@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/dist/utils/vault-api.js

@@ -62,8 +62,65 @@ async function peekPlanLimitStatus(response) {
         return response;
     }
 }
+/**
+ * Map Cognito JWT paths onto parallel Bearer `hqk_` routes under `/v1/keys/…`.
+ * Returns null when no keyed route exists (caller must fail closed).
+ *
+ * The table mirrors hq-pro's gateway routes, NOT its path shapes: a rewrite is
+ * listed only where an `hqk_`-authorized route actually exists. Two surfaces
+ * are therefore unmapped ON PURPOSE, and adding a rewrite for them would turn
+ * an explicit fail-closed error into a 404/401 that reads like a login problem:
+ *
+ *   - the unversioned file ACL + share surfaces (`/files/{companyUid}/acl…`,
+ *     `/files/{companyUid}/share-session`) — hq-pro serves these under JWT
+ *     only. `/v1/keys/files/…` exists but covers the VERSIONED family
+ *     (`list`, `versions`, `versions-list`, `grants`, `tombstones`, `presign`,
+ *     `delete`, `restore`), which is a different set of handlers.
+ *   - the notify surface (`/v1/notify/dm`, `/v1/notify/thread`) behind
+ *     `hq agents message|thread` — there is no `/v1/keys/notify…` route.
+ *
+ * Both are additionally gated at the command layer so they fail before any
+ * network call; this stays the backstop for a new call site that forgets to.
+ */
+export function rewritePathForApiKey(path) {
+    if (path.startsWith("/v1/keys/") || path === "/v1/keys/secrets/fetch") {
+        return path;
+    }
+    const rewrites = [
+        [/^\/v1\/files(\/|$)/, "/v1/keys/files$1"],
+        [/^\/v1\/agents(\/|$)/, "/v1/keys/agents$1"],
+        [/^\/v1\/search(\/|$)/, "/v1/keys/search$1"],
+        [/^\/v1\/listings(\/|$)/, "/v1/keys/listings$1"],
+        [/^\/v1\/fleet(\/|$)/, "/v1/keys/fleet$1"],
+        [/^\/v1\/outposts(\/|$)/, "/v1/keys/outposts$1"],
+        [/^\/v1\/integrations(\/|$)/, "/v1/keys/integrations$1"],
+        [/^\/v1\/work-mesh(\/|$)/, "/v1/keys/work-mesh$1"],
+        [/^\/v1\/memberships(\/|$)/, "/v1/keys/memberships$1"],
+        [/^\/v1\/companies(\/|$)/, "/v1/keys/companies$1"],
+        [/^\/membership(\/|$)/, "/v1/keys/membership$1"],
+        [/^\/company-settings(\/|$)/, "/v1/keys/company-settings$1"],
+        [/^\/sts(\/|$)/, "/v1/keys/sts$1"],
+        // Secrets Cognito routes → keyed family (list/set/get/delete/acl).
+        [/^\/secrets(\/|$)/, "/v1/keys/secrets$1"],
+    ];
+    for (const [pattern, replacement] of rewrites) {
+        if (pattern.test(path))
+            return path.replace(pattern, replacement);
+    }
+    return null;
+}
 export async function vaultApiFetch(opts) {
-    const url = new URL(opts.path, opts.baseUrl ?? DEFAULT_VAULT_API_URL);
+    let path = opts.path;
+    if (opts.token.startsWith("hqk_")) {
+        const rewritten = rewritePathForApiKey(path);
+        if (rewritten === null) {
+            throw Object.assign(new Error(`HQ_API_KEY cannot call '${path}' — hq-pro has no Bearer hqk_ route ` +
+                `for this surface. Use a Cognito session (unset HQ_API_KEY), or a ` +
+                `keyed route under /v1/keys/… when available.`), { expected: true });
+        }
+        path = rewritten;
+    }
+    const url = new URL(path, opts.baseUrl ?? DEFAULT_VAULT_API_URL);
     if (opts.query) {
         for (const [k, v] of Object.entries(opts.query)) {
             url.searchParams.set(k, v);
@@ -73,7 +130,7 @@ export async function vaultApiFetch(opts) {
     const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
     Sentry.addBreadcrumb({
         category: "http",
-        message: `${method} ${opts.path}`,
+        message: `${method} ${path}`,
         level: "info",
         data: { url: safeUrl, method },
     });
@@ -89,7 +146,7 @@ export async function vaultApiFetch(opts) {
     if (!response.ok) {
         Sentry.addBreadcrumb({
             category: "http",
-            message: `${method} ${opts.path} → ${response.status}`,
+            message: `${method} ${path} → ${response.status}`,
             level: "warning",
             data: { url: safeUrl, status: response.status },
         });
@@ -267,6 +324,20 @@ async function resolveCompanyFromMemberships(token) {
         uids.map((u) => `  --company ${u}`).join('\n'));
 }
 export async function getCompanyUid(token, companySlug) {
+    // Vault API keys are company-bound. Entity slug resolution has no keyed
+    // route, so under hqk_ we accept an explicit cmp_ uid (or HQ_COMPANY_UID)
+    // and otherwise fall through to keyed GET /v1/keys/membership/me.
+    if (token.startsWith("hqk_")) {
+        const ref = companySlug ?? process.env.HQ_COMPANY_UID?.trim();
+        if (ref) {
+            if (!looksLikeCompanyUid(ref)) {
+                throw Object.assign(new Error(`HQ_API_KEY is set; --company must be a company uid (cmp_…) — ` +
+                    `resolving a slug needs a Cognito session. Got '${ref}'.`), { expected: true });
+            }
+            return ref;
+        }
+        return resolveCompanyFromMemberships(token);
+    }
     if (companySlug) {
         return resolveCompanyUid(token, companySlug);
     }

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.77.14",
+  "version": "5.78.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
     "hq": "dist/index.js",
     "hq-auth-refresh": "dist/bin/hq-auth-refresh.js"
   },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "assets/scaffold",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "build": "node scripts/generate-dsn.mjs && tsc && node scripts/chmod-bins.mjs",
     "prepublishOnly": "npm run build",

package/.claude/policies/hq-cli-interactive-reads-use-sts-vend.md

@@ -1,49 +0,0 @@
----
-id: hq-cli-interactive-reads-use-sts-vend
-title: Interactive vault reads vend via /sts/vend, never the legacy POST /vend
-scope: repo
-trigger: any hq-cli command that vends vault credentials to read/list company objects (files browse, files cat, files get/search, or any new interactive read surface)
-enforcement: hard
-public: false
-version: 1
-created: 2026-05-29
-updated: 2026-05-29
-source: back-pressure-failure
-applies_to: [aws]
----
-
-## Rule
-
-Interactive vault reads in hq-cli MUST vend through the multi-tenant STS
-routes — `VaultClient.sts.vend({ companyUid })` (`POST /sts/vend`, company) or
-`VaultClient.sts.vendSelf({ personUid })` (`POST /sts/vend-self`, personal).
-NEVER vend through the legacy `VaultClient.vend(...)` (`POST /vend`).
-
-The legacy `POST /vend` (hq-pro `VaultVendFunction` → `vend.handler`) builds
-its IAM policy against a static `process.env.BUCKET_ARN`, but the hq-pro infra
-(`infra/vault-service.ts`) deliberately does NOT set `BUCKET_ARN` — production
-is multi-tenant with one bucket per company. At runtime `BUCKET_ARN` is
-`undefined`, so the session policy contains `"Resource":[null,"undefined/…"]`
-and STS rejects it with `MalformedPolicyDocument: Syntax error at position
-(-1,-1)` → the client sees a 500 "Failed to generate credentials". Only
-`/sts/vend{,-self,-child}` resolve the per-entity bucket (`entity.bucketArn`)
-and apply role/ACL scoping server-side (owner/admin → full access; member/
-guest → per-prefix). `policy-builder.ts` even documents that `POST /vend` "has
-no production callers" — treat it as dead.
-
-Related namespace rule: company vault bucket keys are **company-relative**
-(`knowledge/foo.md`, NOT `companies/<slug>/knowledge/foo.md`). Translate the
-CLI's anchored `companies/<slug>/…` form to the bucket-relative key at the S3
-boundary (`toBucketRelative` / `toCompanyAnchored` in `files-browse.ts`), and
-normalize ACL grant paths with `grantPathToPrefix` before `startsWith`
-classification. Listing/getting with the anchored prefix returns nothing.
-
-## Rationale
-
-`hq files browse`/`cat` (US-009) were wired to `POST /vend`, which 500'd on
-every multi-tenant call. The root cause was an undefined `BUCKET_ARN` env on
-the vend Lambda, not a stale deploy — redeploying clean source did not fix it.
-The working fix routed both commands through `/sts/vend` + `/sts/vend-self`
-(client-only, hq-cloud 5.43.0 / hq-cli 5.29.0) and fixed the company-relative
-namespace translation. Captured so future interactive-read surfaces reach for
-the STS routes from the start and don't resurrect the dead `POST /vend`.

package/.github/workflows/ci.yml

@@ -1,46 +0,0 @@
-name: CI
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: build (node ${{ matrix.node-version }})
-    strategy:
-      fail-fast: false
-      matrix:
-        # 20 is the declared engines floor (package.json engines.node >=20),
-        # 22 is the current dev/publish baseline.
-        node-version: ["20", "22"]
-    uses: indigoai-us/.github/.github/workflows/_node-ci.yml@main
-    with:
-      package-manager: pnpm
-      pnpm-version: "10"
-      node-version: ${{ matrix.node-version }}
-      run-build: true
-      run-lint: true
-      run-coverage: true
-    secrets: inherit
-
-  e2e:
-    name: e2e (node 22)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: "10"
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm build
-      - run: pnpm test:e2e

package/.github/workflows/publish.yml

@@ -1,36 +0,0 @@
-name: Publish to npm
-on:
-  push:
-    tags: ["v*"]
-  # Manual dry-run: validate the build/pack/smoke pipeline without publishing.
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Dry-run (validate build/pack/smoke; npm publish --dry-run, no Sentry upload)"
-        type: boolean
-        default: true
-
-jobs:
-  publish:
-    permissions:
-      contents: read
-      id-token: write
-    uses: indigoai-us/.github/.github/workflows/_npm-publish.yml@main
-    with:
-      package-manager: pnpm
-      pnpm-version: "10"
-      node-version: "24"
-      build-command: "pnpm run build"
-      dsn-env-name: "HQ_CLI_PUBLISH_SENTRY_DSN"
-      sentry-inject-dir: "dist/"
-      smoke-test-arg: "hq"
-      sentry-release-prefix: "hq-cli"
-      sentry-upload-paths: "dist/ node_modules/@indigoai-us/hq-cloud/dist/"
-      sentry-org: "indigo-d0"
-      sentry-project: "hq-cli"
-      # Prerelease versions (e.g. 5.x.y-rc.0) ship to the rc dist-tag, not latest.
-      prerelease-dist-tag: "rc"
-      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
-    secrets:
-      sentry-dsn: ${{ secrets.HQ_CLI_PUBLISH_SENTRY_DSN }}
-      sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}

package/.github/workflows/scripts/smoke-test-pkg.sh

@@ -1,97 +0,0 @@
-#!/bin/bash
-# smoke-test-pkg.sh — pre-publish cross-package import smoke test (Bug A guard).
-#
-# Single-package adaptation of the same script used in the legacy hq monorepo.
-# The monorepo version operated on `packages/$PKG/package.json`; this version
-# reads `./package.json` because each extracted repo is a single package at
-# its root.
-#
-# Install the package in an isolated tmpdir — using a freshly-packed tarball
-# when the package.json version is new, or fetching the existing name@version
-# from npm when it is already published — then boot the binary with
-# `--version`. The boot exercises the full module-load graph and the
-# transitive `@indigoai-us/*` resolution path a customer's `npm install`
-# would take. If the boot fails the script exits non-zero and the workflow
-# aborts before any further publish steps run.
-#
-# Why we don't skip when the consumer's version is already on npm:
-#   @indigoai-us/hq-cli depends on @indigoai-us/hq-cloud via a caret range
-#   (^5.1.0). A producer bump (published from indigoai-us/hq-cloud) re-resolves
-#   this consumer's transitive deps on the next fresh install, so an already-
-#   published consumer is NOT actually "locked." If the new producer drops or
-#   renames a symbol the published consumer imports, `hq --version` crashes
-#   on every fresh install starting the moment the producer publishes.
-#
-# Usage:
-#   smoke-test-pkg.sh <bin-name>
-# Example:
-#   smoke-test-pkg.sh hq
-
-set -uo pipefail
-
-BIN=${1:?usage: smoke-test-pkg.sh <bin-name>}
-
-PKG_JSON="package.json"
-if [ ! -f "$PKG_JSON" ]; then
-  echo "::error::smoke-test-pkg.sh: $PKG_JSON not found (cwd: $(pwd))"
-  exit 2
-fi
-
-NAME=$(jq -r .name "$PKG_JSON")
-VER=$(jq -r .version "$PKG_JSON")
-
-# Pick the install target. Already on npm → install by name@version so the
-# smoke matches what a customer would actually receive. Not yet on npm →
-# pack the local repo; the next publish step will push that exact byte-for-
-# byte content. Either way, `npm install` happens OUTSIDE this repo so
-# transitive @indigoai-us/* deps resolve from the registry.
-INSTALL_SOURCE=""
-if npm view "$NAME@$VER" version >/dev/null 2>&1; then
-  INSTALL_TARGET="$NAME@$VER"
-  INSTALL_SOURCE="npm registry (consumer version already published)"
-else
-  TARBALL_RELATIVE=$(npm pack --silent --pack-destination /tmp)
-  if [ -z "$TARBALL_RELATIVE" ]; then
-    echo "::error::npm pack produced no tarball for $NAME"
-    exit 1
-  fi
-  INSTALL_TARGET="/tmp/$TARBALL_RELATIVE"
-  if [ ! -f "$INSTALL_TARGET" ]; then
-    echo "::error::expected tarball at $INSTALL_TARGET not found"
-    exit 1
-  fi
-  INSTALL_SOURCE="packed tarball ($TARBALL_RELATIVE)"
-fi
-
-echo "::group::smoke test: $NAME@$VER via $INSTALL_SOURCE"
-
-SMOKE=$(mktemp -d)
-pushd "$SMOKE" >/dev/null
-
-printf '%s' '{"name":"smoke","version":"0.0.0","private":true}' > package.json
-
-if ! npm install --no-audit --no-fund --no-package-lock "$INSTALL_TARGET" >/tmp/smoke-install.log 2>&1; then
-  echo "::error::pre-publish smoke install FAILED for $NAME@$VER:"
-  tail -50 /tmp/smoke-install.log
-  popd >/dev/null
-  echo "::endgroup::"
-  exit 1
-fi
-
-set +e
-OUT=$("./node_modules/.bin/$BIN" --version 2>&1)
-CODE=$?
-set -e
-
-popd >/dev/null
-
-if [ "$CODE" -ne 0 ]; then
-  echo "::error::pre-publish smoke FAILED for $NAME@$VER (exit $CODE):"
-  echo "::error::$OUT"
-  echo "::error::Likely cause: a cross-package symbol was changed (added, removed, renamed) in another @indigoai-us/* package without keeping this consumer's import in sync. Bump this consumer (or revert the producer change) and re-tag, OR set the repo/workflow variable WORKFLOW_ALLOW_BROKEN_PUBLISH=1 to override (audited)."
-  echo "::endgroup::"
-  exit 1
-fi
-
-echo "✓ smoke ok: $NAME@$VER → $BIN --version → $OUT  (via $INSTALL_SOURCE)"
-echo "::endgroup::"

package/e2e/cli.test.ts

@@ -1,128 +0,0 @@
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { spawn } from "node:child_process";
-import { afterEach, describe, expect, it } from "vitest";
-import { version } from "../package.json";
-
-const cliEntry = path.resolve("dist/index.js");
-const tempDirs: string[] = [];
-
-interface CliResult {
-  code: number | null;
-  stdout: string;
-  stderr: string;
-}
-
-function runHq(args: string[], options: { cwd?: string; env?: NodeJS.ProcessEnv } = {}) {
-  return new Promise<CliResult>((resolve, reject) => {
-    const child = spawn(process.execPath, [cliEntry, ...args], {
-      cwd: options.cwd,
-      env: {
-        ...process.env,
-        HQ_NO_UPDATE_CHECK: "1",
-        ...options.env,
-      },
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", reject);
-    child.on("close", (code) => resolve({ code, stdout, stderr }));
-  });
-}
-
-// Spawn the built CLI with its stdout read-end closed immediately, so the
-// child's first write to stdout hits EPIPE — the `hq … | head` / `source <(hq
-// …)` scenario behind HQ-6B. Returns the child's own exit code + stderr.
-function runHqWithClosedStdout(args: string[]) {
-  return new Promise<{ code: number | null; stderr: string }>(
-    (resolve, reject) => {
-      const child = spawn(process.execPath, [cliEntry, ...args], {
-        env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
-        stdio: ["ignore", "pipe", "pipe"],
-      });
-      let stderr = "";
-      child.stderr.setEncoding("utf8");
-      child.stderr.on("data", (chunk) => {
-        stderr += chunk;
-      });
-      // Close the read end up front (and again on any byte that slips through)
-      // so subsequent writes by the child fail with EPIPE.
-      child.stdout.on("data", () => child.stdout.destroy());
-      child.stdout.destroy();
-      child.on("error", reject);
-      child.on("close", (code) => resolve({ code, stderr }));
-    },
-  );
-}
-
-async function makeTempDir(prefix: string) {
-  const dir = await mkdtemp(path.join(tmpdir(), prefix));
-  tempDirs.push(dir);
-  return dir;
-}
-
-afterEach(async () => {
-  await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
-});
-
-describe("built hq CLI", () => {
-  it("prints help from the built entrypoint", async () => {
-    const result = await runHq(["--help"]);
-
-    expect(result.code).toBe(0);
-    expect(result.stderr).toBe("");
-    expect(result.stdout).toContain("Usage: hq [options] [command]");
-    expect(result.stdout).toContain("HQ management CLI");
-    expect(result.stdout).toContain("whoami");
-  });
-
-  it("exits cleanly when the downstream reader closes the pipe (HQ-6B)", async () => {
-    // Regression for HQ-6B: a closed stdout reader must NOT crash the CLI with
-    // a fatal `write EPIPE`. The process should exit 0 with no EPIPE traceback.
-    const { code, stderr } = await runHqWithClosedStdout(["--help"]);
-
-    expect(code).toBe(0);
-    expect(stderr).not.toMatch(/EPIPE/);
-    expect(stderr).not.toMatch(/Error:/);
-  });
-
-  it("prints the package version from the built entrypoint", async () => {
-    const result = await runHq(["--version"]);
-
-    expect(result.code).toBe(0);
-    expect(result.stderr).toBe("");
-    expect(result.stdout.trim()).toBe(version);
-  });
-
-  it("reports logged-out state without network or credentials", async () => {
-    const home = await makeTempDir("hq-cli-e2e-home-");
-    const cwd = await makeTempDir("hq-cli-e2e-cwd-");
-
-    const result = await runHq(["whoami"], {
-      cwd,
-      env: {
-        HOME: home,
-        USERPROFILE: home,
-        XDG_CONFIG_HOME: path.join(home, ".config"),
-        XDG_CACHE_HOME: path.join(home, ".cache"),
-        HQ_MACHINE_IDENTITY: undefined,
-        HQ_MACHINE_CREDS: undefined,
-      },
-    });
-
-    expect(result.code).toBe(0);
-    expect(result.stderr).toBe("");
-    expect(result.stdout.trim()).toBe("Not logged in. Run 'hq login' to authenticate.");
-  });
-});

package/eslint.config.js

@@ -1,37 +0,0 @@
-import js from "@eslint/js";
-import tseslint from "typescript-eslint";
-
-const sourceFiles = ["src/**/*.ts"];
-const recommended = tseslint
-  .config(js.configs.recommended, ...tseslint.configs.recommended)
-  .map((config) => ({
-    ...config,
-    files: sourceFiles,
-  }));
-
-export default [
-  {
-    ignores: ["dist/**", "generated/**", "node_modules/**"],
-  },
-  ...recommended,
-  {
-    files: sourceFiles,
-    rules: {
-      "no-undef": "off",
-      "no-useless-assignment": "warn",
-      "no-useless-escape": "warn",
-      "prefer-const": "warn",
-      "preserve-caught-error": "off",
-      "@typescript-eslint/no-explicit-any": "warn",
-      "@typescript-eslint/no-require-imports": "warn",
-      "@typescript-eslint/no-unused-vars": [
-        "warn",
-        {
-          argsIgnorePattern: "^_",
-          caughtErrorsIgnorePattern: "^_",
-          varsIgnorePattern: "^_",
-        },
-      ],
-    },
-  },
-];

package/pnpm-workspace.yaml

@@ -1,4 +0,0 @@
-allowBuilds:
-  better-sqlite3: true
-minimumReleaseAgeExclude:
-  - '@indigoai-us/hq-cloud@6.14.14 || 6.14.18 || 6.14.19 || 6.14.27'

package/scripts/chmod-bins.mjs

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-/**
- * Make every declared `bin` executable after `tsc` emits it.
- *
- * WHY: the build is plain `tsc`, and TypeScript does NOT set the executable
- * bit on its output — `dist/index.js` lands as 0644 despite carrying a
- * `#!/usr/bin/env node` shebang. Most `npm install` paths re-chmod bin targets
- * to 0755 while linking, but not all do: a root global install on a fresh
- * Amazon Linux outpost (`npm install -g @indigoai-us/hq-cli`) has been observed
- * to leave the linked target at 0644, so `/usr/bin/hq` resolves to a
- * non-executable file and EVERY `hq …` invocation on the box dies with
- * "Permission denied" — the outpost never becomes CLI-ready.
- *
- * Fixing it here means the published tarball ships its bins already 0755, so
- * the runnable bit no longer depends on the installer re-chmod'ing. Runs from
- * `build` (local + CI) and `prepublishOnly` (guarantees a fresh publish is
- * always executable, whatever state the publisher's dist was in).
- *
- * Cross-platform: uses fs.chmod (no `chmod` shell dependency); a no-op on
- * Windows where the mode bits are ignored anyway.
- */
-import { chmodSync, existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const pkgPath = resolve(here, "..", "package.json");
-const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-
-const bins =
-  typeof pkg.bin === "string"
-    ? { [pkg.name]: pkg.bin }
-    : (pkg.bin ?? {});
-
-let touched = 0;
-for (const [name, relPath] of Object.entries(bins)) {
-  const target = resolve(here, "..", relPath);
-  if (!existsSync(target)) {
-    // Build not run yet / stale bin map — surface it loudly so a publish that
-    // would ship a missing bin fails fast instead of silently.
-    console.error(`chmod-bins: declared bin "${name}" not found at ${relPath}`);
-    process.exitCode = 1;
-    continue;
-  }
-  chmodSync(target, 0o755);
-  touched += 1;
-}
-
-console.log(`chmod-bins: made ${touched} bin(s) executable (0755)`);

package/scripts/generate-dsn.mjs

@@ -1,26 +0,0 @@
-import { writeFileSync } from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-const isGitHubActions = process.env.GITHUB_ACTIONS === "true";
-const isPublishJob = process.env.GITHUB_JOB === "publish";
-const dsn = process.env.HQ_CLI_PUBLISH_SENTRY_DSN ?? "";
-
-if (isGitHubActions && isPublishJob && !dsn) {
-  process.stderr.write(
-    "[generate-dsn] FATAL: GITHUB_ACTIONS=true, GITHUB_JOB=publish, " +
-      "but HQ_CLI_PUBLISH_SENTRY_DSN is not set. " +
-      "Add the repo secret HQ_CLI_PUBLISH_SENTRY_DSN before publishing.\n",
-  );
-  process.exit(1);
-}
-
-const outPath = join(__dirname, "../src/sentry-dsn.generated.ts");
-const content = `export const BUNDLED_DSN = "${dsn}";\n`;
-
-writeFileSync(outPath, content, "utf8");
-process.stdout.write(
-  `[generate-dsn] Wrote BUNDLED_DSN="${dsn ? "[DSN set]" : ""}" to ${outPath}\n`,
-);