@indigoai-us/hq-cli 5.345.156 → 5.345.159

package/dist/commands/mesh.js

@@ -13,7 +13,7 @@ import { CLI_VERSION } from "../cli-version.js";
 import chalk from "chalk";
 import { ensureCognitoToken, isExpiring, isMachineIdentity, loadCachedTokens, } from "../utils/cognito-session.js";
 import * as readline from "node:readline/promises";
-import { STORY_STATUSES, appendThreadEvent, addProjectMember, ensureProjectThread, eventPayload, getProjectView, listActiveMembershipCompanies, listActiveThreads, meshJson, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, warmMeshConversationCache, } from "../lib/mesh/api.js";
+import { STORY_STATUSES, appendThreadEvent, addProjectMember, ensureProjectThread, eventPayload, getProjectLifecycle, getProjectView, listActiveMembershipCompanies, listActiveThreads, listProjectLifecycles, meshJson, patchStory, putProjectView, registerMeshProject, resolveActiveMembershipCompany, resolveMeshPrincipalUid, setProjectLifecycle, warmMeshConversationCache, } from "../lib/mesh/api.js";
 import { closeSupersededProjectThread, ensureMissingBoardStories, ensureProjectBoard, boardStoryStatus, formatStoryStatusChanges, mergeProjectStories, prdSyncEventsThatChangeBoard, reconcileProjectStories, } from "../lib/mesh/project-board.js";
 import { ACCEPTED_LEDGER_STATES, mapSourceStoryStatus, UnknownProjectStoryStateError } from "../lib/mesh/story-status.js";
 import { buildPreflightFixtures } from "../lib/work-context/preflight-contract.js";
@@ -665,6 +665,130 @@ async function runProjectMemberAdd(projectId, personUid, opts) {
         ? `Work mesh: added ${personUid} to project ${projectId}`
         : `Work mesh: ${personUid} is already a member of project ${projectId}`);
 }
+const LIFECYCLE_VERBS = {
+    archived: "archive",
+    completed: "complete",
+    active: "activate",
+};
+/**
+ * `hq mesh project archive|complete|activate <projectId>` (feedback 5d596dd0).
+ *
+ * Moves a Board between active, completed and archived through the server's
+ * lifecycle route. Nothing is deleted: stories, the project folder, channel,
+ * memberships and history all stay. An archived or completed project leaves
+ * the active Board list and the organize candidates, which is how a duplicate
+ * Board (one registered under a board id, one under the folder slug) is put
+ * away without touching the live one.
+ */
+async function runProjectLifecycle(projectId, status, opts) {
+    const verb = LIFECYCLE_VERBS[status];
+    const id = projectId.trim();
+    if (!id)
+        fail(`project ${verb} requires a project id`);
+    let expectedVersion;
+    if (opts.expectedVersion !== undefined) {
+        expectedVersion = Number.parseInt(opts.expectedVersion, 10);
+        if (!Number.isSafeInteger(expectedVersion) || expectedVersion < 0) {
+            fail("--expected-version must be a non-negative integer");
+        }
+    }
+    const { token, company } = await withCompany(opts);
+    const companyRef = company.companySlug || company.companyUid;
+    let current;
+    try {
+        current = await getProjectLifecycle(token, company.companyUid, id);
+    }
+    catch (err) {
+        if (isRouteUnavailable(err))
+            return reportUnavailable("Project lifecycle", `project.${verb}`, opts.json);
+        throw err;
+    }
+    if (current && current.status === status) {
+        if (opts.json) {
+            console.log(JSON.stringify({ ok: true, action: `project.${verb}`, changed: false, company, ...current }, null, 2));
+            return;
+        }
+        console.log(`Work mesh: project ${id} is already ${status} in company ${companyRef} (nothing changed)`);
+        return;
+    }
+    // The server's OCC version is the lifecycle row version, not the Board version.
+    const version = expectedVersion ?? current?.version ?? 0;
+    let result;
+    try {
+        result = await setProjectLifecycle(token, company.companyUid, id, {
+            status,
+            expectedVersion: version,
+            ...(opts.confirmNonempty ? { confirmNonempty: true } : {}),
+        });
+    }
+    catch (err) {
+        const failure = err;
+        const body = (failure.body && typeof failure.body === "object" ? failure.body : {});
+        // The list GET above already answered, so the lifecycle routes exist on
+        // this server; a 404 here is the project, not the route. Only 405 means
+        // the PATCH is missing.
+        if (failure.status === 405)
+            return reportUnavailable("Project lifecycle", `project.${verb}`, opts.json);
+        if (failure.status === 404) {
+            fail(`Work mesh project ${id} was not found in company ${companyRef}. Check the id with "hq mesh project lifecycle --company ${companyRef}" or the Board.`);
+        }
+        if (failure.status === 409 && failure.code === "BOARD_NONEMPTY") {
+            const count = Number.isFinite(Number(body.storyCount)) ? Number(body.storyCount) : undefined;
+            fail(`Work mesh project ${id} still has ${count !== undefined ? `${count} ` : ""}stor${count === 1 ? "y" : "ies"} on its Board. ` +
+                `Re-run with --confirm-nonempty to archive it anyway; the stories, project folder, channel, memberships and history are kept.`);
+        }
+        if (failure.status === 409) {
+            fail(`Work mesh project ${id} lifecycle changed since it was read (expected version ${version}). Re-run the command to retry against the current state.`);
+        }
+        throw err;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: `project.${verb}`, changed: true, company, previousStatus: current?.status ?? "active", ...result }, null, 2));
+        return;
+    }
+    const detail = status === "active"
+        ? "it is back on the active Board list and in organize candidates"
+        : "it leaves the active Board list and organize candidates; stories, folder, channel, memberships and history are kept";
+    console.log(`Work mesh: project ${result.projectId} is now ${result.status} in company ${companyRef} (${detail})`);
+}
+/** `hq mesh project lifecycle [projectId]`: list projects that are not active, or show one. */
+async function runProjectLifecycleList(projectId, opts) {
+    const { token, company } = await withCompany(opts);
+    const companyRef = company.companySlug || company.companyUid;
+    let rows;
+    try {
+        rows = await listProjectLifecycles(token, company.companyUid);
+    }
+    catch (err) {
+        if (isRouteUnavailable(err))
+            return reportUnavailable("Project lifecycle", "project.lifecycle", opts.json);
+        throw err;
+    }
+    const id = projectId?.trim();
+    if (id) {
+        const row = rows.find((r) => r.projectId === id) ?? null;
+        if (opts.json) {
+            console.log(JSON.stringify({ ok: true, action: "project.lifecycle", company, projectId: id, lifecycle: row ?? { projectId: id, status: "active", version: 0 } }, null, 2));
+            return;
+        }
+        console.log(row
+            ? `Work mesh: project ${id} is ${row.status} in company ${companyRef} (lifecycle version ${row.version}, updated ${row.updatedAt || "unknown"})`
+            : `Work mesh: project ${id} is active in company ${companyRef} (no lifecycle change recorded)`);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, action: "project.lifecycle", company, projects: rows }, null, 2));
+        return;
+    }
+    if (!rows.length) {
+        console.log(`Work mesh: no project in company ${companyRef} has been completed or archived`);
+        return;
+    }
+    console.log(`Work mesh: project lifecycle in company ${companyRef}`);
+    for (const row of rows.sort((a, b) => a.projectId.localeCompare(b.projectId))) {
+        console.log(`  ${row.projectId}  ${row.status}  v${row.version}  ${row.updatedAt || ""}`.trimEnd());
+    }
+}
 /**
  * Create or merge the project Board view from a parsed PRD, register the
  * project, and verify every PRD story and repo is on the Board. Shared by
@@ -2690,6 +2814,30 @@ export function registerMeshCommand(program, deps = {}) {
         .option("--note <text>", "Handoff note")
         .option("--json", "Print machine-readable JSON")
         .action((projectId, opts) => wrap(() => runProjectReassign(projectId, opts))());
+    for (const status of ["archived", "completed", "active"]) {
+        const verb = LIFECYCLE_VERBS[status];
+        const description = status === "archived"
+            ? "Archive a Board (for example a duplicate); keeps stories, folder, channel, members and history"
+            : status === "completed"
+                ? "Mark a Board completed; it leaves the active list and organize candidates"
+                : "Restore a completed or archived Board to active";
+        const cmd = project
+            .command(`${verb} <projectId>`)
+            .description(description)
+            .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+            .option("--expected-version <n>", "Lifecycle row version to replace (defaults to the current one)")
+            .option("--json", "Print machine-readable JSON");
+        if (status === "archived") {
+            cmd.option("--confirm-nonempty", "Archive even when the Board still has stories");
+        }
+        cmd.action((projectId, opts) => wrap(() => runProjectLifecycle(projectId, status, opts))());
+    }
+    project
+        .command("lifecycle [projectId]")
+        .description("List completed and archived Boards, or show one project's lifecycle status")
+        .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
+        .option("--json", "Print machine-readable JSON")
+        .action((projectId, opts) => wrap(() => runProjectLifecycleList(projectId, opts))());
     project
         .command("member")
         .description("Manage project members")

package/dist/commands/monitor.d.ts

@@ -21,6 +21,7 @@ export declare function runMonitorEnabledCommand(deps?: {
     writeError?: (text: string) => void;
 }): Promise<number>;
 export declare function armText(meta: MonitorMetadata): string;
+export declare function expiredText(id: string, timeoutMs: number, events: number): string;
 export declare function resolveMonitorStartTarget(hqRoot: string, discovered: MonitorTarget, explicitlyProvided: boolean, runtime?: MonitorRuntimeIdentity): MonitorTarget;
 export declare function invokeLaneMonitorMessage(hqRoot: string, meta: MonitorMetadata, sequence: number, text: string, inProcess?: MonitorLaneMessageApi): {
     delivered: boolean;

package/dist/commands/monitor.js

@@ -168,6 +168,9 @@ function formatDuration(milliseconds) {
         return `${milliseconds / 1_000}s`;
     return `${milliseconds}ms`;
 }
+export function expiredText(id, timeoutMs, events) {
+    return `[hq monitor ${id} expired after ${formatDuration(timeoutMs)} with ${events} events delivered. Re-arm with \`hq monitor start ... --timeout <duration>\` (for example --timeout 30m) or \`--persistent\` if you still need the watch — and widen the filter if silence was unexpected.]`;
+}
 function monitorTimeout(timeoutMs, onTimeout) {
     const startedAt = performance.now();
     let timer = null;
@@ -711,7 +714,7 @@ export async function runSupervisor(id, deps = {}) {
         const priorEvents = state.event_count;
         if (reason !== "stopped" && reason !== "target_ended" && reason !== "supervisor_died") {
             const terminalText = reason === "expired"
-                ? `[hq monitor ${id} expired after ${formatDuration(meta.timeout_ms ?? MONITOR_DEFAULT_TIMEOUT_MS)} with ${priorEvents} events delivered. Re-arm with \`hq monitor start ...\` if you still need the watch — and widen the filter if silence was unexpected.]`
+                ? expiredText(id, meta.timeout_ms ?? MONITOR_DEFAULT_TIMEOUT_MS, priorEvents)
                 : reason === "rate_exceeded"
                     ? `[hq monitor ${id} stopped: rate_exceeded after suppressing sustained output.]`
                     : `[hq monitor ${id} ${JSON.stringify(meta.description)} exited with code ${exitCode ?? 1} after ${priorEvents} events]`;

package/dist/commands/repo.d.ts

@@ -0,0 +1,41 @@
+import { Command } from "commander";
+/**
+ * `hq repo add <path> --company <slug>` — register a git checkout with HQ:
+ * link it into `repos/<private|public>/<name>` and list it under
+ * `companies.<slug>.repos` in `companies/manifest.yaml`.
+ *
+ * The manifest edit is a line insert, not a YAML re-dump, so comments,
+ * ordering, and quoting in the rest of the file are left as they were. The
+ * result is parsed back before writing; if the entry does not show up where
+ * expected, nothing is written.
+ */
+export declare const MANIFEST_RELATIVE_PATH: string;
+export declare function manifestRepos(text: string, company: string): string[] | null;
+/**
+ * Companies other than `company` whose `repos` list contains one of `entries`.
+ */
+export declare function otherCompaniesClaiming(text: string, company: string, entries: string[]): string[];
+/**
+ * Return manifest text with `entry` appended to `companies.<company>.repos`.
+ * Returns the input unchanged when the entry is already listed. Throws when
+ * the company is not in the manifest or the edit cannot be placed. Pure.
+ */
+export declare function addRepoToManifestText(text: string, company: string, entry: string): string;
+export interface RepoAddOptions {
+    source: string;
+    company: string;
+    hqRoot: string;
+    visibility: "private" | "public";
+    name?: string;
+    dryRun?: boolean;
+}
+export interface RepoAddResult {
+    entry: string;
+    linked: boolean;
+    manifestChanged: boolean;
+    warnings: string[];
+}
+/** Register a checkout. Throws a user-facing Error on any refusal. */
+export declare function runRepoAdd(opts: RepoAddOptions): RepoAddResult;
+export declare function registerRepoCommand(program: Command): void;
+//# sourceMappingURL=repo.d.ts.map

package/dist/commands/repo.js

@@ -0,0 +1,331 @@
+import chalk from "chalk";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+import { findHqRoot } from "../utils/manifest.js";
+/**
+ * `hq repo add <path> --company <slug>` — register a git checkout with HQ:
+ * link it into `repos/<private|public>/<name>` and list it under
+ * `companies.<slug>.repos` in `companies/manifest.yaml`.
+ *
+ * The manifest edit is a line insert, not a YAML re-dump, so comments,
+ * ordering, and quoting in the rest of the file are left as they were. The
+ * result is parsed back before writing; if the entry does not show up where
+ * expected, nothing is written.
+ */
+export const MANIFEST_RELATIVE_PATH = path.join("companies", "manifest.yaml");
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+function isContentLine(line) {
+    const t = line.trim();
+    return t !== "" && !t.startsWith("#");
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseManifest(text) {
+    const parsed = yaml.load(text);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error("companies/manifest.yaml is empty or not a mapping.");
+    }
+    return parsed;
+}
+export function manifestRepos(text, company) {
+    const doc = parseManifest(text);
+    const entry = doc.companies?.[company];
+    if (entry === undefined)
+        return null;
+    const repos = entry?.repos;
+    return Array.isArray(repos) ? repos.map(String) : [];
+}
+/**
+ * Companies other than `company` whose `repos` list contains one of `entries`.
+ */
+export function otherCompaniesClaiming(text, company, entries) {
+    const doc = parseManifest(text);
+    const out = [];
+    for (const [slug, block] of Object.entries(doc.companies ?? {})) {
+        if (slug === company)
+            continue;
+        const repos = block?.repos;
+        if (Array.isArray(repos) && repos.map(String).some((r) => entries.includes(r))) {
+            out.push(slug);
+        }
+    }
+    return out;
+}
+/**
+ * Return manifest text with `entry` appended to `companies.<company>.repos`.
+ * Returns the input unchanged when the entry is already listed. Throws when
+ * the company is not in the manifest or the edit cannot be placed. Pure.
+ */
+export function addRepoToManifestText(text, company, entry) {
+    const before = manifestRepos(text, company);
+    if (before === null) {
+        throw new Error(`Company '${company}' is not in companies/manifest.yaml. Add the company first (/newcompany).`);
+    }
+    if (before.includes(entry))
+        return text;
+    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+    const lines = text.split(/\r?\n/);
+    const companiesIdx = lines.findIndex((l) => /^companies:\s*(#.*)?$/.test(l));
+    if (companiesIdx === -1) {
+        throw new Error("companies/manifest.yaml has no top-level `companies:` key.");
+    }
+    const companyRe = new RegExp(`^(\\s+)(["']?)${escapeRegExp(company)}\\2:\\s*(#.*)?$`);
+    let companyIdx = -1;
+    for (let i = companiesIdx + 1; i < lines.length; i++) {
+        if (isContentLine(lines[i]) && indentOf(lines[i]) === 0)
+            break;
+        if (companyRe.test(lines[i])) {
+            companyIdx = i;
+            break;
+        }
+    }
+    if (companyIdx === -1) {
+        throw new Error(`Could not find the '${company}:' block in companies/manifest.yaml to edit.`);
+    }
+    const ci = indentOf(lines[companyIdx]);
+    let blockEnd = lines.length; // exclusive
+    for (let i = companyIdx + 1; i < lines.length; i++) {
+        if (isContentLine(lines[i]) && indentOf(lines[i]) <= ci) {
+            blockEnd = i;
+            break;
+        }
+    }
+    let lastContent = companyIdx;
+    for (let i = companyIdx + 1; i < blockEnd; i++) {
+        if (isContentLine(lines[i]))
+            lastContent = i;
+    }
+    for (let i = companyIdx + 1; i < blockEnd; i++) {
+        if (/^\s+repos:\s*\[\s*[^\]\s]/.test(lines[i]) && indentOf(lines[i]) > ci) {
+            throw new Error(`companies.${company}.repos is an inline list (repos: [...]), which this command does not edit. Add the entry by hand.`);
+        }
+    }
+    const out = [...lines];
+    const reposIdx = (() => {
+        for (let i = companyIdx + 1; i < blockEnd; i++) {
+            if (/^\s+repos:\s*(\[\s*\])?\s*(#.*)?$/.test(lines[i]) && indentOf(lines[i]) > ci) {
+                return i;
+            }
+        }
+        return -1;
+    })();
+    if (reposIdx === -1) {
+        const keyIndent = " ".repeat(ci + 2);
+        out.splice(lastContent + 1, 0, `${keyIndent}repos:`, `${keyIndent}  - ${entry}`);
+    }
+    else {
+        const ri = indentOf(lines[reposIdx]);
+        if (/\[\s*\]/.test(lines[reposIdx])) {
+            out[reposIdx] = `${" ".repeat(ri)}repos:`;
+            out.splice(reposIdx + 1, 0, `${" ".repeat(ri + 2)}- ${entry}`);
+        }
+        else {
+            let lastItem = -1;
+            let itemPrefix = `${" ".repeat(ri + 2)}- `;
+            for (let i = reposIdx + 1; i < blockEnd; i++) {
+                const l = lines[i];
+                if (!isContentLine(l))
+                    continue;
+                const ind = indentOf(l);
+                if (ind < ri || (ind === ri && !l.trimStart().startsWith("- ")))
+                    break;
+                if (l.trimStart().startsWith("- ")) {
+                    lastItem = i;
+                    itemPrefix = `${" ".repeat(ind)}- `;
+                }
+                else if (ind <= ri) {
+                    break;
+                }
+            }
+            out.splice((lastItem === -1 ? reposIdx : lastItem) + 1, 0, `${itemPrefix}${entry}`);
+        }
+    }
+    const next = out.join(eol);
+    const after = manifestRepos(next, company);
+    if (!after || !after.includes(entry) || after.length !== before.length + 1) {
+        throw new Error("Could not update companies/manifest.yaml safely (unusual layout). Add the entry by hand.");
+    }
+    return next;
+}
+function isInside(parent, child) {
+    const rel = path.relative(parent, child);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+/**
+ * Write `text` to `file` through a temp file in the same directory and a
+ * rename, so a crash cannot leave a truncated manifest. Refuses when the file
+ * no longer holds `expected` (another writer edited it since it was read).
+ */
+function writeManifestAtomically(file, expected, text) {
+    const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(tmp, text);
+    try {
+        if (fs.readFileSync(file, "utf8") !== expected) {
+            throw new Error("companies/manifest.yaml changed while this command was running. Nothing was written to it; run the command again.");
+        }
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+}
+function isGitCheckout(dir) {
+    return fs.existsSync(path.join(dir, ".git"));
+}
+/** Register a checkout. Throws a user-facing Error on any refusal. */
+export function runRepoAdd(opts) {
+    const hqRoot = path.resolve(opts.hqRoot);
+    const manifestPath = path.join(hqRoot, MANIFEST_RELATIVE_PATH);
+    if (!fs.existsSync(manifestPath)) {
+        throw new Error(`No companies/manifest.yaml under ${hqRoot}. Pass --hq-root <path>.`);
+    }
+    const source = path.resolve(opts.source);
+    if (!fs.existsSync(source) || !fs.statSync(source).isDirectory()) {
+        throw new Error(`${source} is not a directory.`);
+    }
+    if (!isGitCheckout(source)) {
+        throw new Error(`${source} is not a git checkout (no .git).`);
+    }
+    const sourceReal = fs.realpathSync(source);
+    const hqRootReal = fs.realpathSync(hqRoot);
+    const reposRoot = fs.existsSync(path.join(hqRoot, "repos"))
+        ? fs.realpathSync(path.join(hqRoot, "repos"))
+        : path.join(hqRootReal, "repos");
+    // Direct child of repos/private or repos/public, checked on the path as
+    // given (parent resolved, last component not), so an existing link such as
+    // repos/private/foo -> ~/code/bar is registered as itself, not re-linked.
+    const directChild = (p) => {
+        const rel = path.relative(reposRoot, p);
+        const parts = rel.split(path.sep);
+        if (!rel.startsWith("..") &&
+            !path.isAbsolute(rel) &&
+            parts.length === 2 &&
+            (parts[0] === "private" || parts[0] === "public")) {
+            return parts;
+        }
+        return null;
+    };
+    const sourceAsGiven = path.join(fs.realpathSync(path.dirname(source)), path.basename(source));
+    const inPlace = directChild(sourceAsGiven) ?? directChild(sourceReal);
+    if (!inPlace && isInside(hqRootReal, sourceReal)) {
+        throw new Error(`${source} is inside the HQ root. Only a checkout directly under repos/private or repos/public can be registered from inside HQ.`);
+    }
+    const warnings = [];
+    let entry;
+    let linkPath = null;
+    if (inPlace) {
+        entry = ["repos", ...inPlace].join("/");
+        if (opts.name !== undefined) {
+            warnings.push(`--name is ignored: ${entry} is already under repos/ and is registered in place.`);
+        }
+        if (opts.visibility === "public" && inPlace[0] !== "public") {
+            warnings.push(`--public is ignored: ${entry} is already under repos/ and is registered in place.`);
+        }
+    }
+    else {
+        const name = opts.name ?? path.basename(sourceReal);
+        if (!/^[A-Za-z0-9._-]+$/.test(name) || name === "." || name === "..") {
+            throw new Error(`'${name}' is not a usable repo name. Pass --name <name>.`);
+        }
+        entry = `repos/${opts.visibility}/${name}`;
+        linkPath = path.join(hqRoot, "repos", opts.visibility, name);
+        if (fs.existsSync(linkPath) || isDanglingSymlink(linkPath)) {
+            const existingReal = safeRealpath(linkPath);
+            if (existingReal !== sourceReal) {
+                throw new Error(`${entry} already exists and points somewhere else. Pass --name <name> to pick another name.`);
+            }
+            linkPath = null; // already linked to this checkout
+        }
+    }
+    const manifestText = fs.readFileSync(manifestPath, "utf8");
+    const nextText = addRepoToManifestText(manifestText, opts.company, entry);
+    const manifestChanged = nextText !== manifestText;
+    // Refuse when another company already lists this checkout. Consumers treat a
+    // repo claimed by two companies as ambiguous, so a second claim would
+    // silently drop the first company's ownership.
+    const parsed = parseManifest(manifestText);
+    const sameCheckout = new Set([entry]);
+    for (const block of Object.values(parsed.companies ?? {})) {
+        const repos = block?.repos;
+        if (!Array.isArray(repos))
+            continue;
+        for (const r of repos.map(String)) {
+            if (safeRealpath(path.resolve(hqRoot, r)) === sourceReal)
+                sameCheckout.add(r);
+        }
+    }
+    const claimants = otherCompaniesClaiming(manifestText, opts.company, [...sameCheckout]);
+    if (claimants.length > 0) {
+        throw new Error(`${entry} is already listed for ${claimants.join(", ")} in companies/manifest.yaml. A repo can belong to one company; remove it there first.`);
+    }
+    if (!opts.dryRun) {
+        if (linkPath) {
+            fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+            fs.symlinkSync(sourceReal, linkPath, "dir");
+        }
+        if (manifestChanged)
+            writeManifestAtomically(manifestPath, manifestText, nextText);
+    }
+    return { entry, linked: linkPath !== null, manifestChanged, warnings };
+}
+function isDanglingSymlink(p) {
+    try {
+        return fs.lstatSync(p).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function safeRealpath(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+export function registerRepoCommand(program) {
+    const repo = program
+        .command("repo")
+        .description("Register code repos with HQ (repos/ and companies/manifest.yaml)");
+    repo
+        .command("add <path>")
+        .description("Link a git checkout into repos/<private|public>/<name> and list it under " +
+        "companies.<slug>.repos in companies/manifest.yaml. A checkout already " +
+        "directly under repos/private or repos/public is registered in place.")
+        .requiredOption("--company <slug>", "Company that owns the repo (checked against companies/manifest.yaml only, not the session's locked company set or your memberships)")
+        .option("--public", "Link under repos/public (default: repos/private)")
+        .option("--name <name>", "Name under repos/ (default: the checkout's folder name)")
+        .option("--hq-root <path>", "HQ root (default: found from the current directory)")
+        .option("--dry-run", "Print what would change without changing anything")
+        .action((source, opts) => {
+        try {
+            const result = runRepoAdd({
+                source,
+                company: opts.company,
+                hqRoot: opts.hqRoot ?? findHqRoot(),
+                visibility: opts.public ? "public" : "private",
+                name: opts.name,
+                dryRun: opts.dryRun,
+            });
+            for (const w of result.warnings)
+                console.warn(chalk.yellow("Warning:"), w);
+            const prefix = opts.dryRun ? "Would register" : "Registered";
+            const parts = [
+                result.linked ? "linked" : "already linked",
+                result.manifestChanged ? "added to the manifest" : "already in the manifest",
+            ];
+            console.log(chalk.green(`${prefix} ${result.entry} for ${opts.company} (${parts.join(", ")}).`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=repo.js.map

package/dist/commands/scan.d.ts

@@ -6,7 +6,9 @@
  *   hq scan secrets --json        findings as JSON
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
- * HQ's own token patterns. No network, no account, no quota.
+ * HQ's own token patterns. No network, no account, no quota. A staged scan also
+ * honours `[[allowlists]]` / `[allowlist]` in the repo's own .gitleaks.toml
+ * (lib/secret-scan/repo-config.ts); a file it cannot accept exits 2.
  *
  * Exit codes: 0 clean, 1 possible secret found, 2 the scan could not run.
  * A pre-commit hook blocks on any non-zero exit, so the gate fails closed.

package/dist/commands/scan.js

@@ -6,12 +6,15 @@
  *   hq scan secrets --json        findings as JSON
  *
  * Rules: the vendored gitleaks default rule set (MIT, vendor/gitleaks/) plus
- * HQ's own token patterns. No network, no account, no quota.
+ * HQ's own token patterns. No network, no account, no quota. A staged scan also
+ * honours `[[allowlists]]` / `[allowlist]` in the repo's own .gitleaks.toml
+ * (lib/secret-scan/repo-config.ts); a file it cannot accept exits 2.
  *
  * Exit codes: 0 clean, 1 possible secret found, 2 the scan could not run.
  * A pre-commit hook blocks on any non-zero exit, so the gate fails closed.
  * Output names the rule, file and line; secret values are never printed.
  */
+import { ScanConfigError } from "../lib/secret-scan/repo-config.js";
 import { ScanInputError, scanFiles, scanStaged } from "../lib/secret-scan/staged.js";
 function report(findings, scope) {
     if (!findings.length)
@@ -22,7 +25,8 @@ function report(findings, scope) {
         process.stderr.write(`  ${f.file}:${f.line}  ${f.ruleId}  ${f.description}\n`);
     }
     process.stderr.write("\nRemove the secret from the change, then stage it again. Keep real credentials in the HQ vault\n" +
-        "(hq secrets, hq run). A known false positive can carry a `gitleaks:allow` comment on that line.\n");
+        "(hq secrets, hq run). A known false positive can carry a `gitleaks:allow` comment on that line,\n" +
+        "or an [[allowlists]] entry in the repo's .gitleaks.toml.\n");
 }
 export function runScanSecrets(paths, opts, cwd = process.cwd()) {
     let findings;
@@ -30,7 +34,7 @@ export function runScanSecrets(paths, opts, cwd = process.cwd()) {
         findings = paths.length && !opts.staged ? scanFiles(paths) : scanStaged(cwd);
     }
     catch (err) {
-        const msg = err instanceof ScanInputError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
+        const msg = err instanceof ScanInputError || err instanceof ScanConfigError ? err.message : `scan failed: ${err instanceof Error ? err.message : String(err)}`;
         if (opts.json)
             process.stdout.write(`${JSON.stringify({ ok: false, error: msg })}\n`);
         process.stderr.write(`HQ secret scan: ${msg}\n`);

package/dist/commands/secrets.d.ts

@@ -20,9 +20,21 @@ export { vaultApiFetch, getCompanyUid, getEntityUid };
  */
 export declare const HQ_PRO_RESOURCE_SURFACES: readonly ["api", "bot_invite", "bot_join_now", "calendar_auto_schedule", "calendar_preferences", "cli_secrets_set", "console_secrets_form", "deploy_precheck", "external_connection", "factory_install", "integrations_connect", "oauth_callback", "plan_limit_check", "secrets_input_link", "web"];
 export declare const CLI_SECRETS_SET_SURFACE = "cli_secrets_set";
+/**
+ * Shown when `secrets share` / `unshare` gets a 403. Changing a secret's
+ * grants needs admin on that secret, which is a separate check from read.
+ * The old "Not authorized to share this secret" text led people and agents to
+ * conclude the secret itself was locked to them, so this names the missing
+ * permission and says read access is unchanged.
+ */
+export declare const SECRET_SHARE_ADMIN_REQUIRED_MESSAGE: string;
 interface SecretAclPrincipal {
     granteeType: "email" | "group" | "company-wide" | "person";
     granteeId: string;
+    /** What the caller typed, when it differs from the wire grantee (agt_… uids). */
+    label?: string;
+    /** The fleet agent behind an agt_… uid or its machine email. */
+    agentUid?: string;
 }
 /**
  * hq-pro refuses any Outpost grant above read with 400
@@ -31,6 +43,15 @@ interface SecretAclPrincipal {
 export declare const OUTPOST_GRANT_READ_ONLY_CODE = "OUTPOST_GRANT_READ_ONLY";
 export declare const OUTPOST_GRANT_READ_ONLY_MESSAGE = "Company Outposts can only be given read access to a secret.";
 export declare function parseSecretAclPrincipal(principal: string): SecretAclPrincipal | null;
+/**
+ * Refuse a share to a fleet agent that is not an active agent of this
+ * company. hq-pro turns the machine-email grantee into an agt_… grant only
+ * for an active member; for any other agent it stores an email row the agent
+ * can never use and still returns 200. Reads the company roster
+ * (`GET /v1/agents?companyUid=…`, the same call as `hq agents list`) before
+ * any write. Returns an error message, or null when the agent is active here.
+ */
+export declare function inactiveCompanyAgentReason(token: string, companyUid: string, agentUid: string): Promise<string | null>;
 export interface SecretInjectionRecipe {
     header: string;
     scheme: "raw" | "bearer";