@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [5.78.0]
+
+### Added
+
+- Hidden `hq core` command group bundles 21 HQ scaffold scripts from
+  `assets/scaffold/`; its ten index rebuilders run through
+  `hq core rebuild-index <target>`. The group is absent from `hq --help`. (#279)
+- Capability-scoped `HQ_API_KEY` surfaces now cover vault secrets, files,
+  agents, members, and pack installs. (#278)
+- Clarified `hq api-keys create --scope`: scopes grant the exact secret name and
+  slash descendants, not underscore siblings. (#277)
+
+### Fixed
+
+- Kept `convert-codex` scaffold-owned because its validator remains in the HQ
+  tree. (#279)
+- `rebuild-threads-index` no longer skips `recent.md` when `pipefail` meets a
+  large result set. (#279)
+- `generate-openai-yaml` now resolves the correct HQ root instead of finding
+  zero skills. (#279)
+- Source maps no longer enter the npm tarball when the package `files` allowlist
+  is present. (#279)
+
+## [5.77.14]
+
+### Fixed
+
+- Extend `HQ_API_KEY` fail-closed: reject metadata-only `hq secrets get`
+  without `--reveal`, and hard-error `hq run` / `hq install` when a vault API
+  key is set (Cognito session required). (#273)
+- Keep the Cognito-only gate on the top-level `hq install` route only — not
+  inside shared `installPack()` — so `hq packs update` cannot un-wire a pack
+  and then abort mid-flight under `HQ_API_KEY`. (#273)
+
 ## [5.77.13]
 
 ### Added

package/assets/scaffold/core/scripts/archive-old-threads.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# archive-old-threads.sh — move thread JSONs older than CUTOFF_DAYS into
+# workspace/threads/archive/YYYY-MM/.
+#
+# Default cutoff: 60 days. Idempotent — files already in archive/ are ignored.
+# Safe to run repeatedly; gated to once-per-day via a touchfile when invoked
+# with --gated.
+#
+# Usage:
+#   core/scripts/archive-old-threads.sh              # run archive, 60-day cutoff
+#   core/scripts/archive-old-threads.sh --days 90    # custom cutoff
+#   core/scripts/archive-old-threads.sh --gated      # skip if ran within 24h
+#   core/scripts/archive-old-threads.sh --dry-run    # preview without moving
+
+set -euo pipefail
+
+HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+cd "$HQ_ROOT"
+
+CUTOFF_DAYS=60
+DRY_RUN="false"
+GATED="false"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --days) CUTOFF_DAYS="$2"; shift 2 ;;
+    --dry-run) DRY_RUN="true"; shift ;;
+    --gated) GATED="true"; shift ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+TOUCHFILE="workspace/.last-archive-run"
+if [[ "$GATED" == "true" && -f "$TOUCHFILE" ]]; then
+  # macOS `stat -f %m` gives mtime epoch; GNU `stat -c %Y`. Try both.
+  mtime=$(stat -f %m "$TOUCHFILE" 2>/dev/null || stat -c %Y "$TOUCHFILE" 2>/dev/null || echo 0)
+  now=$(date +%s)
+  if [[ $((now - mtime)) -lt 86400 ]]; then
+    echo "archive-old-threads: gated (ran <24h ago, skipping)" >&2
+    exit 0
+  fi
+fi
+
+THREADS_DIR="workspace/threads"
+ARCHIVE_ROOT="${THREADS_DIR}/archive"
+mkdir -p "$ARCHIVE_ROOT"
+
+# Thread files are named T-YYYYMMDD-HHMMSS-slug.json.
+# Extract YYYYMMDD from name, compare to cutoff.
+CUTOFF_EPOCH=$(date -v-"${CUTOFF_DAYS}"d +%Y%m%d 2>/dev/null || date -d "-${CUTOFF_DAYS} days" +%Y%m%d 2>/dev/null)
+if [[ -z "$CUTOFF_EPOCH" ]]; then
+  echo "archive-old-threads: could not compute cutoff date" >&2
+  exit 1
+fi
+
+moved=0
+skipped=0
+while IFS= read -r f; do
+  base=$(basename "$f")
+  # Extract YYYYMMDD (after "T-")
+  date_part=$(echo "$base" | sed -E 's/^T-([0-9]{8})-.*/\1/')
+  if [[ ! "$date_part" =~ ^[0-9]{8}$ ]]; then
+    skipped=$((skipped + 1))
+    continue
+  fi
+  if [[ "$date_part" -lt "$CUTOFF_EPOCH" ]]; then
+    # Archive bucket: YYYY-MM
+    yyyy="${date_part:0:4}"
+    mm="${date_part:4:2}"
+    bucket="${ARCHIVE_ROOT}/${yyyy}-${mm}"
+    if [[ "$DRY_RUN" == "true" ]]; then
+      echo "WOULD MOVE: $f -> $bucket/" >&2
+    else
+      mkdir -p "$bucket"
+      mv "$f" "$bucket/"
+    fi
+    moved=$((moved + 1))
+  fi
+done < <(ls "$THREADS_DIR"/T-*.json 2>/dev/null || true)
+
+if [[ "$DRY_RUN" != "true" && "$GATED" == "true" ]]; then
+  mkdir -p "$(dirname "$TOUCHFILE")"
+  touch "$TOUCHFILE"
+fi
+
+echo "archive-old-threads: cutoff=${CUTOFF_DAYS}d (before ${CUTOFF_EPOCH}) moved=${moved} skipped=${skipped} dry_run=${DRY_RUN}" >&2

package/assets/scaffold/core/scripts/backfill-company-skill-mirrors.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# backfill-company-skill-mirrors.sh
+#
+# One-shot, idempotent. Walks every company under companies/{co}/skills/ and
+# companies/{co}/commands/ and ensures a mirror symlink exists at
+# .claude/skills/{prefix}-{name}/ (or .claude/commands/{prefix}-{name}.md).
+#
+# Logic is delegated to .claude/hooks/auto-mirror-company-skill.sh — this
+# script just discovers candidate paths and feeds them in. Re-run safely.
+#
+# Usage:  bash core/scripts/backfill-company-skill-mirrors.sh
+
+set -euo pipefail
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+HOOK="$PROJECT_DIR/.claude/hooks/auto-mirror-company-skill.sh"
+
+if [[ ! -x "$HOOK" ]]; then
+  echo "ERROR: auto-mirror hook not found or not executable: $HOOK" >&2
+  exit 1
+fi
+
+cd "$PROJECT_DIR"
+
+CREATED=0
+SKIPPED=0
+
+emit() {
+  local rel_path="$1"
+  rel_path="${rel_path//\/\//\/}"
+  local out
+  out=$(echo "{\"tool_input\":{\"file_path\":\"$rel_path\"}}" | CLAUDE_PROJECT_DIR="$PROJECT_DIR" bash "$HOOK" 2>&1 || true)
+  if [[ -n "$out" ]]; then
+    echo "$out"
+    if [[ "$out" == *"linked"* ]]; then
+      CREATED=$((CREATED + 1))
+    else
+      SKIPPED=$((SKIPPED + 1))
+    fi
+  fi
+}
+
+shopt -s nullglob
+for co_dir in companies/*/; do
+  co="${co_dir%/}"
+  co="${co##*/}"
+
+  # Skip if no manifest entry (defensive — shouldn't happen).
+  [[ -d "$co_dir" ]] || continue
+
+  # Top-level skills: directory form (skills/{name}/SKILL.md) and flat-file form (skills/{name}.md).
+  if [[ -d "$co_dir/skills" ]]; then
+    for skill_md in "$co_dir/skills"/*/SKILL.md; do
+      [[ -f "$skill_md" ]] || continue
+      emit "$skill_md"
+    done
+    for flat_md in "$co_dir/skills"/*.md; do
+      [[ -f "$flat_md" ]] || continue
+      emit "$flat_md"
+    done
+  fi
+
+  # Top-level commands: commands/{name}.md
+  if [[ -d "$co_dir/commands" ]]; then
+    for cmd_md in "$co_dir/commands"/*.md; do
+      [[ -f "$cmd_md" ]] || continue
+      emit "$cmd_md"
+    done
+  fi
+done
+
+echo ""
+echo "backfill complete: $CREATED linked, $SKIPPED skipped (already-correct or no-prefix)"

package/assets/scaffold/core/scripts/backfill-workspace-mirror.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# One-time backfill: walk workspace/threads/*.json and replay each through
+# the mirror hook so existing sessions are represented in their companies'
+# workspace/ folders.
+#
+# Idempotent: hardlinks use ln -f, index.jsonl rows are deduped by
+# (thread_id, ts, kind). Safe to re-run.
+#
+# Usage:  bash core/scripts/backfill-workspace-mirror.sh [HQ_ROOT]
+
+set -euo pipefail
+
+HQ_ROOT="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+HOOK="$HQ_ROOT/.claude/hooks/mirror-thread-to-company.sh"
+THREADS_DIR="$HQ_ROOT/workspace/threads"
+
+[ -x "$HOOK" ] || { echo "Mirror hook missing or not executable: $HOOK" >&2; exit 1; }
+[ -d "$THREADS_DIR" ] || { echo "No threads dir at $THREADS_DIR" >&2; exit 1; }
+
+mirrored=0
+skipped=0
+total=0
+
+for thread in "$THREADS_DIR"/T-*.json; do
+  [ -f "$thread" ] || continue
+  total=$((total + 1))
+
+  has_company=$(jq -r 'if .metadata.company then "yes" else "no" end' "$thread" 2>/dev/null || echo "no")
+  if [ "$has_company" != "yes" ]; then
+    skipped=$((skipped + 1))
+    continue
+  fi
+
+  printf '{"tool_name":"Write","tool_input":{"file_path":"%s"}}' "$thread" \
+    | bash "$HOOK"
+
+  mirrored=$((mirrored + 1))
+done
+
+echo "Backfill complete:"
+echo "  Total threads:   $total"
+echo "  Mirrored:        $mirrored"
+echo "  Skipped (no co): $skipped"
+echo
+echo "Per-company index.jsonl row counts:"
+for index_file in "$HQ_ROOT"/companies/*/workspace/index.jsonl; do
+  [ -f "$index_file" ] || continue
+  co=$(basename "$(dirname "$(dirname "$index_file")")")
+  rows=$(wc -l < "$index_file" | tr -d ' ')
+  printf "  %-20s %s rows\n" "$co" "$rows"
+done