@indigoai-us/hq-cli 5.345.114 → 5.345.116

package/dist/commands/core-jobs-schedule.js

@@ -0,0 +1,243 @@
+/** Native schedule parsing shared by hq core and local bot jobs. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+const SCHEDULE_PARSE_USAGE = 'usage: jobs-schedule-parse.sh [--tz IANA] "<nl or cron schedule>"\n';
+const CRON_RE = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$/;
+const processScheduleParseWriters = {
+    stdout: (value) => { process.stdout.write(value); },
+    stderr: (value) => { process.stderr.write(value); },
+};
+const DAY_NAMES = {
+    sun: 0, sunday: 0, mon: 1, monday: 1, tue: 2, tues: 2, tuesday: 2,
+    wed: 3, wednesday: 3, thu: 4, thur: 4, thurs: 4, thursday: 4,
+    fri: 5, friday: 5, sat: 6, saturday: 6,
+};
+const DAY_LABELS = {
+    "0": "Sunday", "1": "Monday", "2": "Tuesday", "3": "Wednesday",
+    "4": "Thursday", "5": "Friday", "6": "Saturday", "1-5": "weekday",
+    "*": "day",
+};
+function parseClock(text) {
+    const match = /^(\d{1,2})(?::(\d{2}))?\s*(am|pm)?$/i.exec(text.trim().toLowerCase().replace(/ /g, ""));
+    if (!match)
+        return undefined;
+    let hour = Number.parseInt(match[1], 10);
+    const minute = Number.parseInt(match[2] || "0", 10);
+    const meridiem = match[3];
+    if (minute > 59)
+        return undefined;
+    if (meridiem) {
+        if (hour < 1 || hour > 12)
+            return undefined;
+        hour = meridiem === "am"
+            ? (hour === 12 ? 0 : hour)
+            : (hour === 12 ? 12 : hour + 12);
+    }
+    else if (hour > 23) {
+        return undefined;
+    }
+    return [hour, minute];
+}
+function formatClock(hour, minute) {
+    const hour12 = hour % 12 || 12;
+    return `${hour12}:${String(minute).padStart(2, "0")} ${hour < 12 ? "AM" : "PM"}`;
+}
+function humanizeCron(cron, timezone) {
+    const fields = cron.split(/\s+/);
+    if (fields.length !== 5)
+        return `Cron \`${cron}\` (${timezone})`;
+    const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
+        && month === "*" && (dayOfWeek === "*" || dayOfWeek === "1-5")) {
+        const day = dayOfWeek === "1-5" ? "Every weekday" : "Every day";
+        return `${day} at ${formatClock(+hour, +minute)} (${timezone})`;
+    }
+    if (/^\d+$/.test(minute) && /^\d+$/.test(hour) && dayOfMonth === "*"
+        && month === "*" && /^\d+$/.test(dayOfWeek)) {
+        const day = DAY_LABELS[dayOfWeek] || `day ${dayOfWeek}`;
+        return `Every ${day} at ${formatClock(+hour, +minute)} (${timezone})`;
+    }
+    if (minute.startsWith("*/") && hour === "*" && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every ${minute.slice(2)} minutes (${timezone})`;
+    }
+    if (minute === "0" && hour.startsWith("*/") && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every ${hour.slice(2)} hours (${timezone})`;
+    }
+    if (minute === "0" && hour === "*" && dayOfMonth === "*"
+        && month === "*" && dayOfWeek === "*") {
+        return `Every hour on the hour (${timezone})`;
+    }
+    return `Cron \`${cron}\` (${timezone})`;
+}
+function parseNaturalLanguage(text) {
+    const normalized = text.trim().toLowerCase();
+    let match = /^every\s+(\d+)\s+minutes?$/.exec(normalized);
+    if (match) {
+        const minutes = Number(match[1]);
+        if (minutes < 1 || minutes > 59)
+            return [null, "minute interval must be 1..59"];
+        return [`*/${minutes} * * * *`, `Every ${minutes} minutes`];
+    }
+    if (normalized === "every hour" || normalized === "hourly") {
+        return ["0 * * * *", "Every hour on the hour"];
+    }
+    match = /^every\s+(\d+)\s+hours?$/.exec(normalized);
+    if (match) {
+        const hours = Number(match[1]);
+        if (hours < 1 || hours > 23)
+            return [null, "hour interval must be 1..23"];
+        return [`0 */${hours} * * *`, `Every ${hours} hours`];
+    }
+    match = /^(?:every\s+)?(weekday|weekdays|day|daily)\s+(?:at\s+)?(.+)$/.exec(normalized);
+    if (match) {
+        const clock = parseClock(match[2]);
+        if (!clock)
+            return [null, `could not parse time: ${match[2]}`];
+        const [hour, minute] = clock;
+        const weekdays = match[1] === "weekday" || match[1] === "weekdays";
+        return [
+            `${minute} ${hour} * * ${weekdays ? "1-5" : "*"}`,
+            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(hour, minute)}`,
+        ];
+    }
+    match = /^(?:every\s+)?(sun(?:day)?|mon(?:day)?|tue(?:s|sday)?|wed(?:nesday)?|thu(?:r|rs|rsday)?|fri(?:day)?|sat(?:urday)?)s?\s+(?:at\s+)?(.+)$/.exec(normalized);
+    if (match) {
+        const day = DAY_NAMES[match[1]];
+        const clock = parseClock(match[2]);
+        if (!clock)
+            return [null, `could not parse time: ${match[2]}`];
+        return [
+            `${clock[1]} ${clock[0]} * * ${day}`,
+            `Every ${DAY_LABELS[String(day)]} at ${formatClock(...clock)}`,
+        ];
+    }
+    match = /^at\s+(.+?)\s+every\s+(weekday|weekdays|day|daily)$/.exec(normalized);
+    if (match) {
+        const clock = parseClock(match[1]);
+        if (!clock)
+            return [null, `could not parse time: ${match[1]}`];
+        const weekdays = match[2] === "weekday" || match[2] === "weekdays";
+        return [
+            `${clock[1]} ${clock[0]} * * ${weekdays ? "1-5" : "*"}`,
+            `${weekdays ? "Every weekday" : "Every day"} at ${formatClock(...clock)}`,
+        ];
+    }
+    return [
+        null,
+        "unrecognized schedule — try 'every weekday at 9am', 'every day at 14:30', "
+            + "'every monday at 9am', a 5-field cron, or 'every 15 minutes'",
+    ];
+}
+function isValidTimezone(timezone) {
+    const wellFormed = /^(UTC|[A-Za-z0-9_+-]+(\/[A-Za-z0-9_+-]+)+)$/;
+    if (!wellFormed.test(timezone))
+        return false;
+    try {
+        new Intl.DateTimeFormat(undefined, { timeZone: timezone });
+        return true;
+    }
+    catch {
+        // Hosts without tzdata accept the same well-formed names as the shell.
+        return wellFormed.test(timezone);
+    }
+}
+export function detectHostTimezone(override, resolveLocaltime = fs.realpathSync, readTimedatectl = () => {
+    const result = spawnSync("timedatectl", ["show", "-p", "Timezone", "--value"], { encoding: "utf8", timeout: 2000, stdio: ["ignore", "pipe", "ignore"] });
+    if (result.error || result.status !== 0)
+        return "";
+    return result.stdout || "";
+}) {
+    if (override)
+        return override;
+    const environmentTimezone = (process.env.TZ || "").trim();
+    if (environmentTimezone && environmentTimezone.includes("/"))
+        return environmentTimezone;
+    try {
+        const realpath = resolveLocaltime("/etc/localtime");
+        const parts = realpath.split(path.sep).filter(Boolean);
+        const zoneinfo = parts.indexOf("zoneinfo");
+        if (zoneinfo >= 0 && parts.slice(zoneinfo + 1).length) {
+            return parts.slice(zoneinfo + 1).join("/");
+        }
+    }
+    catch {
+        // Ignore an unavailable local timezone link.
+    }
+    try {
+        const timezone = readTimedatectl().trim();
+        if (timezone && timezone.includes("/"))
+            return timezone;
+    }
+    catch {
+        // Ignore unavailable timedatectl.
+    }
+    return "UTC";
+}
+export function runScheduleParse(argv, writers = processScheduleParseWriters) {
+    let timezoneOverride = "";
+    const args = [...argv];
+    while (args.length) {
+        const argument = args[0];
+        if (argument === "--tz") {
+            if (args.length < 2) {
+                writers.stderr(SCHEDULE_PARSE_USAGE);
+                return 2;
+            }
+            timezoneOverride = args[1];
+            args.splice(0, 2);
+        }
+        else if (argument === "--json") {
+            args.shift();
+        }
+        else if (argument === "-h" || argument === "--help") {
+            writers.stderr(SCHEDULE_PARSE_USAGE);
+            return 2;
+        }
+        else if (argument === "--") {
+            args.shift();
+            break;
+        }
+        else if (argument.startsWith("-")) {
+            writers.stderr(`jobs-schedule-parse: unknown flag: ${argument}\n${SCHEDULE_PARSE_USAGE}`);
+            return 2;
+        }
+        else {
+            break;
+        }
+    }
+    if (!args.length) {
+        writers.stderr(SCHEDULE_PARSE_USAGE);
+        return 2;
+    }
+    const input = args.join(" ").trim();
+    if (!input) {
+        writers.stdout('{"ok":false,"error":"empty schedule"}\n');
+        return 1;
+    }
+    const timezone = detectHostTimezone(timezoneOverride);
+    if (!isValidTimezone(timezone)) {
+        writers.stdout(`${JSON.stringify({ ok: false, error: `invalid IANA timezone: ${timezone}` })}\n`);
+        return 1;
+    }
+    if (CRON_RE.test(input) && !/[A-Za-z]/.test(input)) {
+        writers.stdout(`${JSON.stringify({ ok: true, cron: input, timezone, human: humanizeCron(input, timezone), source: "cron" })}\n`);
+        return 0;
+    }
+    const namedCron = /^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(mon-fri|monday-friday)$/i.exec(input);
+    if (namedCron) {
+        const cron = `${namedCron[1]} ${namedCron[2]} ${namedCron[3]} ${namedCron[4]} 1-5`;
+        writers.stdout(`${JSON.stringify({ ok: true, cron, timezone, human: humanizeCron(cron, timezone), source: "cron" })}\n`);
+        return 0;
+    }
+    const [cron, message] = parseNaturalLanguage(input);
+    if (cron === null) {
+        writers.stdout(`${JSON.stringify({ ok: false, error: message })}\n`);
+        return 1;
+    }
+    writers.stdout(`${JSON.stringify({ ok: true, cron, timezone, human: `${message} (${timezone})`, source: "nl" })}\n`);
+    return 0;
+}
+//# sourceMappingURL=core-jobs-schedule.js.map

package/dist/commands/core-native-utilities.d.ts

@@ -1,4 +1,4 @@
-/** Shared dispatch for the default-off Wave 5 operator utilities. */
+/** Shared registration for native operator utility commands. */
 import type { Command } from "commander";
 import { type CoreCommandRoot } from "./core-command-catalog.js";
 export type UtilityOutput = {
@@ -15,13 +15,12 @@ export type UtilityContext = {
 };
 export type NativeUtilityDefinition = {
     name: string;
-    asset: string;
     root: CoreCommandRoot;
     summary: string;
     resolveRoot: (cwd: string, hqRoot?: string) => string;
     run: (args: string[], context: UtilityContext) => UtilityOutput | Promise<UtilityOutput>;
 };
-/** Register one raw-argv command and retain the original shell as rollback. */
+/** Register one raw-argv native command. */
 export declare function registerNativeUtility(core: Command, definition: NativeUtilityDefinition): void;
 export declare function utilityError(message: string, code?: number): UtilityOutput;
 /** Preserve Bash's set -u diagnostic for a missing positional option value. */

package/dist/commands/core-native-utilities.js

@@ -1,9 +1,7 @@
 import * as path from "node:path";
-import { coreNativeUtilitiesEnabled } from "./core-native-utilities-flag.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
-import { runBundledScript } from "../utils/run-bundled-script.js";
 import { packageRoot } from "../utils/hq-roots.js";
-/** Register one raw-argv command and retain the original shell as rollback. */
+/** Register one raw-argv native command. */
 export function registerNativeUtility(core, definition) {
     const command = core.command(definition.name)
         .description(definition.summary)
@@ -16,21 +14,6 @@ export function registerNativeUtility(core, definition) {
         const groupRoot = core.opts().hqRoot;
         const operands = cmd.args.length > 0 ? cmd.args : args;
         const root = definition.resolveRoot(cwd, groupRoot);
-        const nativeEnabled = await coreNativeUtilitiesEnabled();
-        if (process.env.HQ_CM_W5_EXPECT_NATIVE === "1" && !nativeEnabled) {
-            throw new Error(`core-native-utilities dispatch gate is disabled for ${definition.name}`);
-        }
-        if (!nativeEnabled) {
-            const result = runBundledScript({
-                asset: definition.asset,
-                args: operands,
-                cwd: definition.root === "live" ? root : cwd,
-                hqRoot: root,
-            });
-            if (result.code !== 0)
-                process.exitCode = result.code;
-            return;
-        }
         const result = await definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
         if (result.stdout)
             process.stdout.write(result.stdout);
@@ -41,7 +24,7 @@ export function registerNativeUtility(core, definition) {
         if (result.code !== 0)
             process.exitCode = result.code;
     });
-    describeCoreCommand(command, { execution: "native", asset: definition.asset, root: definition.root });
+    describeCoreCommand(command, { execution: "native", root: definition.root });
 }
 export function utilityError(message, code = 1) {
     return { code, stdout: "", stderr: `${message}\n` };

package/dist/commands/core-pin-native.js

@@ -228,7 +228,7 @@ export function runPin(args, deps) {
 }
 export function registerCorePinNative(core) {
     registerNativeUtility(core, {
-        name: "pin", asset: PIN_ASSET, root: "live", summary: "Pin the current session to one goal",
+        name: "pin", root: "live", summary: "Pin the current session to one goal",
         resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
         run: (args, context) => runPin(args, context),
     });

package/dist/commands/core-refresh-vault-access-native.js

@@ -239,7 +239,7 @@ export function runRefreshVaultAccess(args, deps) {
 }
 export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
-        name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
+        name: "refresh-vault-access", root: "cwd", summary: "Refresh the local vault access manifest",
         resolveRoot: (cwd) => cwd,
         run: (args, context) => runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(context.cwd, context.env, context.now)),
     });

package/dist/commands/core-resolve-company-command.js

@@ -1,8 +1,6 @@
 import { resolveLiveRoot } from "../utils/hq-roots.js";
-import { runBundledScript } from "../utils/run-bundled-script.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
-import { coreNativeUtilitiesEnabled } from "./core-native-utilities-flag.js";
-import { RESOLVE_COMPANY_ASSET, resolveCompany } from "./core-resolve-company-native.js";
+import { resolveCompany } from "./core-resolve-company-native.js";
 /** Commander registration stays in the full graph; the native resolver is fast-path safe. */
 export function registerCoreResolveCompanyNativeCommand(core) {
     const command = core.command("resolve-company")
@@ -13,19 +11,6 @@ export function registerCoreResolveCompanyNativeCommand(core) {
         .argument("[args...]")
         .action(async (args = [], _options, cmd) => {
         const operands = cmd.args.length > 0 ? cmd.args : args;
-        if (!await coreNativeUtilitiesEnabled()) {
-            const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
-            const { code } = runBundledScript({
-                asset: RESOLVE_COMPANY_ASSET,
-                args: operands,
-                cwd: root,
-                hqRoot: root,
-                env: { HQ_CALLER_CWD: process.cwd() },
-            });
-            if (code !== 0)
-                process.exit(code);
-            return;
-        }
         const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
         const result = await resolveCompany(operands, {
             cwd: process.cwd(),
@@ -38,6 +23,6 @@ export function registerCoreResolveCompanyNativeCommand(core) {
         if (result.code !== 0)
             process.exit(result.code);
     });
-    describeCoreCommand(command, { execution: "native", asset: RESOLVE_COMPANY_ASSET, root: "live" });
+    describeCoreCommand(command, { execution: "native", root: "live" });
 }
 //# sourceMappingURL=core-resolve-company-command.js.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -250,7 +250,7 @@ export function runWorkMeshBindTrusted(args, deps) {
 }
 export function registerCoreWorkMeshBindTrustedNative(core) {
     registerNativeUtility(core, {
-        name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
+        name: "work-mesh-bind-trusted", root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
         resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
         run: async (args, context) => {
             const { fastFlagEnabled } = await import("../native-fast-route.js");

package/dist/commands/core.js

@@ -255,17 +255,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/session-project.sh", root: "live", summary: "Rollback companion for native session project" },
     { asset: "core/scripts/session-title.sh", root: "live", summary: "Rollback companion for native session title" },
     { asset: "core/scripts/session-title-config.sh", root: "live", summary: "Rollback companion for native session-title settings" },
-    { asset: "core/scripts/resolve-company.sh", root: "live", summary: "Rollback companion for native resolve-company" },
-    { asset: "core/scripts/jobs-schedule-parse.sh", root: "live", summary: "Rollback companion for native jobs schedule-parse" },
-    { asset: "core/scripts/jobs-validate.sh", root: "live", summary: "Rollback companion for native jobs validate" },
-    { asset: "core/scripts/outpost-jobs-reconcile.sh", root: "live", summary: "Rollback companion for native jobs reconcile" },
-    { asset: "core/scripts/hq-job-probe.sh", root: "live", summary: "Scheduled jobs readiness probe used by the reconcile rollback path" },
-    { asset: "core/scripts/hq-job-run.sh", root: "live", summary: "Scheduled jobs runner used by generated systemd units" },
-    { asset: "core/scripts/hq-job-notify.sh", root: "live", summary: "Scheduled jobs failure notification helper" },
-    { asset: "core/scripts/hq-job-remediate.sh", root: "live", summary: "Scheduled jobs bounded remediation helper" },
     { asset: "core/scripts/pipeline-worker-table.sh", root: "live", summary: "Rollback companion for native pipeline worker-table" },
-    { asset: "core/scripts/hq-dm-bind.sh", root: "live", summary: "Rollback shell for native dm-bind" },
-    { asset: "core/scripts/work-mesh-live-bind-trusted.sh", root: "live", summary: "Rollback shell for native work-mesh-bind-trusted" },
     { asset: "core/scripts/share-suggestion-state.sh", root: "live", summary: "Rollback shell for native share-suggestion-state" },
     { asset: "core/scripts/repo-run-registry.sh", root: "live", summary: "Rollback shell for native repo-run-registry" },
     { asset: "core/scripts/detect-stale-review-base.sh", root: "live", summary: "Rollback shell for native detect-stale-review-base" },
@@ -317,13 +307,7 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
-    // Wave 5 native utility rollback companions, sourced verbatim from staging
-    // because these assets were not present in the hq-cli bundle at launch.
-    { asset: "core/scripts/audit-log.sh", root: "live", summary: "Rollback shell for native audit-log" },
-    { asset: "core/scripts/git-pack-extension-check.sh", root: "cwd", summary: "Rollback shell for native git-pack-extension-check" },
-    { asset: "core/scripts/hq-pin.sh", root: "live", summary: "Rollback shell for native pin" },
-    { asset: "core/scripts/refresh-vault-access.sh", root: "cwd", summary: "Rollback shell for native refresh-vault-access" },
-    { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by the audit-log rollback shell" },
+    { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by bundled scripts" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
         root,

package/dist/fast-scaffold.d.ts

@@ -63,7 +63,7 @@ export declare function coreCommandHasPathOperands(argv: readonly string[]): boo
 /** Apply the manifest's operand rule to a copied process.argv vector. */
 export declare function normalizeCorePathOperands(argv: readonly string[], platform?: NodeJS.Platform, convertPath?: (value: string) => string): string[];
 /** Family kill switches whose owner-approved default is enabled. */
-export declare const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS: readonly ["core-native-session", "core-native-hook-helpers", "core-native-policy", "core-native-utilities", "core-native-jobs", "core-native-handoff", "core-native-bucket-c", "core-native-delegate"];
+export declare const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS: readonly ["core-native-session", "core-native-hook-helpers", "core-native-policy", "core-native-handoff", "core-native-bucket-c", "core-native-delegate"];
 export declare function isDefaultOnFastFamily(flagKey: string): boolean;
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];

package/dist/fast-scaffold.js

@@ -150,8 +150,6 @@ export const CORE_NATIVE_DEFAULT_ON_FAMILY_FLAGS = [
     "core-native-session",
     "core-native-hook-helpers",
     "core-native-policy",
-    "core-native-utilities",
-    "core-native-jobs",
     "core-native-handoff",
     "core-native-bucket-c",
     "core-native-delegate",
@@ -263,11 +261,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
                 : name === "remediate" ? "runJobRemediateFast"
                     : "runJobFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-jobs",
-        asset: `core/scripts/hq-job-${name}.sh`,
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
         requiresNodeNetworkCompatibility: name === "probe" || name === "run",
     })),
     {
@@ -276,11 +270,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-pin-fast.js",
         exportName: "runPinFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/hq-pin.sh",
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
     },
     {
         name: "worker lint",
@@ -474,12 +464,8 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-jobs-native.js",
         exportName: "runJobsFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-jobs",
-        asset: `core/scripts/${name === "reconcile" ? "outpost-jobs-reconcile" : `jobs-${name}`}.sh`,
         requiresNodeNetworkCompatibility: true,
         root: name === "reconcile" ? "passthrough" : "cwd",
-        shellCwd: "caller",
-        shellHqRoot: name === "reconcile" ? "reconcile-default" : "none",
     })),
     ...["share-suggestion-state", "repo-run-registry", "detect-stale-review-base"].map((name) => ({
         name,
@@ -508,11 +494,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-resolve-company-native.js",
         exportName: "runResolveCompanyFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/resolve-company.sh",
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
     },
     ...["session-journal", "session-project", "session-title", "session-title-config"].map((name) => ({
         name,
@@ -602,11 +584,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-audit-log-fast.js",
         exportName: "runAuditLogFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/audit-log.sh",
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
     },
     {
         name: "refresh-vault-access",
@@ -614,11 +592,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-refresh-vault-access-fast.js",
         exportName: "runRefreshVaultAccessFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/refresh-vault-access.sh",
         root: "cwd",
-        shellCwd: "caller",
-        shellHqRoot: "cwd",
     },
     {
         name: "generate-workers-registry",
@@ -635,11 +609,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-dm-bind-fast.js",
         exportName: "runDmBindFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/hq-dm-bind.sh",
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
         readsStdinFor: (args) => {
             if (args[0] !== "post")
                 return false;
@@ -660,11 +630,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-git-pack-extension-check-fast.js",
         exportName: "runGitPackExtensionCheckFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/git-pack-extension-check.sh",
         root: "cwd",
-        shellCwd: "caller",
-        shellHqRoot: "cwd",
     },
     {
         name: "scan-packages",
@@ -690,11 +656,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-work-mesh-bind-trusted-fast.js",
         exportName: "runWorkMeshBindTrustedFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-utilities",
-        asset: "core/scripts/work-mesh-live-bind-trusted.sh",
         root: "live",
-        shellCwd: "live",
-        shellHqRoot: "live",
         requiresNodeNetworkCompatibility: true,
     },
     {

package/dist/lib/daemon/catalog.d.ts

@@ -121,8 +121,6 @@ export interface PlanContext {
     legacyOwner: (unitId: string) => string | null;
     /** This CLI is a global install the updater can replace (not a project dependency). */
     cliSelfUpdatable: boolean;
-    /** `<hqRoot>/core/scripts/outpost-jobs-reconcile.sh` when it exists. */
-    jobsReconcileScript: string | null;
     /** Absolute paths of the claude and tmux binaries, or null when not installed. */
     claudePath: string | null;
     tmuxPath: string | null;

package/dist/lib/daemon/catalog.js

@@ -279,21 +279,18 @@ function planService(service, ctx) {
         case "jobs-reconcile": {
             if (ctx.platform === "win32")
                 return [unavailable(service, "needs bash; not supported on Windows")];
-            const script = ctx.jobsReconcileScript;
             return [
                 base(service, {
                     kind: "scheduled",
                     intervalSec: 600,
                     initialDelaySec: 600,
                     command: {
-                        type: "exec",
-                        file: "bash",
-                        args: [script ?? "", "--hq-root", ctx.hqRoot ?? "", "--ensure-hook", "--after-sync"],
+                        type: "hq",
+                        args: ["core", "--hq-root", ctx.hqRoot ?? "", "jobs", "reconcile", "--ensure-hook", "--after-sync"],
                     },
-                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot } : {},
+                    env: ctx.hqRoot ? { HQ_ROOT: ctx.hqRoot, HQ_NO_UPDATE_CHECK: "1" } : { HQ_NO_UPDATE_CHECK: "1" },
                     blocked: firstBlock([
                         [!ctx.hqRoot, NO_HQ_ROOT],
-                        [!script, "this HQ folder has no core/scripts/outpost-jobs-reconcile.sh"],
                     ]),
                 }),
             ];

package/dist/lib/daemon/run.js

@@ -350,12 +350,6 @@ export function desktopAppManagesSync(opts) {
         return false;
     return opts.legacy.some((u) => u.service === "sync" && !u.migratable) || opts.appRunning();
 }
-function jobsReconcileScript(hqRoot) {
-    if (!hqRoot)
-        return null;
-    const script = path.join(hqRoot, "core", "scripts", "outpost-jobs-reconcile.sh");
-    return fs.existsSync(script) ? script : null;
-}
 function signedIn(env, home, log) {
     if (fs.existsSync(agentKitPaths(home, env).machineCredsPath))
         return true;
@@ -859,7 +853,6 @@ export async function runDaemon(opts) {
             bots: listLocalBots(),
             legacyOwner: legacyOwnerLookup(legacy),
             cliSelfUpdatable: updatable,
-            jobsReconcileScript: jobsReconcileScript(hqRoot),
             claudePath: findUserBinary("claude", env, home),
             codexPath: findUserBinary("codex", env, home),
             codexRunnerScript: platform === "linux" && fs.existsSync(CODEX_RUNNER_SCRIPT) ? CODEX_RUNNER_SCRIPT : null,

package/dist/lib/scan-packages/index.js

@@ -4,6 +4,7 @@ import * as path from 'node:path';
 import * as yaml from 'js-yaml';
 import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
+import { isExcludedWorkerDirectory } from '../workers-registry/index.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();
 }
@@ -75,6 +76,11 @@ function workerId(file) {
 function allWorkerYamlFiles(root, relative) {
     const output = [];
     const walk = (next, seen) => {
+        // Prune exactly what the worker registry prunes (tenant repos/ checkouts,
+        // _template, _overrides). A worker.yaml the registry never indexes cannot
+        // collide with a pack worker, and walking source checkouts is slow.
+        if (isExcludedWorkerDirectory(next))
+            return;
         const absolute = path.join(root, next);
         if (!isDirectory(absolute))
             return;

package/dist/lib/workers-registry/index.d.ts

@@ -9,6 +9,22 @@ export interface GenerateWorkersRegistryResult {
     written: boolean;
     quarantined: number;
 }
+/**
+ * Worker roots hold two kinds of `worker.yaml` that must never reach the
+ * registry.
+ *
+ * The `_template` company and any `_overrides` directory are scaffolding —
+ * copies kept so a new tenant or a pack override can be stamped out from them.
+ *
+ * A checkout nested under a tenant's `repos/` is a source repository that tenant
+ * happens to keep inside HQ, and when that repository is HQ itself, its own
+ * `core/workers` and template trees are full of worker.yaml files. Indexing them
+ * treats product source as deployed workers: they claim ids real workers already
+ * own, and because duplicates resolve by path order — a tenant path sorts before
+ * both `core` and `personal` — the checkout wins. The operator's actual worker
+ * then silently vanishes from the registry every skill reads.
+ */
+export declare function isExcludedWorkerDirectory(relativeDirectory: string): boolean;
 /**
  * Generate core/workers/registry.yaml from worker.yaml files. Invalid workers
  * are quarantined but do not prevent all valid workers from being registered.

package/dist/lib/workers-registry/index.js

@@ -158,7 +158,7 @@ function withoutTimestamp(content) {
  * both `core` and `personal` — the checkout wins. The operator's actual worker
  * then silently vanishes from the registry every skill reads.
  */
-function isExcludedWorkerDirectory(relativeDirectory) {
+export function isExcludedWorkerDirectory(relativeDirectory) {
     const normalized = relativeDirectory.replaceAll('\\', '/');
     const [root, tenant, nested] = normalized.split('/');
     if (root !== 'companies')