@indigoai-us/hq-cli 5.345.19 → 5.345.20

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.345.20] — 2026-10-06
+- Keep bundled scaffold scripts and `hq core register-project` aligned with the shared source, including company UID lookup from `companies/manifest.yaml`.
+
 ## [5.345.19] — 2026-10-06
 - Fix installation and updates of the published hq-anywhere pack through its built-in alias while continuing to reject reserved names from user-supplied remote sources.
 - With `hq-anywhere-runtime` enabled, hqd now starts on Windows through the user-scoped named-pipe host and refuses service only when secure pipe setup or ACL verification fails. `hq doctor` describes unsafe named-pipe startup as an ACL setup failure and recommends the daemon install or restart action based on service state.

package/assets/scaffold/core/scripts/hq-delegate-secrets.sh

@@ -90,7 +90,7 @@ fi
 
 # --- parse names (KEY= lines; comments and blanks ignored) --------------------
 
-NAMES="$(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$ENV_SCHEMA" | cut -d= -f1 | sort -u)"
+NAMES="$(grep -E '^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*=' "$ENV_SCHEMA" | cut -d= -f1 | sort -u)"
 if [ -z "$NAMES" ]; then
   update_manifest '.secrets = [] | .secretsSkipped = false'
   echo "hq-delegate-secrets: $ENV_SCHEMA declares no secret names — nothing to grant"

package/assets/scaffold/core/scripts/lib/transcript-tail.sh

@@ -54,45 +54,55 @@ hq_transcript_tail() {
 }
 
 # hq_transcript_tail_with_latest_assistant <path> [max_bytes] [scan_cap_bytes]
-# Return the normal bounded suffix plus the latest complete assistant record
-# when later metadata records have pushed it outside that suffix. The fallback
-# scan is bounded; status 3 means the latest assistant could not be verified
-# within the cap and security-sensitive callers must fail closed.
+# Return the normal bounded suffix plus the newest complete assistant record
+# when later records pushed it outside that suffix. The third argument remains
+# accepted for caller compatibility, but reverse scanning is no longer capped.
+# Return 1 only when the transcript cannot be read or no reverse-line tool is
+# available; callers handling user-facing policy checks must fail open silently.
 hq_transcript_tail_with_latest_assistant() {
   [ "$#" -ge 1 ] && [ "$#" -le 3 ] || return 2
   local path="$1" max_bytes="${2:-$HQ_TRANSCRIPT_TAIL_MAX_BYTES}"
-  local scan_cap="${3:-16777216}" size normal_tail assistant_record scan_tail
+  local scan_cap="${3:-16777216}" normal_tail assistant_record reverse_mode line=""
   case "$scan_cap" in ''|*[!0-9]*) return 2 ;; esac
   [ "$scan_cap" -gt 0 ] || return 2
 
+  # Most turns keep their newest assistant record in the ordinary bounded
+  # suffix, so preserve that fast path before any reverse scan.
   normal_tail="$(hq_transcript_tail "$path" "$max_bytes")" || return $?
-  assistant_record="$(printf '%s\n' "$normal_tail" | jq -Rrc 'fromjson? | select(.type == "assistant")' | tail -n 1)"
+  assistant_record="$(printf '%s\n' "$normal_tail" | jq -Rrc 'fromjson? | select(.type == "assistant" or (.type == "response_item" and .payload.type == "message" and .payload.role == "assistant"))' | tail -n 1)"
   if [ -n "$assistant_record" ]; then
     [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
     return 0
   fi
 
-  size="$(hq_transcript_size "$path")" || {
-    printf '%s\n' "hq_transcript_tail_with_latest_assistant: cannot read transcript size: $path" >&2
-    return 1
-  }
-  if [ "$size" -le "$scan_cap" ]; then
-    scan_tail="$(cat "$path"; printf '.')"
+  # GNU tac and BSD/macOS tail -r both stream records from EOF toward the
+  # beginning. grep discards ordinary tool-output lines before Bash reads them;
+  # jq confirms candidates and the loop exits at the newest assistant.
+  if command -v tac >/dev/null 2>&1; then
+    reverse_mode=tac
+  elif tail -r /dev/null >/dev/null 2>&1; then
+    reverse_mode=tail-r
   else
-    scan_tail="$(tail -c "$((scan_cap + 1))" "$path" | sed '1d'; printf '.')"
+    printf '%s\n' "hq_transcript_tail_with_latest_assistant: no reverse-line reader is available" >&2
+    return 1
   fi
-  scan_tail="${scan_tail%.}"
-  assistant_record="$(printf '%s\n' "$scan_tail" | jq -Rrc 'fromjson? | select(.type == "assistant")' | tail -n 1)"
+
+  assistant_record="$(
+    if [ "$reverse_mode" = tac ]; then
+      { tac "$path" 2>/dev/null || true; }
+    else
+      { tail -r "$path" 2>/dev/null || true; }
+    fi | { grep -E '"assistant"' || true; } | while IFS= read -r line || [ -n "$line" ]; do
+      # grep filters large non-assistant records before Bash reads their lines.
+      if printf '%s\n' "$line" | jq -Rre 'fromjson? | select(.type == "assistant" or (.type == "response_item" and .payload.type == "message" and .payload.role == "assistant"))' >/dev/null 2>&1; then
+        printf '%s\n' "$line"
+        break
+      fi
+    done
+  )"
   if [ -n "$assistant_record" ]; then
     printf '%s\n' "$assistant_record"
-    [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
-    return 0
   fi
-
-  if [ "$size" -gt "$scan_cap" ]; then
-    printf '%s\n' "hq_transcript_tail_with_latest_assistant: latest assistant record exceeds the ${scan_cap}-byte verification window" >&2
-    return 3
-  fi
-
   [ -z "$normal_tail" ] || printf '%s\n' "$normal_tail"
+  return 0
 }

package/assets/scaffold/core/scripts/ontology-garden.mjs

@@ -80,6 +80,69 @@ function writeDoc(file, fm, body, dry) {
 const slugify = s => s.toLowerCase().normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 const today = () => new Date().toISOString().slice(0, 10);
 const now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+const yyyyMm = () => new Date().toISOString().slice(0, 7);
+
+// ── Fact-file compaction ─────────────────────────────────────────────
+// Fact pages append one line per signal-mention of an entity (see step 3
+// below). Without a bound a hot entity accumulates every mention it has
+// ever received, so the page becomes a flat log. Compaction keeps the
+// most recent N lines inline and rolls the older ones into a dated,
+// append-only archive next to the fact file. `signal_count` on the
+// entity itself is unaffected — it is the true total.
+const BACKREF_COMPACT_THRESHOLD = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+const BACKREF_KEEP_INLINE = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+const SUMMARY_MARKER = "<!-- backref-archive -->";
+
+function isBackrefLine(line) { return /^- \[[a-z_]+\] .+ \(signal [0-9a-f]{12}\)\s*$/.test(line); }
+function isSummaryLine(line) { return line.includes(SUMMARY_MARKER); }
+
+function readArchiveIndex(file) {
+  if (!fs.existsSync(file)) return { version: 1, signalIds: [] };
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (parsed && Array.isArray(parsed.signalIds)) {
+      return { version: 1, signalIds: parsed.signalIds.filter(s => typeof s === "string") };
+    }
+  } catch (err) {
+    console.warn(`ontology-garden: archive index unreadable at ${file}: ${err.message || err}; skipping compaction`);
+  }
+  // Present but unreadable: never compact on top of it, or the rewrite would
+  // drop every archived id it lists.
+  return { version: 1, signalIds: [], unreadable: true };
+}
+
+// Compact `body` when its backref-line count exceeds the threshold.
+// Returns { body, archivedLines, archivedIds, changed }.
+function compactFactBody(body, { slug, archivedTotalBefore, dry }) {
+  const lines = body.split("\n").map(l => l.trimEnd()).filter(l => l.length > 0);
+  const backrefLines = lines.filter(isBackrefLine);
+  const other = lines.filter(l => !isBackrefLine(l) && !isSummaryLine(l));
+  if (backrefLines.length <= BACKREF_COMPACT_THRESHOLD) {
+    return { body, archivedLines: [], archivedIds: [], changed: false };
+  }
+  const archiveCount = backrefLines.length - BACKREF_KEEP_INLINE;
+  const archivedLines = backrefLines.slice(0, archiveCount);
+  const inlineLines = backrefLines.slice(archiveCount);
+  const archivedIds = archivedLines
+    .map(l => (l.match(/\(signal ([0-9a-f]{12})\)$/) || [])[1])
+    .filter(Boolean);
+  const archivedTotal = archivedTotalBefore + archivedLines.length;
+  const stamp = yyyyMm();
+  const summary = `- ${SUMMARY_MARKER} _${archivedTotal} older mention${archivedTotal === 1 ? "" : "s"} archived in [history](./${slug}.history/${stamp}.md)_`;
+  const nextBody = [summary, ...other, ...inlineLines].join("\n");
+  return { body: nextBody, archivedLines, archivedIds, changed: true, stamp };
+}
+
+function appendArchiveFile(file, isoDate, lines, dry) {
+  if (dry) return;
+  const batch = `\n<!-- archived ${isoDate} -->\n${lines.join("\n")}\n`;
+  const prev = fs.existsSync(file) ? fs.readFileSync(file, "utf8").replace(/\s+$/, "") : "";
+  const next = prev ? `${prev}\n${batch}` : `# Back-reference archive\n${batch}`;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp`;
+  fs.writeFileSync(tmp, next);
+  fs.renameSync(tmp, file);
+}
 
 function listCandidates(dir) {
   if (!fs.existsSync(dir)) return [];
@@ -193,10 +256,30 @@ function main() {
       for (const slug of hit) {
         const e = entities.get(slug);
         const ffile = path.join(ont, "facts", `@${key}`, e.type, `${slug}.md`);
-        const line = `- [${type}] ${body.split("\n")[0]} (signal ${id.slice(0, 12)})`;
+        const sid12 = id.slice(0, 12);
+        const line = `- [${type}] ${body.split("\n")[0]} (signal ${sid12})`;
         const prev = fs.existsSync(ffile) ? readDoc(ffile) : { fm: { entity: slug, type: e.type, audience_key: key }, body: "" };
-        if (!prev.body.includes(`signal ${id.slice(0, 12)}`)) {
-          writeDoc(ffile, prev.fm, [prev.body, line].filter(Boolean).join("\n"), a.dryRun);
+        const idxFile = path.join(path.dirname(ffile), `${slug}.history`, "_index.json");
+        const archiveIndex = readArchiveIndex(idxFile);
+        const alreadyArchived = archiveIndex.signalIds.includes(sid12);
+        if (!prev.body.includes(`signal ${sid12}`) && !alreadyArchived) {
+          let nextBody = [prev.body, line].filter(Boolean).join("\n");
+          const compact = compactFactBody(nextBody, {
+            slug,
+            archivedTotalBefore: archiveIndex.signalIds.length,
+            dry: a.dryRun,
+          });
+          if (compact.changed && !archiveIndex.unreadable) {
+            const archiveFile = path.join(path.dirname(ffile), `${slug}.history`, `${compact.stamp}.md`);
+            appendArchiveFile(archiveFile, today(), compact.archivedLines, a.dryRun);
+            if (!a.dryRun) {
+              const nextIdx = { version: 1, signalIds: [...archiveIndex.signalIds, ...compact.archivedIds] };
+              fs.mkdirSync(path.dirname(idxFile), { recursive: true });
+              fs.writeFileSync(idxFile, JSON.stringify(nextIdx) + "\n");
+            }
+            nextBody = compact.body;
+          }
+          writeDoc(ffile, prev.fm, nextBody, a.dryRun);
           report.facts_written++;
         }
         if (key === "company") {

package/assets/scaffold/core/scripts/ontology-source-worklist.sh

@@ -32,10 +32,77 @@ while [ $# -gt 0 ]; do
   esac
 done
 [ -n "$co" ] && [ -n "$ch" ] || { echo "usage: ontology-source-worklist.sh --company <co> --channel <ch> [--limit N] [--force] [--mark-done <file>]" >&2; exit 2; }
-D="$root/companies/$co/sources/$ch"; Y="$D/source.yaml"; ledger="$D/.processed"
+D="$root/companies/$co/sources/$ch"; Y="$D/source.yaml"; ledger="$D/.processed"; skip_ledger="$D/.skipped"
+# Bumped when the audience parser gains new recognisable frontmatter fields; items
+# previously skipped as no-audience under an older PARSER_VERSION get re-evaluated
+# on the next run instead of staying stuck forever (see feedback_b8d61e28).
+PARSER_VERSION=2
 bash "$here/source-yaml-validate.sh" "$Y" >/dev/null || { bash "$here/source-yaml-validate.sh" "$Y" >&2; exit 2; }
 
-if [ -n "$done_item" ]; then echo "$(basename "$done_item")" >> "$ledger"; exit 0; fi
+if [ -n "$done_item" ]; then printf '%s\t%s\n' "$(basename "$done_item")" "$PARSER_VERSION" >> "$ledger"; exit 0; fi
+
+# Migrate `.processed` to parser-version stamps so a successfully processed item
+# stays processed across runs. Entries are `basename\tversion`; new mark-done
+# writes always include the stamp. Convergence rule for legacy UNSTAMPED
+# entries from the pre-fix slack-dm bug (254 DMs recorded in `.processed` as
+# plain basenames while no candidates were ever written): drop ones whose file
+# carries `resolved_participants:` (the exact bug signature) so the main loop
+# re-evaluates them exactly once; the next mark-done writes them back stamped
+# at the current version. Any other unstamped entry is upgraded in place to a
+# stamp — never re-stripped again. Stamped entries at a version below current
+# PARSER_VERSION are also dropped so a parser upgrade re-evaluates them.
+# ontology-candidate ids are content-addressed, so a true reprocess is idempotent.
+if [ -f "$ledger" ]; then
+  tmp="$ledger.heal.$$"
+  : > "$tmp"
+  changed=0
+  while IFS=$'\t' read -r b ver || [ -n "$b" ]; do
+    b="${b%$'\r'}"; ver="${ver%$'\r'}"
+    [ -n "$b" ] || continue
+    if [ -n "${ver:-}" ]; then
+      if [ "$ver" -lt "$PARSER_VERSION" ] 2>/dev/null; then changed=1; continue; fi
+      printf '%s\t%s\n' "$b" "$ver" >> "$tmp"
+      continue
+    fi
+    item="$D/$b"
+    if [ -f "$item" ] && awk '/^---$/{fm++; if(fm==2) exit} fm==1 && /^resolved_participants:/{found=1; exit} END{exit !found}' "$item" 2>/dev/null; then
+      changed=1; continue
+    fi
+    printf '%s\t%s\n' "$b" "$PARSER_VERSION" >> "$tmp"
+    changed=1
+  done < "$ledger"
+  if [ "$changed" = 1 ]; then mv "$tmp" "$ledger"; else rm -f "$tmp"; fi
+fi
+is_processed() { # 0 if $1 is recorded in .processed at >= current parser version (or unstamped — treated as current after migration)
+  [ -f "$ledger" ] || return 1
+  awk -F '\t' -v b="$1" -v v="$PARSER_VERSION" '
+    { sub(/\r$/, "") }
+    $1==b { if (NF < 2 || $2=="") { found=1; exit } if (($2+0) >= v) { found=1; exit } }
+    END { exit !found }
+  ' "$ledger"
+}
+
+# Walk `.skipped`: entries whose recorded version is < current PARSER_VERSION
+# are dropped so the main loop re-evaluates them. Entries at the current
+# version stay as the ignore set for this run.
+declare_skipped=""
+if [ -f "$skip_ledger" ]; then
+  tmp="$skip_ledger.rev.$$"
+  : > "$tmp"
+  changed=0
+  while IFS=$'\t' read -r b reason ver || [ -n "$b" ]; do
+    [ -n "$b" ] || continue
+    if [ -z "${ver:-}" ] || [ "$ver" -lt "$PARSER_VERSION" ] 2>/dev/null; then
+      changed=1; continue
+    fi
+    printf '%s\t%s\t%s\n' "$b" "$reason" "$ver" >> "$tmp"
+  done < "$skip_ledger"
+  if [ "$changed" = 1 ]; then mv "$tmp" "$skip_ledger"; else rm -f "$tmp"; fi
+fi
+skipped_at_current() { # 0 if $1 is recorded as skipped at the current parser version
+  [ -f "$skip_ledger" ] || return 1
+  awk -F '\t' -v b="$1" -v v="$PARSER_VERSION" '$1==b && $3==v { found=1; exit } END { exit !found }' "$skip_ledger"
+}
 
 get() { awk -v k="$1" '$0 ~ "^"k":" { sub("^"k":[[:space:]]*", ""); gsub(/^["\x27]|["\x27]$/, ""); print; exit }' "$Y"; }
 run="$(get run)"; rule="$(get audience_rule)"
@@ -53,11 +120,69 @@ item_list() { # frontmatter list field: inline [a, b] or block "- a"
   ' "$1"
 }
 
+# participant_ids: for a frontmatter block list of mappings under key $2 (e.g.
+# resolved_participants:), emit one id per entry: the entry's `person_uid:` if
+# present, otherwise its `email:`. Entries with only `slack_user_id:` (no
+# person_uid, no email) are skipped — the audience must stay exactly the
+# resolvable DM participants, never widened. Scope: ONLY the mapping list
+# directly under $2 in frontmatter.
+participant_ids() {
+  awk -v k="$2" '
+    { sub(/\r$/, "") }
+    BEGIN{fm=0; inlist=0; have_pid=0; have_email=0; pid=""; em=""}
+    function flush() {
+      if (have_pid && pid != "") { print pid }
+      else if (have_email && em != "") { print em }
+      have_pid=0; have_email=0; pid=""; em=""
+    }
+    /^---$/ { fm++; if (fm==2) { if (inlist) flush(); exit } next }
+    fm==1 && $0 ~ "^"k":" { inlist=1; next }
+    fm==1 && inlist {
+      # end of list = a line that is not indented beyond col 0 and not a bare "-"
+      if ($0 ~ /^[^ \t-]/) { flush(); inlist=0; next }
+      is_dash = ($0 ~ /^[[:space:]]*-[[:space:]]/)
+      if (is_dash) {
+        flush()
+        s=$0; sub(/^[[:space:]]*-[[:space:]]*/, "", s)
+        # inline mapping (JSON-style) on same line as the dash
+        if (s ~ /^\{/) {
+          gsub(/[{}"\x27]/, "", s); n=split(s, kv, ",")
+          for (i=1;i<=n;i++) {
+            gsub(/^[ \t]+|[ \t]+$/, "", kv[i])
+            if (match(kv[i], /^person_uid[[:space:]]*:[[:space:]]*/)) { pid=substr(kv[i], RLENGTH+1); have_pid=1 }
+            else if (match(kv[i], /^email[[:space:]]*:[[:space:]]*/)) { em=substr(kv[i], RLENGTH+1); have_email=1 }
+          }
+          flush()
+          next
+        }
+        # First mapping key on same line as the dash, e.g.
+        #   - person_uid: prs_01ALICE
+        # Fall through to the key/value handlers below with the de-dashed line.
+        line = s
+      } else {
+        line = $0; sub(/^[[:space:]]+/, "", line)
+      }
+      if (line ~ /^person_uid:/) {
+        v=line; sub(/^person_uid:[[:space:]]*/, "", v); gsub(/["\x27]/, "", v); gsub(/^[ \t]+|[ \t]+$/, "", v)
+        if (v != "") { pid=v; have_pid=1 }
+        next
+      }
+      if (line ~ /^email:/) {
+        v=line; sub(/^email:[[:space:]]*/, "", v); gsub(/["\x27]/, "", v); gsub(/^[ \t]+|[ \t]+$/, "", v)
+        if (v != "") { em=v; have_email=1 }
+        next
+      }
+    }
+    END { if (inlist) flush() }
+  ' "$1"
+}
+
 n=0
 for f in "$D"/*.md; do
   [ -f "$f" ] || continue
   b="$(basename "$f")"
-  [ -f "$ledger" ] && grep -qxF "$b" "$ledger" && continue
+  is_processed "$b" && continue
+  skipped_at_current "$b" && continue
   [ "$n" -ge "$limit" ] && break
   n=$((n+1))
   rel="sources/$ch/$b"
@@ -68,12 +193,24 @@ for f in "$D"/*.md; do
     *)
       aud="$(item_list "$f" audience | paste -sd, -)"
       [ -n "$aud" ] || aud="$(item_list "$f" attendees | grep -E '@|^(prs|agt)_' | paste -sd, -)"
+      # Slack DM items (hq-pro inbound slack-personal-dm.ts) only carry
+      # resolved_participants: a block list of mappings with person_uid /
+      # slack_user_id / email. Derive audience from those, scoped exactly to
+      # the DM's own participants (never widened to company). Only entries
+      # whose person_uid or email resolves become audience ids; a slack_user_id
+      # alone is not a usable audience key, so that entry is dropped — matching
+      # the frontmatter contract exercised in hq-pro
+      # test/sources/inbound/slack-personal-dm.test.ts.
+      [ -n "$aud" ] || aud="$(participant_ids "$f" resolved_participants | grep -E '@|^(prs|agt)_' | paste -sd, -)"
       if [ -z "$aud" ]; then
         aud="$("$HQ" files --company "$co" acl "$rel" --json 2>/dev/null \
           | jq -r '[.direct[]? | select(.granteeType=="person" or .granteeType=="email" or .granteeType=="agent") | select(.permission=="read" or .permission=="write" or .permission=="admin") | .granteeId] | unique | join(",")' 2>/dev/null)"
       fi ;;
   esac
-  if [ -z "$aud" ]; then jq -cn --arg f "$rel" '{file:$f, skip:"no-audience"}'; continue; fi
+  if [ -z "$aud" ]; then
+    printf '%s\t%s\t%s\n' "$b" "no-audience" "$PARSER_VERSION" >> "$skip_ledger"
+    jq -cn --arg f "$rel" '{file:$f, skip:"no-audience"}'; continue
+  fi
   key="$(HQ_ROOT="$root" bash "$here/ontology-candidate.sh" key "$aud")"
   jq -cn --arg f "$rel" --arg k "$key" --arg a "$aud" '{file:$f, audience_key:$k, audience:($a|split(","))}'
 done

package/assets/scaffold/core/scripts/register-project.sh

@@ -21,13 +21,44 @@ resolve_uid() {
     tr -d '[:space:]' < "$file"
     return
   fi
-  die "no company uid for $company (set HQ_COMPANY_UID or companies/$company/.company-uid)"
+  if [ -f "$ROOT/companies/manifest.yaml" ]; then
+    local manifest_uid
+    manifest_uid="$(awk -v company="$company" '
+      /^companies:[[:space:]]*$/ { in_companies=1; next }
+      in_companies && /^[^[:space:]]/ { in_companies=0 }
+      in_companies && /^  [^ #][^:]*:/ {
+        slug=$1; sub(/[[:space:]]+$/, "", slug); sub(/:$/, "", slug); in_company=(slug == company); next
+      }
+      in_company && /^  [^[:space:]#]/ { exit }
+      in_company && $1 == "cloud_uid:" { gsub(/["\047]/, "", $2); sub(/[[:space:]]+$/, "", $2); print $2; exit }
+    ' "$ROOT/companies/manifest.yaml")"
+    if [ -n "$manifest_uid" ]; then
+      printf '%s\n' "$manifest_uid"
+      return
+    fi
+  fi
+  die "no company uid for $company (set HQ_COMPANY_UID, companies/$company/.company-uid, or manifest cloud_uid)"
+}
+
+mesh_project_id_for_prd() {
+  local company="$1" project="$2" board rel resolved
+  board="$(board_path "$company")"
+  rel="companies/$company/projects/$project/prd.json"
+  resolved=""
+  if [ -f "$board" ]; then
+    resolved="$(jq -r --arg path "$rel" --arg project "$project" '
+      [.projects[]? | select(.prd_path == $path or .id == $project)] | first | (.mesh_project_id // .id // empty)
+    ' "$board" 2>/dev/null | tr -d '\r' || true)"
+  fi
+  printf '%s\n' "${resolved:-$project}"
 }
 
 has_board() {
-  local company="$1" project="$2" uid
+  local company="$1" project="$2" uid mesh_project
   uid="$(resolve_uid "$company")"
-  [ -f "${HOME}/.hq/work-mesh/cache/projects/${uid}/${project}.json" ]
+  mesh_project="$(mesh_project_id_for_prd "$company" "$project")"
+  [ -f "${HOME}/.hq/work-mesh/cache/projects/${uid}/${mesh_project}.json" ] \
+    || [ -f "${HOME}/.hq/work-mesh/cache/projects/${uid}/${project}.json" ]
 }
 
 story_not_done() {
@@ -69,7 +100,7 @@ mark_pending() {
   prd="$ROOT/companies/$company/projects/$project/prd.json"
   rel="companies/$company/projects/$project/prd.json"
   now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  title="$(jq -r '.name // empty' "$prd" 2>/dev/null || true)"
+  title="$(jq -r '.name // empty' "$prd" 2>/dev/null | tr -d '\r' || true)"
   [ -n "$title" ] || title="$project"
   mkdir -p "$(dirname "$board")"
   if [ ! -f "$board" ]; then
@@ -108,19 +139,21 @@ mark_pending() {
 register_one() {
   local company="$1" project="$2"
   local prd="$ROOT/companies/$company/projects/$project/prd.json"
+  local mesh_project
+  mesh_project="$(mesh_project_id_for_prd "$company" "$project")"
   [ -f "$prd" ] || die "registration incomplete: missing $prd"
   if ! cli_has_project_ensure; then
     mark_pending "$company" "$project"
     die "hq-cli ${MIN_HQ_CLI} or newer is required; ${company}/${project} stays local until then"
   fi
   local ensure_json
-  if ! ensure_json="$(hq mesh project ensure "$project" --company "$company" --stories-file "$prd" --json)"; then
+  if ! ensure_json="$(hq mesh project ensure "$mesh_project" --company "$company" --stories-file "$prd" --json)"; then
     echo "registration incomplete: hq mesh project ensure failed for $company/$project" >&2
     exit 1
   fi
   local thread channel
-  thread="$(printf '%s' "$ensure_json" | jq -er '.threadId // empty')" || die "registration incomplete: ensure output missing threadId"
-  channel="$(printf '%s' "$ensure_json" | jq -er '.channelId // empty')" || die "registration incomplete: ensure output missing channelId"
+  thread="$(printf '%s' "$ensure_json" | jq -er '.threadId // empty' | tr -d '\r')" || die "registration incomplete: ensure output missing threadId"
+  channel="$(printf '%s' "$ensure_json" | jq -er '.channelId // empty' | tr -d '\r')" || die "registration incomplete: ensure output missing channelId"
   [ -n "$thread" ] || die "registration incomplete: empty threadId"
   [ -n "$channel" ] || die "registration incomplete: empty channelId"
 
@@ -128,7 +161,7 @@ register_one() {
   local rel="companies/$company/projects/$project/prd.json"
   local now title tmp
   now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  title="$(jq -r '.name // empty' "$prd")"
+  title="$(jq -r '.name // empty' "$prd" | tr -d '\r')"
   [ -n "$title" ] || title="$project"
   mkdir -p "$(dirname "$board")"
   if [ ! -f "$board" ]; then
@@ -136,7 +169,8 @@ register_one() {
   fi
   tmp="$(mktemp)"
   jq \
-    --arg id "$project" \
+    --arg id "$mesh_project" \
+    --arg project "$project" \
     --arg path "$rel" \
     --arg thread "$thread" \
     --arg channel "$channel" \
@@ -144,9 +178,9 @@ register_one() {
     --arg title "$title" \
     '
       .projects = (.projects // []) |
-      if any(.projects[]; .id == $id or .prd_path == $path or .mesh_project_id == $id) then
+      if any(.projects[]; .id == $id or .id == $project or .prd_path == $path or .mesh_project_id == $id) then
         .projects |= map(
-          if .id == $id or .prd_path == $path or .mesh_project_id == $id then
+          if .id == $id or .id == $project or .prd_path == $path or .mesh_project_id == $id then
             . + {threadId:$thread, channelId:$channel, updated_at:$now, prd_path:(.prd_path // $path), mesh_project_id:$id} | del(.pending_registration)
           else . end
         )
@@ -169,14 +203,45 @@ register_one() {
   jq -e \
     --arg id "$project" \
     --arg path "$rel" \
+    --arg mesh "$mesh_project" \
     --arg thread "$thread" \
     --arg channel "$channel" \
-    'any(.projects[]?; (.id == $id or .prd_path == $path or .mesh_project_id == $id) and .threadId == $thread and .channelId == $channel)' \
+    'any(.projects[]?; (.id == $id or .prd_path == $path or .mesh_project_id == $mesh) and .mesh_project_id == $mesh and .threadId == $thread and .channelId == $channel)' \
     "$board" >/dev/null \
     || die "registration incomplete: board.json entry for $project did not verify"
   echo "registered $company/$project thread=$thread channel=$channel"
 }
 
+register_brainstorm() {
+  local company="$1" project="$2" board title description ensure_json thread channel tmp
+  resolve_uid "$company" >/dev/null
+  board="$(board_path "$company")"
+  [ -f "$board" ] || die "registration incomplete: missing $board"
+  title="$(jq -r --arg id "$project" '[.projects[]? | select(.id == $id or .mesh_project_id == $id)] | first | .title // empty' "$board" | tr -d '\r')"
+  description="$(jq -r --arg id "$project" '[.projects[]? | select(.id == $id or .mesh_project_id == $id)] | first | .description // empty' "$board" | tr -d '\r')"
+  [ -n "$title" ] || die "registration incomplete: missing local Board project $company/$project"
+  if ! ensure_json="$(hq mesh project set "$project" --company "$company" --name "$title" --description "$description" --create --json)"; then
+    die "registration incomplete: hq mesh project set failed for $company/$project"
+  fi
+  thread="$(printf '%s' "$ensure_json" | jq -er '.registration.threadId // .threadId // empty' | tr -d '\r')" \
+    || die "registration incomplete: project set output missing threadId"
+  channel="$(printf '%s' "$ensure_json" | jq -er '.registration.channelId // .channelId // empty' | tr -d '\r')" \
+    || die "registration incomplete: project set output missing channelId"
+  [ -n "$thread" ] && [ -n "$channel" ] || die "registration incomplete: empty threadId or channelId"
+  tmp="$(mktemp)"
+  jq --arg id "$project" --arg thread "$thread" --arg channel "$channel" --arg now "$(date -u +%Y-%m-%dT%H:%M:%SZ)" '
+    .projects |= map(if .id == $id or .mesh_project_id == $id then . + {
+      threadId:$thread, channelId:$channel, mesh_project_id:$id,
+      mesh_registration_prompt_state:"accepted", updated_at:$now
+    } | del(.pending_registration) else . end)
+  ' "$board" > "$tmp"
+  mv "$tmp" "$board"
+  jq -e --arg id "$project" --arg thread "$thread" --arg channel "$channel" \
+    'any(.projects[]?; (.id == $id or .mesh_project_id == $id) and .threadId == $thread and .channelId == $channel)' \
+    "$board" >/dev/null || die "registration incomplete: local Board registration did not verify"
+  echo "registered $company/$project thread=$thread channel=$channel"
+}
+
 audit() {
   local company="$1"
   [ -n "$company" ] || die "usage: register-project.sh --audit <company>"
@@ -248,7 +313,10 @@ retry_pending() {
   done < <(jq -r '[.projects[]? | select(.pending_registration == true) | .id // empty] | .[]' "$board" 2>/dev/null | tr -d '\r' || true)
 }
 
-if [ "${1:-}" = "--audit" ]; then
+if [ "${1:-}" = "--brainstorm" ]; then
+  [ "$#" -eq 3 ] || die "usage: register-project.sh --brainstorm <company> <board-project-id>"
+  register_brainstorm "$2" "$3"
+elif [ "${1:-}" = "--audit" ]; then
   audit "${2:-}"
 elif [ "${1:-}" = "--backfill" ]; then
   shift
@@ -258,5 +326,5 @@ elif [ "${1:-}" = "--retry-pending" ]; then
 elif [ $# -eq 2 ]; then
   register_one "$1" "$2"
 else
-  die "usage: register-project.sh <company> <project> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>"
+  die "usage: register-project.sh <company> <project> | --brainstorm <company> <board-project-id> | --audit <company> | --backfill <company> --only-active [--yes] | --retry-pending <company>"
 fi

package/assets/scaffold/core/scripts/resume-thread-lock.sh

@@ -199,11 +199,11 @@ existing_state() {
   fi
 
   local record_thread record_session record_at record_epoch record_generation current_epoch
-  record_thread="$(jq -r '.thread_id' "$record_path")"
-  record_session="$(jq -r '.session_id' "$record_path")"
-  record_at="$(jq -r '.resumed_at' "$record_path")"
-  record_epoch="$(jq -r '.resumed_epoch' "$record_path")"
-  record_generation="$(jq -r '.generation' "$record_path")"
+  record_thread="$(jq -r '.thread_id' "$record_path" | tr -d '\r')"
+  record_session="$(jq -r '.session_id' "$record_path" | tr -d '\r')"
+  record_at="$(jq -r '.resumed_at' "$record_path" | tr -d '\r')"
+  record_epoch="$(jq -r '.resumed_epoch' "$record_path" | tr -d '\r')"
+  record_generation="$(jq -r '.generation' "$record_path" | tr -d '\r')"
 
   if [[ "$record_thread" != "$thread_id" || ! "$record_epoch" =~ ^[0-9]+$ ]]; then
     emit_stale "invalid-record" "$record_session" "$record_at" "$record_generation"

package/assets/scaffold/core/scripts/share-suggestion-state.sh

@@ -113,7 +113,10 @@ const sortKeys = (v) =>
 
 function readJson(p, dflt) {
   if (!fs.existsSync(p)) return dflt;
-  try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch (e) { return dflt; }
+  try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch (e) {
+    console.error(`share-suggestion-state: unable to read ${p} (${e.name || "Error"})`);
+    process.exit(3);
+  }
 }
 
 function writeJson(p, payload) {
@@ -537,5 +540,10 @@ process.exit(0);
 JS
 }
 
-main "$@" || log_error "internal error"
+# Exit 3 means an existing state file could not be read; callers see that
+# failure. Every other error is logged and the helper exits 0.
+main "$@"
+status=$?
+[ "$status" -eq 3 ] && exit 3
+[ "$status" -eq 0 ] || log_error "internal error"
 exit 0

package/assets/scaffold/core/scripts/work-mesh-live-bind-trusted.sh

@@ -144,9 +144,41 @@ if [ "${HQ_WORK_MESH_RECONCILE_STUB:-}" = "1" ]; then
 fi
 
 HQ_BIN="$(command -v hq 2>/dev/null || true)"
-if [ -n "$HQ_BIN" ] && [ -f "$OBS_FILE" ]; then
-  nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
-    >/dev/null 2>&1 </dev/null &
-  disown 2>/dev/null || true
+if [ -z "$HQ_BIN" ]; then
+  printf '%s\n' 'Work Mesh reconcile skipped: hq CLI not found on PATH.' >&2
+else
+  flag_reader="$ROOT/.claude/hooks/work-mesh-daemon-not-loaded-flag.cjs"
+  daemon_warning_enabled=false
+  if [[ -n "${HQ_FLAGS_API_URL:-}" \
+    && "${HQ_COMPANY_UID:-}" =~ ^cmp_[A-Za-z0-9]{3,128}$ ]] \
+    && command -v node >/dev/null 2>&1 && [[ -f "$flag_reader" ]]; then
+    daemon_warning_enabled="$(HQ_CLI_BIN="$HQ_BIN" node "$flag_reader")" || daemon_warning_enabled=false
+  fi
+  if [ "$daemon_warning_enabled" = "true" ]; then
+    # Status only reads the installed service and its live state. Keep this hook
+    # bounded, and fail quiet when the CLI or service manager cannot answer.
+    daemon_status_file="$(mktemp "${TMPDIR:-/tmp}/hq-work-mesh-daemon-status.XXXXXX" 2>/dev/null)" || daemon_status_file=""
+    if [ -n "$daemon_status_file" ]; then
+      HQ_NO_UPDATE_CHECK=1 "$HQ_BIN" mesh daemon status --json >"$daemon_status_file" 2>/dev/null &
+      daemon_status_pid=$!
+      ( sleep 2; kill "$daemon_status_pid" 2>/dev/null || true ) &
+      daemon_status_watchdog=$!
+      daemon_status_rc=0
+      wait "$daemon_status_pid" || daemon_status_rc=$?
+      kill "$daemon_status_watchdog" 2>/dev/null || true
+      wait "$daemon_status_watchdog" 2>/dev/null || true
+      if [ "$daemon_status_rc" -eq 0 ] && command -v jq >/dev/null 2>&1 && \
+        jq -e '(.ok == true) and (.running == false) and (.message | type == "string" and contains("installed ("))' \
+          "$daemon_status_file" >/dev/null 2>&1; then
+        printf '%s\n' 'Work Mesh daemon is installed but not loaded; start it with: hq mesh daemon install' >&2
+      fi
+      rm -f "$daemon_status_file" 2>/dev/null || true
+    fi
+  fi
+  if [ -f "$OBS_FILE" ]; then
+    nohup "$HQ_BIN" mesh context reconcile --observation-file "$OBS_FILE" --machine \
+      >/dev/null 2>&1 </dev/null &
+    disown 2>/dev/null || true
+  fi
 fi
 exit 0

package/assets/scaffold/core/scripts/worktree-gc.sh

@@ -249,7 +249,7 @@ for wt in "${CANDIDATES[@]:-}"; do
   created_epoch="$wt_mtime"
   stamp_file="$GC_META_DIR/$(path_key "$wt").json"
   if [[ -f "$stamp_file" ]]; then
-    stamped=$(jq -r '.createdAtEpoch // empty' "$stamp_file" 2>/dev/null || echo "")
+    stamped=$(jq -r '.createdAtEpoch // empty' "$stamp_file" 2>/dev/null | tr -d '\r' || echo "")
     [[ -n "$stamped" ]] && created_epoch="$stamped"
   fi
   age_days=$(( (NOW - created_epoch) / 86400 ))

package/dist/commands/core-ontology-native.js

@@ -799,15 +799,119 @@ export function worklistCommand(args, root) {
     if (validation.code !== 0)
         return err(2, `${validation.stderr}${validation.stdout}${validation.stderr}`);
     const ledger = path.join(directory, ".processed");
+    const skipLedger = path.join(directory, ".skipped");
+    const parserVersion = 2;
     if (doneItem) {
-        fs.appendFileSync(ledger, `${path.basename(doneItem)}\n`);
+        fs.appendFileSync(ledger, `${path.basename(doneItem)}\t${parserVersion}\n`);
         return ok();
     }
+    const hasFrontmatterField = (file, field) => {
+        if (!fs.existsSync(file))
+            return false;
+        let frontmatter = 0;
+        for (const rawLine of fs.readFileSync(file, "utf8").split("\n")) {
+            const line = rawLine.replace(/\r$/, "");
+            if (line === "---") {
+                frontmatter += 1;
+                if (frontmatter === 2)
+                    return false;
+                continue;
+            }
+            if (frontmatter === 1 && line.startsWith(`${field}:`))
+                return true;
+        }
+        return false;
+    };
+    const rewriteIfChanged = (file, original, output) => {
+        if (output === original)
+            return;
+        const temporary = `${file}.native-${process.pid}`;
+        fs.writeFileSync(temporary, output);
+        fs.renameSync(temporary, file);
+    };
+    // Match the shell's parser-version migration. Unstamped legacy rows are
+    // stamped unless they carry the old resolved_participants bug signature;
+    // older parser versions are dropped so those sources are re-evaluated.
+    let processed = "";
+    if (fs.existsSync(ledger)) {
+        const original = fs.readFileSync(ledger, "utf8");
+        const kept = [];
+        let changed = false;
+        const rows = original.split("\n");
+        if (rows.at(-1) === "")
+            rows.pop();
+        for (const rawLine of rows) {
+            const fields = rawLine.split("\t");
+            const basename = (fields[0] ?? "").replace(/\r$/, "");
+            const version = (fields[1] ?? "").replace(/\r$/, "");
+            if (!basename)
+                continue;
+            if (version) {
+                if (/^[+-]?\d+$/.test(version) && Number(version) < parserVersion) {
+                    changed = true;
+                    continue;
+                }
+                kept.push(`${basename}\t${version}`);
+                continue;
+            }
+            changed = true;
+            if (hasFrontmatterField(path.join(directory, basename), "resolved_participants"))
+                continue;
+            kept.push(`${basename}\t${parserVersion}`);
+        }
+        processed = kept.join("\n");
+        if (kept.length > 0)
+            processed += "\n";
+        if (changed)
+            rewriteIfChanged(ledger, original, processed);
+    }
+    let skipped = "";
+    if (fs.existsSync(skipLedger)) {
+        const original = fs.readFileSync(skipLedger, "utf8");
+        const kept = [];
+        let changed = false;
+        const rows = original.split("\n");
+        if (rows.at(-1) === "")
+            rows.pop();
+        for (const rawLine of rows) {
+            const fields = rawLine.split("\t");
+            const basename = fields[0] ?? "";
+            const reason = fields[1] ?? "";
+            const version = fields[2] ?? "";
+            if (!basename)
+                continue;
+            if (!version || (/^[+-]?\d+$/.test(version) && Number(version) < parserVersion)) {
+                changed = true;
+                continue;
+            }
+            kept.push(`${basename}\t${reason}\t${version}`);
+        }
+        skipped = kept.join("\n");
+        if (kept.length > 0)
+            skipped += "\n";
+        if (changed)
+            rewriteIfChanged(skipLedger, original, skipped);
+    }
+    const isProcessed = (basename) => processed.split("\n").some((line) => {
+        if (!line)
+            return false;
+        const [name, version] = line.split("\t");
+        if (name !== basename)
+            return false;
+        if (version === undefined || version === "")
+            return true;
+        return Number(version) >= parserVersion;
+    });
+    const isSkippedAtCurrentVersion = (basename) => skipped.split("\n").some((line) => {
+        if (!line)
+            return false;
+        const fields = line.split("\t");
+        return fields[0] === basename && fields[2] === String(parserVersion);
+    });
     const run = awkField(sourceFile, "run", false);
     const rule = awkField(sourceFile, "audience_rule", false);
     if (run === "cloud" && !force)
         return err(4, "assigned to cloud agent (run: cloud); pass --force to run locally\n");
-    const processed = fs.existsSync(ledger) ? fs.readFileSync(ledger, "utf8").split("\n") : [];
     const entries = fs.existsSync(directory)
         ? fs.readdirSync(directory).filter((name) => name.endsWith(".md") && !name.startsWith("."))
             .filter((name) => { try {
@@ -821,12 +925,12 @@ export function worklistCommand(args, root) {
     const output = [];
     let count = 0;
     for (const name of entries) {
-        if (processed.includes(name))
+        if (isProcessed(name) || isSkippedAtCurrentVersion(name))
             continue;
         if (/^[+-]?\d+$/.test(limit) && count >= Number(limit))
             break;
         if (!/^[+-]?\d+$/.test(limit)) {
-            process.stderr.write(`${resolveBundledAsset(`${ASSET}ontology-source-worklist.sh`)}: line 61: [: ${limit}: integer expression expected\n`);
+            process.stderr.write(`${resolveBundledAsset(`${ASSET}ontology-source-worklist.sh`)}: line 186: [: ${limit}: integer expression expected\n`);
         }
         count += 1;
         const file = path.join(directory, name);
@@ -860,6 +964,8 @@ export function worklistCommand(args, root) {
             }
         }
         if (!audience) {
+            fs.appendFileSync(skipLedger, `${name}\tno-audience\t${parserVersion}\n`);
+            skipped += `${name}\tno-audience\t${parserVersion}\n`;
             output.push(`${JSON.stringify({ file: relative, skip: "no-audience" })}\n`);
             continue;
         }

package/dist/commands/core-register-project-native.js

@@ -51,11 +51,44 @@ function companyUid(company, deps) {
         return direct;
     const file = path.join(deps.root, "companies", company, ".company-uid");
     try {
-        return deps.fs.readFileSync(file, "utf8").replace(/[\s\u0085\u00a0]+/g, "");
+        const fromFile = deps.fs.readFileSync(file, "utf8").replace(/[\s\u0085\u00a0]+/g, "");
+        if (fromFile)
+            return fromFile;
+    }
+    catch { /* shell falls through to companies/manifest.yaml */ }
+    const manifest = path.join(deps.root, "companies", "manifest.yaml");
+    let contents;
+    try {
+        contents = deps.fs.readFileSync(manifest, "utf8");
     }
     catch {
         return null;
     }
+    let inCompanies = false;
+    let inCompany = false;
+    for (const line of contents.split(/\r?\n/u)) {
+        if (/^companies:[\t ]*$/u.test(line)) {
+            inCompanies = true;
+            continue;
+        }
+        if (inCompanies && /^[^\t ]/u.test(line)) {
+            inCompanies = false;
+            inCompany = false;
+        }
+        if (inCompanies && /^ {2}[^ #][^:]*:/u.test(line)) {
+            const slug = line.trim().split(/[\t ]+/u, 1)[0]?.replace(/:$/u, "");
+            inCompany = slug === company;
+            continue;
+        }
+        if (inCompany && /^ {2}[^\t ]/u.test(line))
+            break;
+        if (inCompany) {
+            const fields = line.trim().split(/[\t ]+/u);
+            if (fields[0] === "cloud_uid:" && fields[1])
+                return fields[1].replace(/["']/gu, "").replace(/[\t ]+$/u, "");
+        }
+    }
+    return null;
 }
 function boardPath(company, deps) { return path.join(deps.root, "companies", company, "board.json"); }
 function runHelpProbe(deps) {
@@ -217,7 +250,7 @@ function audit(company, deps) {
                 return false;
             const uid = companyUid(company, deps);
             if (uid === null) {
-                stderr += `no company uid for ${company} (set HQ_COMPANY_UID or companies/${company}/.company-uid)\n`;
+                stderr += `no company uid for ${company} (set HQ_COMPANY_UID, companies/${company}/.company-uid, or manifest cloud_uid)\n`;
                 return true;
             }
             return !deps.fs.existsSync(path.join(deps.env.HOME || os.homedir(), ".hq/work-mesh/cache/projects", uid, `${project}.json`));
@@ -243,7 +276,7 @@ function storyNotDone(prd, deps, diagnostics) {
             diagnostics.push(jq.stderr);
         else if (jq.error?.code === "ENOENT") {
             const script = resolveBundledAsset(REGISTER_PROJECT_ASSET);
-            diagnostics.push(`${script}: line 34: jq: command not found\n`);
+            diagnostics.push(`${script}: line 65: jq: command not found\n`);
         }
         return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.19",
+  "version": "5.345.20",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {