@indigoai-us/hq-cli 5.345.23 → 5.345.24

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.345.24] — 2026-10-06
+- Keep native core ontology, delegate-secret, share-suggestion-state, and trusted-bind behavior aligned with their scaffold scripts.
+
 ## [5.345.23] — 2026-10-06
 - Route eight additional isolated native core commands through the fast CLI entry.
 - hqd applies the runtime kill switch to new hook and MCP operations within the existing 60-second freshness bound. A local opt-out also disables the daemon, while a local opt-in cannot override an operator-off value.

package/assets/scaffold/core/scripts/ontology-garden.mjs

@@ -158,6 +158,12 @@ function listCandidates(dir) {
 
 function main() {
   const a = parseArgs(process.argv.slice(2));
+  const backrefThreshold = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+  const backrefKeepInline = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+  if (!(backrefThreshold > backrefKeepInline)) {
+    console.error(`ontology-garden: BACKREF_THRESHOLD (${backrefThreshold}) must be greater than BACKREF_KEEP_INLINE (${backrefKeepInline})`);
+    process.exit(1);
+  }
   const co = path.join(a.root, "companies", a.company);
   if (!fs.existsSync(co)) { console.error(`ontology-garden: no company ${a.company}`); process.exit(2); }
   const ont = path.join(co, "ontology"), sig = path.join(co, "signals");

package/dist/commands/core-delegate.d.ts

@@ -41,6 +41,7 @@ export declare function requireRecord(value: unknown, property: string): JsonRec
 export declare function moveFile(source: string, target: string): void;
 export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean): void;
 export declare function delegateDiagnosticPath(argument: string): string;
+export declare function scanSecretFiles(file: string): string[] | undefined;
 /** Fast-entry adapter; family gating and shell fallback happen before import. */
 export declare function runDelegateFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 /** Register the Wave 1a delegate commands and preserve the shell rollback path. */

package/dist/commands/core-delegate.js

@@ -703,7 +703,7 @@ function runRepo(args, context) {
     writeOut(`${prefix} recorded branch state (pushed=${pushed}, dirty=${dirtyLines.length} files, accessVerified=${accessVerified})\n`);
     return 0;
 }
-function scanSecretFiles(file) {
+export function scanSecretFiles(file) {
     let schema;
     try {
         schema = fs.readFileSync(file, "utf8");
@@ -715,7 +715,7 @@ function scanSecretFiles(file) {
         throw error;
     }
     return [...new Set(schema.split(/\r?\n/)
-            .filter((line) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(line))
+            .filter((line) => /^[A-Z][A-Z0-9_]*(\/[A-Z][A-Z0-9_]+)*=/.test(line))
             .map((line) => line.slice(0, line.indexOf("="))))].sort();
 }
 function isRegularFile(file) {

package/dist/commands/core-ontology-native.js

@@ -397,6 +397,52 @@ function writeGardenDoc(file, fm, body, dryRun) {
     fs.writeFileSync(`${file}.tmp`, lines.join("\n"));
     fs.renameSync(`${file}.tmp`, file);
 }
+const BACKREF_SUMMARY_MARKER = "<!-- backref-archive -->";
+function readGardenArchiveIndex(file) {
+    if (!fs.existsSync(file))
+        return { signalIds: [], unreadable: false, stderr: "" };
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && Array.isArray(parsed.signalIds)) {
+            return {
+                signalIds: (parsed.signalIds).filter((item) => typeof item === "string"),
+                unreadable: false,
+                stderr: "",
+            };
+        }
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return { signalIds: [], unreadable: true, stderr: `ontology-garden: archive index unreadable at ${file}: ${detail}; skipping compaction\n` };
+    }
+    return { signalIds: [], unreadable: true, stderr: "" };
+}
+function compactGardenFactBody(body, slug, threshold, keepInline, archivedTotalBefore) {
+    const lines = body.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0);
+    const isBackref = (line) => /^- \[[a-z_]+\] .+ \(signal [0-9a-f]{12}\)\s*$/.test(line);
+    const backrefLines = lines.filter(isBackref);
+    const other = lines.filter((line) => !isBackref(line) && !line.includes(BACKREF_SUMMARY_MARKER));
+    if (backrefLines.length <= threshold)
+        return { body, archivedLines: [], archivedIds: [], stamp: "", changed: false };
+    const archiveCount = backrefLines.length - keepInline;
+    const archivedLines = backrefLines.slice(0, archiveCount);
+    const inlineLines = backrefLines.slice(archiveCount);
+    const archivedIds = archivedLines.map((line) => line.match(/\(signal ([0-9a-f]{12})\)$/)?.[1]).filter((id) => Boolean(id));
+    const total = archivedTotalBefore + archivedLines.length;
+    const stamp = new Date().toISOString().slice(0, 7);
+    const summary = `- ${BACKREF_SUMMARY_MARKER} _${total} older mention${total === 1 ? "" : "s"} archived in [history](./${slug}.history/${stamp}.md)_`;
+    return { body: [summary, ...other, ...inlineLines].join("\n"), archivedLines, archivedIds, stamp, changed: true };
+}
+function appendGardenArchive(file, isoDate, lines, dryRun) {
+    if (dryRun)
+        return;
+    const batch = `\n<!-- archived ${isoDate} -->\n${lines.join("\n")}\n`;
+    const previous = fs.existsSync(file) ? fs.readFileSync(file, "utf8").replace(/\s+$/, "") : "";
+    const next = previous ? `${previous}\n${batch}` : `# Back-reference archive\n${batch}`;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(`${file}.tmp`, next);
+    fs.renameSync(`${file}.tmp`, file);
+}
 const slugify = (value) => value.toLowerCase().normalize("NFKD").replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 const isoNow = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 function listCandidates(directory) {
@@ -436,6 +482,11 @@ export function gardenCommand(args, defaultRoot) {
     }
     if (!company)
         return err(2, "usage: ontology-garden.mjs --company <co> [--hq-root <p>] [--dry-run] [--json]\n");
+    const threshold = Number(process.env.HQ_ONTOLOGY_BACKREF_THRESHOLD || 50);
+    const keepInline = Number(process.env.HQ_ONTOLOGY_BACKREF_KEEP_INLINE || 25);
+    if (!(threshold > keepInline)) {
+        return err(1, `ontology-garden: BACKREF_THRESHOLD (${threshold}) must be greater than BACKREF_KEEP_INLINE (${keepInline})\n`);
+    }
     const hqRoot = root || process.env.HQ_ROOT || defaultRoot;
     const companyDir = path.join(hqRoot, "companies", company);
     if (!fs.existsSync(companyDir))
@@ -445,6 +496,7 @@ export function gardenCommand(args, defaultRoot) {
     const report = { company, entities_created: 0, entities_updated: 0, signals_promoted: 0, facts_written: 0, rejected: 0, candidates_processed: 0, dry_run: dryRun };
     const rejected = [];
     const moves = [];
+    let stderr = "";
     const entities = new Map();
     const nameIndex = new Map();
     const entityDirectory = path.join(ontology, "entities");
@@ -563,8 +615,24 @@ export function gardenCommand(args, defaultRoot) {
                 const previous = fs.existsSync(factFile)
                     ? readGardenDoc(factFile)
                     : { fm: { entity: slug, type: entity.type, audience_key: key }, body: "" };
-                if (!previous.body.includes(`signal ${id.slice(0, 12)}`)) {
-                    writeGardenDoc(factFile, previous.fm, [previous.body, line].filter(Boolean).join("\n"), dryRun);
+                const indexFile = path.join(path.dirname(factFile), `${slug}.history`, "_index.json");
+                const archiveIndex = readGardenArchiveIndex(indexFile);
+                stderr += archiveIndex.stderr;
+                const signalId = id.slice(0, 12);
+                if (!previous.body.includes(`signal ${signalId}`) && !archiveIndex.signalIds.includes(signalId)) {
+                    let nextBody = [previous.body, line].filter(Boolean).join("\n");
+                    const compact = compactGardenFactBody(nextBody, slug, threshold, keepInline, archiveIndex.signalIds.length);
+                    if (compact.changed && !archiveIndex.unreadable) {
+                        const archiveFile = path.join(path.dirname(factFile), `${slug}.history`, `${compact.stamp}.md`);
+                        appendGardenArchive(archiveFile, new Date().toISOString().slice(0, 10), compact.archivedLines, dryRun);
+                        if (!dryRun) {
+                            const nextIndex = { version: 1, signalIds: [...archiveIndex.signalIds, ...compact.archivedIds] };
+                            fs.mkdirSync(path.dirname(indexFile), { recursive: true });
+                            fs.writeFileSync(indexFile, `${JSON.stringify(nextIndex)}\n`);
+                        }
+                        nextBody = compact.body;
+                    }
+                    writeGardenDoc(factFile, previous.fm, nextBody, dryRun);
                     report.facts_written += 1;
                 }
                 if (key === "company") {
@@ -598,9 +666,9 @@ export function gardenCommand(args, defaultRoot) {
             fs.writeFileSync(path.join(ontology, ".last-run"), `${Date.now()}\n`);
         }
     }
-    return ok(json
-        ? `${JSON.stringify(report)}\n`
-        : `garden ${company}: +${report.entities_created} entities, ~${report.entities_updated} updated, +${report.signals_promoted} signals, +${report.facts_written} facts, ${report.rejected} rejected, ${report.candidates_processed} candidates${dryRun ? " (dry run)" : ""}\n`);
+    return { code: 0, stdout: json
+            ? `${JSON.stringify(report)}\n`
+            : `garden ${company}: +${report.entities_created} entities, ~${report.entities_updated} updated, +${report.signals_promoted} signals, +${report.facts_written} facts, ${report.rejected} rejected, ${report.candidates_processed} candidates${dryRun ? " (dry run)" : ""}\n`, stderr };
 }
 export function audienceGrant(args, root) {
     let company = "";

package/dist/commands/core-share-suggestion-state-native.js

@@ -209,8 +209,14 @@ export function runShareSuggestionState(args, stdin, deps) {
         try {
             return JSON.parse(f.readFileSync(file, "utf8"));
         }
-        catch {
-            return fallback;
+        catch (cause) {
+            const failure = new Error("share-suggestion-state JSON read failed");
+            failure.name = "ShareSuggestionStateReadError";
+            Object.assign(failure, {
+                shareSuggestionStateReadPath: file,
+                shareSuggestionStateCauseName: cause instanceof Error && cause.name ? cause.name : "Error",
+            });
+            throw failure;
         }
     };
     const writeJson = (file, value) => {
@@ -454,6 +460,17 @@ export function runShareSuggestionState(args, stdin, deps) {
         return { code: 0, stdout: "", stderr: "" };
     }
     catch (error) {
+        if (error instanceof Error && "shareSuggestionStateReadPath" in error) {
+            const failure = error;
+            const readPath = platform === "win32"
+                ? path.win32.resolve(failure.shareSuggestionStateReadPath).replaceAll("\\", "/")
+                : failure.shareSuggestionStateReadPath;
+            return {
+                code: 3,
+                stdout: "",
+                stderr: `share-suggestion-state: unable to read ${readPath} (${failure.shareSuggestionStateCauseName})\n`,
+            };
+        }
         const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
         return { code: 0, stdout: "", stderr: `share-suggestion-state: internal error\n${detail}\n` };
     }

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -15,6 +15,7 @@ export type WorkMeshBindDeps = {
         stdout: string;
         stderr: string;
     };
+    daemonWarningEnabled: boolean;
     runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
         code: number;
         stdout: string;
@@ -25,8 +26,27 @@ export type WorkMeshBindDeps = {
     tmpDir: string;
     ulid: (now: Date) => string;
 };
-export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date, daemonWarningEnabled?: boolean) => WorkMeshBindDeps;
+type DetachedSpawnOptions = {
+    cwd: string;
+    root: string;
+    env: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    existsSync?: (candidate: string) => boolean;
+    spawnProcess?: (command: string, args: string[], options: {
+        cwd: string;
+        env: NodeJS.ProcessEnv;
+        detached: boolean;
+        stdio: "ignore";
+        shell: boolean;
+        windowsVerbatimArguments?: boolean;
+    }) => {
+        unref: () => void;
+    };
+};
+export declare function spawnWorkMeshHqDetached(args: string[], options: DetachedSpawnOptions): void;
 export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
 export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
 export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+export {};
 //# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -2,10 +2,13 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { generateUlid } from "../lib/mesh/live/ulid.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { planResolvedCommandSpawn } from "../utils/windows-spawn.js";
 import { registerNativeUtility } from "./core-native-utilities.js";
 export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+const WORK_MESH_DAEMON_WARNING_FLAG = "hooks.work-mesh-daemon-not-loaded-warning";
 export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
 US-011 — write session meta + reconcile with observation.trustedContext.
 No --trusted CLI flag in hq-cli; trusted bind is the observation field.
@@ -14,21 +17,61 @@ set -euo pipefail
 ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
 if [ -z "$ROOT" ]; then
 `;
-export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+export const createWorkMeshBindDeps = (root, cwd, env, now, daemonWarningEnabled = false) => ({
     root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    daemonWarningEnabled: daemonWarningEnabled
+        && Boolean(env.HQ_FLAGS_API_URL?.trim())
+        && /^cmp_[A-Za-z0-9]{3,128}$/.test(env.HQ_COMPANY_UID?.trim() ?? ""),
     runHq: (args, childEnv) => {
-        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        const executable = "hq";
+        const resolvedExecutable = process.platform === "win32"
+            ? resolveWindowsExecutable(executable, childEnv, (candidate) => {
+                try {
+                    return fs.statSync(candidate).isFile();
+                }
+                catch {
+                    return false;
+                }
+            }, cwd) ?? executable
+            : executable;
+        const plan = planResolvedCommandSpawn(resolvedExecutable, args, childEnv);
+        const result = spawnSync(plan.cmd, plan.args, {
+            cwd,
+            env: { ...childEnv, HQ_ROOT: root },
+            encoding: "utf8",
+            shell: plan.shell,
+            ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+            timeout: 2_000,
+        });
         return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
     },
     runHqSession: (scriptRoot, args, childEnv) => {
         const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
         return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
     },
-    spawnHq: (args, childEnv) => {
-        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
-        child.unref();
-    },
+    spawnHq: (args, childEnv) => spawnWorkMeshHqDetached(args, {
+        cwd,
+        root,
+        env: childEnv,
+    }),
 });
+export function spawnWorkMeshHqDetached(args, options) {
+    const platform = options.platform ?? process.platform;
+    const childEnv = { ...options.env, HQ_ROOT: options.root };
+    const executable = platform === "win32"
+        ? resolveWindowsExecutable("hq", childEnv, options.existsSync ?? fs.existsSync, options.cwd) ?? "hq"
+        : "hq";
+    const plan = planResolvedCommandSpawn(executable, args, childEnv, platform);
+    const child = (options.spawnProcess ?? spawn)(plan.cmd, plan.args, {
+        cwd: options.cwd,
+        env: childEnv,
+        detached: true,
+        stdio: "ignore",
+        shell: plan.shell,
+        ...(plan.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+    });
+    child.unref();
+}
 export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
     for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
         const value = (env[key] ?? "").replace(/\s/g, "");
@@ -44,6 +87,16 @@ export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
     }
 }
 function hasExecutable(deps, command) {
+    if (process.platform === "win32") {
+        return Boolean(resolveWindowsExecutable(command, deps.env, (candidate) => {
+            try {
+                return deps.fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        }, deps.cwd));
+    }
     for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
         if (!directory)
             continue;
@@ -175,6 +228,21 @@ export function runWorkMeshBindTrusted(args, deps) {
     }
     if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
         return { code: 0, stdout: output.join(""), stderr };
+    if (deps.daemonWarningEnabled && hasExecutable(deps, "hq")) {
+        const status = deps.runHq(["mesh", "daemon", "status", "--json"], { ...deps.env, HQ_NO_UPDATE_CHECK: "1" });
+        if (status.code === 0) {
+            try {
+                const parsed = JSON.parse(status.stdout);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    const daemon = parsed;
+                    if (daemon.ok === true && daemon.running === false && typeof daemon.message === "string" && daemon.message.includes("installed (")) {
+                        stderr += "Work Mesh daemon is installed but not loaded; start it with: hq mesh daemon install\n";
+                    }
+                }
+            }
+            catch { /* the shell's jq test fails quiet on invalid status JSON */ }
+        }
+    }
     if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
         deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
     }
@@ -184,7 +252,11 @@ export function registerCoreWorkMeshBindTrustedNative(core) {
     registerNativeUtility(core, {
         name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
         resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
-        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+        run: async (args, context) => {
+            const { fastFlagEnabled } = await import("../native-fast-route.js");
+            const daemonWarningEnabled = await fastFlagEnabled(WORK_MESH_DAEMON_WARNING_FLAG, context.env);
+            return runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now, daemonWarningEnabled));
+        },
     });
 }
 //# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.23",
+  "version": "5.345.24",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {