@indigoai-us/hq-cli 5.345.22 → 5.345.24

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [5.345.24] — 2026-10-06
+- Keep native core ontology, delegate-secret, share-suggestion-state, and trusted-bind behavior aligned with their scaffold scripts.
+
+## [5.345.23] — 2026-10-06
+- Route eight additional isolated native core commands through the fast CLI entry.
+- hqd applies the runtime kill switch to new hook and MCP operations within the existing 60-second freshness bound. A local opt-out also disables the daemon, while a local opt-in cannot override an operator-off value.
+
 ## [5.345.22] — 2026-10-06
 - Fix Claude quota holds so time-only reset messages keep accounts unavailable until the provider's stated UTC reset, and expose the hold state in host capacity output.
 

package/assets/scaffold/core/scripts/ontology-garden.mjs

@@ -158,6 +158,12 @@ function listCandidates(dir) {
 
 function main() {
   const a = parseArgs(process.argv.slice(2));
+  const backrefThreshold = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+  const backrefKeepInline = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+  if (!(backrefThreshold > backrefKeepInline)) {
+    console.error(`ontology-garden: BACKREF_THRESHOLD (${backrefThreshold}) must be greater than BACKREF_KEEP_INLINE (${backrefKeepInline})`);
+    process.exit(1);
+  }
   const co = path.join(a.root, "companies", a.company);
   if (!fs.existsSync(co)) { console.error(`ontology-garden: no company ${a.company}`); process.exit(2); }
   const ont = path.join(co, "ontology"), sig = path.join(co, "signals");

package/dist/commands/core-audit-log-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runAuditLogFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-audit-log-fast.d.ts.map

package/dist/commands/core-audit-log-fast.js

@@ -0,0 +1,12 @@
+import { runAuditLog } from "./core-audit-log-native.js";
+export function runAuditLogFast(args, _stdin, _cwd, hqRoot) {
+    const result = runAuditLog(args, { root: hqRoot ?? process.cwd(), now: () => new Date() });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-audit-log-fast.js.map

package/dist/commands/core-delegate.d.ts

@@ -41,6 +41,7 @@ export declare function requireRecord(value: unknown, property: string): JsonRec
 export declare function moveFile(source: string, target: string): void;
 export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean): void;
 export declare function delegateDiagnosticPath(argument: string): string;
+export declare function scanSecretFiles(file: string): string[] | undefined;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runDelegateFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 /** Register the Wave 1a delegate commands and preserve the shell rollback path. */

package/dist/commands/core-delegate.js

@@ -703,7 +703,7 @@ function runRepo(args, context) {
     writeOut(`${prefix} recorded branch state (pushed=${pushed}, dirty=${dirtyLines.length} files, accessVerified=${accessVerified})\n`);
     return 0;
 }
-function scanSecretFiles(file) {
+export function scanSecretFiles(file) {
     let schema;
     try {
         schema = fs.readFileSync(file, "utf8");
@@ -715,7 +715,7 @@ function scanSecretFiles(file) {
         throw error;
     }
     return [...new Set(schema.split(/\r?\n/)
-            .filter((line) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(line))
+            .filter((line) => /^[A-Z][A-Z0-9_]*(\/[A-Z][A-Z0-9_]+)*=/.test(line))
             .map((line) => line.slice(0, line.indexOf("="))))].sort();
 }
 function isRegularFile(file) {

package/dist/commands/core-detect-stale-core-policy-mirror-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetectStaleCorePolicyMirrorFast(args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.d.ts.map

package/dist/commands/core-detect-stale-core-policy-mirror-fast.js

@@ -0,0 +1,5 @@
+import { detectStaleCorePolicyMirror } from "../lib/core-utils/detect-stale-core-policy-mirror.js";
+export function runDetectStaleCorePolicyMirrorFast(args, _stdin, _cwd, hqRoot) {
+    return detectStaleCorePolicyMirror(args, { root: hqRoot ?? process.cwd() });
+}
+//# sourceMappingURL=core-detect-stale-core-policy-mirror-fast.js.map

package/dist/commands/core-dm-bind-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runDmBindFast(args: string[], stdin: string, cwd: string, hqRoot?: string): Promise<number>;
+//# sourceMappingURL=core-dm-bind-fast.d.ts.map

package/dist/commands/core-dm-bind-fast.js

@@ -0,0 +1,14 @@
+import { createDmBindDeps, runDmBind } from "./core-dm-bind-native.js";
+export async function runDmBindFast(args, stdin, cwd, hqRoot) {
+    const deps = createDmBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date());
+    deps.readStdin = async () => stdin;
+    const result = await runDmBind(args, deps);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-dm-bind-fast.js.map

package/dist/commands/core-generate-workers-registry-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGenerateWorkersRegistryFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-generate-workers-registry-fast.d.ts.map

package/dist/commands/core-generate-workers-registry-fast.js

@@ -0,0 +1,5 @@
+import { generateWorkersRegistry } from "../lib/workers-registry/index.js";
+export function runGenerateWorkersRegistryFast(_args, _stdin, _cwd, hqRoot) {
+    return generateWorkersRegistry(hqRoot ?? process.cwd()).status;
+}
+//# sourceMappingURL=core-generate-workers-registry-fast.js.map

package/dist/commands/core-git-pack-extension-check-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runGitPackExtensionCheckFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-git-pack-extension-check-fast.d.ts.map

package/dist/commands/core-git-pack-extension-check-fast.js

@@ -0,0 +1,12 @@
+import { runGitPackExtensionCheck } from "./core-git-pack-extension-check-native.js";
+export function runGitPackExtensionCheckFast(args, _stdin, cwd) {
+    const result = runGitPackExtensionCheck(args, { cwd, env: process.env });
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-git-pack-extension-check-fast.js.map

package/dist/commands/core-ontology-native.js

@@ -397,6 +397,52 @@ function writeGardenDoc(file, fm, body, dryRun) {
     fs.writeFileSync(`${file}.tmp`, lines.join("\n"));
     fs.renameSync(`${file}.tmp`, file);
 }
+const BACKREF_SUMMARY_MARKER = "<!-- backref-archive -->";
+function readGardenArchiveIndex(file) {
+    if (!fs.existsSync(file))
+        return { signalIds: [], unreadable: false, stderr: "" };
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && Array.isArray(parsed.signalIds)) {
+            return {
+                signalIds: (parsed.signalIds).filter((item) => typeof item === "string"),
+                unreadable: false,
+                stderr: "",
+            };
+        }
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return { signalIds: [], unreadable: true, stderr: `ontology-garden: archive index unreadable at ${file}: ${detail}; skipping compaction\n` };
+    }
+    return { signalIds: [], unreadable: true, stderr: "" };
+}
+function compactGardenFactBody(body, slug, threshold, keepInline, archivedTotalBefore) {
+    const lines = body.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0);
+    const isBackref = (line) => /^- \[[a-z_]+\] .+ \(signal [0-9a-f]{12}\)\s*$/.test(line);
+    const backrefLines = lines.filter(isBackref);
+    const other = lines.filter((line) => !isBackref(line) && !line.includes(BACKREF_SUMMARY_MARKER));
+    if (backrefLines.length <= threshold)
+        return { body, archivedLines: [], archivedIds: [], stamp: "", changed: false };
+    const archiveCount = backrefLines.length - keepInline;
+    const archivedLines = backrefLines.slice(0, archiveCount);
+    const inlineLines = backrefLines.slice(archiveCount);
+    const archivedIds = archivedLines.map((line) => line.match(/\(signal ([0-9a-f]{12})\)$/)?.[1]).filter((id) => Boolean(id));
+    const total = archivedTotalBefore + archivedLines.length;
+    const stamp = new Date().toISOString().slice(0, 7);
+    const summary = `- ${BACKREF_SUMMARY_MARKER} _${total} older mention${total === 1 ? "" : "s"} archived in [history](./${slug}.history/${stamp}.md)_`;
+    return { body: [summary, ...other, ...inlineLines].join("\n"), archivedLines, archivedIds, stamp, changed: true };
+}
+function appendGardenArchive(file, isoDate, lines, dryRun) {
+    if (dryRun)
+        return;
+    const batch = `\n<!-- archived ${isoDate} -->\n${lines.join("\n")}\n`;
+    const previous = fs.existsSync(file) ? fs.readFileSync(file, "utf8").replace(/\s+$/, "") : "";
+    const next = previous ? `${previous}\n${batch}` : `# Back-reference archive\n${batch}`;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(`${file}.tmp`, next);
+    fs.renameSync(`${file}.tmp`, file);
+}
 const slugify = (value) => value.toLowerCase().normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 const isoNow = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 function listCandidates(directory) {
@@ -436,6 +482,11 @@ export function gardenCommand(args, defaultRoot) {
     }
     if (!company)
         return err(2, "usage: ontology-garden.mjs --company <co> [--hq-root <p>] [--dry-run] [--json]\n");
+    const threshold = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+    const keepInline = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+    if (!(threshold > keepInline)) {
+        return err(1, `ontology-garden: BACKREF_THRESHOLD (${threshold}) must be greater than BACKREF_KEEP_INLINE (${keepInline})\n`);
+    }
     const hqRoot = root || process.env.HQ_ROOT || defaultRoot;
     const companyDir = path.join(hqRoot, "companies", company);
     if (!fs.existsSync(companyDir))
@@ -445,6 +496,7 @@ export function gardenCommand(args, defaultRoot) {
     const report = { company, entities_created: 0, entities_updated: 0, signals_promoted: 0, facts_written: 0, rejected: 0, candidates_processed: 0, dry_run: dryRun };
     const rejected = [];
     const moves = [];
+    let stderr = "";
     const entities = new Map();
     const nameIndex = new Map();
     const entityDirectory = path.join(ontology, "entities");
@@ -563,8 +615,24 @@ export function gardenCommand(args, defaultRoot) {
                 const previous = fs.existsSync(factFile)
                     ? readGardenDoc(factFile)
                     : { fm: { entity: slug, type: entity.type, audience_key: key }, body: "" };
-                if (!previous.body.includes(`signal ${id.slice(0, 12)}`)) {
-                    writeGardenDoc(factFile, previous.fm, [previous.body, line].filter(Boolean).join("\n"), dryRun);
+                const indexFile = path.join(path.dirname(factFile), `${slug}.history`, "_index.json");
+                const archiveIndex = readGardenArchiveIndex(indexFile);
+                stderr += archiveIndex.stderr;
+                const signalId = id.slice(0, 12);
+                if (!previous.body.includes(`signal ${signalId}`) && !archiveIndex.signalIds.includes(signalId)) {
+                    let nextBody = [previous.body, line].filter(Boolean).join("\n");
+                    const compact = compactGardenFactBody(nextBody, slug, threshold, keepInline, archiveIndex.signalIds.length);
+                    if (compact.changed && !archiveIndex.unreadable) {
+                        const archiveFile = path.join(path.dirname(factFile), `${slug}.history`, `${compact.stamp}.md`);
+                        appendGardenArchive(archiveFile, new Date().toISOString().slice(0, 10), compact.archivedLines, dryRun);
+                        if (!dryRun) {
+                            const nextIndex = { version: 1, signalIds: [...archiveIndex.signalIds, ...compact.archivedIds] };
+                            fs.mkdirSync(path.dirname(indexFile), { recursive: true });
+                            fs.writeFileSync(indexFile, `${JSON.stringify(nextIndex)}\n`);
+                        }
+                        nextBody = compact.body;
+                    }
+                    writeGardenDoc(factFile, previous.fm, nextBody, dryRun);
                     report.facts_written += 1;
                 }
                 if (key === "company") {
@@ -598,9 +666,9 @@ export function gardenCommand(args, defaultRoot) {
             fs.writeFileSync(path.join(ontology, ".last-run"), `${Date.now()}\n`);
         }
     }
-    return ok(json
-        ? `${JSON.stringify(report)}\n`
-        : `garden ${company}: +${report.entities_created} entities, ~${report.entities_updated} updated, +${report.signals_promoted} signals, +${report.facts_written} facts, ${report.rejected} rejected, ${report.candidates_processed} candidates${dryRun ? " (dry run)" : ""}\n`);
+    return { code: 0, stdout: json
+            ? `${JSON.stringify(report)}\n`
+            : `garden ${company}: +${report.entities_created} entities, ~${report.entities_updated} updated, +${report.signals_promoted} signals, +${report.facts_written} facts, ${report.rejected} rejected, ${report.candidates_processed} candidates${dryRun ? " (dry run)" : ""}\n`, stderr };
 }
 export function audienceGrant(args, root) {
     let company = "";

package/dist/commands/core-refresh-vault-access-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runRefreshVaultAccessFast(args: string[], _stdin: string, cwd: string): number;
+//# sourceMappingURL=core-refresh-vault-access-fast.d.ts.map

package/dist/commands/core-refresh-vault-access-fast.js

@@ -0,0 +1,12 @@
+import { createRefreshVaultAccessDependencies, runRefreshVaultAccess } from "./core-refresh-vault-access-native.js";
+export function runRefreshVaultAccessFast(args, _stdin, cwd) {
+    const result = runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-refresh-vault-access-fast.js.map

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -15,6 +15,7 @@ export type RefreshVaultAccessDependencies = {
     hqAvailable: boolean;
     runHq?: (args: string[], cwd: string) => HqResult;
 };
+export declare function createRefreshVaultAccessDependencies(cwd: string, env: NodeJS.ProcessEnv, now: () => Date): RefreshVaultAccessDependencies;
 export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
 export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
 //# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -59,6 +59,15 @@ function executableOnPath(name, value) {
     }
     return false;
 }
+export function createRefreshVaultAccessDependencies(cwd, env, now) {
+    return {
+        cwd,
+        env,
+        now,
+        hqAvailable: executableOnPath("hq", env.PATH),
+        runHq: (args, directory) => defaultHq(args, directory, env),
+    };
+}
 function isHqRoot(root) {
     const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
     if (!candidate)
@@ -219,11 +228,7 @@ export function registerCoreRefreshVaultAccessNative(core) {
     registerNativeUtility(core, {
         name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
         resolveRoot: (cwd) => cwd,
-        run: (args, context) => runRefreshVaultAccess(args, {
-            cwd: context.cwd, env: context.env, now: context.now,
-            hqAvailable: executableOnPath("hq", context.env.PATH),
-            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
-        }),
+        run: (args, context) => runRefreshVaultAccess(args, createRefreshVaultAccessDependencies(context.cwd, context.env, context.now)),
     });
 }
 //# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core-scan-packages-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runScanPackagesFast(_args: string[], _stdin: string, _cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-scan-packages-fast.d.ts.map

package/dist/commands/core-scan-packages-fast.js

@@ -0,0 +1,5 @@
+import { scanPackages } from "../lib/scan-packages/index.js";
+export function runScanPackagesFast(_args, _stdin, _cwd, hqRoot) {
+    return scanPackages(hqRoot ?? process.cwd(), { quiet: process.env.HQ_SCAN_QUIET === "1" }).status;
+}
+//# sourceMappingURL=core-scan-packages-fast.js.map

package/dist/commands/core-share-suggestion-state-native.js

@@ -209,8 +209,14 @@ export function runShareSuggestionState(args, stdin, deps) {
         try {
             return JSON.parse(f.readFileSync(file, "utf8"));
         }
-        catch {
-            return fallback;
+        catch (cause) {
+            const failure = new Error("share-suggestion-state JSON read failed");
+            failure.name = "ShareSuggestionStateReadError";
+            Object.assign(failure, {
+                shareSuggestionStateReadPath: file,
+                shareSuggestionStateCauseName: cause instanceof Error && cause.name ? cause.name : "Error",
+            });
+            throw failure;
         }
     };
     const writeJson = (file, value) => {
@@ -454,6 +460,17 @@ export function runShareSuggestionState(args, stdin, deps) {
         return { code: 0, stdout: "", stderr: "" };
     }
     catch (error) {
+        if (error instanceof Error && "shareSuggestionStateReadPath" in error) {
+            const failure = error;
+            const readPath = platform === "win32"
+                ? path.win32.resolve(failure.shareSuggestionStateReadPath).replaceAll("\\", "/")
+                : failure.shareSuggestionStateReadPath;
+            return {
+                code: 3,
+                stdout: "",
+                stderr: `share-suggestion-state: unable to read ${readPath} (${failure.shareSuggestionStateCauseName})\n`,
+            };
+        }
         const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
         return { code: 0, stdout: "", stderr: `share-suggestion-state: internal error\n${detail}\n` };
     }

package/dist/commands/core-work-mesh-bind-trusted-fast.d.ts

@@ -0,0 +1,2 @@
+export declare function runWorkMeshBindTrustedFast(args: string[], _stdin: string, cwd: string, hqRoot?: string): number;
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-fast.js

@@ -0,0 +1,12 @@
+import { createWorkMeshBindDeps, runWorkMeshBindTrusted } from "./core-work-mesh-bind-trusted-native.js";
+export function runWorkMeshBindTrustedFast(args, _stdin, cwd, hqRoot) {
+    const result = runWorkMeshBindTrusted(args, createWorkMeshBindDeps(hqRoot ?? cwd, cwd, process.env, () => new Date()));
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderrBytes)
+        process.stderr.write(result.stderrBytes);
+    else if (result.stderr)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-fast.js.map

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -15,6 +15,7 @@ export type WorkMeshBindDeps = {
         stdout: string;
         stderr: string;
     };
+    daemonWarningEnabled: boolean;
     runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
         code: number;
         stdout: string;
@@ -25,8 +26,27 @@ export type WorkMeshBindDeps = {
     tmpDir: string;
     ulid: (now: Date) => string;
 };
-export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date, daemonWarningEnabled?: boolean) => WorkMeshBindDeps;
+type DetachedSpawnOptions = {
+    cwd: string;
+    root: string;
+    env: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    existsSync?: (candidate: string) => boolean;
+    spawnProcess?: (command: string, args: string[], options: {
+        cwd: string;
+        env: NodeJS.ProcessEnv;
+        detached: boolean;
+        stdio: "ignore";
+        shell: boolean;
+        windowsVerbatimArguments?: boolean;
+    }) => {
+        unref: () => void;
+    };
+};
+export declare function spawnWorkMeshHqDetached(args: string[], options: DetachedSpawnOptions): void;
 export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
 export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
 export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+export {};
 //# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -2,10 +2,13 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 import { registerNativeUtility } from "./core-native-utilities.js";
 export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+const WORK_MESH_DAEMON_WARNING_FLAG = "hooks.work-mesh-daemon-not-loaded-warning";
 export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
 US-011 — write session meta + reconcile with observation.trustedContext.
 No --trusted CLI flag in hq-cli; trusted bind is the observation field.
@@ -14,21 +17,61 @@ set -euo pipefail
 ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
 if [ -z "$ROOT" ]; then
 `;
-export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+export const createWorkMeshBindDeps = (root, cwd, env, now, daemonWarningEnabled = false) => ({
     root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    daemonWarningEnabled: daemonWarningEnabled
+        && Boolean(env.HQ_FLAGS_API_URL?.trim())
+        && /^cmp_[A-Za-z0-9]{3,128}$/.test(env.HQ_COMPANY_UID?.trim() ?? ""),
     runHq: (args, childEnv) => {
-        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        const executable = "hq";
+        const resolvedExecutable = process.platform === "win32"
+            ? resolveWindowsExecutable(executable, childEnv, (candidate) => {
+                try {
+                    return fs.statSync(candidate).isFile();
+                }
+                catch {
+                    return false;
+                }
+            }, cwd) ?? executable
+            : executable;
+        const plan = planResolvedCommandSpawn(resolvedExecutable, args, childEnv);
+        const result = spawnSync(plan.cmd, plan.args, {
+            cwd,
+            env: { ...childEnv, HQ_ROOT: root },
+            encoding: "utf8",
+            shell: plan.shell,
+            ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+            timeout: 2_000,
+        });
         return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
     },
     runHqSession: (scriptRoot, args, childEnv) => {
         const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
         return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
     },
-    spawnHq: (args, childEnv) => {
-        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
-        child.unref();
-    },
+    spawnHq: (args, childEnv) => spawnWorkMeshHqDetached(args, {
+        cwd,
+        root,
+        env: childEnv,
+    }),
 });
+export function spawnWorkMeshHqDetached(args, options) {
+    const platform = options.platform ?? process.platform;
+    const childEnv = { ...options.env, HQ_ROOT: options.root };
+    const executable = platform === "win32"
+        ? resolveWindowsExecutable("hq", childEnv, options.existsSync ?? fs.existsSync, options.cwd) ?? "hq"
+        : "hq";
+    const plan = planResolvedCommandSpawn(executable, args, childEnv, platform);
+    const child = (options.spawnProcess ?? spawn)(plan.cmd, plan.args, {
+        cwd: options.cwd,
+        env: childEnv,
+        detached: true,
+        stdio: "ignore",
+        shell: plan.shell,
+        ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
+    child.unref();
+}
 export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
     for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
         const value = (env[key] ?? "").replace(/\s/g, "");
@@ -44,6 +87,16 @@ export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
     }
 }
 function hasExecutable(deps, command) {
+    if (process.platform === "win32") {
+        return Boolean(resolveWindowsExecutable(command, deps.env, (candidate) => {
+            try {
+                return deps.fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        }, deps.cwd));
+    }
     for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
@@ -175,6 +228,21 @@ export function runWorkMeshBindTrusted(args, deps) {
     }
     if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
         return { code: 0, stdout: output.join(""), stderr };
+    if (deps.daemonWarningEnabled && hasExecutable(deps, "hq")) {
+        const status = deps.runHq(["mesh", "daemon", "status", "--json"], { ...deps.env, HQ_NO_UPDATE_CHECK: "1" });
+        if (status.code === 0) {
+            try {
+                const parsed = JSON.parse(status.stdout);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    const daemon = parsed;
+                    if (daemon.ok === true && daemon.running === false && typeof daemon.message === "string" && daemon.message.includes("installed (")) {
+                        stderr += "Work Mesh daemon is installed but not loaded; start it with: hq mesh daemon install\n";
+                    }
+                }
+            }
+            catch { /* the shell's jq test fails quiet on invalid status JSON */ }
+        }
+    }
     if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
         deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
     }
@@ -184,7 +252,11 @@ export function registerCoreWorkMeshBindTrustedNative(core) {
     registerNativeUtility(core, {
         name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
         resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
-        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+        run: async (args, context) => {
+            const { fastFlagEnabled } = await import("../native-fast-route.js");
+            const daemonWarningEnabled = await fastFlagEnabled(WORK_MESH_DAEMON_WARNING_FLAG, context.env);
+            return runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now, daemonWarningEnabled));
+        },
     });
 }
 //# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map

package/dist/fast-core.js

@@ -65,7 +65,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         worktreeScopeFixEnabled = await coreRrrWorktreeScopeFixFastFlagEnabled(process.env);
     }
     const shouldInjectRoot = useShell
-        ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
+        ? entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
             !parsed.args.includes("--hq-root") && !parsed.args.includes("--help") && !parsed.args.includes("-h"))
         : entry.kind === "shell"
             ? true
@@ -76,7 +76,10 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
     // its expected-user-error formatting remains authoritative.
     let hqRoot;
     const rootResolutionStartedAt = profileMark();
-    if (shouldInjectRoot) {
+    if (useShell && entry.kind === "native" && entry.shellHqRoot === "cwd") {
+        hqRoot = process.cwd();
+    }
+    else if (shouldInjectRoot) {
         const shortcutRoot = entry.name === "checkpoint-stop-gate" || entry.name === "session-journal"
             ? resolveExplicitFastLiveRoot(parsed.hqRootArg, process.env)
             : undefined;
@@ -146,7 +149,7 @@ export async function runFastCore(argv, parsed = parseFastCore(argv)) {
         ? hqRoot ?? process.cwd()
         : process.cwd();
     const injectRoot = entry.kind === "shell" || entry.kind === "native" &&
-        (entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
+        (entry.shellHqRoot === "cwd" || entry.shellHqRoot === "live" || entry.shellHqRoot === "reconcile-default" && shouldInjectRoot);
     const childEnv = {
         ...(entry.name === "hq-session" ? { HQ_HQ_SESSION_NO_CLI: "1" } : {}),
         ...(entry.name === "migrate-policy-triggers"

package/dist/fast-scaffold.d.ts

@@ -39,7 +39,7 @@ export type FastScaffoldScript = {
     /** Cwd used for a shell rollback companion. Defaults to the caller cwd. */
     shellCwd?: "caller" | "live";
     /** Root injection behavior for a shell rollback companion. */
-    shellHqRoot?: "none" | "live" | "reconcile-default";
+    shellHqRoot?: "none" | "cwd" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
     /** Bound bytes buffered from stdin; overflow is treated as empty input. */

package/dist/fast-scaffold.js

@@ -432,6 +432,107 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         shellCwd: "caller",
         shellHqRoot: name === "source-yaml-validate" ? "none" : "live",
     })),
+    {
+        name: "audit-log",
+        kind: "native",
+        modulePath: "./commands/core-audit-log-fast.js",
+        exportName: "runAuditLogFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/audit-log.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+    },
+    {
+        name: "refresh-vault-access",
+        kind: "native",
+        modulePath: "./commands/core-refresh-vault-access-fast.js",
+        exportName: "runRefreshVaultAccessFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/refresh-vault-access.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "generate-workers-registry",
+        kind: "native",
+        modulePath: "./commands/core-generate-workers-registry-fast.js",
+        exportName: "runGenerateWorkersRegistryFast",
+        flagKey: "hq-core-native-fast-route",
+        root: "live",
+        asset: "core/scripts/generate-workers-registry.sh",
+    },
+    {
+        name: "dm-bind",
+        kind: "native",
+        modulePath: "./commands/core-dm-bind-fast.js",
+        exportName: "runDmBindFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/hq-dm-bind.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        readsStdinFor: (args) => {
+            if (args[0] !== "post")
+                return false;
+            const valueOptions = new Set(["--topic", "--under", "--to", "--title", "--state", "--line", "--next", "--ask"]);
+            for (let index = 1; index < args.length; index += 1) {
+                if (args[index] === "-")
+                    return true;
+                if (valueOptions.has(args[index] ?? ""))
+                    index += 1;
+            }
+            return false;
+        },
+        requiresNodeNetworkCompatibility: true,
+    },
+    {
+        name: "git-pack-extension-check",
+        kind: "native",
+        modulePath: "./commands/core-git-pack-extension-check-fast.js",
+        exportName: "runGitPackExtensionCheckFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/git-pack-extension-check.sh",
+        root: "cwd",
+        shellCwd: "caller",
+        shellHqRoot: "cwd",
+    },
+    {
+        name: "scan-packages",
+        kind: "native",
+        modulePath: "./commands/core-scan-packages-fast.js",
+        exportName: "runScanPackagesFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/scan-packages.sh",
+        root: "live",
+    },
+    {
+        name: "detect-stale-core-policy-mirror",
+        kind: "native",
+        modulePath: "./commands/core-detect-stale-core-policy-mirror-fast.js",
+        exportName: "runDetectStaleCorePolicyMirrorFast",
+        flagKey: "hq-core-native-fast-route",
+        asset: "core/scripts/detect-stale-core-policy-mirror.sh",
+        root: "live",
+    },
+    {
+        name: "work-mesh-bind-trusted",
+        kind: "native",
+        modulePath: "./commands/core-work-mesh-bind-trusted-fast.js",
+        exportName: "runWorkMeshBindTrustedFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-native-utilities",
+        asset: "core/scripts/work-mesh-live-bind-trusted.sh",
+        root: "live",
+        shellCwd: "live",
+        shellHqRoot: "live",
+        requiresNodeNetworkCompatibility: true,
+    },
 ];
 /**
  * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry

package/dist/lib/daemon/flag.d.ts

@@ -17,6 +17,8 @@ export interface DaemonFlagClient {
 }
 export interface ReadDaemonFlagOptions {
     env?: NodeJS.ProcessEnv;
+    /** Controls how this read combines a local person setting with the registry value. */
+    localOverrideMode?: "respect" | "off-only" | "ignore";
     createClient?: (options: FlagClientOptions) => DaemonFlagClient;
     getToken?: () => Promise<string>;
     onError?: (error: unknown) => void;

package/dist/lib/daemon/flag.js

@@ -15,7 +15,8 @@ const READ_TIMEOUT_MS = 5_000;
 export async function readDaemonFlag(flagKey, options = {}) {
     const env = options.env ?? process.env;
     const override = readLocalOverride(flagKey, env);
-    if (override !== null)
+    const localOverrideMode = options.localOverrideMode ?? "respect";
+    if (override !== null && (localOverrideMode === "respect" || (localOverrideMode === "off-only" && !override)))
         return override;
     let failed = false;
     let reportedError;

package/dist/lib/daemon/server.d.ts

@@ -12,6 +12,7 @@ import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { SessionRegistry } from "./session-registry.js";
 import { HqMcpBridge, type RunWorkerRequest } from "./ops/mcp.js";
 import { type StdinMachineCredentials } from "./machine-login.js";
+import { type ReadDaemonFlagOptions } from "./flag.js";
 import { type WindowsPipeAclReport, type WindowsPipeHost } from "./windows-pipe-host.js";
 export interface HqdServerOptions {
     socketPath: string;
@@ -41,7 +42,7 @@ export interface HqdServerOptions {
     /** Test seam for the hq-anywhere-runtime default-off gate. */
     mcpEnabled?: () => boolean | Promise<boolean>;
     /** Test seam for the live hq-flags read used by the daemon's bounded runtime monitor. */
-    runtimeFlagReader?: () => Promise<boolean>;
+    runtimeFlagReader?: (options: ReadDaemonFlagOptions) => Promise<boolean>;
     /** Test seam for the hosted Streamable HTTP MCP transport. */
     mcpBridge?: HqMcpBridge;
     /** Test seam for machine login while keeping production credentials off disk. */

package/dist/lib/daemon/server.js

@@ -396,14 +396,22 @@ export async function startHqdServer(opts) {
         }
     }
     const runtimeFlagMonitor = opts.mcpEnabled ? undefined : createBoundedDaemonFlagMonitor({
-        read: opts.runtimeFlagReader ?? (() => readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, {
-            env,
-            throwOnError: true,
-        })),
+        read: () => {
+            const options = {
+                env,
+                throwOnError: true,
+                // A local opt-out is honored, while a local opt-in cannot override the operator kill switch.
+                localOverrideMode: "off-only",
+            };
+            return opts.runtimeFlagReader
+                ? opts.runtimeFlagReader(options)
+                : readDaemonFlag(HQ_ANYWHERE_RUNTIME_FLAG, options);
+        },
         onChange: (enabled) => {
             if (!enabled) {
                 flagRevocationGeneration += 1;
                 ephemeralMachineToken = undefined;
+                sessions.clear();
             }
         },
         onReadError: (error) => {
@@ -426,8 +434,22 @@ export async function startHqdServer(opts) {
             socket: healthSocket(socketPath, isPipe),
         };
     };
-    /** Synchronous ops answer in request order; policy.check and mcp.call may return a promise. */
+    const alwaysAvailableOps = new Set(["ping", "health", "auth.status", "shutdown"]);
+    const allowedWhileDisabled = new Set(["session.get", "session.close"]);
+    /** Gate each external hqd request once, leaving diagnostics and cleanup available while disabled. */
     const handle = (req) => {
+        const requestStartedAt = Date.now();
+        if (alwaysAvailableOps.has(req.op))
+            return dispatch(req, requestStartedAt);
+        return Promise.resolve(mcpEnabled()).then((enabled) => {
+            if (!enabled && !allowedWhileDisabled.has(req.op)) {
+                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+            }
+            return dispatch(req, requestStartedAt);
+        });
+    };
+    /** Internal MCP sub-operations reuse the already-gated external request. */
+    const dispatch = (req, requestStartedAt = Date.now()) => {
         const args = req.args ?? {};
         switch (req.op) {
             case "ping":
@@ -565,7 +587,6 @@ export async function startHqdServer(opts) {
                 }, { hqRoot: opts.hqRoot, workMeshRoot: opts.workMeshRoot, env, now: clock });
             }
             case "mcp.call": {
-                const requestStartedAt = Date.now();
                 const name = stringArg(args, "name");
                 const raw = args.arguments ?? {};
                 if (raw === null || typeof raw !== "object" || Array.isArray(raw))
@@ -581,7 +602,7 @@ export async function startHqdServer(opts) {
                     companyArgs.runtime = runtime;
                 if (sessionId !== undefined)
                     companyArgs.sessionId = sessionId;
-                const call = (op, a) => handle({ id: req.id, op, args: a });
+                const call = (op, a) => dispatch({ id: req.id, op, args: a });
                 const asResult = (value) => (value instanceof Promise ? value.then(jsonResult) : jsonResult(value));
                 const policyGuardedCall = (run) => {
                     const company = companyFor(companyArgs);
@@ -601,7 +622,11 @@ export async function startHqdServer(opts) {
                             const reason = Array.isArray(decision.reasons) ? decision.reasons.filter((r) => typeof r === "string").join("; ") : "policy check did not allow this tool";
                             throw new OpError("policy_blocked", reason || "policy check did not allow this tool");
                         }
-                        return run();
+                        return Promise.resolve(mcpEnabled()).then((enabled) => {
+                            if (!enabled)
+                                throw new OpError("anywhere_disabled", `HQ Anywhere is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
+                            return run();
+                        });
                     });
                 };
                 switch (name) {
@@ -628,10 +653,7 @@ export async function startHqdServer(opts) {
                             ? Math.max(1, Math.min(args.timeoutMs, 120_000))
                             : HQD_DEFAULT_REQUEST_TIMEOUT_MS;
                         const deadline = requestStartedAt + timeoutMs;
-                        const forward = () => Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
+                        const forward = () => {
                             const remainingMs = Math.floor(deadline - Date.now());
                             if (remainingMs <= 0) {
                                 throw new McpOpError("hq_mcp_timeout", `Hosted hq-mcp request exceeded its ${timeoutMs}ms end-to-end deadline before forwarding.`);
@@ -650,15 +672,10 @@ export async function startHqdServer(opts) {
                                 },
                             });
                             return hqMcp.callTool(name, raw, remainingMs);
-                        });
-                        return Promise.resolve(mcpEnabled()).then((enabled) => {
-                            if (!enabled) {
-                                throw new OpError("anywhere_disabled", `Hosted hq-mcp forwarding is disabled by the ${HQ_ANYWHERE_RUNTIME_FLAG} flag.`);
-                            }
-                            return !MCP_READ_ONLY_TOOL_NAMES.has(name)
-                                ? policyGuardedCall(forward)
-                                : forward();
-                        });
+                        };
+                        return !MCP_READ_ONLY_TOOL_NAMES.has(name)
+                            ? policyGuardedCall(forward)
+                            : forward();
                     }
                 }
             }

package/dist/lib/daemon/session-registry.d.ts

@@ -24,6 +24,7 @@ export declare class SessionRegistry {
     }): HqdSession;
     get(runtime: string, sessionId: string): HqdSession | null;
     close(runtime: string, sessionId: string): boolean;
+    clear(): void;
     list(): HqdSession[];
     get size(): number;
 }

package/dist/lib/daemon/session-registry.js

@@ -32,6 +32,9 @@ export class SessionRegistry {
     close(runtime, sessionId) {
         return this.sessions.delete(sessionKey(runtime, sessionId));
     }
+    clear() {
+        this.sessions.clear();
+    }
     list() {
         return [...this.sessions.values()];
     }

package/dist/lib/scan-packages/index.js

@@ -2,7 +2,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from 'js-yaml';
-import { contributionLinks } from '../../utils/pack-contributions.js';
+import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();

package/dist/utils/pack-contribution-links.d.ts

@@ -0,0 +1,15 @@
+import type { PackContributeKey } from '../types.js';
+/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
+export interface WiredLink {
+    key: PackContributeKey;
+    item: string;
+    src: string;
+    dst: string;
+}
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
+//# sourceMappingURL=pack-contribution-links.d.ts.map

package/dist/utils/pack-contribution-links.js

@@ -0,0 +1,33 @@
+import * as path from 'node:path';
+import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+/**
+ * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
+ * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
+ * keys (e.g. `mcp`) produce no symlink and are skipped here.
+ */
+export function contributionLinks(hqRoot, packDir, contributes) {
+    const links = [];
+    for (const [key, items] of Object.entries(contributes)) {
+        if (!(key in CONTRIBUTION_TABLE))
+            continue;
+        if (!Array.isArray(items))
+            continue;
+        if (CONTRIBUTION_TABLE[key].wire !== 'symlink')
+            continue;
+        for (const item of items) {
+            if (typeof item !== 'string' || item.length === 0)
+                continue;
+            const row = CONTRIBUTION_TABLE[key];
+            const payloadRel = payloadFor(key, item);
+            const dstRel = path.join(row.host, path.basename(payloadRel));
+            links.push({
+                key,
+                item,
+                src: path.join(packDir, payloadRel),
+                dst: path.join(hqRoot, dstRel),
+            });
+        }
+    }
+    return links;
+}
+//# sourceMappingURL=pack-contribution-links.js.map

package/dist/utils/pack-contributions.d.ts

@@ -38,6 +38,8 @@
  */
 import type { PackManifest, PackContributeKey } from '../types.js';
 import { type WireMode } from './contribution-table.js';
+import { type WiredLink } from './pack-contribution-links.js';
+export { contributionLinks, type WiredLink } from './pack-contribution-links.js';
 import { type UnregisterServerResult, type SafeWriteEnv, type AcquireLockOptions } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 export type { WireMode };
@@ -62,21 +64,7 @@ export declare function mcpServerNameForContribution(packName: string, contribut
  * order, de-duplicated.
  */
 export declare function mergeKeys(contributes: Partial<Record<PackContributeKey, string[]>>): PackContributeKey[];
-/** A single symlink a pack contributes: dst (host path) -> src (inside pack). */
-export interface WiredLink {
-    key: PackContributeKey;
-    item: string;
-    src: string;
-    dst: string;
-}
 export type LinkStatus = 'live' | 'broken' | 'missing' | 'foreign';
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export declare function contributionLinks(hqRoot: string, packDir: string, contributes: Partial<Record<PackContributeKey, string[]>>): WiredLink[];
 /** Classify a host path against the link that should own it. */
 export declare function linkStatus(link: WiredLink, packDir?: string): LinkStatus;
 /** A content pack's manifest plus the install-time stamped source. */

package/dist/utils/pack-contributions.js

@@ -39,7 +39,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
-import { CONTRIBUTION_TABLE, payloadFor } from './contribution-table.js';
+import { CONTRIBUTION_TABLE } from './contribution-table.js';
+import { contributionLinks } from './pack-contribution-links.js';
+export { contributionLinks } from './pack-contribution-links.js';
 import { unregisterMcpServers, } from '../commands/mcp-registration.js';
 export { readHqVersion, readRecommendedPackages } from './hq-core-yaml.js';
 /**
@@ -78,60 +80,6 @@ export function mergeKeys(contributes) {
     }
     return out;
 }
-/**
- * Map one SYMLINK contributes entry to its source/host paths, READING the
- * single-source `CONTRIBUTION_TABLE` (US-003). The src is the expanded pack
- * payload; the dst is `<host-dir>/<payload-basename>` so per-key suffixes
- * (`.md`, `.sh`, none) carry through.
- *
- * Returns `null` for a `wire: 'merge'` key (e.g. `mcp`): a merge contribution
- * is not a symlink and has no `WiredLink`. Callers that only handle symlinks
- * (contributionLinks/unwirePack) skip those keys.
- */
-function linkFor(hqRoot, packDir, key, item) {
-    const row = CONTRIBUTION_TABLE[key];
-    if (row.wire !== 'symlink')
-        return null;
-    const payloadRel = payloadFor(key, item); // e.g. commands/foo.md
-    // dst keeps the payload's basename (so the suffix carries through) under the
-    // host directory declared in the table.
-    const dstRel = path.join(row.host, path.basename(payloadRel));
-    return {
-        key,
-        item,
-        src: path.join(packDir, payloadRel),
-        dst: path.join(hqRoot, dstRel),
-    };
-}
-/**
- * Every SYMLINK a pack's `contributes` block declares. Empty subfields and
- * non-array values are ignored, mirroring scan-packages.sh. `wire: 'merge'`
- * keys (e.g. `mcp`) produce no symlink and are skipped here -- their host
- * effect (a config merge) is handled separately (US-004/US-005).
- */
-export function contributionLinks(hqRoot, packDir, contributes) {
-    const links = [];
-    for (const [key, items] of Object.entries(contributes)) {
-        if (!(key in CONTRIBUTION_TABLE))
-            continue; // unknown key -> ignore
-        if (!Array.isArray(items))
-            continue;
-        // INVARIANT (US-005): merge keys are NEVER symlinked. They route to
-        // registerMcpServers (commands/mcp-registration.ts) instead. Skip them
-        // explicitly here -- not just via linkFor returning null -- so the symlink
-        // path provably excludes them.
-        if (routeContribution(key) === 'merge')
-            continue;
-        for (const item of items) {
-            if (typeof item !== 'string' || item.length === 0)
-                continue;
-            const link = linkFor(hqRoot, packDir, key, item);
-            if (link)
-                links.push(link); // null for merge keys -- skip
-        }
-    }
-    return links;
-}
 /**
  * Canonical absolute path — resolves symlinks and platform aliases such as
  * macOS `/var` ↔ `/private/var` so equivalent paths compare equal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.22",
+  "version": "5.345.24",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {