@indigoai-us/hq-cli 5.71.0 → 5.73.0

package/dist/commands/outposts.d.ts

@@ -73,6 +73,13 @@ export declare function listOutposts(token: string): Promise<OutpostSummary[]>;
 export declare function getOutpostStatus(token: string, outpostId?: string): Promise<Record<string, unknown>>;
 export declare function enableCodex(token: string, outpostId?: string): Promise<Record<string, unknown>>;
 export declare function regenerateLoginUrl(token: string, outpostId?: string): Promise<Record<string, unknown>>;
+/**
+ * Hand the box the one-time Claude sign-in code the operator got from the login
+ * URL. hq-pro stores it as the row's pending code; the box polls for it, feeds
+ * it to `claude`, and flips itself `awaiting-claude-login → ready`. This is the
+ * terminal-native equivalent of pasting the code into the web console.
+ */
+export declare function submitLoginCode(token: string, code: string, outpostId?: string): Promise<Record<string, unknown>>;
 export declare function destroyOutpost(token: string, outpostId?: string): Promise<Record<string, unknown>>;
 /** Result of `POST /outpost/exec` — a terminal SSM invocation on the box. */
 export interface OutpostExecResult {
@@ -188,5 +195,27 @@ export interface SelfDeployDependencies {
     defaultHqRoot: () => string;
     invokingUser: () => string;
 }
-export declare function registerOutpostsCommand(program: Command, selfDeployOverrides?: Partial<SelfDeployDependencies>): void;
+/**
+ * The extra local surface `replica-sync` needs on top of the self-deploy set:
+ * two filesystem probes for the repos clone. Kept as an extension so the
+ * `self-deploy` dependency surface stays minimal.
+ */
+export interface ReplicaSyncDependencies extends SelfDeployDependencies {
+    pathExists: (p: string) => boolean;
+    mkdirp: (p: string) => void;
+}
+/** One repo entry resolved from `personal/data/repos.yaml`. */
+export interface ReplicaRepo {
+    url: string;
+    visibility: "public" | "private";
+    name: string;
+}
+/**
+ * Parse `personal/data/repos.yaml` into a clone list. Pure + exported for
+ * tests. Mirrors setup.sh's `clone_repos`: `visibility` defaults to public,
+ * `name` defaults to the URL basename. Malformed entries are skipped, never
+ * thrown.
+ */
+export declare function parseReposManifest(yamlText: string): ReplicaRepo[];
+export declare function registerOutpostsCommand(program: Command, selfDeployOverrides?: Partial<ReplicaSyncDependencies>): void;
 //# sourceMappingURL=outposts.d.ts.map

package/dist/commands/outposts.js

@@ -20,8 +20,6 @@
  * web console can't rename them either), so this CLI wraps only the lifecycle
  * and status routes that exist. Renaming an Outpost is not a backend capability.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="839f8f76-584d-5ea8-b86e-a92a55c32a16")}catch(e){}}();
 import chalk from "chalk";
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
@@ -29,6 +27,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import * as readline from "node:readline";
 import { randomBytes } from "node:crypto";
+import * as yaml from "js-yaml";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
@@ -117,6 +116,21 @@ export async function regenerateLoginUrl(token, outpostId) {
         query: outpostId ? { outpostId } : undefined,
     });
 }
+/**
+ * Hand the box the one-time Claude sign-in code the operator got from the login
+ * URL. hq-pro stores it as the row's pending code; the box polls for it, feeds
+ * it to `claude`, and flips itself `awaiting-claude-login → ready`. This is the
+ * terminal-native equivalent of pasting the code into the web console.
+ */
+export async function submitLoginCode(token, code, outpostId) {
+    return outpostRequest({
+        token,
+        path: "/outpost/login-code",
+        method: "POST",
+        body: { code },
+        query: outpostId ? { outpostId } : undefined,
+    });
+}
 export async function destroyOutpost(token, outpostId) {
     return outpostRequest({
         token,
@@ -506,9 +520,161 @@ async function selfDeployOutpost(opts, deps) {
     console.log(chalk.dim("Check it with: systemctl status outpost-sync.service"));
     console.log(chalk.dim("It is unregistered and unmanaged by hq-pro (no console entry or remote management)."));
 }
+const defaultReplicaSyncDependencies = {
+    ...defaultSelfDeployDependencies,
+    pathExists: (p) => fs.existsSync(p),
+    mkdirp: (p) => {
+        fs.mkdirSync(p, { recursive: true });
+    },
+};
+function repoNameFromUrl(url) {
+    const tail = url.split("/").pop() ?? "";
+    return tail.replace(/\.git$/, "").trim();
+}
+/**
+ * A repo `name` becomes a path segment under repos/<visibility>/. A synced
+ * repos.yaml is operator data, but a malformed or hostile name must never
+ * escape that directory, so constrain it to a single, non-traversal component.
+ */
+function isSafePathComponent(value) {
+    return (value.length > 0 &&
+        !value.includes("/") &&
+        !value.includes("\\") &&
+        value !== "." &&
+        value !== "..");
+}
+/**
+ * Parse `personal/data/repos.yaml` into a clone list. Pure + exported for
+ * tests. Mirrors setup.sh's `clone_repos`: `visibility` defaults to public,
+ * `name` defaults to the URL basename. Malformed entries are skipped, never
+ * thrown.
+ */
+export function parseReposManifest(yamlText) {
+    let doc;
+    try {
+        doc = yaml.load(yamlText);
+    }
+    catch {
+        return [];
+    }
+    const rawRepos = doc?.repos;
+    if (!Array.isArray(rawRepos))
+        return [];
+    const out = [];
+    for (const entry of rawRepos) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const e = entry;
+        const url = typeof e.url === "string" ? e.url.trim() : "";
+        if (!url)
+            continue;
+        const visibility = e.visibility === "private" ? "private" : "public";
+        const name = typeof e.name === "string" && e.name.trim()
+            ? e.name.trim()
+            : repoNameFromUrl(url);
+        if (!isSafePathComponent(name))
+            continue;
+        out.push({ url, visibility, name });
+    }
+    return out;
+}
+/**
+ * Best-effort spawn: log a one-line outcome and carry on. NEVER throws and
+ * NEVER echoes child output — the same secret-safety stance as `runChecked`,
+ * since these children (auth refresh, secrets exec) touch credentials.
+ */
+function runBestEffort(deps, command, args, description, options) {
+    let result;
+    try {
+        result = deps.spawnSync(command, args, options ?? { stdio: "inherit" });
+    }
+    catch {
+        console.warn(`replica-sync: ${description} could not run — continuing.`);
+        return false;
+    }
+    if (!result || result.error || result.status !== 0) {
+        console.warn(`replica-sync: ${description} did not complete cleanly — continuing.`);
+        return false;
+    }
+    return true;
+}
+/**
+ * Authenticate `gh` for private clones by streaming GITHUB_TOKEN through the
+ * vault into the child's ENV ONLY, unsetting it in-shell, and piping it to
+ * `gh auth login --with-token` over stdin. The token never touches argv or
+ * this process's logs. Mirrors personal/scripts/setup.sh's `configure_gh`.
+ */
+function authGitHubViaVault(deps) {
+    const ghLogin = [
+        'TOKEN="$GITHUB_TOKEN"',
+        "unset GITHUB_TOKEN",
+        'printf "%s" "$TOKEN" | gh auth login --with-token',
+    ].join("\n");
+    const authed = runBestEffort(deps, "hq", ["secrets", "--personal", "exec", "--only", "GITHUB_TOKEN", "--", "bash", "-c", ghLogin], "GitHub auth via vault");
+    if (authed) {
+        // Let plain `git clone https://github.com/...` reuse gh's token so private
+        // repos don't prompt for a username/password.
+        runBestEffort(deps, "gh", ["auth", "setup-git"], "gh auth setup-git");
+    }
+}
+/** Clone any repos from `personal/data/repos.yaml` that aren't on disk yet. */
+function replicateRepos(deps, hqRoot) {
+    const manifestPath = path.join(hqRoot, "personal", "data", "repos.yaml");
+    let manifestText;
+    try {
+        manifestText = deps.readTextFile(manifestPath);
+    }
+    catch {
+        console.log("replica-sync: no personal/data/repos.yaml — skipping repo clone.");
+        return;
+    }
+    const repos = parseReposManifest(manifestText);
+    if (repos.length === 0) {
+        console.log("replica-sync: repos.yaml lists no repos — skipping.");
+        return;
+    }
+    const missing = repos.filter((repo) => !deps.pathExists(path.join(hqRoot, "repos", repo.visibility, repo.name, ".git")));
+    if (missing.length === 0) {
+        console.log("replica-sync: all repos already present.");
+        return;
+    }
+    // Private repos need gh auth first; public-only manifests skip the vault call.
+    if (missing.some((repo) => repo.visibility === "private")) {
+        authGitHubViaVault(deps);
+    }
+    for (const repo of missing) {
+        deps.mkdirp(path.join(hqRoot, "repos", repo.visibility));
+        const dest = path.join(hqRoot, "repos", repo.visibility, repo.name);
+        console.log(`replica-sync: cloning ${repo.visibility}/${repo.name}…`);
+        runBestEffort(deps, "git", ["clone", "--recurse-submodules", repo.url, dest], `clone ${repo.visibility}/${repo.name}`);
+    }
+}
+async function replicaSyncOutpost(opts, deps) {
+    const hqRoot = opts.hqRoot ?? deps.defaultHqRoot();
+    // Gate: only replicate on a box that has an HQ session. A box that was never
+    // signed in has nothing to pull — exit cleanly so the timer stays green.
+    const session = deps.loadCachedTokens();
+    if (!session?.refreshToken) {
+        console.log("replica-sync: no HQ session on this box yet — nothing to replicate.");
+        return;
+    }
+    // Auth refresh gates the run: if the seeded refresh token is dead, every
+    // authenticated step below (pull, secrets exec) would just cascade 401s.
+    // Stop the cycle cleanly instead — the timer retries next tick.
+    if (!runBestEffort(deps, "hq", ["auth", "refresh"], "HQ auth refresh")) {
+        console.warn("replica-sync: auth refresh failed — skipping this cycle (token likely expired).");
+        return;
+    }
+    runBestEffort(deps, "hq", ["sync", "pull", "--personal", "--hq-root", hqRoot, "--on-conflict", "keep"], "personal vault pull");
+    // rescue lays down the core kernel and expects companies/ to exist.
+    deps.mkdirp(path.join(hqRoot, "companies"));
+    runBestEffort(deps, "hq", ["rescue", "--hq-root", hqRoot, "--yes"], "HQ kernel rescue");
+    replicateRepos(deps, hqRoot);
+    console.log("replica-sync: complete.");
+}
 export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
-    const selfDeployDependencies = {
-        ...defaultSelfDeployDependencies,
+    const deps = {
+        ...defaultReplicaSyncDependencies,
         ...selfDeployOverrides,
     };
     const outposts = program
@@ -518,15 +684,29 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
         .command("self-deploy", { hidden: true })
         .description("Configure this EC2 host as a locally self-hosted HQ outpost")
         .option("--yes", "Skip the self-hosting confirmation")
-        .option("--hq-root <path>", "HQ root to sync", selfDeployDependencies.defaultHqRoot())
+        .option("--hq-root <path>", "HQ root to sync", deps.defaultHqRoot())
         .action(async (opts) => {
         try {
-            await selfDeployOutpost(opts, selfDeployDependencies);
+            await selfDeployOutpost(opts, deps);
         }
         catch (err) {
             fail(err);
         }
     });
+    outposts
+        .command("replica-sync", { hidden: true })
+        .description("Replicate your full HQ onto this box (personal pull + core rescue + repos). Runs on a timer.")
+        .option("--hq-root <path>", "HQ root to replicate into", deps.defaultHqRoot())
+        .action(async (opts) => {
+        // Best-effort background job: never hard-fail the systemd unit on a
+        // transient step. Swallow, log, and exit 0.
+        try {
+            await replicaSyncOutpost(opts, deps);
+        }
+        catch (err) {
+            console.warn(`replica-sync: unexpected error — ${err instanceof Error ? err.message : String(err)}`);
+        }
+    });
     outposts
         .command("provision")
         .alias("create")
@@ -846,8 +1026,40 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
                 process.stdout.write(JSON.stringify(result, null, 2) + "\n");
                 return;
             }
-            console.log(chalk.green("Login-URL regeneration requested. The box mints a fresh URL shortly — " +
-                "check `hq outposts status` to pick it up."));
+            console.log(chalk.green("Login-URL regeneration requested. The box mints a fresh URL shortly."));
+            console.log(chalk.dim("Next: `hq outposts status" +
+                (opts.id ? ` --id ${opts.id}` : "") +
+                "` to read the login URL, open it and sign in, then paste the code back with " +
+                "`hq outposts login-code <code>" +
+                (opts.id ? ` --id ${opts.id}` : "") +
+                "`."));
+        }
+        catch (err) {
+            fail(err);
+        }
+    });
+    outposts
+        .command("login-code <code>")
+        .description("Submit the Claude sign-in code for an Outpost that is awaiting login")
+        .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--json", "Emit raw JSON")
+        .action(async function (code, opts) {
+        try {
+            const trimmed = code.trim();
+            if (!trimmed) {
+                console.error(chalk.red("Provide the sign-in code: hq outposts login-code <code>"));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const result = await submitLoginCode(token, trimmed, opts.id);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(chalk.green("Code submitted — the box will finish signing in shortly."));
+            console.log(chalk.dim("Track it: `hq outposts status" +
+                (opts.id ? ` --id ${opts.id}` : "") +
+                "` (it flips to `ready` once Claude auth completes)."));
         }
         catch (err) {
             fail(err);
@@ -885,5 +1097,4 @@ export function registerOutpostsCommand(program, selfDeployOverrides = {}) {
         }
     });
 }
-//# sourceMappingURL=outposts.js.map
-//# debugId=839f8f76-584d-5ea8-b86e-a92a55c32a16
+//# sourceMappingURL=outposts.js.map

package/dist/commands/pack-install.js

@@ -33,8 +33,6 @@
  * registry file under the v12 layout. (`hq update <pack>` re-resolves source
  * from each pack's package.yaml; rationale lives in the layout-fix PR.)
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a90272ca-94a1-5905-85f8-af12a01cb58a")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -1699,5 +1697,4 @@ export async function installPack(source, opts = {}) {
         fs.rmSync(tmpDir, { recursive: true, force: true });
     }
 }
-//# sourceMappingURL=pack-install.js.map
-//# debugId=a90272ca-94a1-5905-85f8-af12a01cb58a
+//# sourceMappingURL=pack-install.js.map

package/dist/commands/packs.js

@@ -16,8 +16,6 @@
  *
  * Spec: knowledge/public/hq-core/package-yaml-spec.md.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b743f774-8d9b-594b-9ce4-e7f5a44faca0")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
@@ -469,5 +467,4 @@ export function registerPacksCommand(parent) {
         }
     });
 }
-//# sourceMappingURL=packs.js.map
-//# debugId=b743f774-8d9b-594b-9ce4-e7f5a44faca0
+//# sourceMappingURL=packs.js.map

package/dist/commands/people.js

@@ -11,8 +11,6 @@
  * roster for exactly ONE company (the active company, or the one named by
  * `--company`); nothing reads across company boundaries.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="555055d9-98e2-5fcd-b736-4b1df12daf4d")}catch(e){}}();
 import * as fs from "fs";
 import { Option } from "commander";
 import chalk from "chalk";
@@ -292,5 +290,4 @@ export function registerPeopleCommand(program, deps = {}) {
         }
     });
 }
-//# sourceMappingURL=people.js.map
-//# debugId=555055d9-98e2-5fcd-b736-4b1df12daf4d
+//# sourceMappingURL=people.js.map

package/dist/commands/pkg-install.js

@@ -12,8 +12,6 @@
  * 8. Update packages/registry.yaml
  * 9. Print next-step message
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ccc2e70c-f577-5a47-9a29-31a206194392")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -165,5 +163,4 @@ async function installPackage(slug, company) {
         }
     }
 }
-//# sourceMappingURL=pkg-install.js.map
-//# debugId=ccc2e70c-f577-5a47-9a29-31a206194392
+//# sourceMappingURL=pkg-install.js.map

package/dist/commands/pkg-list.js

@@ -4,11 +4,8 @@
  * Package installs use the content-pack installer, so this command delegates
  * to the same list view as `hq packs list`.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96eb060c-c1d0-5874-918f-e818f92c6242")}catch(e){}}();
 import { registerPacksListCommand } from './packs.js';
 export function registerPackageListCommand(parent) {
     registerPacksListCommand(parent);
 }
-//# sourceMappingURL=pkg-list.js.map
-//# debugId=96eb060c-c1d0-5874-918f-e818f92c6242
+//# sourceMappingURL=pkg-list.js.map

package/dist/commands/pkg-remove.js

@@ -5,8 +5,6 @@
  * 2. Remove entry from packages/registry.yaml
  * 3. Print next-step message
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e44da498-3e38-5643-b124-49aa2e91f42b")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
@@ -52,5 +50,4 @@ async function removePackage(slug) {
     console.log(chalk.green(`\nRemoved ${slug}.`));
     console.log(chalk.cyan('Run /package-remove ' + slug + ' in Claude to clean up merged content.'));
 }
-//# sourceMappingURL=pkg-remove.js.map
-//# debugId=e44da498-3e38-5643-b124-49aa2e91f42b
+//# sourceMappingURL=pkg-remove.js.map

package/dist/commands/pkg-update.js

@@ -4,8 +4,6 @@
  * If no slug: check all installed packages for updates.
  * If slug given: update only that package.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="35fae6a0-f8e1-5fde-90d8-34ae4adb3c1c")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -123,5 +121,4 @@ async function updatePackages(slug) {
     }
     console.log(`\n${updatedCount} package(s) updated${updatedCount > 0 ? '.' : ' — everything is current.'}`);
 }
-//# sourceMappingURL=pkg-update.js.map
-//# debugId=35fae6a0-f8e1-5fde-90d8-34ae4adb3c1c
+//# sourceMappingURL=pkg-update.js.map

package/dist/commands/publish.js

@@ -27,8 +27,6 @@
  *   - pack-install.ts:validateManifest (the 10 validation rules)
  *   - manifest.ts (modules.yaml read/write for provenance)
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e2f6607e-188c-57f9-beba-a81488d15225")}catch(e){}}();
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -405,5 +403,4 @@ export function registerPublishCommand(program) {
         }
     });
 }
-//# sourceMappingURL=publish.js.map
-//# debugId=e2f6607e-188c-57f9-beba-a81488d15225
+//# sourceMappingURL=publish.js.map

package/dist/commands/reindex.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="91aee9b3-dd72-5f05-99a8-d23b37f5eabe")}catch(e){}}();
 import { reindex } from '@indigoai-us/hq-cloud';
 export function registerReindexCommand(program) {
     program
@@ -34,5 +32,4 @@ export function registerReindexCommand(program) {
         process.exit(status);
     });
 }
-//# sourceMappingURL=reindex.js.map
-//# debugId=91aee9b3-dd72-5f05-99a8-d23b37f5eabe
+//# sourceMappingURL=reindex.js.map

package/dist/commands/rescue.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e0da62c9-7fd5-5514-b2d0-1b5b76ebcd21")}catch(e){}}();
 import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -157,5 +155,4 @@ export function registerRescueCommand(program) {
         }
     });
 }
-//# sourceMappingURL=rescue.js.map
-//# debugId=e0da62c9-7fd5-5514-b2d0-1b5b76ebcd21
+//# sourceMappingURL=rescue.js.map

package/dist/commands/run.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="26bb7e02-3864-5c66-8232-3abc8fc17dc1")}catch(e){}}();
 import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
@@ -144,5 +142,4 @@ export function registerRunCommand(program) {
         }
     });
 }
-//# sourceMappingURL=run.js.map
-//# debugId=26bb7e02-3864-5c66-8232-3abc8fc17dc1
+//# sourceMappingURL=run.js.map

package/dist/commands/safe-extract.js

@@ -32,8 +32,6 @@
  *     actually written (we do NOT rely solely on the pre-flight scan or on the
  *     tar binary's own protections).
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="372e4f76-03b2-5287-ac66-249543f88937")}catch(e){}}();
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -343,5 +341,4 @@ export function safeExtractTarball(tarballPath, finalDir, opts = {}) {
         }
     }
 }
-//# sourceMappingURL=safe-extract.js.map
-//# debugId=372e4f76-03b2-5287-ac66-249543f88937
+//# sourceMappingURL=safe-extract.js.map

package/dist/commands/secrets-scope.js

@@ -1,6 +1,4 @@
 /** Human label for a secrets scope: "your personal vault" or "company <slug-or-uid>". */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="718913a3-f80f-5bff-928e-a7aa9f51dd0d")}catch(e){}}();
 export function describeSecretsScope(ref) {
     if (ref.personal)
         return "your personal vault";
@@ -15,5 +13,4 @@ export function formatSecretsListHeader(scope) {
 export function formatSecretsListEmpty(scope) {
     return `No secrets found for ${scope}.`;
 }
-//# sourceMappingURL=secrets-scope.js.map
-//# debugId=718913a3-f80f-5bff-928e-a7aa9f51dd0d
+//# sourceMappingURL=secrets-scope.js.map

package/dist/commands/secrets.js

@@ -1,5 +1,3 @@
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="136bd272-0091-5fce-9a93-a2a375f98b38")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -1396,5 +1394,4 @@ export function registerSecretsCommand(program) {
         console.log(chalk.green("Secrets cache cleared."));
     });
 }
-//# sourceMappingURL=secrets.js.map
-//# debugId=136bd272-0091-5fce-9a93-a2a375f98b38
+//# sourceMappingURL=secrets.js.map

package/dist/commands/signals.js

@@ -19,8 +19,6 @@
  * agents can't fabricate a signal type even if they bypass the CLI's
  * --type flag parsing.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="395fa417-375a-55e7-b881-e65431742835")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
@@ -241,5 +239,4 @@ export function registerSignalsCommand(program) {
         .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
-//# sourceMappingURL=signals.js.map
-//# debugId=395fa417-375a-55e7-b881-e65431742835
+//# sourceMappingURL=signals.js.map

package/dist/commands/skill.js

@@ -32,8 +32,6 @@
  * derived `authorPersonUid`; the CLI never sends an author. An optional
  * `--note` rides as `authorNote` (the change's rationale / failure context).
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5bdf8a18-3088-5615-b596-9be2c9fdb5cc")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createHash } from "node:crypto";
@@ -589,5 +587,4 @@ export function registerSkillCommand(program, deps = {}) {
     });
     return skill;
 }
-//# sourceMappingURL=skill.js.map
-//# debugId=5bdf8a18-3088-5615-b596-9be2c9fdb5cc
+//# sourceMappingURL=skill.js.map

package/dist/commands/sources.js

@@ -17,8 +17,6 @@
  *   --format   'table' when stdout is a TTY, 'json' when piped.
  *   --limit    50.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1123e933-4c37-5679-ae51-84cffd42e31b")}catch(e){}}();
 import * as fs from "node:fs";
 import * as path from "node:path";
 import chalk from "chalk";
@@ -251,5 +249,4 @@ export function registerSourcesCommand(program) {
         .option("--format <fmt>", "Output format: table | json (default: table for TTY, json piped)")
         .action(withErrorHandling(async (options) => runEntities(options)));
 }
-//# sourceMappingURL=sources.js.map
-//# debugId=1123e933-4c37-5679-ae51-84cffd42e31b
+//# sourceMappingURL=sources.js.map

package/dist/commands/sync-mode.js

@@ -30,8 +30,6 @@
  * in package.json — revert that line to `^5.20.0` (or whatever the
  * published cut is) once US-004 ships to npm.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="534a51ec-53e8-5cde-98c6-5ffc1741d2c1")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -245,5 +243,4 @@ export function registerSyncModeCommand(syncCmd) {
         }
     });
 }
-//# sourceMappingURL=sync-mode.js.map
-//# debugId=534a51ec-53e8-5cde-98c6-5ffc1741d2c1
+//# sourceMappingURL=sync-mode.js.map

package/dist/commands/sync-narrow.js

@@ -36,8 +36,6 @@
  * release is unpublished, hq-cli pins `@indigoai-us/hq-cloud` to
  * `file:../hq-cloud` via `pnpm.overrides`.
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8cdf980e-e3cf-585c-b2e5-1615765675a1")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import * as fs from "node:fs";
@@ -334,5 +332,4 @@ export function registerSyncNarrowCommand(syncCmd) {
         }
     });
 }
-//# sourceMappingURL=sync-narrow.js.map
-//# debugId=8cdf980e-e3cf-585c-b2e5-1615765675a1
+//# sourceMappingURL=sync-narrow.js.map

package/dist/commands/sync.js

@@ -1,8 +1,6 @@
 /**
  * hq modules sync command (US-004)
  */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="abaf6ba7-702e-53e3-9d38-21182f05e529")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import { findHqRoot, readManifest, readLock, writeLock, getModulesDir, } from '../utils/manifest.js';
@@ -111,5 +109,4 @@ export function registerSyncCommand(program) {
         }
     });
 }
-//# sourceMappingURL=sync.js.map
-//# debugId=abaf6ba7-702e-53e3-9d38-21182f05e529
+//# sourceMappingURL=sync.js.map