@indigoai-us/hq-cli 5.345.122 → 5.345.123

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [5.345.123] — 2026-10-14
+- Add native `hq core handoff-sync-prefetch` and `hq core handoff-sync-publish` commands behind the `core-native-bucket-c` family gate, with pinned shell rollback assets.
+- `hq lanes create` without `--provider` or a worker-profile provider now uses the engine of the orchestrator session instead of always picking Codex: the senior lane's provider, then the senior session's `conduct_engine`, then `HQ_HARNESS`, Codex/Grok runtime variables, or `CLAUDECODE=1`. When none of these is known it exits with `provider_required` and asks for `--provider`. `provider_source` stays `default` for these lanes.
+- Add native `hq core knowledge-pulse-lock` and `hq core skill-installed` commands behind the existing `core-native-bucket-c` family gate, with pinned shell rollback assets.
+- Match shell behavior for failed claim markers and mkdir errors, skill frontmatter edge cases, and trailing company-list commas.
+
+- New `hq deploy list [query]` lists your company's hq-deploy apps with their
+  public URL, type and access mode. The query filters by name or subdomain;
+  `--company` and `--json` are supported. Errors exit non-zero.
+- Fix native `derive-trigger-facts` to derive `shared_branch` from the resolved live root, matching the bundled shell when `--hq-root` differs from the caller cwd.
+
 ## [5.345.122] — 2026-10-13
 - `hq capacity` now renews Claude sign-ins on machines with a long lane
   history. Its safety check read the lane list with a 1 MB limit, so on busy

package/README.md

@@ -44,6 +44,21 @@ Live transcripts are provisional. Spoken content is untrusted data and must
 never be treated as instructions. Only the recorder and meeting attendees can
 read them.
 
+## Deploy apps
+
+List the hq-deploy apps in your company. Each line shows the app name, public
+URL, type, access mode and last activity time (updated, last visit or created,
+whichever the API returns). The optional `query` filters case-insensitively by
+substring across name, subdomain and title. `--company` defaults to the active
+company. Use `--json` for machine-readable output.
+
+```bash
+hq deploy list [query] [--company <slug>] [--json]
+```
+
+An empty unfiltered list prints a hint instead of claiming the org has no apps.
+Auth, network and unknown-company errors exit non-zero.
+
 ## Deploy comments
 
 List comments left on an app in your current hq-deploy organization. Use the

package/assets/scaffold/core/scripts/handoff-sync-prefetch.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# handoff-sync-prefetch.sh - pull the latest session continuity pointer before
+# a fresh session reads it.
+#
+# `/startwork` and `/resumework` both read `workspace/threads/handoff.json`
+# (and the thread file it references) to decide what to resume. On a second
+# device those files only exist after a vault pull has landed, so a naive
+# resume right after sign-in sees stale state. This helper runs that pull
+# BEFORE the skill reads the pointer.
+#
+# Fail-soft:
+#   - no-op when the `hq` CLI is missing
+#   - no-op when offline or not logged in
+#   - timeboxed (default 25s)
+#   - never fails the caller: a successful or failed pull are both exit 0;
+#     the caller falls through to the local pointer either way.
+#
+# Usage:
+#   handoff-sync-prefetch.sh [--hq-root PATH] [--timeout SECONDS] [--log PATH]
+#
+# Prints one line of status on stdout for the caller to echo (or ignore):
+#   `ok`           - pull completed within the timeout
+#   `missing-cli`  - `hq` is not on PATH; nothing was attempted
+#   `skipped`      - CLI is present but the pull refused to start (no login,
+#                    locked, etc.); local pointer is still used
+#   `timed-out`    - pull exceeded the timeout and was killed
+#   `error:<rc>`   - pull returned a non-zero exit code
+#
+# Exits 0 in every case so a shell `|| true` is unnecessary at call sites.
+
+set -euo pipefail
+
+HQ_ROOT=""
+TIMEOUT="${HQ_HANDOFF_PREFETCH_TIMEOUT:-25}"
+LOG="/tmp/handoff-sync-prefetch.log"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --hq-root) HQ_ROOT="$2"; shift 2 ;;
+    --timeout) TIMEOUT="$2"; shift 2 ;;
+    --log) LOG="$2"; shift 2 ;;
+    -h|--help)
+      sed -n '1,/^set -euo pipefail/p' "$0" | sed '$d' | sed 's/^# \{0,1\}//'
+      exit 0 ;;
+    *) echo "handoff-sync-prefetch: unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+if ! command -v hq >/dev/null 2>&1; then
+  echo "missing-cli"
+  exit 0
+fi
+
+if [[ -z "$HQ_ROOT" ]]; then
+  HQ_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null || true
+: >>"$LOG"
+printf '\n--- handoff-sync-prefetch %s hq_root=%s timeout=%ss ---\n' \
+  "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HQ_ROOT" "$TIMEOUT" >>"$LOG"
+
+# Portable timeout: do not depend on coreutils `timeout` (missing on stock
+# macOS, missing in some Git Bash installs). Run the child in the background,
+# start a watchdog that polls until the deadline, and kill the child on expiry.
+# Exit code 124 is reserved to mean "timed out" so the caller branch is
+# reachable regardless of which path ran.
+run_with_timeout() {
+  local secs="$1"; shift
+  local flag="/tmp/handoff-sync-prefetch.timeout.$$.$RANDOM"
+  rm -f "$flag"
+  "$@" >>"$LOG" 2>&1 &
+  local child=$!
+  (
+    local waited=0
+    while [ "$waited" -lt "$secs" ]; do
+      sleep 1
+      kill -0 "$child" 2>/dev/null || exit 0
+      waited=$((waited + 1))
+    done
+    : >"$flag"
+    kill -TERM "$child" 2>/dev/null || true
+    sleep 1
+    if kill -0 "$child" 2>/dev/null; then
+      kill -KILL "$child" 2>/dev/null || true
+    fi
+  ) >/dev/null 2>&1 &
+  local watchdog=$!
+  local rc=0
+  wait "$child" 2>/dev/null || rc=$?
+  kill "$watchdog" 2>/dev/null || true
+  wait "$watchdog" 2>/dev/null || true
+  if [ -f "$flag" ]; then
+    rm -f "$flag"
+    return 124
+  fi
+  rm -f "$flag"
+  return "$rc"
+}
+
+rc=0
+run_with_timeout "$TIMEOUT" \
+  hq sync pull --personal --hq-root "$HQ_ROOT" --lock-timeout 0 \
+  || rc=$?
+printf 'exit=%s\n' "$rc" >>"$LOG"
+
+case "$rc" in
+  0)   echo "ok" ;;
+  124) echo "timed-out" ;;
+  *)
+    # Distinguish "could not even start" (no login / lock refused) from a real
+    # error so operator logs don't scream when the user simply isn't signed in
+    # yet. `hq sync pull` returns 1 for both; the log file carries the detail.
+    if grep -qE 'not logged in|no cached session|refused immediately|requires login' "$LOG" 2>/dev/null; then
+      echo "skipped"
+    else
+      echo "error:${rc}"
+    fi
+    ;;
+esac
+exit 0

package/assets/scaffold/core/scripts/handoff-sync-publish.sh

@@ -0,0 +1,124 @@
+#!/bin/bash
+# handoff-sync-publish.sh - push the session continuity pointer to the personal vault.
+#
+# Cross-device handoff depends on `workspace/threads/handoff.json` and the
+# single thread file it points to reaching the vault before a fresh session on
+# another machine runs `/startwork` or `/resumework`. The workspace tree is
+# otherwise machine-local (`PERSONAL_VAULT_EXCLUDED_TOP_LEVEL`), so without a
+# push run between the two sessions machine B sees stale state or no handoff
+# at all. See hq-cloud-sync `computeContinuityPointerPaths`.
+#
+# This helper is intentionally minimal and fail-soft:
+#   - no-op when the `hq` CLI is missing (fresh install, agent box without CLI)
+#   - no-op when offline or not logged in (vault push will fail; we never
+#     block /handoff on cloud reachability)
+#   - timeboxed (default 25s) so a slow network cannot stall session end
+#   - detached by default; the handoff-finalize payload is already emitted
+#
+# Usage:
+#   handoff-sync-publish.sh [--hq-root PATH] [--timeout SECONDS]
+#                          [--sync] [--log PATH]
+#
+#   --sync     Run synchronously in the foreground and return the exit code.
+#              Default behaviour forks a backgrounded worker and prints its PID.
+#   --timeout  Wall-clock bound in seconds; the push is killed on expiry.
+#   --log      Append combined stdout/stderr to this path (default: `/tmp/handoff-sync-publish.log`).
+#
+# Exits 0 on dispatch (background mode) or on push success (sync mode).
+# A sync-mode failure returns the underlying `hq` exit, or 124 on timeout.
+
+set -euo pipefail
+
+HQ_ROOT=""
+TIMEOUT="${HQ_HANDOFF_PUBLISH_TIMEOUT:-25}"
+MODE="background"
+LOG="/tmp/handoff-sync-publish.log"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --hq-root) HQ_ROOT="$2"; shift 2 ;;
+    --timeout) TIMEOUT="$2"; shift 2 ;;
+    --sync) MODE="sync"; shift ;;
+    --log) LOG="$2"; shift 2 ;;
+    -h|--help)
+      sed -n '1,/^set -euo pipefail/p' "$0" | sed '$d' | sed 's/^# \{0,1\}//'
+      exit 0 ;;
+    *) echo "handoff-sync-publish: unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+if ! command -v hq >/dev/null 2>&1; then
+  # Fresh install / agent box without the CLI. Nothing to publish from here.
+  exit 0
+fi
+
+if [[ -z "$HQ_ROOT" ]]; then
+  HQ_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi
+
+# Portable timeout: do not depend on coreutils `timeout` (missing on stock
+# macOS, missing in some Git Bash installs). Return 124 on timeout so the
+# caller can distinguish wall-clock expiry from a real `hq` error.
+run_with_timeout() {
+  local secs="$1"; shift
+  local flag="/tmp/handoff-sync-publish.timeout.$$.$RANDOM"
+  rm -f "$flag"
+  "$@" >>"$LOG" 2>&1 &
+  local child=$!
+  (
+    local waited=0
+    while [ "$waited" -lt "$secs" ]; do
+      sleep 1
+      kill -0 "$child" 2>/dev/null || exit 0
+      waited=$((waited + 1))
+    done
+    : >"$flag"
+    kill -TERM "$child" 2>/dev/null || true
+    sleep 1
+    if kill -0 "$child" 2>/dev/null; then
+      kill -KILL "$child" 2>/dev/null || true
+    fi
+  ) >/dev/null 2>&1 &
+  local watchdog=$!
+  local rc=0
+  wait "$child" 2>/dev/null || rc=$?
+  kill "$watchdog" 2>/dev/null || true
+  wait "$watchdog" 2>/dev/null || true
+  if [ -f "$flag" ]; then
+    rm -f "$flag"
+    return 124
+  fi
+  rm -f "$flag"
+  return "$rc"
+}
+
+run_publish() {
+  # `hq sync push --personal` is the canonical publish path for the session
+  # continuity pointer (the vault scope that carves out handoff.json + the
+  # referenced thread file). A `--lock-timeout 0` keeps the push from queueing
+  # behind a long-running sync pass; the operator can rerun later.
+  run_with_timeout "$TIMEOUT" \
+    hq sync push --personal --hq-root "$HQ_ROOT" --lock-timeout 0 \
+      --message "handoff continuity pointer"
+}
+
+mkdir -p "$(dirname "$LOG")" 2>/dev/null || true
+: >>"$LOG"
+printf '\n--- handoff-sync-publish %s hq_root=%s mode=%s timeout=%ss ---\n' \
+  "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$HQ_ROOT" "$MODE" "$TIMEOUT" >>"$LOG"
+
+if [[ "$MODE" == "sync" ]]; then
+  rc=0; run_publish || rc=$?
+  printf 'exit=%s\n' "$rc" >>"$LOG"
+  exit "$rc"
+fi
+
+# background: detach cleanly so handoff-finalize can return immediately.
+(
+  rc=0
+  run_publish || rc=$?
+  printf 'exit=%s\n' "$rc" >>"$LOG"
+) </dev/null >>"$LOG" 2>&1 &
+disown || true
+printf '%s\n' "$!"
+exit 0

package/assets/scaffold/core/scripts/knowledge-pulse-lock.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 4 || "$1" != "claim" ]]; then
+  echo "Usage: knowledge-pulse-lock.sh claim <claim-root> <company-slug> <YYYY-MM-DD>" >&2
+  exit 2
+fi
+
+claim_root="$2"
+company_slug="$3"
+claim_date="$4"
+
+if [[ -z "$claim_root" || ! "$company_slug" =~ ^[a-z0-9][a-z0-9-]*$ || ! "$claim_date" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
+  echo "knowledge-pulse-lock: invalid claim root, company slug, or date" >&2
+  exit 2
+fi
+
+mkdir -p "$claim_root"
+marker="$claim_root/$company_slug-$claim_date.claimed"
+if mkdir "$marker" 2>/dev/null; then
+  printf 'claimed\n'
+elif [[ -d "$marker" ]]; then
+  printf 'already-claimed\n'
+else
+  echo "knowledge-pulse-lock: could not create claim marker" >&2
+  exit 1
+fi

package/assets/scaffold/core/scripts/lib/session-skill-catalog.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# hq-core: public
+# session-skill-catalog.sh — bounded company-scoped skill catalog for system.txt.
+#
+# Enumerates SKILL.md frontmatter (name + description) from:
+#   1. companies/<companySlug>/skills/*/SKILL.md   (wins on name collision)
+#   2. .claude/skills/*/SKILL.md
+#   3. core/packages/*/skills/*/SKILL.md
+#
+# Cross-company skills are never listed. Catalog is name + one-line description
+# only (never full bodies). Bounded by HQ_SESSION_SKILL_CATALOG_MAX_BYTES
+# (default 32768). Exports:
+#   SESSION_SKILLS_AVAILABLE
+#   SESSION_SKILL_CATALOG_TSV   — name<TAB>path<TAB>origin per line
+#   SESSION_SKILL_CATALOG_BODY
+#   SESSION_SKILL_CATALOG_RENDERED_BYTES
+
+# session_skill_read_frontmatter <skill.md>
+#   Prints "name<TAB>description" from YAML frontmatter (first --- block).
+session_skill_read_frontmatter() {
+  local file="${1:-}"
+  [ -f "$file" ] || return 1
+  awk '
+    BEGIN { in_fm=0; name=""; desc=""; in_desc_block=0; desc_indent=0 }
+    /^---[ \t]*$/ {
+      if (in_fm == 0) { in_fm=1; next }
+      if (name != "") {
+        gsub(/[ \t\r\n]+/, " ", desc)
+        gsub(/^ | $/, "", desc)
+        print name "\t" desc
+      }
+      exit
+    }
+    in_fm && in_desc_block {
+      if ($0 ~ /^[ \t]*$/) {
+        desc=desc " "
+        next
+      }
+      indent=match($0, /[^ \t]/) - 1
+      if (indent > desc_indent) {
+        desc=desc " " substr($0, indent + 1)
+        next
+      }
+      in_desc_block=0
+    }
+    in_fm && /^name:[ \t]*/ {
+      s=$0; sub(/^name:[ \t]*/,"",s)
+      gsub(/^["'"'"']|["'"'"']$/,"",s)
+      name=s; next
+    }
+    in_fm && /^description:[ \t]*/ {
+      s=$0; sub(/^description:[ \t]*/,"",s)
+      if (s ~ /^[|>][-+]?[ \t]*$/) {
+        in_desc_block=1
+        desc_indent=match($0, /[^ \t]/) - 1
+        next
+      }
+      gsub(/^["'"'"']|["'"'"']$/,"",s)
+      desc=s; next
+    }
+  ' "$file"
+}
+
+# session_skill_catalog_build <root> <companySlug>
+#   Builds internal catalog state. Prints skillsAvailable on stdout.
+session_skill_catalog_build() {
+  local root="${1:-}" company="${2:-}"
+  local max_bytes skill_dir f fm n d line lb name_line name_bytes
+  local full_line full_bytes remaining_name_bytes indicator indicator_bytes
+  local count=0 rendered_bytes=0 name_only_bytes=0
+  local tsv_file render_file list_file catalog_file
+
+  SESSION_SKILLS_AVAILABLE=0
+  SESSION_SKILL_CATALOG_TSV=""
+  SESSION_SKILL_CATALOG_RENDERED_BYTES=0
+  SESSION_SKILL_CATALOG_BODY=""
+
+  [ -n "$root" ] && [ -n "$company" ] || {
+    echo 0
+    return 0
+  }
+
+  max_bytes="${HQ_SESSION_SKILL_CATALOG_MAX_BYTES:-32768}"
+  case "$max_bytes" in ''|*[!0-9]*) max_bytes=32768 ;; esac
+
+  tsv_file="$(mktemp)"
+  render_file="$(mktemp)"
+  list_file="$(mktemp)"
+  catalog_file="$(mktemp)"
+  : > "$tsv_file"
+  : > "$render_file"
+  : > "$list_file"
+  : > "$catalog_file"
+
+  # Build ordered candidate list: company first, then root, then packages.
+  # Format per line: origin<TAB>path
+  local -a company_slugs=()
+  IFS=, read -r -a company_slugs <<< "$company"
+  for company in "${company_slugs[@]}"; do
+    [ -n "$company" ] || continue
+    if [ -d "$root/companies/$company/skills" ]; then
+      for skill_dir in "$root/companies/$company/skills"/*/; do
+        [ -d "$skill_dir" ] || continue
+        f="${skill_dir}SKILL.md"
+        [ -f "$f" ] && printf 'company\t%s\n' "$f" >> "$list_file"
+      done
+    fi
+  done
+  if [ -d "$root/.claude/skills" ]; then
+    for skill_dir in "$root/.claude/skills"/*/; do
+      [ -d "$skill_dir" ] || continue
+      case "$(basename "$skill_dir")" in
+        _*|README*) continue ;;
+      esac
+      f="${skill_dir}SKILL.md"
+      [ -f "$f" ] && printf 'root\t%s\n' "$f" >> "$list_file"
+    done
+  fi
+  if [ -d "$root/core/packages" ]; then
+    for skill_dir in "$root/core/packages"/*/skills/*/; do
+      [ -d "$skill_dir" ] || continue
+      f="${skill_dir}SKILL.md"
+      [ -f "$f" ] && printf 'package\t%s\n' "$f" >> "$list_file"
+    done
+  fi
+
+  # First name wins (company enumerated first → shadowing).
+  local origin names_blob=""
+  names_blob=""
+  while IFS=$'\t' read -r origin f || [ -n "${origin:-}" ]; do
+    [ -z "${origin:-}" ] && continue
+    [ -f "$f" ] || continue
+    fm="$(session_skill_read_frontmatter "$f")" || continue
+    [ -n "$fm" ] || continue
+    n="${fm%%$'\t'*}"
+    d="${fm#*$'\t'}"
+    [ -n "$n" ] || continue
+    case $'\n'"$names_blob"$'\n' in
+      *$'\n'"$n"$'\n'*) continue ;;
+    esac
+    names_blob="${names_blob}${n}"$'\n'
+    printf '%s\t%s\t%s\n' "$n" "$f" "$origin" >> "$tsv_file"
+    printf '%s\t%s\n' "$n" "$d" >> "$catalog_file"
+    count=$((count + 1))
+  done < "$list_file"
+
+  # Names are the catalog's discovery contract. Calculate their minimum total
+  # first, then spend only surplus bytes on descriptions. This prevents early
+  # verbose entries from silently crowding later skill names out of the prompt.
+  while IFS=$'\t' read -r n d || [ -n "${n:-}" ]; do
+    [ -n "${n:-}" ] || continue
+    name_line="- /$n"
+    name_bytes="$(printf '%s\n' "$name_line" | wc -c | tr -d '[:space:]')"
+    case "$name_bytes" in ''|*[!0-9]*) name_bytes=0 ;; esac
+    name_only_bytes=$((name_only_bytes + name_bytes))
+  done < "$catalog_file"
+
+  if [ "$name_only_bytes" -le "$max_bytes" ]; then
+    remaining_name_bytes="$name_only_bytes"
+    while IFS=$'\t' read -r n d || [ -n "${n:-}" ]; do
+      [ -n "${n:-}" ] || continue
+      name_line="- /$n"
+      name_bytes="$(printf '%s\n' "$name_line" | wc -c | tr -d '[:space:]')"
+      case "$name_bytes" in ''|*[!0-9]*) name_bytes=0 ;; esac
+      remaining_name_bytes=$((remaining_name_bytes - name_bytes))
+      line="$name_line"
+      lb="$name_bytes"
+      if [ -n "${d:-}" ]; then
+        full_line="$name_line — $d"
+        full_bytes="$(printf '%s\n' "$full_line" | wc -c | tr -d '[:space:]')"
+        case "$full_bytes" in ''|*[!0-9]*) full_bytes="$name_bytes" ;; esac
+        if [ $((rendered_bytes + full_bytes + remaining_name_bytes)) -le "$max_bytes" ]; then
+          line="$full_line"
+          lb="$full_bytes"
+        fi
+      fi
+      printf '%s\n' "$line" >> "$render_file"
+      rendered_bytes=$((rendered_bytes + lb))
+    done < "$catalog_file"
+  else
+    indicator="- (catalog truncated)"
+    indicator_bytes="$(printf '%s\n' "$indicator" | wc -c | tr -d '[:space:]')"
+    case "$indicator_bytes" in ''|*[!0-9]*) indicator_bytes=0 ;; esac
+    while IFS=$'\t' read -r n d || [ -n "${n:-}" ]; do
+      [ -n "${n:-}" ] || continue
+      name_line="- /$n"
+      name_bytes="$(printf '%s\n' "$name_line" | wc -c | tr -d '[:space:]')"
+      case "$name_bytes" in ''|*[!0-9]*) name_bytes=0 ;; esac
+      if [ $((rendered_bytes + name_bytes + indicator_bytes)) -le "$max_bytes" ]; then
+        printf '%s\n' "$name_line" >> "$render_file"
+        rendered_bytes=$((rendered_bytes + name_bytes))
+      fi
+    done < "$catalog_file"
+    if [ $((rendered_bytes + indicator_bytes)) -le "$max_bytes" ]; then
+      printf '%s\n' "$indicator" >> "$render_file"
+      rendered_bytes=$((rendered_bytes + indicator_bytes))
+    fi
+  fi
+
+  SESSION_SKILLS_AVAILABLE="$count"
+  SESSION_SKILL_CATALOG_TSV="$(cat "$tsv_file")"
+  SESSION_SKILL_CATALOG_RENDERED_BYTES="$rendered_bytes"
+  SESSION_SKILL_CATALOG_BODY="$(cat "$render_file")"
+
+  rm -f "$tsv_file" "$render_file" "$list_file" "$catalog_file"
+  echo "$count"
+  return 0
+}
+
+# session_skill_catalog_append <runDir> <companySlug> <compactFlag>
+session_skill_catalog_append() {
+  local run_dir="${1:-}" company="${2:-}" compact="${3:-0}"
+  local system_txt="$run_dir/system.txt"
+  [ -f "$system_txt" ] || return 0
+  {
+    printf '<!-- hq-section: skill-catalog -->\n'
+    if [ "$compact" = "true" ]; then
+      printf 'Read the relevant SKILL.md directly when a task calls for an HQ skill. Search only .claude/skills/*/SKILL.md, companies/%s/skills/*/SKILL.md, and core/packages/*/skills/*/SKILL.md. Do not inspect another company directory.\n' "$company"
+    elif [ -n "${SESSION_SKILL_CATALOG_BODY:-}" ]; then
+      printf '%s\n' "$SESSION_SKILL_CATALOG_BODY"
+    else
+      printf '(no skills available)\n'
+    fi
+  } >> "$system_txt"
+  return 0
+}

package/assets/scaffold/core/scripts/skill-installed.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Report whether a skill is in the active session's company-scoped catalog.
+
+set -euo pipefail
+
+skill="${1:-}"
+company="${2:-${HQ_ACTIVE_COMPANY:-}}"
+HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+resolver="$HQ_ROOT/core/scripts/lib/session-skill-catalog.sh"
+
+if [[ -z "$company" ]]; then
+  company="$(bash "$HQ_ROOT/core/scripts/hq-session.sh" get company_slugs 2>/dev/null || true)"
+fi
+
+if [[ ! "$skill" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
+  exit 1
+fi
+if [[ -z "$company" ]]; then
+  # The catalog requires a company to enumerate skills. This impossible
+  # company slug selects the same root and package skills without a tenant.
+  company="__hq_unbound_session__"
+else
+  IFS=, read -r -a companies <<< "$company"
+  for slug in "${companies[@]}"; do
+    [[ "$slug" =~ ^[a-z][a-z0-9_-]*$ ]] || exit 1
+  done
+fi
+
+if [[ ! -r "$resolver" ]]; then
+  printf 'skill availability resolver is missing: %s\n' "$resolver" >&2
+  exit 2
+fi
+
+# Use the same ordered, company-scoped catalog as session skill discovery.
+# shellcheck source=core/scripts/lib/session-skill-catalog.sh
+source "$resolver"
+session_skill_catalog_build "$HQ_ROOT" "$company" >/dev/null
+
+while IFS=$'\t' read -r catalog_skill catalog_path _; do
+  [[ "$catalog_skill" == "$skill" && -f "$catalog_path" ]] && exit 0
+done <<< "${SESSION_SKILL_CATALOG_TSV:-}"
+
+exit 1