@indigoai-us/hq-cli 5.345.118 → 5.345.120

package/dist/commands/core-pipeline-driver-process.d.ts

@@ -0,0 +1,4 @@
+export declare function extractWindowsDriverIdentityFunction(source: string): string;
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export declare function isPipelineDriverProcess(pid: number, platform?: NodeJS.Platform): boolean;
+//# sourceMappingURL=core-pipeline-driver-process.d.ts.map

package/dist/commands/core-pipeline-driver-process.js

@@ -0,0 +1,68 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
+import { resolveWindowsBash } from "../utils/run-bundled-script.js";
+const DRIVER_MARKER = "pipeline-driver";
+const WINDOWS_DRIVER_IDENTITY_SIGNATURE = "is_driver() { # pid -> 0 when that pid is alive and is a pipeline-driver";
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function extractWindowsDriverIdentityFunction(source) {
+    const escapedSignature = WINDOWS_DRIVER_IDENTITY_SIGNATURE.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const functionSource = source.match(new RegExp(`^${escapedSignature}\\n[\\s\\S]*?^\\}`, "mu"))?.[0];
+    if (!functionSource)
+        throw new Error(`Bundled pipeline-driver.sh must define '${WINDOWS_DRIVER_IDENTITY_SIGNATURE}'`);
+    return functionSource;
+}
+function isWindowsPipelineDriverProcess(pid) {
+    const bash = resolveWindowsBash(process.env).executable;
+    if (!bash)
+        return false;
+    const scriptPath = path.join(packageRoot(), BUNDLED_ASSET_DIR, "core", "scripts", "pipeline-driver.sh");
+    const source = fs.readFileSync(scriptPath, "utf8");
+    const functionSource = extractWindowsDriverIdentityFunction(source);
+    // Windows intentionally runs the pinned Git Bash implementation because its
+    // lock format uses both MSYS and Win32 PIDs. This keeps native checks aligned
+    // with the shell's liveness-then-identity order and process-table lookup.
+    const result = spawnSync(bash, ["-c", `${functionSource}\nis_driver "$1"`, "pipeline-driver-lock-check", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export function isPipelineDriverProcess(pid, platform = process.platform) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    if (platform === "win32")
+        return isWindowsPipelineDriverProcess(pid);
+    if (!isAlive(pid))
+        return false;
+    if (platform === "linux") {
+        try {
+            return fs.readFileSync(`/proc/${pid}/cmdline`).toString("utf8").includes(DRIVER_MARKER);
+        }
+        catch {
+            return false;
+        }
+    }
+    const args = platform === "darwin"
+        ? ["-ww", "-o", "args=", "-p", String(pid)]
+        : ["-p", String(pid), "-o", "args="];
+    const result = spawnSync("ps", args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    return result.status === 0 && String(result.stdout ?? "").includes(DRIVER_MARKER);
+}
+//# sourceMappingURL=core-pipeline-driver-process.js.map

package/dist/commands/core-pipeline-envelope-native.d.ts

@@ -0,0 +1,4 @@
+type EnvelopeKind = "envelope" | "handoff";
+export declare function validatePipelinePhaseFile(filePath: string, kind: EnvelopeKind): [boolean, string];
+export {};
+//# sourceMappingURL=core-pipeline-envelope-native.d.ts.map

package/dist/commands/core-pipeline-envelope-native.js

@@ -0,0 +1,87 @@
+import * as fs from "node:fs";
+export function validatePipelinePhaseFile(filePath, kind) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(filePath));
+        if (text.charCodeAt(0) === 0xfeff)
+            text = text.slice(1);
+        text = text.replace(/\r\n?/g, "\n");
+    }
+    catch (error) {
+        const message = error && typeof error === "object" && "message" in error ? String(error.message) : String(error);
+        return [false, "pipeline-envelope: cannot read input: " + message];
+    }
+    if (!text.trim())
+        return [false, "invalid: empty input"];
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return [false, "invalid: unparseable JSON (" + message + ")"];
+    }
+    if (!isObject(doc)) {
+        const typeName = doc === null ? "NoneType" : Array.isArray(doc) ? "list" : typeof doc === "string" ? "str"
+            : typeof doc === "boolean" ? "bool" : Number.isInteger(doc) ? "int" : "float";
+        return [false, "invalid: top level must be a JSON object, got " + typeName];
+    }
+    const problems = [];
+    const schemas = { envelope: "hq-phase-envelope/v1", handoff: "hq-phase-handoff/v1" };
+    if (Object.hasOwn(doc, "schema") && doc.schema !== schemas[kind])
+        problems.push("wrong type: schema (want " + schemas[kind] + ")");
+    else if (!Object.hasOwn(doc, "schema"))
+        problems.push("missing field: schema");
+    const isString = (value) => typeof value === "string";
+    const isNonEmpty = (value) => isString(value) && value !== "";
+    const stringList = (value) => Array.isArray(value) && value.every(isString);
+    const check = (name, predicate, want, required = true) => {
+        if (!Object.hasOwn(doc, name)) {
+            if (required)
+                problems.push("missing field: " + name);
+            return;
+        }
+        if (!predicate(doc[name]))
+            problems.push("wrong type: " + name + " (want " + want + ")");
+    };
+    if (kind === "envelope") {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("worktree", isNonEmpty, "string path");
+        check("incoming_handoff", (value) => value === null || isNonEmpty(value), "string path or null");
+        check("acceptance_criteria", stringList, "array of strings");
+        check("deadline", (value) => isString(value) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]00:?00)\n?$/.test(value), "ISO8601 UTC string");
+        check("fresh_call", (value) => typeof value === "boolean", "boolean");
+        for (const field of ["project", "engine", "result_path", "story_title", "story_description", "reopen_note", "repo", "branch", "prior_handoff"])
+            check(field, isString, "string", false);
+        check("resumed_after_interrupt", (value) => typeof value === "boolean", "boolean", false);
+        check("constraints", stringList, "array of strings", false);
+    }
+    else {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("status", (value) => value === "passed" || value === "failed" || value === "blocked", "one of passed|failed|blocked");
+        check("summary", isString, "string");
+        check("files_changed", stringList, "array of strings");
+        check("commits", stringList, "array of strings");
+        if (!Object.hasOwn(doc, "back_pressure"))
+            problems.push("missing field: back_pressure");
+        else if (!isObject(doc.back_pressure))
+            problems.push("wrong type: back_pressure (want object)");
+        else
+            for (const group of ["tests", "lint", "typecheck", "build"]) {
+                if (!Object.hasOwn(doc.back_pressure, group))
+                    problems.push("missing field: back_pressure." + group);
+                else if (!["pass", "fail", "skip"].includes(String(doc.back_pressure[group])))
+                    problems.push("wrong type: back_pressure." + group + " (want one of pass|fail|skip)");
+            }
+        check("context_for_next", isString, "string");
+        for (const field of ["engine", "notes"])
+            check(field, isString, "string", false);
+    }
+    return problems.length ? [false, problems.join("\n")] : [true, "valid " + kind];
+}
+function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=core-pipeline-envelope-native.js.map

package/dist/commands/core-policy.js

@@ -772,6 +772,8 @@ function autoRetire(options, root, cwd, env, now) {
         reportText += `# Automatic policy retirement — ${today}\n\nMode: human on the loop. Each policy below was retired by \`policy-retire.sh --auto\` with the reason shown.\nReverse any wrong call with \`bash core/scripts/policy-retire.sh <slug> --restore\` and fix the rule that produced it.\n\n`;
     }
     reportText += `## Run ${now.toISOString().slice(11, 19)}Z — dirs: ${dirs.join(' ')}\n\n`;
+    // Match the shell's preflight: fail to create the report temp before any
+    // policy can be retired, then replace it with the complete run section.
     fs.writeFileSync(tempPath, reportText);
     let retired = 0;
     let failed = 0;
@@ -847,6 +849,7 @@ function autoRetire(options, root, cwd, env, now) {
         stdout += `policy-retire --auto: ${wouldRetire} of ${candidates.length} candidates would be retired (dry run)\n`;
     }
     else if (retired > 0 || failed > 0 || needfix > 0) {
+        fs.writeFileSync(tempPath, reportText);
         fs.appendFileSync(outputPath, fs.readFileSync(tempPath));
         fs.rmSync(tempPath, { force: true });
         stdout += `policy-retire --auto: ${retired} retired, ${failed} failed, ${needfix} need a fix; report ${displayPolicyPath(outputPath, root)}\n`;

package/dist/commands/core-session-journal-native.js

@@ -89,6 +89,18 @@ function processIsAlive(pid) {
         return error.code !== "ESRCH";
     }
 }
+function counterLockOwnerIsAlive(lock, pid) {
+    if (processIsAlive(pid))
+        return true;
+    if (process.platform !== "win32")
+        return false;
+    let windowsPid = 0;
+    try {
+        windowsPid = Number.parseInt(fs.readFileSync(path.join(lock, "winpid"), "utf8"), 10) || 0;
+    }
+    catch { /* older shell locks did not record the Win32 PID */ }
+    return windowsPid > 1 && processIsAlive(windowsPid);
+}
 function acquireJournalWriteLock(dir) {
     const lock = path.join(dir, ".session-journal-write.lock");
     const ownerFile = path.join(lock, "pid");
@@ -142,26 +154,144 @@ function releaseJournalWriteLock(lock) {
     }
     catch { /* shell lock cleanup is best-effort */ }
 }
-function withCounterLock(lock, action) {
+const COUNTER_LOCK_PIDLESS_STALE_MS = 60_000;
+function isAgedPidlessCounterLock(lock, now) {
+    try {
+        return now().getTime() - fs.statSync(lock).mtimeMs >= COUNTER_LOCK_PIDLESS_STALE_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function reclaimStaleCounterLock(lock, now) {
+    let rawOwner;
+    try {
+        rawOwner = fs.readFileSync(path.join(lock, "pid"), "utf8").trim();
+    }
+    catch (error) {
+        if (error.code !== "ENOENT" || !isAgedPidlessCounterLock(lock, now))
+            return false;
+        rawOwner = "";
+    }
+    if (rawOwner !== "" && !/^\d+$/u.test(rawOwner))
+        return false;
+    let rawWindowsPid = "";
+    try {
+        rawWindowsPid = fs.readFileSync(path.join(lock, "winpid"), "utf8").trim();
+    }
+    catch { /* older shell locks did not record the Win32 PID */ }
+    if (rawWindowsPid !== "" && !/^\d+$/u.test(rawWindowsPid))
+        return false;
+    const owner = rawOwner ? Number.parseInt(rawOwner, 10) : 0;
+    const windowsOwner = rawWindowsPid ? Number.parseInt(rawWindowsPid, 10) : 0;
+    if (rawOwner && (owner <= 1 || counterLockOwnerIsAlive(lock, owner)))
+        return false;
+    if (!rawOwner && windowsOwner > 1 && processIsAlive(windowsOwner))
+        return false;
+    const claim = `${lock}.reclaim`;
+    try {
+        fs.mkdirSync(claim);
+    }
+    catch {
+        return false;
+    }
+    try {
+        fs.writeFileSync(path.join(claim, "pid"), `${process.pid}\n`, { flag: "wx" });
+    }
+    catch {
+        try {
+            fs.rmSync(claim, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+        return false;
+    }
+    let currentRawOwner;
+    try {
+        currentRawOwner = fs.readFileSync(path.join(lock, "pid"), "utf8").trim();
+    }
+    catch {
+        currentRawOwner = "";
+    }
+    let currentRawWindowsPid;
+    try {
+        currentRawWindowsPid = fs.readFileSync(path.join(lock, "winpid"), "utf8").trim();
+    }
+    catch {
+        currentRawWindowsPid = "";
+    }
+    const sameOwner = currentRawOwner === rawOwner && currentRawWindowsPid === rawWindowsPid;
+    const stillStale = rawOwner
+        ? sameOwner && !counterLockOwnerIsAlive(lock, owner)
+        : sameOwner && !(windowsOwner > 1 && processIsAlive(windowsOwner)) && isAgedPidlessCounterLock(lock, now);
+    if (stillStale) {
+        const stale = `${lock}.stale-${process.pid}-${Math.random().toString(16).slice(2)}`;
+        try {
+            fs.renameSync(lock, stale);
+            fs.rmSync(stale, { recursive: true, force: true });
+            fs.rmSync(claim, { recursive: true, force: true });
+            return true;
+        }
+        catch { /* another waiter reclaimed it */ }
+    }
+    try {
+        fs.rmSync(claim, { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+    return false;
+}
+function withCounterLock(lock, env, writers, now, action) {
     let i = 0;
     let acquired = false;
-    while (!acquired) {
+    let tries = env.HQ_JOURNAL_COUNTER_LOCK_TRIES ?? "250";
+    if (!/^\d+$/u.test(tries))
+        tries = "250";
+    const retryLimit = Number.parseInt(tries, 10);
+    while (i < retryLimit) {
         try {
             fs.mkdirSync(lock);
             acquired = true;
+            try {
+                if (process.platform === "win32")
+                    fs.writeFileSync(path.join(lock, "winpid"), `${process.pid}\n`, { flag: "wx" });
+                fs.writeFileSync(path.join(lock, "pid"), `${process.pid}\n`, { flag: "wx" });
+            }
+            catch {
+                try {
+                    fs.rmSync(lock, { recursive: true, force: true });
+                }
+                catch { /* best effort */ }
+                return;
+            }
+            break;
         }
         catch {
+            if (reclaimStaleCounterLock(lock, now))
+                continue;
             i++;
-            if (i >= 50)
-                break;
-            sleepSync(20);
+            if (i < retryLimit)
+                sleepSync(20);
         }
     }
-    action();
+    if (!acquired) {
+        writers.stderr("session-journal: tool-counter: lock remained busy; skipped update\n");
+        return;
+    }
     try {
-        fs.rmdirSync(lock);
+        action();
+    }
+    finally {
+        let owner = 0;
+        try {
+            owner = Number.parseInt(fs.readFileSync(path.join(lock, "pid"), "utf8"), 10) || 0;
+        }
+        catch { /* lock disappeared */ }
+        if (owner === process.pid) {
+            try {
+                fs.rmSync(lock, { recursive: true, force: true });
+            }
+            catch { /* best effort */ }
+        }
     }
-    catch { /* shell rmdir is best-effort */ }
 }
 function nextSequence(dir) {
     let names = [];
@@ -205,12 +335,12 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
         writers.stderr(`${sessionJournalAsset}: line ${line}: ${printableCounter}: Is a directory\n`);
     };
     if (action === "increment") {
-        withCounterLock(lock, () => {
+        withCounterLock(lock, env, writers, now, () => {
             try {
                 fs.writeFileSync(counter, `${readCounter(counter) + 1}\n`);
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 395);
+                reportDirectoryWriteFailure(error, 457);
             }
         });
     }
@@ -218,12 +348,12 @@ function runToolCounter(root, action, sessionArg, env, now, writers) {
         writers.stdout(`${readCounter(counter)}\n`);
     }
     else if (action === "reset") {
-        withCounterLock(lock, () => {
+        withCounterLock(lock, env, writers, now, () => {
             try {
                 fs.writeFileSync(counter, "0\n");
             }
             catch (error) {
-                reportDirectoryWriteFailure(error, 403);
+                reportDirectoryWriteFailure(error, 465);
             }
         });
     }

package/dist/commands/core-worker-lint-native.d.ts

@@ -1,4 +1,3 @@
 import { type WorkerSkillDependencies, type WorkerSkillResult } from "./core-worker-skills-runtime.js";
-export declare const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 export declare function runWorkerSkillLint(args: string[], dependencies: WorkerSkillDependencies): WorkerSkillResult;
 //# sourceMappingURL=core-worker-lint-native.d.ts.map

package/dist/commands/core-worker-lint-native.js

@@ -2,7 +2,6 @@
 import * as crypto from "node:crypto";
 import * as path from "node:path";
 import { errorCode, isDirectory, missingOrUnreadable, resolveWorkerCallerRoot, } from "./core-worker-skills-runtime.js";
-export const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 const DEFAULT_ROOTS = ["core/workers", "core/packages"];
 const USAGE = "Usage: lint-shared-worker-skills.sh [root ...]\nDefault roots: core/workers core/packages\n";
 function joinFindPath(parent, child) {

package/dist/commands/core-worker-share-native.js

@@ -1,6 +1,6 @@
 /** Native port of share-worker-skill.sh. */
 import * as path from "node:path";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
 import { existsFollowingLinks, isDirectory, isSymlink, resolveWorkerCallerRoot, runGit, errorCode, } from "./core-worker-skills-runtime.js";
 export const WORKER_SKILL_SHARE_ASSET = "core/scripts/share-worker-skill.sh";
 const WORKER_SKILL_SHARE_USAGE = "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>...\n";
@@ -88,7 +88,7 @@ function forceSymlink(target, filePath, fileSystem) {
     fileSystem.symlinkSync(target, filePath);
 }
 function runtimeScriptPath(dependencies) {
-    return dependencies.scriptPath ?? resolveBundledAsset(WORKER_SKILL_SHARE_ASSET);
+    return dependencies.scriptPath ?? path.join(packageRoot(), BUNDLED_ASSET_DIR, WORKER_SKILL_SHARE_ASSET);
 }
 export function runWorkerSkillShare(argv, dependencies) {
     let apply = false;

package/dist/commands/core-worker-skills-command.d.ts

@@ -3,6 +3,6 @@ export type WorkerSkillCommandContext = {
     cwd: string;
     hqRoot?: string;
 };
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+/** Run the native implementation for the worker-skills family. */
 export declare function runWorkerSkillCommand(name: WorkerSkillCommandName, args: string[], context: WorkerSkillCommandContext): Promise<number>;
 //# sourceMappingURL=core-worker-skills-command.d.ts.map

package/dist/commands/core-worker-skills-command.js

@@ -1,24 +1,7 @@
-import { runBundledScript } from "../utils/run-bundled-script.js";
-import { coreNativeWorkerSkillsEnabled } from "./core-native-worker-skills-flag.js";
-import { runWorkerSkillLint, WORKER_SKILL_LINT_ASSET } from "./core-worker-lint-native.js";
-import { runWorkerSkillShare, WORKER_SKILL_SHARE_ASSET } from "./core-worker-share-native.js";
-const assets = {
-    lint: WORKER_SKILL_LINT_ASSET,
-    share: WORKER_SKILL_SHARE_ASSET,
-};
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+import { runWorkerSkillLint } from "./core-worker-lint-native.js";
+import { runWorkerSkillShare } from "./core-worker-share-native.js";
+/** Run the native implementation for the worker-skills family. */
 export async function runWorkerSkillCommand(name, args, context) {
-    if (!(await coreNativeWorkerSkillsEnabled())) {
-        const result = runBundledScript({
-            asset: assets[name],
-            args,
-            cwd: context.cwd,
-            hqRoot: context.hqRoot,
-        });
-        if (result.code !== 0)
-            process.exit(result.code);
-        return result.code;
-    }
     const result = name === "lint"
         ? runWorkerSkillLint(args, { cwd: context.cwd })
         : runWorkerSkillShare(args, { cwd: context.cwd });

package/dist/commands/core.d.ts

@@ -75,9 +75,13 @@ export type RebuildIndexTarget = {
     /** One-line summary, shown in `hq core --help`. */
     summary: string;
 };
-export type WorkerSubcommand = ScaffoldAsset & {
+export type WorkerSubcommand = {
     /** Subcommand name under the `worker` group — `hq core worker <name>`. */
     name: string;
+    /** Caller-relative root used by the native command. */
+    root: "cwd";
+    /** One-line summary, shown in `hq core --help`. */
+    summary: string;
 };
 /**
  * Native commands that still claim a scaffold forwarder asset. The forwarder

package/dist/commands/core.js

@@ -51,6 +51,7 @@ import { DERIVE_TRIGGER_FACTS_ASSET } from "./core-derive-trigger-facts-native.j
 import { registerCoreHookStateHelpers } from "./core-hook-state-helpers-native.js";
 import { registerCoreHookBatchCommand } from "./core-hook-batch-command.js";
 import { registerCorePipelineWorkerTableCommand } from "./core-pipeline-workers-command.js";
+import { registerCorePipelineRuntimeCommands } from "./core-pipeline-conductor-command.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -132,13 +133,11 @@ export const NATIVE_SCAFFOLD_COMMANDS = [
 export const WORKER_SUBCOMMANDS = [
     {
         name: "lint",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         summary: "Fail on worker-scoped skills duplicated by copy instead of single-sourced",
     },
     {
         name: "share",
-        asset: "core/scripts/share-worker-skill.sh",
         root: "cwd",
         summary: "Migrate duplicated worker skills onto one canonical file + relative symlinks",
     },
@@ -307,6 +306,10 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
+    // Pipeline rollback companions remain bundled until the family removal PR.
+    { asset: "core/scripts/pipeline-conductor.sh", root: "live", summary: "Rollback shell for native pipeline conductor" },
+    { asset: "core/scripts/pipeline-driver.sh", root: "live", summary: "Rollback shell for native pipeline driver" },
+    { asset: "core/scripts/pipeline-envelope.sh", root: "live", summary: "Validation helper for the pipeline shell rollback companions" },
     { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by bundled scripts" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
@@ -324,7 +327,6 @@ export const SCAFFOLD_ASSETS = [
     ...SCAFFOLD_COMMANDS,
     ...NATIVE_SCAFFOLD_COMMANDS,
     ...SCAFFOLD_ONLY_ASSETS,
-    ...WORKER_SUBCOMMANDS,
 ];
 /**
  * Resolve the tree an entry runs against, and the cwd to run it in.
@@ -404,6 +406,7 @@ export function registerCoreCommands(program) {
     registerCoreDeriveTriggerFactsCommand(core);
     registerCoreHookStateHelpers(core);
     registerCoreHookBatchCommand(core);
+    registerCorePipelineRuntimeCommands(core);
     const sessionHelperCommands = [
         {
             name: "session-journal", asset: "core/scripts/session-journal.sh", root: "live",
@@ -555,7 +558,7 @@ export function registerCoreCommands(program) {
         const command = worker
             .command(entry.name)
             .description(entry.summary)
-            // Pure passthrough: the wrapped script owns its own argument grammar.
+            // Pure passthrough: the native handler owns the worker command grammar.
             .allowUnknownOption()
             .allowExcessArguments()
             .helpOption(false)
@@ -565,11 +568,7 @@ export function registerCoreCommands(program) {
             const operands = cmd.args.length > 0 ? cmd.args : args;
             await runWorkerSkillCommand(entry.name, operands, resolveEntryRoot(entry, scope));
         });
-        describeCoreCommand(command, {
-            execution: interpreterFor(entry.asset) === "node" ? "bundled-node" : "bundled-shell",
-            asset: entry.asset,
-            root: entry.root,
-        });
+        describeCoreCommand(command, { execution: "native", root: entry.root });
     }
     const runCommand = (entry, args = [], cmd, target) => {
         const scope = core.opts();

package/dist/commands/dm.js

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { readFileSync } from "node:fs";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { vaultApiFetch } from "../utils/vault-api.js";
+import { resolveDestinationCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { isMachineIdentity } from "@indigoai-us/hq-cloud";
 import { peekIdToken } from "../utils/id-token.js";
 import { EMAIL_PATTERN, RECIPIENT_UID_PATTERN } from "../lib/notify-recipient.js";
@@ -830,12 +830,20 @@ async function runDmForward(eventId, opts) {
             console.error(chalk.red("--to accepts one recipient or channel, not a group recipient list."));
             process.exit(1);
         }
+        const destinationChannelName = parseChannelName(opts.to);
+        if (opts.company !== undefined && destinationChannelName !== null) {
+            console.error(chalk.red("--company applies to person or agent destinations; a channel uses its own company."));
+            process.exit(1);
+        }
+        if (opts.company !== undefined && !opts.company.trim()) {
+            console.error(chalk.red("--company requires a company slug or cmp_ ID."));
+            process.exit(1);
+        }
         const note = opts.noteFile !== undefined
             ? readFileSync(opts.noteFile, "utf8")
             : opts.note;
         const token = await ensureCognitoToken();
         const source = await resolveForwardSourceConversation(token, opts.from);
-        const destinationChannelName = parseChannelName(opts.to);
         const fileAccess = opts.grantFiles ? "grant" : opts.omitFiles ? "omit" : undefined;
         const shared = {
             ...(note !== undefined ? { body: note } : {}),
@@ -869,8 +877,19 @@ async function runDmForward(eventId, opts) {
                 console.error(chalk.red("--to must be a person email, person/agent UID, or channel name/ID."));
                 process.exit(1);
             }
+            // The server runs the destination-side cross-company check only when the
+            // request names the destination company; without it the destination is
+            // treated as personal. Not defaulted from the source, which would make a
+            // forward into another company look same-company.
+            const destinationCompanyUid = opts.company !== undefined
+                ? await resolveDestinationCompanyUid(token, opts.company.trim())
+                : undefined;
             path = "/v1/notify/dm";
-            payload = { ...recipient, ...shared };
+            payload = {
+                ...recipient,
+                ...shared,
+                ...(destinationCompanyUid ? { companyUid: destinationCompanyUid } : {}),
+            };
             destinationLabel = opts.to;
         }
         const res = await vaultApiFetch({ token, path, method: "POST", body: payload });
@@ -1529,6 +1548,7 @@ export function registerDmCommand(program) {
         .option("--grant-files", "Grant the recipient access to files they cannot currently open")
         .option("--omit-files", "Omit files the recipient cannot currently open")
         .option("--cross-company", "Confirm forwarding across company boundaries")
+        .option("--company <slug|cmp_id>", "Company the person or agent destination belongs to, so cross-company rules apply")
         .action(async (eventId, opts) => {
         await runDmForward(eventId, opts);
     });

package/dist/commands/storage-gate.d.ts

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/commands/storage-gate.js

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/fast-scaffold.js

@@ -278,8 +278,6 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-worker-lint-fast.js",
         exportName: "runWorkerSkillLintFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-worker-skills",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         shellCwd: "caller",
         shellHqRoot: "none",