@indigoai-us/hq-cli 5.345.191 → 5.345.193

package/dist/lib/signals/steps/adapters.js

@@ -0,0 +1,156 @@
+/**
+ * adapters step: one hot-channel sync per company through
+ * runCompanyHotChannelSync (src/commands/sources.ts), which wires
+ * runOnDemandSync from src/lib/hot-channels/run.ts with the gateway deps,
+ * sign-in check and sync lock. The adapters write under
+ * companies/{co}/sources/ and companies/{co}/signals/ themselves.
+ *
+ * US-008: core/settings/signals-adapters.yaml gates adapters locally (an
+ * adapter off there is skipped with reason flag-off and the rest run in one
+ * sync), and after the sync the signed-in person's vault cursors are mirrored
+ * to workspace/signals/watermarks/{co}/{cursorKey}.json through ctx.write.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { FLAG_OFF_REASON, gateAdapters, readSignalsAdaptersCatalog } from "../adapters-catalog.js";
+import { assertNoEscapingLinks } from "../write-guard.js";
+export const defaultHotChannelSync = async (input) => {
+    const { runCompanyHotChannelSync } = await import("../../../commands/sources.js");
+    return runCompanyHotChannelSync(input);
+};
+/** Adapters whose run record carries the token level (US-010). */
+const TOKEN_LEVEL_ADAPTERS = new Set(["attio", "gmail"]);
+export function mapSyncReport(report) {
+    if (report.signInRequired) {
+        return { status: "skipped", itemsIn: 0, itemsOut: 0, skippedReason: "no-login", byAdapter: {}, errorKind: "signed-out" };
+    }
+    if (report.skipped) {
+        return { status: "skipped", itemsIn: 0, itemsOut: 0, skippedReason: "sync-busy", byAdapter: {} };
+    }
+    const byAdapter = {};
+    const itemsInByAdapter = {};
+    const tokenLevels = {};
+    let itemsIn = 0;
+    let itemsOut = 0;
+    let ok = 0;
+    let failed = 0;
+    let reconnect = false;
+    for (const o of report.outcomes) {
+        byAdapter[o.adapter] = (byAdapter[o.adapter] ?? 0) + o.landed;
+        if (o.status !== "gated")
+            itemsInByAdapter[o.adapter] = (itemsInByAdapter[o.adapter] ?? 0) + o.landed + o.duplicates;
+        // A shared workspace token wins over a personal one when both ran.
+        if (o.tokenLevel && TOKEN_LEVEL_ADAPTERS.has(o.adapter) && tokenLevels[o.adapter] !== "workspace") {
+            tokenLevels[o.adapter] = o.tokenLevel;
+        }
+        itemsIn += o.landed + o.duplicates;
+        itemsOut += o.landed;
+        if (o.status === "ok")
+            ok += 1;
+        if (o.status === "failed")
+            failed += 1;
+        if (o.reconnect)
+            reconnect = true;
+    }
+    const result = { status: "ok", itemsIn, itemsOut, byAdapter };
+    if (Object.keys(itemsInByAdapter).length > 0)
+        result.itemsInByAdapter = itemsInByAdapter;
+    if (Object.keys(tokenLevels).length > 0)
+        result.tokenLevels = tokenLevels;
+    if (report.outcomes.length === 0) {
+        result.status = "skipped";
+        result.skippedReason = "no-channels";
+    }
+    else if (report.outcomes.every((o) => o.status === "gated")) {
+        result.status = "skipped";
+        result.skippedReason = FLAG_OFF_REASON;
+    }
+    else if (failed > 0) {
+        result.status = ok > 0 ? "partial" : "failed";
+        const first = report.outcomes.find((o) => o.status === "failed");
+        result.error = first?.message ?? "adapter failed";
+        result.errorKind = reconnect ? "reconnect" : "other";
+    }
+    else if (reconnect) {
+        result.errorKind = "reconnect";
+    }
+    return result;
+}
+async function builtinAdapterIds(hqRoot, company) {
+    const { createBuiltinHotChannelRegistry } = await import("../../hot-channels/adapters/index.js");
+    return createBuiltinHotChannelRegistry({ vaultRoot: path.join(hqRoot, "companies", company) })
+        .list()
+        .map((a) => a.id);
+}
+/**
+ * Mirror the signed-in person's vault cursors
+ * (`companies/{co}/sources/_cursors/@{personKey}/{key}.json`, written by the
+ * loop only after a page's sources land) to the local watermark
+ * `workspace/signals/watermarks/{co}/{key}.json`. Teammates' cursor
+ * directories are never read: their watermarks are not this machine's.
+ */
+export function mirrorWatermarks(ctx, personKey) {
+    const personDir = path.join(ctx.hqRoot, "companies", ctx.company, "sources", "_cursors", `@${personKey}`);
+    let files;
+    try {
+        files = fs.readdirSync(personDir).filter((f) => f.endsWith(".json")).sort();
+    }
+    catch {
+        return [];
+    }
+    const written = [];
+    for (const file of files) {
+        const text = fs.readFileSync(path.join(personDir, file), "utf8");
+        try {
+            JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        const rel = `workspace/signals/watermarks/${ctx.company}/${file}`;
+        ctx.write(rel, text.endsWith("\n") ? text : `${text}\n`);
+        written.push(rel);
+    }
+    return written;
+}
+export const adaptersStep = {
+    name: "adapters",
+    async run(ctx) {
+        // The hot-channel loop writes cursors, ledgers, locks, raw payloads and
+        // landed sources under companies/{co}/sources/, and the signals pass writes
+        // under companies/{co}/signals/, with plain fs. Fail closed before it runs
+        // if any link in either tree leaves this company's folder for that root.
+        for (const store of ["sources", "signals"]) {
+            assertNoEscapingLinks(ctx.hqRoot, `companies/${ctx.company}/${store}`, { company: ctx.company });
+        }
+        const sync = ctx.hotChannelSync ?? defaultHotChannelSync;
+        const ids = ctx.registeredAdapterIds ?? (await builtinAdapterIds(ctx.hqRoot, ctx.company));
+        const gating = await gateAdapters(ids, readSignalsAdaptersCatalog(ctx.hqRoot), ctx.isFlagOn);
+        const skipped = Object.keys(gating.skips).length > 0;
+        if (skipped && gating.enabled.length === 0) {
+            return { status: "skipped", itemsIn: 0, itemsOut: 0, skippedReason: FLAG_OFF_REASON, byAdapter: {}, adapterSkips: gating.skips };
+        }
+        const base = {
+            hqRoot: ctx.hqRoot,
+            company: ctx.company,
+            now: ctx.now,
+            trigger: ctx.trigger === "job" ? "scheduled" : "on-demand",
+            catchUp: ctx.catchUp,
+            ...(ctx.isFlagOn ? { isFlagOn: ctx.isFlagOn } : {}),
+        };
+        // One sync for the enabled list: an enabled adapter the hq-pro catalog
+        // does not list just has nothing to run, instead of failing the step.
+        const report = await sync(skipped ? { ...base, onlyAdapters: gating.enabled } : base);
+        const result = mapSyncReport(report);
+        const adapterSkips = { ...gating.skips };
+        for (const o of report.outcomes)
+            if (o.status === "gated")
+                adapterSkips[o.adapter] = FLAG_OFF_REASON;
+        if (Object.keys(adapterSkips).length > 0)
+            result.adapterSkips = adapterSkips;
+        if (!report.signInRequired && !report.skipped && report.personKey)
+            mirrorWatermarks(ctx, report.personKey);
+        return result;
+    },
+};
+//# sourceMappingURL=adapters.js.map

package/dist/lib/signals/steps/entity-similarity.d.ts

@@ -0,0 +1,10 @@
+/** Name similarity for the garden step's merge-review queue. */
+/** Lowercase, strip accents and punctuation, collapse whitespace. */
+export declare function canonicalName(s: string): string;
+/** Normalized Levenshtein similarity on canonical names, 0..1. */
+export declare function nameSimilarity(a: string, b: string): number;
+export declare const REVIEW_LOW = 0.8;
+export declare const SAME_ENTITY = 0.95;
+export type SimilarityBand = "distinct" | "uncertain" | "same";
+export declare function similarityBand(sim: number): SimilarityBand;
+//# sourceMappingURL=entity-similarity.d.ts.map

package/dist/lib/signals/steps/entity-similarity.js

@@ -0,0 +1,47 @@
+/** Name similarity for the garden step's merge-review queue. */
+/** Lowercase, strip accents and punctuation, collapse whitespace. */
+export function canonicalName(s) {
+    return s
+        .normalize("NFKD")
+        .replace(/[̀-ͯ]/g, "")
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, " ")
+        .trim();
+}
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (!a.length)
+        return b.length;
+    if (!b.length)
+        return a.length;
+    let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        const cur = [i];
+        for (let j = 1; j <= b.length; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            cur.push(Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost));
+        }
+        prev = cur;
+    }
+    return prev[b.length];
+}
+/** Normalized Levenshtein similarity on canonical names, 0..1. */
+export function nameSimilarity(a, b) {
+    const x = canonicalName(a);
+    const y = canonicalName(b);
+    if (!x && !y)
+        return 1;
+    const max = Math.max(x.length, y.length);
+    return 1 - levenshtein(x, y) / max;
+}
+export const REVIEW_LOW = 0.8;
+export const SAME_ENTITY = 0.95;
+export function similarityBand(sim) {
+    if (sim >= SAME_ENTITY)
+        return "same";
+    if (sim >= REVIEW_LOW)
+        return "uncertain";
+    return "distinct";
+}
+//# sourceMappingURL=entity-similarity.js.map

package/dist/lib/signals/steps/extract.d.ts

@@ -0,0 +1,113 @@
+import { type BotRuntimeId } from "../../bot/config.js";
+import type { SignalsStep } from "./types.js";
+export declare const EXTRACT_SIGNAL_TYPES: readonly ["action_item", "commitment", "decision", "risk", "question", "key_point", "participant_contribution", "summary"];
+export declare const DEFAULT_WORKLIST_LIMIT = 20;
+export declare const DEFAULT_TURN_TIMEOUT_MS: number;
+export declare const CODEX_PERMISSION_PROFILE = "hq_signals_extract";
+export declare const CANDIDATE_WRAPPER_NAME = "write-candidate.sh";
+/** The only tools a claude turn may use: Read inside the channel folder and the pinned wrapper. */
+export declare function claudeAllowedTools(channelDir: string, wrapperPath: string): string[];
+export interface ExtractStepOptions {
+    /** Runtime when no main local bot config is found. Default claude. */
+    runtime?: BotRuntimeId;
+    /** Returns the main local bot's runtime, or null. Default reads ~/.hq/bots. */
+    resolveBotRuntime?: () => BotRuntimeId | null;
+    claudeBin?: string;
+    codexBin?: string;
+    worklistLimit?: number;
+    turnTimeoutMs?: number;
+    /** Run channels whose source.yaml says run: cloud too (passes --force). */
+    force?: boolean;
+}
+interface SourceChannel {
+    channel: string;
+    force: boolean;
+}
+interface WorkItem {
+    file: string;
+    audience_key?: string;
+    audience?: string[];
+    skip?: string;
+}
+/** First personal bot under ~/.hq/bots (by name) with a readable config. */
+export declare function defaultResolveBotRuntime(root?: string): BotRuntimeId | null;
+/** Declared source channels with run: local (or any run: when forced). */
+export declare function listSourceChannels(hqRoot: string, company: string, force?: boolean): SourceChannel[];
+/** Shell single-quote a value so a generated script carries it as data. */
+export declare function shellQuote(value: string): string;
+/**
+ * Refuse a worklist item whose path or audience could break out of the prompt
+ * or the channel folder. Returns the reason, or null when the item is safe.
+ */
+export declare function unsafeItemReason(item: WorkItem, channel: string): string | null;
+export declare function buildExtractPrompt(input: {
+    skillText: string;
+    company: string;
+    channel: string;
+    item: WorkItem;
+    itemPath: string;
+    wrapperPath: string;
+    /** codex has no Read tool; it reads with shell commands inside its sandbox. */
+    runtime?: "claude" | "codex";
+}): string;
+/**
+ * The per-item candidate command. It pins --company, --audience and
+ * --source-ref (a repeated flag must match the pinned value), refuses
+ * --body-file and any other flag, and calls ontology-candidate.sh write.
+ */
+export declare function buildCandidateWrapper(input: {
+    hqRoot: string;
+    company: string;
+    audience: string;
+    sourceRef: string;
+}): string;
+/** Parse a stream-json transcript (or a codex --json event stream). */
+export declare function parseTurnOutput(stdout: string): {
+    result: Record<string, unknown> | null;
+    turns: number;
+    costUsd: number;
+};
+/**
+ * Clean up the new candidate files a turn produced.
+ *
+ * With `scope`, only this item's files are touched: a file is this item's when
+ * its source_ref is the wrapper-pinned `scope.sourceRef`. Every other new file
+ * (another company's garden or extract, a /meeting-notes session, another
+ * source, garden moving a candidate into _done/) is left as it is and not
+ * counted.
+ * - In companies/<company>/: this item's file is kept when it conforms and
+ *   deleted when it does not.
+ * - In another company: this item's file is deleted and listed under `foreign`,
+ *   unless that company has its own source item with the same channel and file
+ *   name (then the file is that company's candidate, not a leak).
+ * Every delete goes through the company-scoped write guard.
+ */
+export declare function validateNewCandidates(files: string[], expectedAudienceKey: string | undefined, scope: {
+    hqRoot: string;
+    company: string;
+    sourceRef: string;
+}): {
+    kept: number;
+    rejected: number;
+    foreign: string[];
+};
+/** Paths a turn may touch, all resolved through symlinks. */
+export interface TurnScope {
+    hqRoot: string;
+    company: string;
+    /** companies/{co}/sources/{channel}, realpath. */
+    channelDir: string;
+    /** The turn's temp cwd holding the wrapper, realpath. */
+    turnDir: string;
+    wrapperPath: string;
+    /** companies/{co}/{signals,ontology}/_candidates, realpath. */
+    candidateDirs: string[];
+}
+/** TOML inline table for the codex permission profile's filesystem entries. */
+export declare function codexFilesystemProfile(scope: TurnScope, codexBin: string, envPath: string | undefined): string;
+export declare function claudeTurnArgs(prompt: string, scope: TurnScope, maxTurns: number, budgetUsd: number): string[];
+export declare function codexTurnArgs(prompt: string, scope: TurnScope, codexBin: string, envPath: string | undefined): string[];
+export declare function createExtractStep(options?: ExtractStepOptions): SignalsStep;
+export declare const extractStep: SignalsStep;
+export {};
+//# sourceMappingURL=extract.d.ts.map