@indigoai-us/hq-cli 5.345.183 → 5.345.187

package/dist/lib/hot-channels/run.d.ts

@@ -15,6 +15,7 @@
 import type { CatchUpWindow, HotTransport, SuggestionRule, TokenScope } from "./contract.js";
 import { type RunLedgerEntry, type RunTrigger, type SignalsGeneratedFn } from "./ledger.js";
 import type { HotChannelRegistry } from "./registry.js";
+import { type SelectionLoader } from "./selection.js";
 /** One item of the catalog API's top-level `hotChannels` array (hq-pro US-002). */
 export interface HotChannelCatalogItem {
     entryId?: string;
@@ -96,10 +97,17 @@ export interface OnDemandSyncInput {
     trigger?: RunTrigger;
     /** A scheduled run that fired late, after a missed window. */
     catchUp?: boolean;
+    /** The first run after the bot registered its hot-signal-sync job. */
+    firstRun?: boolean;
     /** The signals pass over each adapter's landed sources (US-011); 0 when absent. */
     signalsGenerated?: SignalsGeneratedFn;
     /** Checked before each document write (sync-lock ownership); a throw stops the run. */
     beforeWrite?: () => Promise<void>;
+    /**
+     * The person's saved hot-channel selections for this run (one loader per
+     * run, so nothing is cached across runs). Absent = land everything.
+     */
+    selections?: SelectionLoader;
 }
 export type SyncOutcomeStatus = "ok" | "failed" | "unavailable" | "no-connection" | "gated";
 export interface SyncOutcome {

package/dist/lib/hot-channels/run.js

@@ -18,6 +18,7 @@ import { bareProvider } from "../integrations/provider-slug.js";
 import { createVaultCursorStore } from "./cursors.js";
 import { cursorFilePath } from "./cursors.js";
 import { runHotChannelSync } from "./ledger.js";
+import { connectionSelection, meetingsSelection } from "./selection.js";
 /** Token-scope providers served from the HQ vault: no external connection. */
 /**
  * The bare, lowercased provider id used to match a connection against a
@@ -174,6 +175,22 @@ function sourcesOnlyCursorStore(vaultRoot, now) {
         },
     };
 }
+/**
+ * The saved selection for one planned entry: the entry's own connection (an
+ * empty list counts as no choice), or for a connectionless channel with companions (meetings) the include/exclude
+ * choice saved on its recorder connections.
+ */
+function selectionFor(load) {
+    return async (entry) => {
+        // An empty saved list on a connection means no choice yet: land everything.
+        if (entry.connectionId)
+            return connectionSelection(await load(entry.connectionId));
+        const companions = entry.companionConnectionIds ?? [];
+        if (companions.length === 0)
+            return undefined;
+        return meetingsSelection(await Promise.all(companions.map((id) => load(id))));
+    };
+}
 export async function runOnDemandSync(input) {
     const report = {
         runId: null,
@@ -276,6 +293,7 @@ export async function runOnDemandSync(input) {
         const sync = await runHotChannelSync({
             trigger: input.trigger ?? "on-demand",
             ...(input.catchUp === undefined ? {} : { catchUp: input.catchUp }),
+            ...(input.firstRun ? { firstRun: true } : {}),
             ...(input.signalsGenerated ? { signalsGenerated: input.signalsGenerated } : {}),
             ...(input.beforeWrite ? { beforeWrite: input.beforeWrite } : {}),
             registry: input.registry,
@@ -284,6 +302,7 @@ export async function runOnDemandSync(input) {
             personUid: input.personUid,
             personKey: input.personKey,
             cursorStore: sourcesOnlyCursorStore(input.vaultRoot, input.now),
+            ...(input.selections ? { selectionFor: selectionFor(input.selections) } : {}),
             gatewayFor: (entry) => {
                 const app = entry.connectionId ? appsByConnection.get(entry.connectionId) : undefined;
                 return app ? gatewayFor(app, input.deps, reconnects) : undefined;

package/dist/lib/hot-channels/schedule.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `hq sources schedule`: find a company's hot-signal-sync job across the
+ * local bots, show when it runs and how each adapter's last run went, and
+ * reschedule it to a daily time.
+ *
+ * Jobs live in each bot's `jobs.json` (lib/bot/local-jobs.ts). Reads go
+ * straight to the file; the reschedule goes through `rescheduleLocalJob`,
+ * which takes the job list's lock.
+ */
+import { type LocalJob } from "../bot/local-jobs.js";
+/** How many UTC days of the run ledger `lastRuns` looks back over, today included. */
+export declare const SCHEDULE_LOOKBACK_DAYS = 7;
+export interface ScheduleJobView {
+    botName: string;
+    jobId: string;
+    cron: string;
+    timezone: string;
+    dailyAt: string | null;
+    nextRunAt: string | null;
+    lastRunAt: string | null;
+}
+export interface ScheduleLastRun {
+    adapter: string;
+    finishedAt: string;
+    ok: boolean;
+    sourcesLanded: number;
+    signalsGenerated: number | null;
+}
+export interface ScheduleReport {
+    company: string;
+    job: ScheduleJobView | null;
+    lastRuns: ScheduleLastRun[];
+}
+export interface FoundHotSignalSyncJob {
+    botName: string;
+    dir: string;
+    job: LocalJob;
+}
+/** Parse `HH:MM` (24-hour). Throws a plain error on anything else. */
+export declare function parseDailyAt(at: string): {
+    hour: number;
+    minute: number;
+};
+/** The stored EventBridge form of "every day at H:M". */
+export declare function dailyCron(hour: number, minute: number): string;
+/** `HH:MM` when the cron fires once a day at a fixed time; null for any other schedule. */
+export declare function dailyAtOf(cron: string): string | null;
+/** Every local bot's hot-signal-sync job for `company`, ordered by bot name. */
+export declare function findHotSignalSyncJobs(botsRoot: string, company: string): FoundHotSignalSyncJob[];
+export declare function toJobView(found: FoundHotSignalSyncJob, now: Date): ScheduleJobView;
+/**
+ * Reschedule each found job to daily at `at`, keeping its time zone. Returns
+ * the jobs as stored after the change.
+ */
+export declare function rescheduleDaily(found: readonly FoundHotSignalSyncJob[], at: string, now: Date): FoundHotSignalSyncJob[];
+/**
+ * The newest ledger entry per adapter over the last `SCHEDULE_LOOKBACK_DAYS`
+ * UTC days, today included. Skipped runs (another sync held the lock) are not
+ * adapter runs and are left out. Sorted by adapter id.
+ */
+export declare function lastRunsPerAdapter(vaultRoot: string, personKey: string, now: Date): Promise<ScheduleLastRun[]>;
+/** Plain lines for the terminal. */
+export declare function renderScheduleReport(report: ScheduleReport, extraBots?: readonly string[]): string;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/lib/hot-channels/schedule.js

@@ -0,0 +1,162 @@
+/**
+ * `hq sources schedule`: find a company's hot-signal-sync job across the
+ * local bots, show when it runs and how each adapter's last run went, and
+ * reschedule it to a daily time.
+ *
+ * Jobs live in each bot's `jobs.json` (lib/bot/local-jobs.ts). Reads go
+ * straight to the file; the reschedule goes through `rescheduleLocalJob`,
+ * which takes the job list's lock.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { hotSignalSyncJobCompany } from "../bot/jobs/hot-signal-sync.js";
+import { nextDueFire, readLocalJobs, rescheduleLocalJob } from "../bot/local-jobs.js";
+import { ledgerDay, readRunLedger } from "./ledger.js";
+/** How many UTC days of the run ledger `lastRuns` looks back over, today included. */
+export const SCHEDULE_LOOKBACK_DAYS = 7;
+/** Parse `HH:MM` (24-hour). Throws a plain error on anything else. */
+export function parseDailyAt(at) {
+    const match = /^(\d{1,2}):(\d{2})$/.exec(at.trim());
+    const hour = match ? Number(match[1]) : NaN;
+    const minute = match ? Number(match[2]) : NaN;
+    if (!match || hour > 23 || minute > 59) {
+        throw new Error(`--at must be a 24-hour time HH:MM, such as 06:30 or 18:05 (got '${at}').`);
+    }
+    return { hour, minute };
+}
+/** The stored EventBridge form of "every day at H:M". */
+export function dailyCron(hour, minute) {
+    return `cron(${minute} ${hour} * * ? *)`;
+}
+function hhmm(hour, minute) {
+    return `${String(hour).padStart(2, "0")}:${String(minute).padStart(2, "0")}`;
+}
+/** `HH:MM` when the cron fires once a day at a fixed time; null for any other schedule. */
+export function dailyAtOf(cron) {
+    const match = /^cron\((\d{1,2}) (\d{1,2}) \* \* \? \*\)$/.exec(cron.trim()) ?? /^(\d{1,2}) (\d{1,2}) \* \* \*$/.exec(cron.trim());
+    if (!match)
+        return null;
+    const minute = Number(match[1]);
+    const hour = Number(match[2]);
+    return hour <= 23 && minute <= 59 ? hhmm(hour, minute) : null;
+}
+/** Every local bot's hot-signal-sync job for `company`, ordered by bot name. */
+export function findHotSignalSyncJobs(botsRoot, company) {
+    let names;
+    try {
+        names = fs.readdirSync(botsRoot);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const found = [];
+    for (const botName of names.sort()) {
+        const dir = path.join(botsRoot, botName);
+        let isDir;
+        try {
+            isDir = fs.statSync(dir).isDirectory();
+        }
+        catch {
+            // Gone between readdir and stat: not a bot.
+            isDir = false;
+        }
+        if (!isDir)
+            continue;
+        for (const job of readLocalJobs(dir)) {
+            if (hotSignalSyncJobCompany(job.context) === company)
+                found.push({ botName, dir, job });
+        }
+    }
+    return found;
+}
+export function toJobView(found, now) {
+    const next = nextDueFire(found.job, now);
+    return {
+        botName: found.botName,
+        jobId: found.job.jobId,
+        cron: found.job.cron,
+        timezone: found.job.timezone,
+        dailyAt: dailyAtOf(found.job.cron),
+        nextRunAt: next ? next.toISOString() : null,
+        lastRunAt: found.job.lastRunAt ?? null,
+    };
+}
+/**
+ * Reschedule each found job to daily at `at`, keeping its time zone. Returns
+ * the jobs as stored after the change.
+ */
+export function rescheduleDaily(found, at, now) {
+    const { hour, minute } = parseDailyAt(at);
+    const cron = dailyCron(hour, minute);
+    const out = [];
+    for (const f of found) {
+        // The time zone is read under the job-list lock, not from the earlier
+        // read, so a concurrent change to it is never overwritten.
+        const updated = rescheduleLocalJob(f.dir, f.job.jobId, { cron }, now);
+        if (!updated)
+            throw new Error(`The hot-signal-sync job ${f.job.jobId} on bot ${f.botName} was removed while rescheduling.`);
+        out.push({ ...f, job: updated });
+    }
+    return out;
+}
+/**
+ * The newest ledger entry per adapter over the last `SCHEDULE_LOOKBACK_DAYS`
+ * UTC days, today included. Skipped runs (another sync held the lock) are not
+ * adapter runs and are left out. Sorted by adapter id.
+ */
+export async function lastRunsPerAdapter(vaultRoot, personKey, now) {
+    const latest = new Map();
+    for (let i = 0; i < SCHEDULE_LOOKBACK_DAYS; i += 1) {
+        const day = ledgerDay(new Date(now.getTime() - i * 24 * 60 * 60 * 1000));
+        const { entries } = await readRunLedger(vaultRoot, personKey, day);
+        for (const entry of entries) {
+            if (entry.status === "skipped")
+                continue;
+            const seen = latest.get(entry.adapter);
+            if (!seen || entry.finishedAt > seen.finishedAt)
+                latest.set(entry.adapter, entry);
+        }
+    }
+    return [...latest.values()]
+        .sort((a, b) => (a.adapter < b.adapter ? -1 : a.adapter > b.adapter ? 1 : 0))
+        .map((e) => ({
+        adapter: e.adapter,
+        finishedAt: e.finishedAt,
+        ok: e.status === "ok",
+        sourcesLanded: e.sourcesLanded,
+        signalsGenerated: typeof e.signalsGenerated === "number" ? e.signalsGenerated : null,
+    }));
+}
+/** Plain lines for the terminal. */
+export function renderScheduleReport(report, extraBots = []) {
+    const lines = [];
+    const job = report.job;
+    if (!job) {
+        lines.push(`No hot-channel sync job for ${report.company} on any local bot.`);
+    }
+    else if (job.dailyAt) {
+        lines.push(`Syncs daily at ${job.dailyAt} (${job.timezone}) on bot ${job.botName}`);
+    }
+    else {
+        lines.push(`Syncs on schedule ${job.cron} (${job.timezone}) on bot ${job.botName}`);
+    }
+    if (job) {
+        if (extraBots.length > 0)
+            lines.push(`Also scheduled on bot ${extraBots.join(", ")}`);
+        lines.push(`Next run: ${job.nextRunAt ?? "not within the next week"}`);
+        lines.push(`Last run: ${job.lastRunAt ?? "never"}`);
+    }
+    if (report.lastRuns.length === 0) {
+        lines.push(`No runs logged in the last ${SCHEDULE_LOOKBACK_DAYS} days.`);
+    }
+    else {
+        for (const run of report.lastRuns) {
+            const signals = run.signalsGenerated === null ? "unknown" : String(run.signalsGenerated);
+            lines.push(`${run.adapter}: ${run.ok ? "ok" : "failed"} at ${run.finishedAt}, ${run.sourcesLanded} source(s), ${signals} signal(s)`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=schedule.js.map

package/dist/lib/hot-channels/selection.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Saved hot-channel selections (hq-pro US-014).
+ *
+ * A person can pick which channels, issues or records to watch on each
+ * connection. hq-pro stores the pick as
+ * `integrations/hot-channels/<connectionId>.json` in that person's own vault
+ * bucket (hq-pro `hotChannelSelectionKey`), shaped
+ * `{ schemaVersion: 1, connectionId, provider, hotChannelId, selected: [{ id, label, source }], updatedAt }`.
+ *
+ * The sync reads it once per connection per run. A missing file (404) means
+ * "no choice made": the adapter lands everything. A file that may exist but
+ * cannot be read (an error, a read slower than 5 seconds, malformed content,
+ * or a file naming another connection) fails closed: the loader throws
+ * `SelectionUnreadableError`, the loop skips that connection's adapter run
+ * and the ledger records it as failed with reason `selection-unreadable`.
+ * Nothing lands that the person may have excluded.
+ *
+ * An empty `selected` list on a connection's own channel (Slack, Linear,
+ * Attio) also means "no choice made" and lands everything: hq-pro saves `[]`
+ * when the person accepts defaults before any suggestions are listed, and has
+ * no delete, so `[]` must not silently stop the channel. Meetings keep their
+ * own rule (`meetingsSelection`): an empty pick on every recorder excludes them.
+ */
+export declare const HOT_CHANNEL_SELECTION_SCHEMA_VERSION = 1;
+export declare const HOT_CHANNEL_SELECTION_PREFIX = "integrations/hot-channels/";
+/** Upper bound on one selection read. */
+export declare const DEFAULT_SELECTION_READ_TIMEOUT_MS = 5000;
+export interface HotChannelSelectionEntry {
+    id: string;
+    label: string;
+    source: "suggested" | "added";
+}
+export interface HotChannelSelectionFile {
+    schemaVersion: typeof HOT_CHANNEL_SELECTION_SCHEMA_VERSION;
+    connectionId: string;
+    provider: string;
+    hotChannelId: string;
+    selected: HotChannelSelectionEntry[];
+    updatedAt: string;
+}
+/** Bucket-relative key of a connection's selection; null for an id hq-pro would never write. */
+export declare function hotChannelSelectionKey(connectionId: string): string | null;
+/**
+ * Parse a stored selection the way hq-pro's `parseSelectionFile` does.
+ * Anything unexpected (bad JSON, other schema version, a bad entry) is null.
+ */
+export declare function parseHotChannelSelection(text: string | null | undefined): HotChannelSelectionFile | null;
+/**
+ * Reads one object from the signed-in person's vault bucket by
+ * bucket-relative key. Resolves null when the object does not exist.
+ */
+export type PersonVaultObjectReader = (key: string) => Promise<string | null>;
+export interface SelectionLoaderOptions {
+    timeoutMs?: number;
+    log?: (message: string) => void;
+}
+export declare const SELECTION_UNREADABLE_REASON = "selection-unreadable";
+/** A saved selection may exist but could not be read; the connection is skipped. */
+export declare class SelectionUnreadableError extends Error {
+    readonly code = "selection-unreadable";
+    constructor(connectionId: string, detail: string);
+}
+/**
+ * Selected ids for one connection; undefined means no saved choice (land
+ * everything). Rejects with `SelectionUnreadableError` when a saved choice may
+ * exist but could not be read.
+ */
+export type SelectionLoader = (connectionId: string) => Promise<ReadonlySet<string> | undefined>;
+/**
+ * A loader for one run. Each connection's file is read at most once, and the
+ * cache dies with the loader, so the next run reads the file again. Rejects
+ * only with `SelectionUnreadableError`.
+ */
+export declare function createSelectionLoader(read: PersonVaultObjectReader, options?: SelectionLoaderOptions): SelectionLoader;
+/**
+ * The selection a connection's own channel lands by: the saved ids, or
+ * undefined (land everything) when nothing was saved or the saved list is empty.
+ */
+export declare function connectionSelection(saved: ReadonlySet<string> | undefined): ReadonlySet<string> | undefined;
+/**
+ * The meetings channel has no connection of its own; its checklist is an
+ * include/exclude choice saved on each meeting-recorder connection. Meetings
+ * are excluded (an empty set) when at least one recorder connection saved an
+ * empty selection and none saved a non-empty one. Otherwise undefined: include.
+ */
+export declare function meetingsSelection(selections: ReadonlyArray<ReadonlySet<string> | undefined>): ReadonlySet<string> | undefined;
+//# sourceMappingURL=selection.d.ts.map

package/dist/lib/hot-channels/selection.js

@@ -0,0 +1,175 @@
+/**
+ * Saved hot-channel selections (hq-pro US-014).
+ *
+ * A person can pick which channels, issues or records to watch on each
+ * connection. hq-pro stores the pick as
+ * `integrations/hot-channels/<connectionId>.json` in that person's own vault
+ * bucket (hq-pro `hotChannelSelectionKey`), shaped
+ * `{ schemaVersion: 1, connectionId, provider, hotChannelId, selected: [{ id, label, source }], updatedAt }`.
+ *
+ * The sync reads it once per connection per run. A missing file (404) means
+ * "no choice made": the adapter lands everything. A file that may exist but
+ * cannot be read (an error, a read slower than 5 seconds, malformed content,
+ * or a file naming another connection) fails closed: the loader throws
+ * `SelectionUnreadableError`, the loop skips that connection's adapter run
+ * and the ledger records it as failed with reason `selection-unreadable`.
+ * Nothing lands that the person may have excluded.
+ *
+ * An empty `selected` list on a connection's own channel (Slack, Linear,
+ * Attio) also means "no choice made" and lands everything: hq-pro saves `[]`
+ * when the person accepts defaults before any suggestions are listed, and has
+ * no delete, so `[]` must not silently stop the channel. Meetings keep their
+ * own rule (`meetingsSelection`): an empty pick on every recorder excludes them.
+ */
+export const HOT_CHANNEL_SELECTION_SCHEMA_VERSION = 1;
+export const HOT_CHANNEL_SELECTION_PREFIX = "integrations/hot-channels/";
+/** Upper bound on one selection read. */
+export const DEFAULT_SELECTION_READ_TIMEOUT_MS = 5_000;
+const CONNECTION_ID_PATTERN = /^[A-Za-z0-9_-]{1,256}$/;
+const ENTRY_ID_PATTERN = /^[^\s/\\]{1,256}$/;
+/** Bucket-relative key of a connection's selection; null for an id hq-pro would never write. */
+export function hotChannelSelectionKey(connectionId) {
+    return CONNECTION_ID_PATTERN.test(connectionId) ? `${HOT_CHANNEL_SELECTION_PREFIX}${connectionId}.json` : null;
+}
+/**
+ * Parse a stored selection the way hq-pro's `parseSelectionFile` does.
+ * Anything unexpected (bad JSON, other schema version, a bad entry) is null.
+ */
+export function parseHotChannelSelection(text) {
+    if (!text)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const file = parsed;
+    if (file.schemaVersion !== HOT_CHANNEL_SELECTION_SCHEMA_VERSION)
+        return null;
+    if (typeof file.connectionId !== "string" || typeof file.provider !== "string")
+        return null;
+    if (typeof file.hotChannelId !== "string" || typeof file.updatedAt !== "string")
+        return null;
+    if (!Array.isArray(file.selected))
+        return null;
+    const selected = [];
+    const seen = new Set();
+    for (const item of file.selected) {
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            return null;
+        const { id, label, source } = item;
+        if (typeof id !== "string" || !ENTRY_ID_PATTERN.test(id.trim()))
+            return null;
+        if (source !== "suggested" && source !== "added")
+            return null;
+        const cleanId = id.trim();
+        if (seen.has(cleanId))
+            continue;
+        seen.add(cleanId);
+        selected.push({ id: cleanId, label: typeof label === "string" && label.trim() ? label.trim() : cleanId, source });
+    }
+    return {
+        schemaVersion: HOT_CHANNEL_SELECTION_SCHEMA_VERSION,
+        connectionId: file.connectionId,
+        provider: file.provider,
+        hotChannelId: file.hotChannelId,
+        selected,
+        updatedAt: file.updatedAt,
+    };
+}
+export const SELECTION_UNREADABLE_REASON = "selection-unreadable";
+/** A saved selection may exist but could not be read; the connection is skipped. */
+export class SelectionUnreadableError extends Error {
+    code = SELECTION_UNREADABLE_REASON;
+    constructor(connectionId, detail) {
+        super(`saved selection for ${connectionId} could not be read (${detail}); skipped this connection`);
+        this.name = "SelectionUnreadableError";
+    }
+}
+class SelectionReadTimeoutError extends Error {
+    constructor(ms) {
+        super(`timed out after ${ms}ms`);
+        this.name = "SelectionReadTimeoutError";
+    }
+}
+async function withTimeout(work, ms) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new SelectionReadTimeoutError(ms)), ms);
+    });
+    try {
+        return await Promise.race([work, timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * A loader for one run. Each connection's file is read at most once, and the
+ * cache dies with the loader, so the next run reads the file again. Rejects
+ * only with `SelectionUnreadableError`.
+ */
+export function createSelectionLoader(read, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SELECTION_READ_TIMEOUT_MS;
+    const log = options.log ?? ((message) => void process.stderr.write(`${message}\n`));
+    const cache = new Map();
+    async function load(connectionId) {
+        const key = hotChannelSelectionKey(connectionId);
+        if (key === null)
+            return undefined;
+        let text;
+        try {
+            text = await withTimeout(Promise.resolve().then(() => read(key)), timeoutMs);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            log(`hot-channel selection for ${connectionId} could not be read (${reason}); skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, reason);
+        }
+        if (text === null)
+            return undefined;
+        const file = parseHotChannelSelection(text);
+        if (!file) {
+            log(`hot-channel selection for ${connectionId} is malformed; skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, "malformed");
+        }
+        if (file.connectionId !== connectionId) {
+            log(`hot-channel selection for ${connectionId} names connection ${file.connectionId}; skipping this connection`);
+            throw new SelectionUnreadableError(connectionId, `names connection ${file.connectionId}`);
+        }
+        return new Set(file.selected.map((entry) => entry.id));
+    }
+    return (connectionId) => {
+        let hit = cache.get(connectionId);
+        if (!hit) {
+            hit = load(connectionId);
+            cache.set(connectionId, hit);
+        }
+        return hit;
+    };
+}
+/**
+ * The selection a connection's own channel lands by: the saved ids, or
+ * undefined (land everything) when nothing was saved or the saved list is empty.
+ */
+export function connectionSelection(saved) {
+    return saved && saved.size > 0 ? saved : undefined;
+}
+/**
+ * The meetings channel has no connection of its own; its checklist is an
+ * include/exclude choice saved on each meeting-recorder connection. Meetings
+ * are excluded (an empty set) when at least one recorder connection saved an
+ * empty selection and none saved a non-empty one. Otherwise undefined: include.
+ */
+export function meetingsSelection(selections) {
+    const saved = selections.filter((s) => s !== undefined);
+    if (saved.length === 0)
+        return undefined;
+    return saved.every((s) => s.size === 0) ? new Set() : undefined;
+}
+//# sourceMappingURL=selection.js.map

package/dist/utils/shipped-codex-hooks.js

@@ -18,7 +18,7 @@ const CORE_SOURCES = [PROD_SOURCE, STAGING_SOURCE];
 /** Resolve a GitHub token: prefer `gh auth token`, fall back to env. */
 export function resolveGhToken() {
     try {
-        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+        const res = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8', timeout: 5_000 });
         if (res.status === 0) {
             const tok = res.stdout.trim();
             if (tok)

package/dist/utils/version-report.d.ts

@@ -16,7 +16,7 @@ export interface VersionReportDeps {
     printUpdateNudge?: (stderr: Pick<NodeJS.WriteStream, "write">) => Promise<void>;
 }
 export declare function normalizeHqCoreTag(tag: string): string | null;
-export declare function fetchLatestHqCoreRelease(fetchImpl?: typeof fetch, timeoutMs?: number): Promise<string | null>;
+export declare function fetchLatestHqCoreRelease(fetchImpl?: typeof fetch, timeoutMs?: number, token?: string | undefined): Promise<string | null>;
 export declare function collectVersionReport(deps?: VersionReportDeps): Promise<VersionReport>;
 export declare function formatVersionReport(report: VersionReport): string;
 export declare function versionReportJson(report: VersionReport): string;

package/dist/utils/version-report.js

@@ -13,22 +13,35 @@ import { CLI_VERSION } from "../cli-version.js";
 import { wantsJson } from "../version-request.js";
 import { findHqRoot } from "./manifest.js";
 import { readHqVersion } from "./hq-core-yaml.js";
+import { resolveGhToken } from "./shipped-codex-hooks.js";
 export const HQ_CORE_LATEST_URL = "https://api.github.com/repos/indigoai-us/hq-core/releases/latest";
 export const LATEST_FETCH_TIMEOUT_MS = 3_000;
 export function normalizeHqCoreTag(tag) {
     const version = tag.trim().replace(/^v/i, "");
     return semver.valid(version) ? version : null;
 }
-export async function fetchLatestHqCoreRelease(fetchImpl = fetch, timeoutMs = LATEST_FETCH_TIMEOUT_MS) {
+export async function fetchLatestHqCoreRelease(fetchImpl = fetch, timeoutMs = LATEST_FETCH_TIMEOUT_MS, token = resolveGhToken()) {
     try {
-        const res = await fetchImpl(HQ_CORE_LATEST_URL, {
-            headers: {
-                Accept: "application/vnd.github+json",
-                "User-Agent": "hq-cli-version",
-                "X-GitHub-Api-Version": "2022-11-28",
-            },
+        const headers = {
+            Accept: "application/vnd.github+json",
+            "User-Agent": "hq-cli-version",
+            "X-GitHub-Api-Version": "2022-11-28",
+        };
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
+        let res = await fetchImpl(HQ_CORE_LATEST_URL, {
+            headers,
             signal: AbortSignal.timeout(timeoutMs),
         });
+        // hq-core is public. A stale GH_TOKEN 401/403 should not hide the anonymous
+        // lookup that used to work.
+        if (token && (res.status === 401 || res.status === 403)) {
+            const { Authorization: _drop, ...anonHeaders } = headers;
+            res = await fetchImpl(HQ_CORE_LATEST_URL, {
+                headers: anonHeaders,
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
         if (!res.ok)
             return null;
         const body = (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.183",
+  "version": "5.345.187",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.183",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.183",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.183",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.183",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.183",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.183"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.187",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.187",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.187",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.187",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.187",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.187"
   }
 }