@indigoai-us/hq-cli 5.345.122 → 5.345.124

package/dist/commands/core-bucket-c-work-mesh-offer-native.js

@@ -0,0 +1,147 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { loadCachedTokens } from "@indigoai-us/hq-cloud";
+import { createFlagClient } from "@indigoai-us/hq-flags-client";
+import { resolveFlagRegistryEndpoint } from "../lib/flag-registry-endpoint.js";
+const success = (stdout) => ({ code: 0, stdout, stderr: "" });
+const failure = (stderr) => ({ code: 1, stdout: "", stderr: `${stderr}\n` });
+const COMPANY = /^[A-Za-z0-9_-]+$/;
+const PROJECT = /^[A-Za-z0-9._-]+$/;
+const COMPANY_UID = /^cmp_[A-Za-z0-9]{3,128}$/;
+const OFFER_FLAG = "workmesh.offer-project-create-on-brainstorm";
+function cloudUid(root, company) {
+    const file = path.join(root, "companies/manifest.yaml");
+    let text;
+    try {
+        text = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return "";
+    }
+    const lines = text.split(/\r?\n/);
+    let inCompanies = false;
+    let inCompany = false;
+    for (const line of lines) {
+        if (/^companies:\s*$/.test(line)) {
+            inCompanies = true;
+            continue;
+        }
+        if (inCompanies && /^[^\s]/.test(line)) {
+            inCompanies = false;
+            inCompany = false;
+        }
+        if (inCompanies && /^ {2}[^ #][^:]*:/.test(line)) {
+            const slug = line.trim().replace(/:$/, "");
+            inCompany = slug === company;
+            continue;
+        }
+        if (inCompany && /^ {2}[^\s#]/.test(line))
+            break;
+        if (inCompany && /^\s+cloud_uid:/.test(line))
+            return (line.split(":")[1] ?? "").trim().replace(/["']/g, "");
+    }
+    return "";
+}
+function boardFile(root, company) { return path.join(root, "companies", company, "board.json"); }
+function matchingProjects(board, project) {
+    const rows = board?.projects;
+    if (!Array.isArray(rows))
+        return [];
+    return rows.filter((row) => Boolean(row && typeof row === "object" && (row.id === project || row.mesh_project_id === project)));
+}
+async function enabledForCompany(company, uid, env) {
+    const endpoint = resolveFlagRegistryEndpoint(undefined, env);
+    if (!endpoint || !COMPANY_UID.test(uid))
+        return false;
+    let client;
+    let failed = false;
+    const deadline = AbortSignal.timeout(150);
+    try {
+        client = createFlagClient({
+            endpoint,
+            companyUid: uid,
+            companyIdentifiers: [company],
+            getToken: () => loadCachedTokens()?.idToken ?? "",
+            refreshIntervalMs: 0,
+            requestTimeoutMs: 150,
+            onError: () => { failed = true; },
+            fetch: (input, init) => fetch(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline }),
+        });
+        await client.ready();
+        return !failed && !deadline.aborted && client.isEnabled(OFFER_FLAG, { fallback: false });
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            client?.close();
+        }
+        catch { /* the shell helper defaults off on close failure */ }
+    }
+}
+function updatePromptState(root, company, project, state) {
+    const file = boardFile(root, company);
+    if (!fs.existsSync(file))
+        return failure(`no company board for ${company}`);
+    let board;
+    try {
+        board = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return failure(`no local Board project ${project} for ${company}`);
+    }
+    const rows = matchingProjects(board, project);
+    if (!rows.length)
+        return failure(`no local Board project ${project} for ${company}`);
+    const object = board;
+    object.projects = object.projects.map((row) => row.id === project || row.mesh_project_id === project ? { ...row, mesh_registration_prompt_state: state } : row);
+    const temp = path.join(path.dirname(file), `.board.json.${process.pid}.${Date.now()}.tmp`);
+    try {
+        fs.writeFileSync(temp, `${JSON.stringify(board, null, 2)}\n`);
+        fs.renameSync(temp, file);
+    }
+    catch (error) {
+        try {
+            fs.rmSync(temp, { force: true });
+        }
+        catch { /* ignore cleanup failure */ }
+        return failure(String(error.message));
+    }
+    return success("");
+}
+export async function runWorkMeshProjectRegistrationOffer(args, root, env = process.env) {
+    if (args.length === 3 && args[0] === "--check") {
+        const [, company, project] = args;
+        if (!COMPANY.test(company) || !PROJECT.test(project))
+            return failure("invalid company or project id");
+        const uid = cloudUid(root, company);
+        if (!uid || !COMPANY_UID.test(uid))
+            return success("local\n");
+        const file = boardFile(root, company);
+        let board;
+        try {
+            board = JSON.parse(fs.readFileSync(file, "utf8"));
+        }
+        catch {
+            return success("missing\n");
+        }
+        const [row] = matchingProjects(board, project);
+        if (!row)
+            return success("missing\n");
+        const registered = row.threadId !== undefined && row.threadId !== null && row.threadId !== ""
+            && row.channelId !== undefined && row.channelId !== null && row.channelId !== "";
+        const state = registered ? "registered" : String(row.mesh_registration_prompt_state ?? "offer");
+        if (["accepted", "deferred", "registered", "missing"].includes(state))
+            return success(`${state}\n`);
+        return success(`${await enabledForCompany(company, uid, env) ? "offer" : "off"}\n`);
+    }
+    if (args.length === 3 && (args[0] === "--accept" || args[0] === "--defer")) {
+        const [, company, project] = args;
+        if (!COMPANY.test(company) || !PROJECT.test(project))
+            return failure("invalid company or project id");
+        return updatePromptState(root, company, project, args[0] === "--accept" ? "accepted" : "deferred");
+    }
+    return failure("usage: work-mesh-project-registration-offer.sh --check <company> <project-id> | --accept <company> <project-id> | --defer <company> <project-id>");
+}
+//# sourceMappingURL=core-bucket-c-work-mesh-offer-native.js.map

package/dist/commands/core-bucket-c-workflow-gate-fast.d.ts

@@ -0,0 +1,3 @@
+export declare function runWorkflowGateFast(args: string[], _stdin: string, _cwd: string, root: string): Promise<number>;
+export declare function runWorkMeshProjectRegistrationOfferFast(args: string[], _stdin: string, _cwd: string, root: string): Promise<number>;
+//# sourceMappingURL=core-bucket-c-workflow-gate-fast.d.ts.map

package/dist/commands/core-bucket-c-workflow-gate-fast.js

@@ -0,0 +1,17 @@
+import { runWorkflowGate } from "./core-bucket-c-workflow-gate-native.js";
+import { runWorkMeshProjectRegistrationOffer } from "./core-bucket-c-work-mesh-offer-native.js";
+async function emit(result) {
+    const output = await result;
+    if (output.stdout)
+        process.stdout.write(output.stdout);
+    if (output.stderr)
+        process.stderr.write(output.stderr);
+    return output.code;
+}
+export function runWorkflowGateFast(args, _stdin, _cwd, root) {
+    return emit(runWorkflowGate(args, root));
+}
+export function runWorkMeshProjectRegistrationOfferFast(args, _stdin, _cwd, root) {
+    return emit(runWorkMeshProjectRegistrationOffer(args, root));
+}
+//# sourceMappingURL=core-bucket-c-workflow-gate-fast.js.map

package/dist/commands/core-bucket-c-workflow-gate-native.d.ts

@@ -0,0 +1,7 @@
+export type WorkflowGateResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export declare function runWorkflowGate(args: readonly string[], root: string, env?: NodeJS.ProcessEnv, now?: () => number, sleep?: () => Promise<void>): Promise<WorkflowGateResult>;
+//# sourceMappingURL=core-bucket-c-workflow-gate-native.d.ts.map

package/dist/commands/core-bucket-c-workflow-gate-native.js

@@ -0,0 +1,250 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+const ok = (stdout = "") => ({ code: 0, stdout, stderr: "" });
+const fail = (message, code = 1) => ({ code, stdout: "", stderr: `${message}\n` });
+const validId = /^[a-z0-9._-]+$/;
+const USAGE = `workflow-gate.sh — inspect and answer human gates opened by codex-workflow.mjs gate().
+
+A gate is a self-contained pending question file written by a paused workflow
+run; writing a matching answered/<id>.json resumes that run in place. Answers
+are durable: a re-launched run returns them instantly instead of re-asking
+the human, so never delete answered/ files while their project is live.
+
+Usage:
+  workflow-gate.sh list
+  workflow-gate.sh show <id>
+  workflow-gate.sh answer <id> <choice|N> [--notes "..."] [--by name] [--force] [--freeform]
+      <choice|N>   an option label, or a 1-based option index
+      --notes      free-text note stored alongside the choice
+      --by         who answered (recorded as answered_by)
+      --force      pre-answer a gate that has not opened yet, or overwrite an
+                   existing answer
+      --freeform   accept a choice that is not one of the gate's options
+  workflow-gate.sh wait-pending [--timeout secs]
+      Blocks until any pending gate exists (exit 0) or the timeout elapses
+      (exit 1). Monitor-friendly wake condition for watching sessions.
+  workflow-gate.sh watch-run <run-dir> [--timeout secs]
+      Run-scoped wake condition for the session that launched a workflow.
+      Blocks until a gate belonging to THAT run opens (prints its id, exit 0),
+      the run finishes (exit 3), or --timeout elapses (exit 1). Match is on
+      the run_dir every gate carries, which is the --run-dir the launching
+      session chose — no id parsing, no env coupling, no startup race.
+  workflow-gate.sh clear <id>
+      Remove both the pending and answered files for a gate id.
+
+Env: HQ_WORKFLOW_GATES_DIR overrides the gates root (default
+<hq-root>/workspace/gates); legacy CODEX_WORKFLOW_GATES_DIR is honored.
+`;
+function gateId(id) {
+    return !validId.test(id) ? fail(`workflow-gate: invalid gate id "${id}" — ids are lowercase [a-z0-9._-]`) : undefined;
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+function listFiles(dir) {
+    try {
+        return fs.readdirSync(dir).filter((entry) => entry.endsWith(".json")).sort().map((entry) => path.join(dir, entry));
+    }
+    catch {
+        return [];
+    }
+}
+function parseTimeout(args) {
+    let timeout;
+    for (let index = 0; index < args.length;) {
+        if (args[index] !== "--timeout")
+            return { error: `workflow-gate: unknown flag: ${args[index]}` };
+        if (index + 1 >= args.length)
+            return { error: "workflow-gate: --timeout needs a value" };
+        const raw = args[index + 1];
+        if (!/^\d+$/.test(raw))
+            return { error: "workflow-gate: --timeout must be a whole number of seconds" };
+        timeout = Number(raw);
+        index += 2;
+    }
+    return { ...(timeout === undefined ? {} : { timeout }) };
+}
+const waitSecond = () => new Promise((resolve) => setTimeout(resolve, 1000));
+export async function runWorkflowGate(args, root, env = process.env, now = Date.now, sleep = waitSecond) {
+    const gatesDir = env.HQ_WORKFLOW_GATES_DIR || env.CODEX_WORKFLOW_GATES_DIR || path.join(root, "workspace/gates");
+    const pending = path.join(gatesDir, "pending");
+    const answered = path.join(gatesDir, "answered");
+    const [command, ...rest] = args;
+    if (!command)
+        return { code: 1, stdout: `${USAGE}\n`, stderr: "" };
+    if (command === "-h" || command === "--help" || command === "help")
+        return ok(`${USAGE}\n`);
+    if (command === "list") {
+        const files = listFiles(pending);
+        if (!files.length)
+            return ok("no pending gates\n");
+        return ok(files.map((file) => {
+            const gate = readJson(file);
+            if (!gate || typeof gate !== "object")
+                return `<unreadable> ${file}`;
+            const created = Date.parse(String(gate.created_at || 0));
+            const ageMin = Math.max(0, Math.round((now() - created) / 60000));
+            const options = Array.isArray(gate.options) ? gate.options.map((option, index) => `${index + 1}=${String(option?.label)}`).join(" ") : "";
+            return `${String(gate.id)}  (${ageMin}m)  ${String(gate.question)}${options ? `  [${options}]` : ""}`;
+        }).join("\n") + "\n");
+    }
+    if (command === "show") {
+        const id = rest[0] ?? "";
+        if (!id)
+            return fail("workflow-gate: usage: show <id>");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        const file = [path.join(pending, `${id}.json`), path.join(answered, `${id}.json`)].find((candidate) => {
+            try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!file)
+            return fail(`workflow-gate: no gate "${id}" in pending or answered`);
+        try {
+            return ok(fs.readFileSync(file, "utf8"));
+        }
+        catch {
+            return fail(`workflow-gate: no gate "${id}" in pending or answered`);
+        }
+    }
+    if (command === "answer") {
+        const [id = "", rawChoice = "", ...flags] = rest;
+        if (!id || !rawChoice)
+            return fail("workflow-gate: usage: answer <id> <choice|N> [--notes ...] [--by name] [--force] [--freeform]");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        let notes = "";
+        let by = "";
+        let force = false;
+        let freeform = false;
+        for (let index = 0; index < flags.length;) {
+            const flag = flags[index];
+            if (flag === "--force") {
+                force = true;
+                index += 1;
+            }
+            else if (flag === "--freeform") {
+                freeform = true;
+                index += 1;
+            }
+            else if (flag === "--notes" || flag === "--by") {
+                if (index + 1 >= flags.length)
+                    return fail(`workflow-gate: ${flag} needs a value`);
+                if (flag === "--notes")
+                    notes = flags[index + 1];
+                else
+                    by = flags[index + 1];
+                index += 2;
+            }
+            else
+                return fail(`workflow-gate: unknown flag: ${flag}`);
+        }
+        const pendingFile = path.join(pending, `${id}.json`);
+        const answerFile = path.join(answered, `${id}.json`);
+        const gate = readJson(pendingFile);
+        if (!gate && !force) {
+            const ids = listFiles(pending).map((file) => path.basename(file, ".json"));
+            return fail(`workflow-gate: no pending gate "${id}"${ids.length ? ` — pending: ${ids.join(", ")}` : " — nothing is pending"} (use --force to pre-answer)`);
+        }
+        let choice = rawChoice;
+        const options = gate && Array.isArray(gate.options) ? gate.options : [];
+        if (options.length) {
+            if (/^\d+$/.test(rawChoice)) {
+                const number = Number(rawChoice);
+                if (number >= 1 && number <= options.length)
+                    choice = String(options[number - 1].label);
+                else
+                    return fail(`workflow-gate: index ${number} is out of range 1..${options.length} for "${id}"`);
+            }
+            else {
+                const hit = options.find((option) => String(option.label).toLowerCase() === rawChoice.toLowerCase());
+                if (hit)
+                    choice = String(hit.label);
+                else if (!freeform)
+                    return fail(`workflow-gate: "${rawChoice}" is not an option for "${id}" — options: ${options.map((option) => option.label).join(", ")} (use --freeform to record it anyway)`);
+            }
+        }
+        if (fs.existsSync(answerFile) && !force)
+            return fail(`workflow-gate: gate "${id}" is already answered (${answerFile}) — use --force to overwrite`);
+        try {
+            fs.mkdirSync(answered, { recursive: true });
+            const temporary = `${answerFile}.tmp-${process.pid}`;
+            fs.writeFileSync(temporary, `${JSON.stringify({ id, choice, ...(notes ? { notes } : {}), ...(by ? { answered_by: by } : {}), answered_at: new Date(now()).toISOString() }, null, 2)}\n`);
+            fs.renameSync(temporary, answerFile);
+            try {
+                fs.rmSync(pendingFile, { force: true });
+            }
+            catch { /* shell is best-effort here */ }
+        }
+        catch (error) {
+            return fail(`workflow-gate: ${String(error.message)}`);
+        }
+        return ok(`answered ${id} -> ${choice}\n`);
+    }
+    if (command === "wait-pending" || command === "watch-run") {
+        let runDir = "";
+        let optionArgs = rest;
+        if (command === "watch-run") {
+            runDir = rest[0] ?? "";
+            if (!runDir || runDir.startsWith("-"))
+                return fail("workflow-gate: usage: watch-run <run-dir> [--timeout secs]");
+            optionArgs = rest.slice(1);
+        }
+        const parsed = parseTimeout(optionArgs);
+        if (parsed.error)
+            return fail(parsed.error);
+        let elapsed = 0;
+        for (;;) {
+            const files = listFiles(pending);
+            if (command === "wait-pending" && files.length)
+                return ok();
+            if (command === "watch-run") {
+                const wanted = path.resolve(runDir);
+                for (const file of files) {
+                    const gate = readJson(file);
+                    if (gate?.run_dir && path.resolve(String(gate.run_dir)) === wanted)
+                        return ok(`${String(gate.id || path.basename(file, ".json"))}\n`);
+                }
+                const journal = path.join(runDir, "journal.jsonl");
+                try {
+                    if (fs.readFileSync(journal, "utf8").includes('"event":"run-done"'))
+                        return { code: 3, stdout: "", stderr: "" };
+                }
+                catch { /* not finished */ }
+            }
+            if (parsed.timeout !== undefined && elapsed >= parsed.timeout)
+                return { code: 1, stdout: "", stderr: "" };
+            await sleep();
+            elapsed += 1;
+        }
+    }
+    if (command === "clear") {
+        const id = rest[0] ?? "";
+        if (!id)
+            return fail("workflow-gate: usage: clear <id>");
+        const invalid = gateId(id);
+        if (invalid)
+            return invalid;
+        try {
+            fs.rmSync(path.join(pending, `${id}.json`), { force: true });
+            fs.rmSync(path.join(answered, `${id}.json`), { force: true });
+        }
+        catch (error) {
+            return fail(`workflow-gate: ${String(error.message)}`);
+        }
+        return ok(`cleared ${id}\n`);
+    }
+    return fail(`workflow-gate: unknown command: ${command} (list | show | answer | wait-pending | watch-run | clear)`);
+}
+//# sourceMappingURL=core-bucket-c-workflow-gate-native.js.map

package/dist/commands/core-derive-trigger-facts-native.js

@@ -591,7 +591,10 @@ export function runDeriveTriggerFacts(options) {
     }
 }
 export function runDeriveTriggerFactsFast(argv, stdin, cwd, hqRoot) {
-    const result = runDeriveTriggerFactsFastResult(argv, stdin, cwd, hqRoot);
+    // The shell fast route runs from the live root and injects it as
+    // CLAUDE_PROJECT_DIR. Keep the native handler's PWD fallback aligned with
+    // that route when the caller supplied --hq-root.
+    const result = runDeriveTriggerFactsFastResult(argv, stdin, hqRoot ?? cwd, hqRoot);
     if (result.stdout.length)
         process.stdout.write(result.stdout);
     if (result.stderr.length)

package/dist/commands/core.js

@@ -218,12 +218,48 @@ export const REBUILD_INDEX_TARGETS = [
  * would make the forwarders harder to audit against this table.
  */
 export const SCAFFOLD_COMMANDS = [
+    {
+        name: "handoff-sync-prefetch",
+        asset: "core/scripts/handoff-sync-prefetch.sh",
+        root: "live",
+        summary: "Pull the latest continuity pointer before a session resumes",
+    },
+    {
+        name: "handoff-sync-publish",
+        asset: "core/scripts/handoff-sync-publish.sh",
+        root: "live",
+        summary: "Publish the session continuity pointer to the personal vault",
+    },
     {
         name: "hq-task",
         asset: "core/scripts/hq-task.sh",
         root: "live",
         summary: "List and update tasks on personal or company boards",
     },
+    {
+        name: "knowledge-pulse-lock",
+        asset: "core/scripts/knowledge-pulse-lock.sh",
+        root: "live",
+        summary: "Atomically claim a company knowledge-pulse run",
+    },
+    {
+        name: "skill-installed",
+        asset: "core/scripts/skill-installed.sh",
+        root: "live",
+        summary: "Check whether a company-scoped skill is installed",
+    },
+    {
+        name: "work-mesh-project-registration-offer",
+        asset: "core/scripts/work-mesh-project-registration-offer.sh",
+        root: "live",
+        summary: "Check and record the work-mesh project registration offer",
+    },
+    {
+        name: "workflow-gate",
+        asset: "core/scripts/workflow-gate.sh",
+        root: "live",
+        summary: "Inspect, answer, and wait for workflow gates",
+    },
     // Session/harness plumbing relocated out of the HQ tree so a single published
     // CLI owns it. Both are `root: "live"`: they read and write the live HQ tree
     // (workspace/sessions, companies/, workspace/orchestrator/hook-state), so the
@@ -250,6 +286,7 @@ export const SCAFFOLD_COMMANDS = [
  */
 export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-task.mjs", root: "live", summary: "Sibling implementation used by the hq-task shell rollback companion" },
+    { asset: "core/scripts/lib/session-skill-catalog.sh", root: "live", summary: "Shared skill catalog helper used by bundled skill-installed" },
     { asset: "core/scripts/session-journal.sh", root: "live", summary: "Rollback companion for native session journal" },
     { asset: "core/scripts/session-project.sh", root: "live", summary: "Rollback companion for native session project" },
     { asset: "core/scripts/session-title.sh", root: "live", summary: "Rollback companion for native session title" },

package/dist/commands/deploy-comments.d.ts

@@ -1,3 +1,5 @@
 import { Command } from "commander";
+export declare function displayText(value: unknown): string;
+export declare function safeJson(value: object): string;
 export declare function registerDeployCommentsCommand(deploy: Command): void;
 //# sourceMappingURL=deploy-comments.d.ts.map

package/dist/commands/deploy-comments.js

@@ -74,7 +74,7 @@ async function listComments(token, appId, orgHeaders) {
     }
     return { commentsEnabled: result.commentsEnabled, comments: result.comments };
 }
-function displayText(value) {
+export function displayText(value) {
     return [...String(value ?? "")].map((character) => {
         const code = character.codePointAt(0) ?? 0;
         return isUnsafeTerminalCodePoint(code)
@@ -88,7 +88,7 @@ function isUnsafeTerminalCodePoint(code) {
         || (code >= 0x202a && code <= 0x202e)
         || (code >= 0x2066 && code <= 0x2069);
 }
-function safeJson(value) {
+export function safeJson(value) {
     return JSON.stringify(value, null, 2).replace(/[\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, (character) => `\\u${(character.codePointAt(0) ?? 0).toString(16).padStart(4, "0")}`);
 }
 function printCommentLine(comment) {

package/dist/commands/deploy-list.d.ts

@@ -0,0 +1,22 @@
+import { Command } from "commander";
+type ApiApp = Record<string, unknown>;
+export interface DeployAppSummary {
+    id: string | null;
+    name: string | null;
+    title: string | null;
+    subdomain: string | null;
+    url: string | null;
+    type: string | null;
+    accessMode: string | null;
+    status: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    lastVisitAt: string | null;
+}
+/** Public app base domain, derived from the deploy API host (api.<base>). */
+export declare function appBaseDomain(apiUrl?: string): string | null;
+export declare function summarizeApp(app: ApiApp): DeployAppSummary;
+export declare function matchesQuery(app: DeployAppSummary, query: string | undefined): boolean;
+export declare function registerDeployListCommand(deploy: Command): void;
+export {};
+//# sourceMappingURL=deploy-list.d.ts.map