? [`${name}.exe`, `${name}.cmd`, `${name}.bat`, name].map((candidate) => path.resolve(entry || ".", candidate))
+            : [path.resolve(entry || ".", name)];
+        for (const candidate of candidates) {
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                if (fs.statSync(candidate).isFile())
+                    return true;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "EACCES" && code !== "UNKNOWN")
+                    throw error;
+            }
         }
     }
     return false;
@@ -143,6 +148,7 @@ function copyClipboardText(value, cwd) {
             env: process.env,
             input: value,
             stdio: ["pipe", "ignore", "ignore"],
+            shell: process.platform === "win32",
         });
         return result.status === 0;
     }
@@ -797,18 +803,45 @@ function spawnBashDetached(script, args, cwd, root, logFile) {
     let fd;
     try {
         mkdirParent(logFile);
-        fd = fs.openSync(logFile, "a");
-        const child = spawn("bash", [script, ...args], {
-            cwd,
-            env: { ...process.env, HQ_ROOT: root },
-            detached: true,
-            windowsHide: true,
-            stdio: ["ignore", fd, fd],
-        });
+        const childEnv = { ...process.env };
+        if (process.platform === "win32") {
+            // Windows treats environment variable names case-insensitively. Replace
+            // every inherited spelling with the Git Bash spelling for this root;
+            // if Bash derives PWD from Node's Windows cwd itself, it can truncate the
+            // drive prefix when starting a detached child.
+            for (const key of Object.keys(childEnv)) {
+                if (key.toUpperCase() === "PWD")
+                    delete childEnv[key];
+            }
+            childEnv.PWD = shellDisplayPath(root);
+            childEnv.HQ_ROOT = shellDisplayPath(root);
+            childEnv.HQ_HANDOFF_CHILD_LOG_FILE = shellDisplayPath(logFile);
+        }
+        else {
+            fd = fs.openSync(logFile, "a");
+            childEnv.HQ_ROOT = root;
+        }
+        const child = process.platform === "win32"
+            ? spawn("bash", ["-c", 'cd -- "$HQ_ROOT" || exit; exec bash "$@" >> "$HQ_HANDOFF_CHILD_LOG_FILE" 2>&1', "_", shellDisplayPath(script), ...args], {
+                cwd,
+                env: childEnv,
+                detached: true,
+                windowsHide: true,
+                stdio: ["ignore", "ignore", "ignore"],
+            })
+            : spawn("bash", [script, ...args], {
+                cwd,
+                env: childEnv,
+                detached: true,
+                windowsHide: true,
+                stdio: ["ignore", fd, fd],
+            });
         child.once("error", (error) => appendLog(logFile, `${error.message}\n`));
         child.unref();
-        fs.closeSync(fd);
-        fd = undefined;
+        if (fd !== undefined) {
+            fs.closeSync(fd);
+            fd = undefined;
+        }
         return child.pid;
     }
     catch {
@@ -836,11 +869,18 @@ function parseLearningCount(file) {
     }
 }
 async function launchHandoffPost(args, root) {
+    const childEnv = { ...process.env, HQ_NATIVE_HANDOFF_POST_CHILD: "1" };
+    if (process.platform === "win32") {
+        for (const key of Object.keys(childEnv))
+            if (key.toUpperCase() === "PWD")
+                delete childEnv[key];
+        childEnv.PWD = shellDisplayPath(root);
+    }
     return await new Promise((resolve) => {
         try {
             const child = spawn("hq", ["core", "--hq-root", root, "handoff", "post", ...args], {
                 cwd: root,
-                env: { ...process.env, HQ_NATIVE_HANDOFF_POST_CHILD: "1" },
+                env: childEnv,
                 detached: true,
                 windowsHide: true,
                 stdio: "ignore",
@@ -902,19 +942,14 @@ export function runHandoffPostWorker(args, context) {
             log("document-release: skipped unsupported files_touched entry");
         if (counts.scope > 0) {
             const installedScript = path.join(root, "core/scripts/skill-installed.sh");
-            const logFd = fs.openSync(logMain, "a");
-            let installedStatus = null;
-            try {
-                const installed = spawnSync("bash", [installedScript, "document-release", process.env.HQ_ACTIVE_COMPANY || ""], {
-                    cwd: root,
-                    env: process.env,
-                    stdio: ["ignore", "ignore", logFd],
-                });
-                installedStatus = installed.status;
-            }
-            finally {
-                fs.closeSync(logFd);
-            }
+            const installed = spawnSync("bash", [installedScript, "document-release", process.env.HQ_ACTIVE_COMPANY || ""], {
+                cwd: root,
+                env: process.env,
+                stdio: ["ignore", "ignore", "pipe"],
+            });
+            if (installed.stderr?.length)
+                fs.appendFileSync(logMain, installed.stderr);
+            const installedStatus = installed.status;
             if (installedStatus === 0) {
                 log(`document-release: eligible and pending runtime dispatch by handoff skill (${counts.scope} scoped files; no dispatch proof)`);
             }

package/dist/commands/core-hq-session-native.js

@@ -4,6 +4,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { awkCannotOpenFileDiagnostic } from "../lib/core-utils/awk-diagnostics.js";
+import { shellDisplayPath } from "../lib/core-utils/shell-display-path.js";
 export const HQ_SESSION_ASSET = "core/scripts/hq-session.sh";
 export const HQ_SESSION_HELP = [
     "hq-core: public",
@@ -154,14 +155,18 @@ function findMetaValue(contents, key) {
     return { found: false, value: "" };
 }
 function getMetaValue(contents, key) { return findMetaValue(contents, key).value; }
-const WORK_MESH_SESSION_START_COMMAND = 'printf "%s" "$1" | bash "$2" SessionStart';
+const WORK_MESH_SESSION_START_COMMAND = 'event=$HQ_CORE_SESSION_EVENT_JSON; unset HQ_CORE_SESSION_EVENT_JSON; printf "%s" "$event" | bash "$1" SessionStart';
 function recordWorkMeshSessionStart(input) {
     const hook = path.join(input.root, "core", "hooks", "SessionStart", "35-work-mesh-session-start.sh");
     // Keep the shell hook as the single owner of SessionStart's Work Mesh behavior.
     // The bundled hq-session helper skips this path if either dependency is absent.
     if (!input.isFile(hook) || !input.findExecutable("jq", input.env))
         return "";
-    const event = JSON.stringify({ session_id: input.sessionId, cwd: input.env.PWD || input.cwd });
+    // hq-session.sh passes its inherited PWD into the Work Mesh event. On
+    // Windows that value is drive-letter based even though Git Bash's own pwd
+    // builtin uses /c/... for filesystem operations.
+    const eventCwd = input.env.PWD || input.cwd;
+    const event = JSON.stringify({ session_id: input.sessionId, cwd: eventCwd });
     if (!event)
         return "";
     const logFile = path.join(input.root, "workspace", "logs", "work-mesh-hook.log");
@@ -170,10 +175,15 @@ function recordWorkMeshSessionStart(input) {
     }
     catch { /* The shell also suppresses mkdir failure and attempts the redirected launch. */ }
     try {
-        input.spawnDetached("nohup", ["bash", "-c", WORK_MESH_SESSION_START_COMMAND, "_", event, hook], input.cwd, {
+        input.spawnDetached("nohup", ["bash", "-c", WORK_MESH_SESSION_START_COMMAND, "_", shellDisplayPath(hook)], input.cwd, {
             ...input.env,
+            HQ_CORE_SESSION_EVENT_JSON: event,
             HQ_ROOT: input.root,
             CLAUDE_CODE_SESSION_ID: input.sessionId,
+            // Git for Windows must not rewrite the JSON payload's backslashes as it
+            // converts command arguments. The following hook path remains eligible
+            // for normal MSYS path conversion.
+            ...(process.platform === "win32" ? { MSYS2_ARG_CONV_EXCL: "*" } : {}),
         }, logFile);
         return "";
     }
@@ -249,6 +259,15 @@ function currentMetaPath(root, sessionOverride, deps) {
             : path.join(root, "workspace", "sessions", id, "meta.yaml")
         : "";
 }
+function shellPathForDiagnostic(value) {
+    if (process.platform !== "win32")
+        return value;
+    const absolute = path.win32.resolve(value);
+    const workspaceIndex = absolute.toLowerCase().indexOf("\\workspace\\");
+    return workspaceIndex < 0
+        ? absolute
+        : `${absolute.slice(0, workspaceIndex)}/workspace/${absolute.slice(workspaceIndex + "\\workspace\\".length).replaceAll("\\", "/")}`;
+}
 function exactCompanyDir(root, slug, deps) {
     if (!root || !slug)
         return false;
@@ -412,7 +431,9 @@ function validateSenior(value) {
     return id !== "" && id !== "." && id !== ".." && /^[A-Za-z0-9._-]+$/.test(id);
 }
 function atomicWrite(filePath, contents, deps) {
-    const temp = deps.makeTempPath();
+    // Keep the staging file on the destination volume so atomic rename works
+    // when the system temp directory and HQ_ROOT are on different Windows drives.
+    const temp = path.join(path.dirname(filePath), path.basename(deps.makeTempPath()));
     try {
         deps.writeFile(temp, contents, 0o600);
         deps.rename(temp, filePath);
@@ -489,7 +510,7 @@ export function executeHqSession(argv, context, overrides = {}) {
         }
         catch (error) {
             if (error?.code === "EACCES" || error?.code === "EPERM") {
-                return { code: 2, stdout: "", stderr: awkCannotOpenFileDiagnostic(metaPath, "Permission denied", 6, process.platform, deps.env.PATH) };
+                return { code: 2, stdout: "", stderr: awkCannotOpenFileDiagnostic(shellPathForDiagnostic(metaPath), "Permission denied", 6, process.platform, deps.env.PATH) };
             }
             if (isExpectedFsMiss(error))
                 return { code: 1, stdout: "", stderr: `awk: cannot open ${metaPath} (Permission denied)\n` };

package/dist/commands/core-job-notify-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runJobNotifyFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined): number;
+//# sourceMappingURL=core-job-notify-fast.d.ts.map