@indigoai-us/hq-cli 5.345.28 → 5.345.30

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.30] — 2026-10-06
+- Sanitize malformed journal scope identifiers before composing per-scope check IDs.
+
+- Sync the bundled outpost reconciler with staging's Bash 3.2-safe PATH handling.
+
+## [5.345.29] — 2026-10-06
+- Route `hq core checkpoint` through an isolated fast entry and defer identity and ontology imports to the paths that use them.
+
+- Add folder-based company registry resolution to the native resolve-company fast path.
+
 ## [5.345.28] — 2026-10-06
 - Limit `hq meetings live` to active, recent, and imminent notetakers by default, and avoid transcript requests for inactive meetings.
 

package/assets/scaffold/core/scripts/hq-delegate-verify.sh

@@ -73,7 +73,7 @@ if [ "$DRY_RUN" -eq 1 ]; then
   done
   SECRET_NAMES="(none — no .env.schema found)"
   if [ -n "$SCHEMA" ]; then
-    SECRET_NAMES="$(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$SCHEMA" | cut -d= -f1 | sort -u | tr '\n' ' ')"
+    SECRET_NAMES="$(grep -E '^[A-Za-z_][A-Za-z0-9_]*(/[A-Za-z_][A-Za-z0-9_]*)*=' "$SCHEMA" | cut -d= -f1 | sort -u | tr '\n' ' ')"
     [ -n "$SECRET_NAMES" ] || SECRET_NAMES="(none declared)"
   fi
 

package/assets/scaffold/core/scripts/resolve-company.sh

@@ -8,26 +8,36 @@
 #
 # Output: {"company":"<slug>","source":"prompt|session|device_default|none"}
 # Always exits 0 and never writes state.
+#
+# Folder mode (--path <dir>): ask the repo-to-company registry through
+# `$HQ_CLI_BIN resolve-company --path <dir> --json` (HQ_CLI_BIN defaults to
+# `hq`). Sources: registry (linked folder), registry_miss (not linked), or
+# unavailable (CLI missing, failed, timed out, or returned bad output). A
+# registry answer is accepted only when it names a real companies/<slug>
+# directory. Folder mode never falls back to prompt, session, or device default.
 
 set -uo pipefail
 
 ROOT=""
 PROMPT=""
 HAVE_PROMPT=0
+FOLDER=""
+HAVE_FOLDER=0
 
 while [ $# -gt 0 ]; do
   case "$1" in
     --root) ROOT="${2:-}"; shift 2 || shift ;;
     --prompt) PROMPT="${2:-}"; HAVE_PROMPT=1; shift 2 || shift ;;
+    --path) FOLDER="${2:-}"; HAVE_FOLDER=1; shift 2 || shift ;;
     --help|-h)
-      sed -n '2,14p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+      sed -n '2,21p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
       exit 0
       ;;
     *) shift ;;
   esac
 done
 
-if [ "$HAVE_PROMPT" -eq 0 ] && [ ! -t 0 ]; then
+if [ "$HAVE_PROMPT" -eq 0 ] && [ "$HAVE_FOLDER" -eq 0 ] && [ ! -t 0 ]; then
   PROMPT="$(cat 2>/dev/null || true)"
 fi
 : "${PROMPT:=}"
@@ -41,6 +51,150 @@ if [ -z "$ROOT" ]; then
   ROOT="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && cd .. && pwd)}}"
 fi
 
+# Runs a command with a hard deadline (HQ_RESOLVE_TIMEOUT_MS, default 2000).
+run_with_timeout() {
+  command -v node >/dev/null 2>&1 || return 127
+  node -e '
+const { spawn } = require("child_process");
+const command = process.argv[1];
+const args = process.argv.slice(2);
+const timeoutMs = Number(process.env.HQ_RESOLVE_TIMEOUT_MS) || 2000;
+if (!command) process.exitCode = 127;
+else {
+  let child;
+  try {
+    child = spawn(command, args, { detached: true, stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    process.exitCode = 127;
+  }
+  if (child) {
+    let exited = false;
+    let exitStatus = 1;
+    let timedOut = false;
+    let drainExpired = false;
+    let pendingWrites = 0;
+    let finished = false;
+    let drainTimer;
+    let timeoutKillTimer;
+    let timeoutFinalTimer;
+    let deadlineTimer;
+    const signalGroup = (signal) => {
+      if (!child.pid) return;
+      try {
+        if (process.platform === "win32") child.kill(signal);
+        else process.kill(-child.pid, signal);
+      } catch {}
+    };
+    const maybeFinish = () => {
+      if (finished || !exited || pendingWrites !== 0 || (!drainExpired && !child.stdout.readableEnded)) return;
+      finished = true;
+      clearTimeout(deadlineTimer);
+      clearTimeout(drainTimer);
+      clearTimeout(timeoutKillTimer);
+      clearTimeout(timeoutFinalTimer);
+      signalGroup("SIGTERM");
+      process.exitCode = timedOut ? 124 : exitStatus;
+      process.exit();
+    };
+    const writeChunk = (chunk) => {
+      pendingWrites += 1;
+      process.stdout.write(chunk, () => {
+        pendingWrites -= 1;
+        maybeFinish();
+      });
+    };
+    child.stdout.on("data", writeChunk);
+    child.stdout.once("end", () => {
+      drainExpired = true;
+      maybeFinish();
+    });
+    child.once("error", () => {
+      exited = true;
+      exitStatus = 127;
+      drainExpired = true;
+      maybeFinish();
+    });
+    child.once("exit", (code) => {
+      exited = true;
+      exitStatus = typeof code === "number" ? code : 1;
+      signalGroup("SIGTERM");
+      if (!child.stdout.readableEnded) {
+        drainTimer = setTimeout(() => {
+          child.stdout.pause();
+          let chunk;
+          while ((chunk = child.stdout.read()) !== null) writeChunk(chunk);
+          process.stdout.write("", () => {
+            drainExpired = true;
+            maybeFinish();
+          });
+        }, 100);
+      } else {
+        drainExpired = true;
+      }
+      maybeFinish();
+    });
+    deadlineTimer = setTimeout(() => {
+      timedOut = true;
+      signalGroup("SIGTERM");
+      timeoutKillTimer = setTimeout(() => signalGroup("SIGKILL"), 100);
+      timeoutFinalTimer = setTimeout(() => {
+        if (!exited) {
+          exited = true;
+          exitStatus = 124;
+          child.stdout.destroy();
+          drainExpired = true;
+          maybeFinish();
+        }
+      }, 1000);
+    }, timeoutMs);
+  }
+}
+' "$@"
+}
+
+unavailable() {
+  printf 'resolve-company: WARNING company registry unavailable (%s); binding personal, not guessing a company\n' "$1" >&2
+  emit "" "unavailable"
+}
+
+if [ "$HAVE_FOLDER" -eq 1 ]; then
+  [ -n "$FOLDER" ] || unavailable "empty --path"
+  case "$FOLDER" in
+    /*|[A-Za-z]:/*|[A-Za-z]:\\*|\\\\*) ;;
+    *)
+      caller_cwd="${HQ_CALLER_CWD:-$PWD}"
+      caller_cwd="$(cd "$caller_cwd" 2>/dev/null && pwd -P)" || unavailable "caller working directory unavailable"
+      if [ "$FOLDER" = "." ]; then FOLDER="$caller_cwd"; else FOLDER="$caller_cwd/$FOLDER"; fi
+      ;;
+  esac
+  cli="${HQ_CLI_BIN:-hq}"
+  command -v "$cli" >/dev/null 2>&1 || unavailable "'$cli' not found"
+  command -v jq >/dev/null 2>&1 || unavailable "jq not found"
+  status=0
+  if command -v node >/dev/null 2>&1; then
+    out="$(HQ_NO_UPDATE_CHECK=1 HQ_RESOLVE_TIMEOUT_MS="${HQ_RESOLVE_TIMEOUT_MS:-5000}" run_with_timeout "$cli" resolve-company --path "$FOLDER" --json)" || status=$?
+  else
+    out="$("$cli" resolve-company --path "$FOLDER" --json 2>/dev/null)" || status=$?
+  fi
+  kind="$(printf '%s' "$out" | jq -r 'if type != "object" then "bad" elif .company == null then "miss" elif (.company | type) == "string" then "hit" else "bad" end' 2>/dev/null | sed 's/\r$//' || printf 'bad')"
+  if [ "$status" -ne 0 ] && ! { [ "$status" -eq 1 ] && [ "$kind" = "miss" ]; }; then
+    unavailable "'$cli resolve-company' exited $status"
+  fi
+  case "$kind" in
+    miss) emit "" "registry_miss" ;;
+    hit) ;;
+    *) unavailable "'$cli resolve-company' returned unreadable output" ;;
+  esac
+  slug="$(printf '%s' "$out" | jq -r '.company' | sed 's/\r$//')"
+  case "$slug" in
+    ''|personal|_*|*[!A-Za-z0-9_-]*) unavailable "registry returned invalid company '$slug'" ;;
+  esac
+  if [ ! -d "$ROOT/companies/$slug" ] || [ -L "$ROOT/companies/$slug" ]; then
+    unavailable "registry company '$slug' has no companies/$slug directory in $ROOT"
+  fi
+  emit "$slug" "registry"
+fi
+
 MANIFEST="$ROOT/companies/manifest.yaml"
 [ -f "$MANIFEST" ] || emit "" "none"
 
@@ -65,7 +219,7 @@ SLUGS="$(
 [ -n "$SLUGS" ] || emit "" "none"
 
 is_known_slug() {
-  printf '%s\n' "$SLUGS" | grep -Fx -- "$1" >/dev/null
+  printf '%s\n' "$SLUGS" | grep -Fx "$1" >/dev/null
 }
 
 prompt_slug() {
@@ -134,72 +288,6 @@ is_fleet_identity() {
   return 1
 }
 
-run_with_timeout() {
-  command -v node >/dev/null 2>&1 || return 127
-  node -e '
-const { spawn } = require("child_process");
-const command = process.argv[1];
-if (!command) process.exit(127);
-const child = spawn(command, process.argv.slice(2), { detached: true, stdio: ["ignore", "pipe", "ignore"] });
-let finished = false;
-let exited = false;
-let exitStatus = 1;
-let flushedAfterExit = false;
-let pendingWrites = 0;
-let stdoutEnded = false;
-let drainTimer;
-const finishWhenReady = () => {
-  if (finished || !exited || pendingWrites !== 0) return;
-  if (!stdoutEnded && !flushedAfterExit) return;
-  finished = true;
-  clearTimeout(timer);
-  clearTimeout(drainTimer);
-  try { process.kill(-child.pid, "SIGTERM"); } catch (_) {}
-  process.exit(exitStatus);
-};
-const forward = (chunk) => {
-  pendingWrites++;
-  process.stdout.write(chunk, () => {
-    pendingWrites--;
-    finishWhenReady();
-  });
-};
-const finish = (status) => {
-  if (finished) return;
-  finished = true;
-  clearTimeout(timer);
-  clearTimeout(drainTimer);
-  try { process.kill(-child.pid, "SIGTERM"); } catch (_) {}
-  process.exit(status);
-};
-child.stdout.on("data", forward);
-child.stdout.once("end", () => {
-  stdoutEnded = true;
-  finishWhenReady();
-});
-child.once("error", () => finish(127));
-child.once("exit", (code) => {
-  exited = true;
-  exitStatus = typeof code === "number" ? code : 1;
-  try { process.kill(-child.pid, "SIGTERM"); } catch (_) {}
-  // Normally EOF follows child exit once the pipe has drained. A detached
-  // grandchild can keep the pipe open, so bound that wait and flush buffered
-  // bytes after a short drain window.
-  drainTimer = setTimeout(() => {
-    child.stdout.pause();
-    let chunk;
-    while ((chunk = child.stdout.read()) !== null) forward(chunk);
-    process.stdout.write("", () => {
-      flushedAfterExit = true;
-      finishWhenReady();
-    });
-  }, 250);
-  finishWhenReady();
-});
-const timer = setTimeout(() => finish(124), 2000);
-' "$@"
-}
-
 if ! is_fleet_identity && command -v hq >/dev/null 2>&1 && command -v jq >/dev/null 2>&1; then
   DEFAULT_JSON="$(run_with_timeout hq mesh context default get --json 2>/dev/null || true)"
   DEFAULT_SLUG="$(printf '%s' "$DEFAULT_JSON" | jq -er '(.defaultCompany // .) as $default | if $default.enabled == true and ($default.source // "") != "disabled" and ($default.needsChoice // false) == false and ($default.slug | type == "string") then $default.slug else empty end' 2>/dev/null || true)"

package/dist/commands/core-checkpoint-fast.d.ts

@@ -0,0 +1,3 @@
+/** Dispatch through the same command action as the full graph, without loading it. */
+export declare function runCheckpointFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined, _commandName: string, hqRootArg: string | undefined): Promise<number>;
+//# sourceMappingURL=core-checkpoint-fast.d.ts.map

package/dist/commands/core-checkpoint-fast.js

@@ -0,0 +1,17 @@
+import { Command, Option } from "commander";
+import { registerCoreCheckpointCommand } from "./core-checkpoint-native.js";
+/** Dispatch through the same command action as the full graph, without loading it. */
+export async function runCheckpointFast(args, _stdin, _cwd, hqRoot, _commandName, hqRootArg) {
+    const core = new Command("hq core")
+        .addOption(new Option("--hq-root <path>", "HQ installation to operate on (live-root commands)").hideHelp())
+        .addHelpText("afterAll", "exact-company-directory-match-v1");
+    registerCoreCheckpointCommand(core, hqRoot);
+    const parseArgs = [
+        ...(hqRootArg || hqRoot ? ["--hq-root", hqRootArg ?? hqRoot] : []),
+        "checkpoint",
+        ...args,
+    ];
+    await core.parseAsync(parseArgs, { from: "user" });
+    return typeof process.exitCode === "number" ? process.exitCode : 0;
+}
+//# sourceMappingURL=core-checkpoint-fast.js.map

package/dist/commands/core-checkpoint-native.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `hq core checkpoint` — synchronous end-of-turn state capture plus an
+ * optional detached HQ-maintenance sibling.
+ *
+ * The foreground command intentionally performs only local filesystem and git
+ * reads/writes. It never waits for the sibling, and it never performs network
+ * I/O itself.
+ */
+import * as fs from "node:fs";
+import { Command } from "commander";
+type Backend = "claude" | "codex" | "grok" | "none";
+type SpawnableBackend = Exclude<Backend, "none">;
+/**
+ * Printed after every non-dry-run checkpoint, real or --idle. Agents were
+ * treating the checkpoint call as the end of the turn, leaving their actual
+ * findings only in the checkpoint payload — which the user never sees. This
+ * line rides the command output (the one channel guaranteed to reach the
+ * calling agent) to force the user-facing reply. Deliberately conditional on
+ * whether the reply was already delivered this turn: an unconditional
+ * "restate in full" made agents repeat a reply the user had already seen
+ * (both the CLI and the desktop app render pre-tool-call text), while an
+ * unconditional "no commentary after" hid the reply from agents that had not
+ * yet written one. The Stop gate makes the same distinction from the
+ * transcript — and backstops this reminder mechanically: a satisfying
+ * checkpoint on a work turn whose genuine reply is still missing is blocked
+ * once with a dedicated reply demand. This line covers proactive checkpoints
+ * the gate never sees. Mirrors the hq-core policies
+ * `checkpoint-is-bookkeeping-not-user-communication` and
+ * `checkpoint-is-not-the-user-report`.
+ */
+export declare const CHECKPOINT_REPLY_REMINDER: string;
+/**
+ * The --idle variant: an idle-only turn (nothing ran, nothing to report) is
+ * exempt at the Stop gate, so this text must never order a reply into
+ * existence — but an --idle after read-only work is NOT exempt (the gate
+ * demands the findings), so the conditional half still points there.
+ */
+export declare const CHECKPOINT_IDLE_REPLY_REMINDER: string;
+export declare function renderSiblingPrompt(runDir: string, payloadPath: string, options?: {
+    company?: string | null;
+    hqRoot?: string;
+}): string;
+export type WriteStampsOptions = {
+    /**
+     * Filesystem seam (default the real `node:fs`); injected in tests to force a
+     * permission errno so the HqStateWriteError conversion can be proven without a
+     * real unwritable path.
+     */
+    fs?: Pick<typeof fs, "mkdirSync" | "writeFileSync" | "renameSync" | "unlinkSync">;
+    /** Runtime seam for proving the Windows-only atomic path without host assumptions. */
+    platform?: NodeJS.Platform;
+    /** Synchronous delay seam for the bounded Windows lock retry. */
+    waitForRetry?: (delayMs: number) => void;
+};
+export declare function writeStamps(liveRoot: string, sessionId: string | undefined, options?: WriteStampsOptions): string[];
+/**
+ * Preference order for `--backend auto`: the caller's own backend first, so a
+ * claude session keeps using claude and a codex session keeps using codex
+ * (same-engine continuity), then the fallback priority claude -> codex -> grok
+ * for whatever the caller is not. Deterministic and env-only, so it is unit
+ * tested directly. `preferGrok` (the company's grok-backend flag) puts grok
+ * ahead of that order and leaves the rest as the fallback.
+ */
+export declare function autoBackendPreference(preferGrok?: boolean): SpawnableBackend[];
+/**
+ * Whether the payload company's last ontology plan recorded
+ * checkpoint.ontology.grok-backend as on. Reads only the local state file the
+ * detached sibling writes, so a foreground checkpoint never waits on the flag
+ * registry; a flag change takes effect from the checkpoint after the next plan.
+ */
+export declare function companyPrefersGrok(liveRoot: string, companySlug: string | null | undefined): Promise<boolean>;
+export declare function siblingArgs(backend: SpawnableBackend, prompt: string): string[];
+/** Attach the native checkpoint command to the hidden `hq core` group. */
+export declare function registerCoreCheckpointCommand(core: Command, preResolvedHqRoot?: string): void;
+export {};
+//# sourceMappingURL=core-checkpoint-native.d.ts.map