@indigoai-us/hq-cli 5.89.0 → 5.89.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [5.89.1]
+
+### Fixed
+
+- `hq core worker lint` now partitions its duplicate check by ownership domain
+  (`core/workers`, each `core/packages/<pack>`, each `companies/<co>`) and
+  excludes dot-directories (`.archive/`) and `._*` AppleDouble files. A
+  whole-tree scan of a real install previously reported false positives for
+  packs that intentionally vendor a byte-identical copy of a core worker skill,
+  for archived pack snapshots, and for macOS metadata files. Within-domain
+  duplicates are still flagged. (policy
+  hq-lint-comparison-domains-must-match-ownership)
+
 ## [5.89.0]
 
 ### Added

package/assets/scaffold/core/scripts/lint-shared-worker-skills.sh

@@ -12,22 +12,37 @@
 #
 # This linter makes that convention enforceable. It flags two failure shapes:
 #
-#   DUPLICATE  — two or more NON-symlink skill files, in any worker under the
-#                scanned roots, whose byte content is identical. Identical bytes
-#                across two real files is exactly an un-single-sourced copy: the
-#                moment someone edits one, they drift. (Symlinks that resolve to
-#                a shared canonical are single-sourced and are NOT flagged, even
-#                though their resolved content matches the canonical.)
+#   DUPLICATE  — two or more NON-symlink skill files, WITHIN A SINGLE OWNERSHIP
+#                DOMAIN, whose byte content is identical. Identical bytes across
+#                two real files in the same domain is exactly an un-single-sourced
+#                copy: the moment someone edits one, they drift. (Symlinks that
+#                resolve to a shared canonical are single-sourced and are NOT
+#                flagged, even though their resolved content matches.)
 #   BROKEN     — a skill entry that is a symlink whose target does not resolve.
 #
 # It deliberately does NOT flag two same-NAMED skills whose content differs
 # (e.g. an API-level vs a browser-level e2e skill): distinct content means they
 # are distinct skills that merely share a filename, not a drifted share.
 #
+# OWNERSHIP DOMAINS — filesystem adjacency does NOT establish duplicate
+# ownership, so comparison is partitioned by the tree that OWNS a skill (policy
+# hq-lint-comparison-domains-must-match-ownership):
+#
+#   - `core/workers`            — the curated first-party worker library
+#   - `core/packages/<pack>`    — one installed pack (self-contained; may legally
+#                                 vendor a byte-identical copy of a core worker)
+#   - `companies/<co>`          — one tenant's workers
+#
+# A byte-identical file in TWO DIFFERENT domains (a pack vendoring a core skill,
+# or two packs shipping the same skill) is intentional distribution, NOT drift,
+# and is never flagged. Excluded from the scan entirely: dot-directories
+# (`.archive/`, `.git/`, …) and `._*` AppleDouble OS-metadata files — byte-
+# identical by design, and not skills.
+#
 # Usage: lint-shared-worker-skills.sh [root ...]
 #   Default roots: core/workers core/packages  (the SHIPPED hq-core scope —
-#   company `_shared-skills/` stores live under companies/<co>/ and are linted
-#   per-tenant, not here).
+#   company workers live under companies/<co>/ and are linted per-tenant; pass
+#   them explicitly to include them).
 #
 # Exit 0 + "OK:" line when clean; exit 1 + a report naming every offending group
 # when not. Matches the loud-and-specific style of lint-skill-script-refs.sh.
@@ -54,11 +69,29 @@ content_hash() {
   fi
 }
 
+# The ownership domain that OWNS a skill path — the boundary within which two
+# byte-identical files are a real duplicate. Across domains, identical content
+# is intentional (a pack vendoring a core skill, two packs shipping the same
+# skill), so it must never be compared. See policy header above.
+domain_of() {
+  local p="${1#./}" rest
+  case "$p" in
+    core/packages/*) rest="${p#core/packages/}"; printf 'core/packages/%s' "${rest%%/*}" ;;
+    companies/*)     rest="${p#companies/}";      printf 'companies/%s' "${rest%%/*}" ;;
+    core/workers/*|core/workers) printf 'core/workers' ;;
+    # Arbitrary root (custom scans, tests): the top path segment is the domain.
+    *) printf '%s' "${p%%/*}" ;;
+  esac
+}
+
 # Collect skill entries: regular files AND symlinks named *.md under any
 # .../skills/... path. -type l must be matched explicitly — a symlink is not a
 # -type f, so a skills symlink would otherwise be invisible to the scan.
+# EXCLUDED: any dot-directory component (`*/.*/*` — covers `.archive/`, `.git/`)
+# and `._*` AppleDouble files; both are byte-identical by design and not skills.
 mapfile -t entries < <(
-  find "${roots[@]}" \( -type f -o -type l \) -path '*/skills/*.md' 2>/dev/null | sort
+  find "${roots[@]}" \( -type f -o -type l \) -path '*/skills/*.md' \
+    -not -path '*/.*/*' -not -name '._*' 2>/dev/null | sort
 )
 
 # Empty is clean — and guards `"${entries[@]}"` under `set -u` on bash 3.2
@@ -69,10 +102,13 @@ if [[ ${#entries[@]} -eq 0 ]]; then
 fi
 
 broken=()
-# Parallel arrays keyed by content hash: hash_keys[i] is a hash, and
-# hash_regfiles[i] is a newline-joined list of the NON-symlink files with that
-# hash. Bash 3.2 (macOS) has no associative arrays in a portable-guaranteed way,
-# so a linear scan over parallel arrays keeps this runnable everywhere HQ runs.
+# Parallel arrays keyed by "<domain>|<content-hash>": hash_keys[i] is that
+# composite key, hash_regfiles[i] a newline-joined list of the NON-symlink files
+# carrying it. Keying on domain AS WELL AS hash is what confines a duplicate
+# finding to a single ownership tree — two identical files in different domains
+# land in different buckets and are never flagged. Bash 3.2 (macOS) has no
+# portable associative arrays, so a linear scan over parallel arrays keeps this
+# runnable everywhere HQ runs.
 hash_keys=()
 hash_regfiles=()
 
@@ -94,12 +130,13 @@ for entry in "${entries[@]}"; do
     fi
     continue
   fi
-  # Regular file: hash its bytes and bucket it. Two regular files sharing a
-  # bucket are two copies of the same skill — the drift hazard.
-  h="$(content_hash "$entry")"
-  idx="$(hash_index "$h")"
+  # Regular file: bucket it by (ownership domain, byte content). Two regular
+  # files sharing a bucket are two copies of the same skill in the same tree —
+  # the drift hazard.
+  key="$(domain_of "$entry")|$(content_hash "$entry")"
+  idx="$(hash_index "$key")"
   if [[ "$idx" == "-1" ]]; then
-    hash_keys+=("$h")
+    hash_keys+=("$key")
     hash_regfiles+=("$entry")
   else
     hash_regfiles[$idx]="${hash_regfiles[$idx]}"$'\n'"$entry"
@@ -116,7 +153,8 @@ for i in "${!hash_keys[@]}"; do
       echo "lint-shared-worker-skills: FAIL — duplicated worker skills (single-source these via _shared-skills/ + relative symlinks):" >&2
     fi
     findings=$((findings + 1))
-    echo "  DUPLICATE (identical content, ${count} copies — pick one canonical and symlink the rest):" >&2
+    domain="${hash_keys[$i]%%|*}"
+    echo "  DUPLICATE in domain '${domain}' (identical content, ${count} copies — pick one canonical and symlink the rest):" >&2
     printf '    %s\n' "$group" >&2
   fi
 done

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.89.0",
+  "version": "5.89.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {