@indigoai-us/hq-cli 5.93.2 → 5.94.1

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 ## [Unreleased]
 
+## [5.94.1]
+
+### Fixed
+
+- The CLI now actually uses its bundled qmd. Package-local resolution had never
+  worked, so every install silently fell through to whatever qmd was on `PATH`,
+  and a host without a global qmd reported `skipped` — defeating the reason
+  `@tobilu/qmd` is a dependency and undoing in practice what 5.93.x set out to
+  fix for Node 26 global installs. Two independent causes, both silent: the
+  resolver looked for `<pkg>/qmd` while the package declares `bin/qmd`, and the
+  package-manifest lookup throws `ERR_PACKAGE_PATH_NOT_EXPORTED` on qmd 2.x,
+  which also blanked the version in `hq index status`. Both now follow the
+  package-manager contract: the binary via `node_modules/.bin/qmd`, the version
+  read from `node_modules/@tobilu/qmd/package.json`. (#333)
+
+### Added
+
+- A shell-vs-native differential for `hq index background`, run against a frozen
+  copy of the pre-migration `qmd-reindex-bg.sh`: agent-box short-circuit before
+  any qmd lookup or lock, empty-`HOME` silence, `cleanup → update → embed`
+  ordering with completion stamp, no stamp after a failed update, and no
+  competing writer behind a held lock. It is what surfaced the resolution bug
+  above. (#333)
+
+## [5.94.0]
+
+### Removed
+
+- `hq core backfill-company-skill-mirrors` and `hq core backfill-workspace-mirror`
+  are retired, along with their bundled shell assets. Both were one-shot
+  migrations for installs predating the current company-skill and
+  workspace-mirror layouts, and nothing in the package, the scaffold, or the
+  shipped skills invoked either. An install still upgrading from that era should
+  run those migrations on 5.93.x first. No `hq core` command dispatches a
+  bundled script directly now; `hq core worker lint|share` remain the only
+  bundled dispatches. (#331)
+
 ## [5.93.0]
 
 ### Fixed

package/dist/commands/core.js

@@ -164,19 +164,11 @@ export const REBUILD_INDEX_TARGETS = [
  * would make the forwarders harder to audit against this table.
  */
 export const SCAFFOLD_COMMANDS = [
-    // ---- One-shot migrations and maintenance (live tree) ----
-    {
-        name: "backfill-company-skill-mirrors",
-        asset: "core/scripts/backfill-company-skill-mirrors.sh",
-        root: "cwd",
-        summary: "One-shot: mirror company skills into place",
-    },
-    {
-        name: "backfill-workspace-mirror",
-        asset: "core/scripts/backfill-workspace-mirror.sh",
-        root: "cwd",
-        summary: "One-shot: mirror threads into company workspaces",
-    },
+// Empty by design. Every former entry is either native now or retired: the
+// two one-shot backfills (company skill mirrors, workspace mirror) were
+// removed outright, having served installs that predate the current layout.
+// `hq core worker lint|share` are the only remaining bundled dispatches and
+// live in WORKER_SUBCOMMANDS.
 ];
 /**
  * Bundled solely for HQ-root scaffolds, which still need these as loose files.

package/dist/lib/search-index/index.d.ts

@@ -28,7 +28,13 @@ export type ResolveQmdBinOptions = {
     packageBin?: () => string | undefined;
     pathBin?: () => string | undefined;
 };
-/** Return the pinned package version when qmd is supplied by this CLI. */
+/**
+ * Return the pinned package version when qmd is supplied by this CLI.
+ *
+ * Read from disk rather than `require('@tobilu/qmd/package.json')`: qmd 2.x does
+ * not export package.json, so the require form throws and the version silently
+ * disappeared from `hq index status`. Same root cause as packageLocalBin.
+ */
 export declare function resolveQmdVersion(): string | undefined;
 /** Resolve qmd without relying on a globally installed copy. */
 export declare function resolveQmdBin(options?: ResolveQmdBinOptions): string;

package/dist/lib/search-index/index.js

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import { createRequire } from 'node:module';
 import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 export class QmdBinaryMissingError extends Error {
     name = 'QmdBinaryMissingError';
@@ -32,24 +33,68 @@ function isExecutable(candidate) {
         return false;
     }
 }
+/**
+ * Locate the bundled qmd through the dependency-bin link the package manager
+ * installs, walking up from this module.
+ *
+ * Two earlier approaches were wrong and both failed silently, so every host fell
+ * through to PATH and a machine without a global qmd reported "skipped" — which
+ * defeats the point of depending on qmd at all:
+ *
+ *   - `<pkg>/qmd` guessed a filename; the package declares `bin/qmd`.
+ *   - `require.resolve('@tobilu/qmd/package.json')` throws
+ *     ERR_PACKAGE_PATH_NOT_EXPORTED on qmd 2.x, whose `exports` map does not
+ *     expose package.json.
+ *
+ * `node_modules/.bin/qmd` is the contract every package manager honours and is
+ * independent of the dependency's own exports map.
+ */
 function packageLocalBin() {
-    try {
-        const packageJson = require.resolve('@tobilu/qmd/package.json');
-        return path.join(path.dirname(packageJson), 'qmd');
-    }
-    catch {
-        return undefined;
+    const names = process.platform === 'win32' ? ['qmd.cmd', 'qmd.exe', 'qmd'] : ['qmd'];
+    let directory = path.dirname(fileURLToPath(import.meta.url));
+    for (let depth = 0; depth < 10; depth++) {
+        for (const name of names) {
+            const candidate = path.join(directory, 'node_modules', '.bin', name);
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
     }
+    return undefined;
 }
-/** Return the pinned package version when qmd is supplied by this CLI. */
+/**
+ * Return the pinned package version when qmd is supplied by this CLI.
+ *
+ * Read from disk rather than `require('@tobilu/qmd/package.json')`: qmd 2.x does
+ * not export package.json, so the require form throws and the version silently
+ * disappeared from `hq index status`. Same root cause as packageLocalBin.
+ */
 export function resolveQmdVersion() {
-    try {
-        const packageJson = require('@tobilu/qmd/package.json');
-        return typeof packageJson.version === 'string' ? packageJson.version : undefined;
-    }
-    catch {
-        return undefined;
+    // Walk for the package directory itself. Neither require() nor the .bin entry
+    // works: qmd 2.x does not export package.json, and .bin/qmd is a generated
+    // shim (not a symlink) under pnpm's hoisted linker, so resolving it lands back
+    // in this package rather than qmd's.
+    let directory = path.dirname(fileURLToPath(import.meta.url));
+    for (let depth = 0; depth < 10; depth++) {
+        const manifest = path.join(directory, 'node_modules', '@tobilu', 'qmd', 'package.json');
+        if (fs.existsSync(manifest)) {
+            try {
+                const parsed = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+                if (typeof parsed.version === 'string')
+                    return parsed.version;
+            }
+            catch { /* unreadable manifest: report no version rather than throwing */ }
+            return undefined;
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
     }
+    return undefined;
 }
 function pathBin() {
     const paths = (process.env.PATH ?? '').split(path.delimiter).filter(Boolean);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.93.2",
+  "version": "5.94.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/assets/scaffold/core/scripts/backfill-company-skill-mirrors.sh

@@ -1,73 +0,0 @@
-#!/bin/bash
-# backfill-company-skill-mirrors.sh
-#
-# One-shot, idempotent. Walks every company under companies/{co}/skills/ and
-# companies/{co}/commands/ and ensures a mirror symlink exists at
-# .claude/skills/{prefix}-{name}/ (or .claude/commands/{prefix}-{name}.md).
-#
-# Logic is delegated to .claude/hooks/auto-mirror-company-skill.sh — this
-# script just discovers candidate paths and feeds them in. Re-run safely.
-#
-# Usage:  bash core/scripts/backfill-company-skill-mirrors.sh
-
-set -euo pipefail
-
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-HOOK="$PROJECT_DIR/.claude/hooks/auto-mirror-company-skill.sh"
-
-if [[ ! -x "$HOOK" ]]; then
-  echo "ERROR: auto-mirror hook not found or not executable: $HOOK" >&2
-  exit 1
-fi
-
-cd "$PROJECT_DIR"
-
-CREATED=0
-SKIPPED=0
-
-emit() {
-  local rel_path="$1"
-  rel_path="${rel_path//\/\//\/}"
-  local out
-  out=$(echo "{\"tool_input\":{\"file_path\":\"$rel_path\"}}" | CLAUDE_PROJECT_DIR="$PROJECT_DIR" bash "$HOOK" 2>&1 || true)
-  if [[ -n "$out" ]]; then
-    echo "$out"
-    if [[ "$out" == *"linked"* ]]; then
-      CREATED=$((CREATED + 1))
-    else
-      SKIPPED=$((SKIPPED + 1))
-    fi
-  fi
-}
-
-shopt -s nullglob
-for co_dir in companies/*/; do
-  co="${co_dir%/}"
-  co="${co##*/}"
-
-  # Skip if no manifest entry (defensive — shouldn't happen).
-  [[ -d "$co_dir" ]] || continue
-
-  # Top-level skills: directory form (skills/{name}/SKILL.md) and flat-file form (skills/{name}.md).
-  if [[ -d "$co_dir/skills" ]]; then
-    for skill_md in "$co_dir/skills"/*/SKILL.md; do
-      [[ -f "$skill_md" ]] || continue
-      emit "$skill_md"
-    done
-    for flat_md in "$co_dir/skills"/*.md; do
-      [[ -f "$flat_md" ]] || continue
-      emit "$flat_md"
-    done
-  fi
-
-  # Top-level commands: commands/{name}.md
-  if [[ -d "$co_dir/commands" ]]; then
-    for cmd_md in "$co_dir/commands"/*.md; do
-      [[ -f "$cmd_md" ]] || continue
-      emit "$cmd_md"
-    done
-  fi
-done
-
-echo ""
-echo "backfill complete: $CREATED linked, $SKIPPED skipped (already-correct or no-prefix)"

package/assets/scaffold/core/scripts/backfill-workspace-mirror.sh

@@ -1,51 +0,0 @@
-#!/bin/bash
-# One-time backfill: walk workspace/threads/*.json and replay each through
-# the mirror hook so existing sessions are represented in their companies'
-# workspace/ folders.
-#
-# Idempotent: hardlinks use ln -f, index.jsonl rows are deduped by
-# (thread_id, ts, kind). Safe to re-run.
-#
-# Usage:  bash core/scripts/backfill-workspace-mirror.sh [HQ_ROOT]
-
-set -euo pipefail
-
-HQ_ROOT="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
-HOOK="$HQ_ROOT/.claude/hooks/mirror-thread-to-company.sh"
-THREADS_DIR="$HQ_ROOT/workspace/threads"
-
-[ -x "$HOOK" ] || { echo "Mirror hook missing or not executable: $HOOK" >&2; exit 1; }
-[ -d "$THREADS_DIR" ] || { echo "No threads dir at $THREADS_DIR" >&2; exit 1; }
-
-mirrored=0
-skipped=0
-total=0
-
-for thread in "$THREADS_DIR"/T-*.json; do
-  [ -f "$thread" ] || continue
-  total=$((total + 1))
-
-  has_company=$(jq -r 'if .metadata.company then "yes" else "no" end' "$thread" 2>/dev/null || echo "no")
-  if [ "$has_company" != "yes" ]; then
-    skipped=$((skipped + 1))
-    continue
-  fi
-
-  printf '{"tool_name":"Write","tool_input":{"file_path":"%s"}}' "$thread" \
-    | bash "$HOOK"
-
-  mirrored=$((mirrored + 1))
-done
-
-echo "Backfill complete:"
-echo "  Total threads:   $total"
-echo "  Mirrored:        $mirrored"
-echo "  Skipped (no co): $skipped"
-echo
-echo "Per-company index.jsonl row counts:"
-for index_file in "$HQ_ROOT"/companies/*/workspace/index.jsonl; do
-  [ -f "$index_file" ] || continue
-  co=$(basename "$(dirname "$(dirname "$index_file")")")
-  rows=$(wc -l < "$index_file" | tr -d ' ')
-  printf "  %-20s %s rows\n" "$co" "$rows"
-done