@indigoai-us/hq-cli 5.345.170 → 5.345.171

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (111) hide show
  1. package/CHANGELOG.md +55 -0
  2. package/assets/scaffold/core/scripts/hq-delegate-send.sh +1 -1
  3. package/dist/command-catalog.generated.d.ts +132 -5
  4. package/dist/command-catalog.generated.js +164 -6
  5. package/dist/commands/access.d.ts +32 -1
  6. package/dist/commands/access.js +112 -3
  7. package/dist/commands/agent-kit.d.ts +1 -1
  8. package/dist/commands/agent-kit.js +3 -1
  9. package/dist/commands/agents.js +2 -1
  10. package/dist/commands/bot.d.ts +3 -0
  11. package/dist/commands/bot.js +137 -14
  12. package/dist/commands/cloud.d.ts +58 -1
  13. package/dist/commands/cloud.js +219 -5
  14. package/dist/commands/core-company-index-scope-flag.d.ts +8 -1
  15. package/dist/commands/core-company-index-scope-flag.js +9 -2
  16. package/dist/commands/core-delegate-w1b.js +5 -2
  17. package/dist/commands/core-dm-bind-native.js +19 -4
  18. package/dist/commands/core-rebuild-index-fast.js +24 -6
  19. package/dist/commands/core.js +18 -6
  20. package/dist/commands/dm.d.ts +17 -3
  21. package/dist/commands/dm.js +121 -26
  22. package/dist/commands/integrations-api.d.ts +4 -0
  23. package/dist/commands/integrations-api.js +18 -2
  24. package/dist/commands/integrations-connect.d.ts +10 -3
  25. package/dist/commands/integrations-connect.js +70 -6
  26. package/dist/commands/integrations-core.d.ts +23 -0
  27. package/dist/commands/integrations-core.js +100 -0
  28. package/dist/commands/integrations-manage.js +8 -1
  29. package/dist/commands/integrations.js +49 -5
  30. package/dist/commands/lanes-loop.d.ts +20 -0
  31. package/dist/commands/lanes-loop.js +69 -11
  32. package/dist/commands/lanes.js +9 -1
  33. package/dist/commands/rescue.d.ts +9 -0
  34. package/dist/commands/rescue.js +31 -0
  35. package/dist/commands/run.js +115 -40
  36. package/dist/commands/scan.d.ts +5 -1
  37. package/dist/commands/scan.js +16 -4
  38. package/dist/commands/secrets.js +50 -9
  39. package/dist/hq-cloud-sync-runner/bin/sync-runner.js +2367 -2109
  40. package/dist/hq-cloud-sync-runner/package.json +1 -1
  41. package/dist/lib/agent-kit/inbox-state.d.ts +17 -0
  42. package/dist/lib/agent-kit/inbox-state.js +41 -20
  43. package/dist/lib/agent-kit/kit-config.d.ts +2 -0
  44. package/dist/lib/agent-kit/kit-config.js +6 -0
  45. package/dist/lib/agent-kit/mcp/tools.js +12 -5
  46. package/dist/lib/agent-kit/run/heartbeat.d.ts +6 -3
  47. package/dist/lib/agent-kit/run/heartbeat.js +6 -3
  48. package/dist/lib/agent-kit/run/inbox.d.ts +8 -3
  49. package/dist/lib/agent-kit/run/inbox.js +42 -10
  50. package/dist/lib/agent-kit/run/request-timeout.d.ts +26 -0
  51. package/dist/lib/agent-kit/run/request-timeout.js +51 -0
  52. package/dist/lib/bot/api.d.ts +1 -1
  53. package/dist/lib/bot/config.d.ts +10 -0
  54. package/dist/lib/bot/config.js +17 -1
  55. package/dist/lib/bot/fleet-local.d.ts +127 -0
  56. package/dist/lib/bot/fleet-local.js +638 -0
  57. package/dist/lib/bot/index.d.ts +1 -0
  58. package/dist/lib/bot/index.js +1 -0
  59. package/dist/lib/bot/local-config.d.ts +3 -2
  60. package/dist/lib/bot/local-config.js +5 -2
  61. package/dist/lib/bot/promote.d.ts +10 -0
  62. package/dist/lib/bot/promote.js +3 -2
  63. package/dist/lib/bot/runtime/index.js +8 -4
  64. package/dist/lib/bot/runtime/scratch-dir.d.ts +24 -0
  65. package/dist/lib/bot/runtime/scratch-dir.js +41 -0
  66. package/dist/lib/caller-principal.d.ts +4 -0
  67. package/dist/lib/caller-principal.js +40 -0
  68. package/dist/lib/capacity/collectors/grok.js +8 -2
  69. package/dist/lib/cli-flag-keys.d.ts +2 -0
  70. package/dist/lib/cli-flag-keys.js +2 -0
  71. package/dist/lib/daemon/catalog.js +4 -1
  72. package/dist/lib/daemon/sync-core-canary.d.ts +3 -0
  73. package/dist/lib/daemon/sync-core-canary.js +8 -3
  74. package/dist/lib/doctor/checks/release-links.d.ts +62 -1
  75. package/dist/lib/doctor/checks/release-links.js +188 -2
  76. package/dist/lib/doctor/fix/apply.js +54 -0
  77. package/dist/lib/doctor/fix/remediation.d.ts +8 -1
  78. package/dist/lib/doctor/fix/remediation.js +22 -0
  79. package/dist/lib/flag-registry-worker-source.generated.d.ts +1 -1
  80. package/dist/lib/flag-registry-worker-source.generated.js +1 -1
  81. package/dist/lib/index-render/index.d.ts +9 -0
  82. package/dist/lib/index-render/index.js +65 -5
  83. package/dist/lib/index-render/session-scope.d.ts +69 -0
  84. package/dist/lib/index-render/session-scope.js +279 -0
  85. package/dist/lib/lanes/admission.js +7 -20
  86. package/dist/lib/lanes/reconcile.js +13 -15
  87. package/dist/lib/lanes/stale-lock.d.ts +50 -0
  88. package/dist/lib/lanes/stale-lock.js +105 -0
  89. package/dist/lib/lanes/store.js +11 -76
  90. package/dist/lib/notify-recipient.d.ts +10 -4
  91. package/dist/lib/notify-recipient.js +16 -4
  92. package/dist/lib/secret-input-link.d.ts +42 -0
  93. package/dist/lib/secret-input-link.js +93 -0
  94. package/dist/lib/secret-scan/range.d.ts +57 -0
  95. package/dist/lib/secret-scan/range.js +266 -0
  96. package/dist/lib/secret-scan/repo-config.d.ts +18 -3
  97. package/dist/lib/secret-scan/repo-config.js +135 -2
  98. package/dist/run/script-bound-schema.d.ts +27 -0
  99. package/dist/run/script-bound-schema.js +97 -0
  100. package/dist/secrets-env-action.d.ts +2 -0
  101. package/dist/secrets-env-action.js +7 -2
  102. package/dist/utils/cognito-session.d.ts +3 -30
  103. package/dist/utils/cognito-session.js +2 -100
  104. package/dist/utils/machine-principal-state.d.ts +38 -0
  105. package/dist/utils/machine-principal-state.js +110 -0
  106. package/dist/utils/safe-link.js +9 -0
  107. package/dist/utils/script-bound-exec.d.ts +158 -0
  108. package/dist/utils/script-bound-exec.js +568 -0
  109. package/dist/utils/sync-watchdog.d.ts +92 -0
  110. package/dist/utils/sync-watchdog.js +250 -0
  111. package/package.json +8 -8
@@ -44,6 +44,7 @@ import { getStateDir } from "@indigoai-us/hq-cloud";
44
44
  import { isPersonalJournalSlug } from "../checks/sync-health.js";
45
45
  import { createDefaultRegistry } from "../registry.js";
46
46
  import { flattenFamilies } from "../report.js";
47
+ import { repairDanglingReleaseLinks } from "../checks/release-links.js";
47
48
  import { parseHookGateProfiles, requiredMissingProfiles, } from "../hook-gate-profiles.js";
48
49
  import { createBackup } from "./backup.js";
49
50
  import { removeStrayGateEntries } from "../stray-gate-entries.js";
@@ -905,6 +906,8 @@ function planFix(hqRoot, result, rem, refreshSync, rewriteBotNodePath = defaultR
905
906
  return planRefreshSync(hqRoot, result, rem, refreshSync);
906
907
  case "refresh-manifest":
907
908
  return planRefreshManifest(hqRoot, result, rem, refreshManifest);
909
+ case "repair-release-link":
910
+ return planRepairReleaseLink(hqRoot, result, rem);
908
911
  default:
909
912
  return null;
910
913
  }
@@ -1075,6 +1078,57 @@ function planRefreshManifest(hqRoot, result, rem, refreshManifest) {
1075
1078
  failureReason: () => failureReason,
1076
1079
  };
1077
1080
  }
1081
+ /**
1082
+ * Repoint (or remove) one dangling HQ-managed release link. The repair writes
1083
+ * only the link entry, never a hook body, so it needs no backup: a link that
1084
+ * does not resolve has no content to restore.
1085
+ */
1086
+ function planRepairReleaseLink(hqRoot, result, rem) {
1087
+ const rel = rem.fixTarget;
1088
+ if (!rel)
1089
+ return null;
1090
+ let failure;
1091
+ return {
1092
+ checkId: result.checkId,
1093
+ fixClass: "repair-release-link",
1094
+ target: rel,
1095
+ relpath: "",
1096
+ preview: ` ${rel}\n` +
1097
+ ` - dangling link\n` +
1098
+ ` + the shipped link to its target under the HQ root (removed if that target is missing)`,
1099
+ summary: `repair dangling link ${rel}`,
1100
+ apply: () => {
1101
+ // Each plan repairs only its own link, and a throw is recorded as this
1102
+ // plan's failure so the remaining plans still run.
1103
+ try {
1104
+ const own = repairDanglingReleaseLinks(hqRoot, { only: rel });
1105
+ const entry = own.find((item) => item.rel === rel);
1106
+ if (!entry) {
1107
+ failure = `${rel} was not repaired`;
1108
+ }
1109
+ else if (entry.action === "skipped" || entry.action === "failed") {
1110
+ failure = `${rel} was not repaired: ${entry.reason ?? entry.action}`;
1111
+ }
1112
+ else {
1113
+ failure = undefined;
1114
+ }
1115
+ }
1116
+ catch (err) {
1117
+ failure = `${rel} was not repaired: ${err instanceof Error ? err.message : String(err)}`;
1118
+ }
1119
+ },
1120
+ postStatus: (results) => {
1121
+ const own = results.filter((entry) => entry.checkId === result.checkId);
1122
+ if (own.some((entry) => entry.target === rel))
1123
+ return "FAIL";
1124
+ // Another link's failure is that plan's status, not this one's.
1125
+ if (own.some((entry) => entry.status === "FAIL"))
1126
+ return "PASS";
1127
+ return own[0]?.status ?? null;
1128
+ },
1129
+ failureReason: () => failure,
1130
+ };
1131
+ }
1078
1132
  /** Restore the execute bit on a hook script. */
1079
1133
  function planExecutableBit(hqRoot, result, rem) {
1080
1134
  const abs = rem.fixTarget;
@@ -43,6 +43,13 @@
43
43
  * hq-cli shim (see `lib/windows/ps1-shims.ts`); the
44
44
  * execution policy is never changed. This is the one
45
45
  * scoped exception to the no-delete rule below.
46
+ * - `repair-release-link` — repoint an HQ-managed release link
47
+ * (`.agents/skills`, `.codex/claude`, ...) whose target
48
+ * is missing, using the link text HQ ships (absolute junction on Windows).
49
+ * When that target is missing too, the dangling link
50
+ * entry is removed. Only a link that does not resolve
51
+ * is touched; a real file or folder never is, and the
52
+ * link is removed without following it.
46
53
  *
47
54
  * EVERYTHING else — content drift between platform copies, a missing script, a
48
55
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -54,7 +61,7 @@
54
61
  */
55
62
  import type { CheckResult } from "../types.js";
56
63
  /** The allowlisted safe repair classes `--fix` is permitted to apply. */
57
- export type FixClass = "executable-bit" | "gate-profile" | "remove-stray-gate-entries" | "refresh-sync" | "refresh-manifest" | "bot-node-path" | "bot-hq-binary" | "remove-ps1-shims";
64
+ export type FixClass = "executable-bit" | "gate-profile" | "remove-stray-gate-entries" | "refresh-sync" | "refresh-manifest" | "bot-node-path" | "bot-hq-binary" | "remove-ps1-shims" | "repair-release-link";
58
65
  /**
59
66
  * A finding's structured remediation. `autoFixable`, `action`, and `command`
60
67
  * are the `--json` surface (AC1); `fixTarget`/`fixClass` are the internal handle
@@ -43,6 +43,13 @@
43
43
  * hq-cli shim (see `lib/windows/ps1-shims.ts`); the
44
44
  * execution policy is never changed. This is the one
45
45
  * scoped exception to the no-delete rule below.
46
+ * - `repair-release-link` — repoint an HQ-managed release link
47
+ * (`.agents/skills`, `.codex/claude`, ...) whose target
48
+ * is missing, using the link text HQ ships (absolute junction on Windows).
49
+ * When that target is missing too, the dangling link
50
+ * entry is removed. Only a link that does not resolve
51
+ * is touched; a real file or folder never is, and the
52
+ * link is removed without following it.
46
53
  *
47
54
  * EVERYTHING else — content drift between platform copies, a missing script, a
48
55
  * missing Codex counterpart, an unquoted `$CLAUDE_PROJECT_DIR`, a stale
@@ -53,6 +60,7 @@
53
60
  * deciding which of two diverged copies is correct needs human judgement.
54
61
  */
55
62
  import * as path from "node:path";
63
+ import { DANGLING_RELEASE_LINK_PROBLEM, RELEASE_LINKS, RELEASE_LINKS_CHECK_ID, } from "../checks/release-links.js";
56
64
  import { isCompanyJournalSlug, isSafeCompanySlug, isPersonalJournalSlug, journalSlugFromCheckId, } from "../checks/sync-health.js";
57
65
  /** Matches an exec-bit remediation command, quoted or not: `chmod +x <path>`. */
58
66
  const CHMOD_EXEC = /^chmod\s+\+x\s+(.+)$/;
@@ -165,6 +173,20 @@ export function deriveRemediation(result) {
165
173
  command: "hq.cmd install --global",
166
174
  };
167
175
  }
176
+ // repair-release-link — a shipped link whose target is missing, such as one
177
+ // a rescue pointed at its deleted temp folder (feedback_2ab63e50).
178
+ if (checkId === RELEASE_LINKS_CHECK_ID &&
179
+ result.status === "FAIL" &&
180
+ RELEASE_LINKS.some((entry) => entry.rel === target) &&
181
+ result.message.startsWith(target + " " + DANGLING_RELEASE_LINK_PROBLEM)) {
182
+ return {
183
+ autoFixable: true,
184
+ fixClass: "repair-release-link",
185
+ fixTarget: target,
186
+ action: `Repoint the dangling ${target} link at its target under the HQ root (or remove the link when that target is missing).`,
187
+ command: "hq doctor --fix",
188
+ };
189
+ }
168
190
  // Available hq-core upgrade. WARN is intentional in `hq doctor` and is
169
191
  // not a broken sync; --fix has no mechanical repair for it.
170
192
  if (checkId === "sync.update.core") {