@indigoai-us/hq-cli 5.345.117 → 5.345.119

package/assets/scaffold/core/scripts/lint-shared-worker-skills.sh

@@ -1,197 +0,0 @@
-#!/usr/bin/env bash
-# lint-shared-worker-skills.sh — fail if a worker-scoped skill is duplicated by
-# copy instead of being single-sourced through the shared-skills convention.
-#
-# THE DRIFT PROBLEM this guards against: a skill used by several workers used to
-# be physically COPIED into each worker's skills/ directory. Editing one copy
-# left the others stale, so the copies drifted apart over time (e.g. a shared
-# e2e-testing skill splitting into two divergent versions). The fix is to keep
-# ONE canonical file under a scope-appropriate `_shared-skills/` store and point
-# each sharing worker's skill entry at it with a relative symlink — see
-# core/knowledge/public/hq-core/shared-worker-skills.md.
-#
-# This linter makes that convention enforceable. It flags two failure shapes:
-#
-#   DUPLICATE  — two or more NON-symlink skill files, WITHIN A SINGLE OWNERSHIP
-#                DOMAIN, whose byte content is identical. Identical bytes across
-#                two real files in the same domain is exactly an un-single-sourced
-#                copy: the moment someone edits one, they drift. (Symlinks that
-#                resolve to a shared canonical are single-sourced and are NOT
-#                flagged, even though their resolved content matches.)
-#   BROKEN     — a skill entry that is a symlink whose target does not resolve.
-#
-# It deliberately does NOT flag two same-NAMED skills whose content differs
-# (e.g. an API-level vs a browser-level e2e skill): distinct content means they
-# are distinct skills that merely share a filename, not a drifted share.
-#
-# OWNERSHIP DOMAINS — filesystem adjacency does NOT establish duplicate
-# ownership, so comparison is partitioned by the tree that OWNS a skill (policy
-# hq-lint-comparison-domains-must-match-ownership):
-#
-#   - `core/workers`            — the curated first-party worker library
-#   - `core/packages/<pack>`    — one installed pack (self-contained; may legally
-#                                 vendor a byte-identical copy of a core worker)
-#   - `companies/<co>`          — one tenant's workers
-#
-# A byte-identical file in TWO DIFFERENT domains (a pack vendoring a core skill,
-# or two packs shipping the same skill) is intentional distribution, NOT drift,
-# and is never flagged. Excluded from the scan entirely: dot-directories
-# (`.archive/`, `.git/`, …) and `._*` AppleDouble OS-metadata files — byte-
-# identical by design, and not skills.
-#
-# Usage: lint-shared-worker-skills.sh [root ...]
-#   Default roots: core/workers core/packages  (the SHIPPED hq-core scope —
-#   company workers live under companies/<co>/ and are linted per-tenant; pass
-#   them explicitly to include them).
-#
-# Exit 0 + "OK:" line when clean; exit 1 + a report naming every offending group
-# when not. Matches the loud-and-specific style of lint-skill-script-refs.sh.
-
-set -euo pipefail
-
-if [[ ${1-} == "--help" || ${1-} == "-h" ]]; then
-  printf '%s\n' \
-    'Usage: lint-shared-worker-skills.sh [root ...]' \
-    'Default roots: core/workers core/packages'
-  exit 0
-fi
-
-repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-cd "$repo_root"
-
-roots=("$@")
-if [[ ${#roots[@]} -gt 0 ]]; then
-  for root in "${roots[@]}"; do
-    if [[ ! -d "$root" ]]; then
-      printf 'lint-shared-worker-skills: root is not a directory: %s\n' "$root" >&2
-      exit 2
-    fi
-  done
-fi
-
-if [[ ${#roots[@]} -eq 0 ]]; then
-  roots=(core/workers core/packages)
-fi
-
-# Content hash of a file, portable across Linux and macOS (neither guaranteed to
-# ship the other's tool): md5sum (GNU) → md5 (BSD/macOS) → shasum (Perl, both).
-content_hash() {
-  if command -v md5sum >/dev/null 2>&1; then
-    md5sum "$1" | cut -d' ' -f1
-  elif command -v md5 >/dev/null 2>&1; then
-    md5 -q "$1"
-  else
-    shasum "$1" | cut -d' ' -f1
-  fi
-}
-
-# The ownership domain that OWNS a skill path — the boundary within which two
-# byte-identical files are a real duplicate. Across domains, identical content
-# is intentional (a pack vendoring a core skill, two packs shipping the same
-# skill), so it must never be compared. See policy header above.
-domain_of() {
-  local p="${1#./}" rest
-  case "$p" in
-    core/packages/*) rest="${p#core/packages/}"; printf 'core/packages/%s' "${rest%%/*}" ;;
-    companies/*)     rest="${p#companies/}";      printf 'companies/%s' "${rest%%/*}" ;;
-    core/workers/*|core/workers) printf 'core/workers' ;;
-    # Arbitrary root (custom scans, tests): the top path segment is the domain.
-    *) printf '%s' "${p%%/*}" ;;
-  esac
-}
-
-# Collect skill entries: regular files AND symlinks named *.md under any
-# .../skills/... path. -type l must be matched explicitly — a symlink is not a
-# -type f, so a skills symlink would otherwise be invisible to the scan.
-# EXCLUDED: any dot-directory component (`*/.*/*` — covers `.archive/`, `.git/`)
-# and `._*` AppleDouble files; both are byte-identical by design and not skills.
-mapfile -t entries < <(
-  find "${roots[@]}" \( -type f -o -type l \) -path '*/skills/*.md' \
-    -not -path '*/.*/*' -not -name '._*' 2>/dev/null | sort
-)
-
-# Empty is clean — and guards `"${entries[@]}"` under `set -u` on bash 3.2
-# (macOS), which errors on an empty array expansion.
-if [[ ${#entries[@]} -eq 0 ]]; then
-  echo "OK: worker-scoped skills are single-sourced (0 skill entries under: ${roots[*]})"
-  exit 0
-fi
-
-broken=()
-# Parallel arrays keyed by "<domain>|<content-hash>": hash_keys[i] is that
-# composite key, hash_regfiles[i] a newline-joined list of the NON-symlink files
-# carrying it. Keying on domain AS WELL AS hash is what confines a duplicate
-# finding to a single ownership tree — two identical files in different domains
-# land in different buckets and are never flagged. Bash 3.2 (macOS) has no
-# portable associative arrays, so a linear scan over parallel arrays keeps this
-# runnable everywhere HQ runs.
-hash_keys=()
-hash_regfiles=()
-
-hash_index() { # echo the index of $1 in hash_keys, or -1
-  local want="$1" i
-  for i in "${!hash_keys[@]}"; do
-    if [[ "${hash_keys[$i]}" == "$want" ]]; then
-      echo "$i"; return 0
-    fi
-  done
-  echo "-1"
-}
-
-for entry in "${entries[@]}"; do
-  if [[ -L "$entry" ]]; then
-    # Symlink: single-sourced by design. Only a DANGLING one is a problem.
-    if [[ ! -e "$entry" ]]; then
-      broken+=("$entry")
-    fi
-    continue
-  fi
-  # Regular file: bucket it by (ownership domain, byte content). Two regular
-  # files sharing a bucket are two copies of the same skill in the same tree —
-  # the drift hazard.
-  key="$(domain_of "$entry")|$(content_hash "$entry")"
-  idx="$(hash_index "$key")"
-  if [[ "$idx" == "-1" ]]; then
-    hash_keys+=("$key")
-    hash_regfiles+=("$entry")
-  else
-    hash_regfiles[$idx]="${hash_regfiles[$idx]}"$'\n'"$entry"
-  fi
-done
-
-findings=0
-
-for i in "${!hash_keys[@]}"; do
-  group="${hash_regfiles[$i]}"
-  count="$(printf '%s\n' "$group" | grep -c .)"
-  if [[ "$count" -ge 2 ]]; then
-    if [[ $findings -eq 0 ]]; then
-      echo "lint-shared-worker-skills: FAIL — duplicated worker skills (single-source these via _shared-skills/ + relative symlinks):" >&2
-    fi
-    findings=$((findings + 1))
-    domain="${hash_keys[$i]%%|*}"
-    echo "  DUPLICATE in domain '${domain}' (identical content, ${count} copies — pick one canonical and symlink the rest):" >&2
-    printf '    %s\n' "$group" >&2
-  fi
-done
-
-if [[ ${#broken[@]} -gt 0 ]]; then
-  if [[ $findings -eq 0 ]]; then
-    echo "lint-shared-worker-skills: FAIL — broken shared-skill symlink(s):" >&2
-  fi
-  findings=$((findings + ${#broken[@]}))
-  echo "  BROKEN (symlink target does not resolve):" >&2
-  printf '    %s\n' "${broken[@]}" >&2
-fi
-
-if [[ $findings -gt 0 ]]; then
-  echo "" >&2
-  echo "  Fix: keep ONE canonical file in the narrowest-scope _shared-skills/ store" >&2
-  echo "  (core/workers/_shared-skills, core/packages/<pack>/workers/_shared-skills," >&2
-  echo "  or companies/<co>/workers/_shared-skills) and replace each duplicate with a" >&2
-  echo "  relative symlink. Helper: hq core worker share" >&2
-  echo "  Doc: core/knowledge/public/hq-core/shared-worker-skills.md" >&2
-  exit 1
-fi
-
-echo "OK: worker-scoped skills are single-sourced (${#entries[@]} skill entries scanned under: ${roots[*]})"

package/assets/scaffold/core/scripts/share-worker-skill.sh

@@ -1,178 +0,0 @@
-#!/usr/bin/env bash
-# share-worker-skill.sh — convert duplicated worker-scoped skill copies into a
-# single canonical file plus relative symlinks, the migration step for the
-# shared-worker-skills convention (core/knowledge/public/hq-core/shared-worker-skills.md).
-#
-# This performs the ONLY mechanical move the design needs: it never edits any
-# worker.yaml (the skill name still resolves to the same path — only the file
-# type changes from regular file to symlink), and it never touches a skill
-# resolver. `/run` reads {worker}/skills/{skill}.md and follows the symlink
-# transparently, so the change is purely file-layout.
-#
-# Usage:
-#   share-worker-skill.sh <scope-dir> <skill-name> <worker-skill-path> [<worker-skill-path> ...]
-#
-#   <scope-dir>          The narrowest scope that contains EVERY sharing worker,
-#                        e.g. core/workers, core/packages/<pack>/workers, or
-#                        companies/<co>/workers. The canonical file is created at
-#                        <scope-dir>/_shared-skills/<skill-name>.md.
-#   <skill-name>         Bare skill name (no .md), e.g. e2e-testing.
-#   <worker-skill-path>  Each worker's current copy, e.g.
-#                        core/workers/foo/skills/e2e-testing.md
-#
-# Safety rails:
-#   * Every worker path MUST live under <scope-dir> (no cross-scope symlinks,
-#     which would break on pack install / hq-sync). Refuses otherwise.
-#   * If no canonical exists yet, the FIRST worker path is promoted to canonical.
-#   * A worker copy whose content DIFFERS from the canonical is a DRIFTED copy:
-#     the script refuses and tells you to reconcile by hand first (the human
-#     decision the design reserves — never a silent overwrite). Re-run after
-#     reconciling, or pass --force to accept the canonical for that copy.
-#   * Idempotent: a path already symlinked to the canonical is left alone.
-#   * DRY-RUN BY DEFAULT. Pass --apply to make changes.
-
-set -euo pipefail
-
-APPLY=0
-FORCE=0
-args=()
-for a in "$@"; do
-  case "$a" in
-    --apply) APPLY=1 ;;
-    --force) FORCE=1 ;;
-    -*) echo "unknown flag: $a" >&2; exit 2 ;;
-    *) args+=("$a") ;;
-  esac
-done
-
-if [[ ${#args[@]} -lt 3 ]]; then
-  echo "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>..." >&2
-  exit 2
-fi
-
-repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-cd "$repo_root"
-
-scope_dir="${args[0]%/}"
-skill_name="${args[1]}"
-worker_paths=("${args[@]:2}")
-
-if [[ ! "$skill_name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
-  echo "error: skill-name '$skill_name' is not a bare skill name (no slashes, no .md)" >&2
-  exit 2
-fi
-if [[ ! -d "$scope_dir" ]]; then
-  echo "error: scope dir does not exist: $scope_dir" >&2
-  exit 2
-fi
-
-canonical="$scope_dir/_shared-skills/$skill_name.md"
-
-note() { printf '%s\n' "$*"; }
-would() { if [[ $APPLY -eq 1 ]]; then note "  did:   $*"; else note "  would: $*"; fi; }
-
-# Normalize a path to repo-relative without requiring GNU realpath (macOS-safe).
-rel_under() { # rel_under <path> <dir> → 0 if <path> is inside <dir>
-  local p="${1#./}" d="${2#./}"
-  [[ "$p" == "$d/"* ]]
-}
-
-# rel_path <from-dir> <to-file> → relative path from <from-dir> to <to-file>,
-# computed purely from the two repo-relative strings (both already normalized,
-# no `..` segments, no symlinks in the literal path). Portable: no python3, no
-# GNU realpath --relative-to (macOS ships neither).
-rel_path() {
-  local from="${1#./}" to="${2#./}"
-  local -a fa ta
-  IFS='/' read -r -a fa <<< "$from"
-  IFS='/' read -r -a ta <<< "$to"
-  local i=0
-  while [[ $i -lt ${#fa[@]} && $i -lt ${#ta[@]} && "${fa[$i]}" == "${ta[$i]}" ]]; do
-    i=$((i + 1))
-  done
-  local up="" j
-  for (( j=i; j<${#fa[@]}; j++ )); do up="../$up"; done
-  local down="" k
-  for (( k=i; k<${#ta[@]}; k++ )); do down="$down${ta[$k]}/"; done
-  down="${down%/}"
-  printf '%s%s' "$up" "$down"
-}
-
-# Every worker path must be inside the scope dir.
-for wp in "${worker_paths[@]}"; do
-  wp="${wp#./}"
-  if ! rel_under "$wp" "$scope_dir"; then
-    echo "error: worker path '$wp' is not under scope dir '$scope_dir'" >&2
-    echo "       canonical must live in the narrowest scope covering all sharers;" >&2
-    echo "       cross-scope symlinks are disallowed. Aborting (no changes made)." >&2
-    exit 2
-  fi
-done
-
-note "Canonical: $canonical"
-note "Scope:     $scope_dir"
-[[ $APPLY -eq 1 ]] || note "(dry run — pass --apply to make changes)"
-
-# 1) Establish the canonical file.
-if [[ -e "$canonical" && ! -L "$canonical" ]]; then
-  note "canonical already exists (regular file) — reusing it"
-else
-  # Promote the first worker path that is a real (non-symlink) file.
-  seed=""
-  for wp in "${worker_paths[@]}"; do
-    if [[ -f "$wp" && ! -L "$wp" ]]; then seed="$wp"; break; fi
-  done
-  if [[ -z "$seed" ]]; then
-    echo "error: no canonical exists and no worker path is a regular file to seed it from" >&2
-    exit 2
-  fi
-  would "mkdir -p $scope_dir/_shared-skills"
-  would "git mv $seed $canonical  (promote first copy to canonical)"
-  if [[ $APPLY -eq 1 ]]; then
-    mkdir -p "$scope_dir/_shared-skills"
-    git mv "$seed" "$canonical" 2>/dev/null || mv "$seed" "$canonical"
-  fi
-fi
-
-# 2) Point each worker path at the canonical via a relative symlink.
-for wp in "${worker_paths[@]}"; do
-  wp="${wp#./}"
-  # Already the canonical file itself (post-promotion) → link it too so every
-  # worker slot is a symlink and the canonical lives only under _shared-skills.
-  target_dir="$(dirname "$wp")"
-  # Relative path from the worker's skills dir to the canonical (portable).
-  rel="$(rel_path "$target_dir" "$canonical")"
-
-  if [[ -L "$wp" ]]; then
-    cur="$(readlink "$wp")"
-    if [[ "$cur" == "$rel" ]]; then
-      note "ok: $wp already links to canonical"
-      continue
-    fi
-    would "relink $wp -> $rel (was: $cur)"
-    if [[ $APPLY -eq 1 ]]; then ln -sfn "$rel" "$wp"; fi
-    continue
-  fi
-
-  if [[ -e "$wp" ]]; then
-    # Regular file present — must match canonical or be reconciled first.
-    if cmp -s "$wp" "$canonical"; then
-      would "replace identical copy $wp with symlink -> $rel"
-      if [[ $APPLY -eq 1 ]]; then rm -f "$wp"; ln -s "$rel" "$wp"; fi
-    else
-      if [[ $FORCE -eq 1 ]]; then
-        would "FORCE replace DRIFTED copy $wp with symlink -> $rel (content discarded)"
-        if [[ $APPLY -eq 1 ]]; then rm -f "$wp"; ln -s "$rel" "$wp"; fi
-      else
-        echo "  DRIFT: $wp differs from canonical — reconcile by hand, then re-run" >&2
-        echo "         (diff $wp $canonical), or pass --force to accept canonical." >&2
-        exit 3
-      fi
-    fi
-  else
-    would "create symlink $wp -> $rel"
-    if [[ $APPLY -eq 1 ]]; then mkdir -p "$target_dir"; ln -s "$rel" "$wp"; fi
-  fi
-done
-
-note "done."

package/dist/commands/core-native-worker-skills-flag.d.ts

@@ -1,4 +0,0 @@
-/** Default-off rollout gate for native worker-scoped skill commands. */
-export declare const CORE_NATIVE_WORKER_SKILLS_FLAG = "core-native-worker-skills";
-export declare function coreNativeWorkerSkillsEnabled(): Promise<boolean>;
-//# sourceMappingURL=core-native-worker-skills-flag.d.ts.map

package/dist/commands/core-native-worker-skills-flag.js

@@ -1,7 +0,0 @@
-/** Default-off rollout gate for native worker-scoped skill commands. */
-export const CORE_NATIVE_WORKER_SKILLS_FLAG = "core-native-worker-skills";
-export async function coreNativeWorkerSkillsEnabled() {
-    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
-    return resolveProcessFlagGate(CORE_NATIVE_WORKER_SKILLS_FLAG, { fallback: false }, () => false);
-}
-//# sourceMappingURL=core-native-worker-skills-flag.js.map