@indigoai-us/hq-cli 5.130.0 → 5.132.0

package/CHANGELOG.md

@@ -2,6 +2,156 @@
 
 ## [Unreleased]
 
+## [5.132.0] — 2026-09-22
+
+### Added
+
+- `hq lanes resume <lane-id> --account <id>` and `hq lanes message <lane-id>
+  --account <id>` move a lane's provider session to another account of the
+  same provider and continue it there, with its full history. The claude
+  transcript (`projects/<encoded cwd>/<session>.jsonl`, plus the session's
+  subagent directory) or the codex rollout
+  (`sessions/YYYY/MM/DD/rollout-*-<session>.jsonl`) is copied into the target
+  account's home; the source copy stays, and a copy the target already holds
+  is refreshed when it differs, so a lane moved back resumes the turns it ran
+  elsewhere. Every check runs before anything is copied or written: the lane must not be running (`lane_running`), the
+  target must be an account of the lane's provider
+  (`account_provider_mismatch`), exist, be enabled, be logged in, hold no
+  quota hold (`account_quota_held`), and know the lane's model; a target that
+  pins a different model needs `--model <id>` (new on both commands, accepted
+  only with `--account`). Grok lanes are refused with
+  `provider_session_not_portable`; a missing transcript or rollout with
+  `provider_session_missing`, naming the path searched. The record's
+  `account` moves, `account_history` gains an `operator_move` entry,
+  `last_resume.account` names the account the run started on, and
+  `hq lanes show` prints them; a record that changed after the move was
+  prepared is refused with `account_move_conflict`. The capacity decision
+  runs under the target account's admission lock, and a moved lane holds its
+  slot (`pending_resume`) until its spawn claims it, so two moves cannot share
+  one free slot. A target at its running cap queues the lane there with
+  `pending_resume`, and the reconcile pass resumes the session on the target,
+  honouring `--no-compact`. Mesh events for a moved lane carry `account` and
+  `account_move`. Credential files are never copied.
+
+- A provider-level turn failure is a named lane failure. When the worker's
+  stdout carries a codex `turn.failed` event, a Claude error result with an
+  HTTP status, or a grok error object, the watcher classifies the lane
+  `failed` with `terminal_reason: provider_rejected` and writes the
+  provider's message (capped), status, error class, `retryable`, and the
+  model and account the run used to `terminal_details`. Such an exit is never
+  `interrupted` and never spawns the envelope repair turn. A 429 stays on the
+  quota path. `hq lanes show` prints `terminal_reason` and
+  `terminal_details`.
+- `hq lanes create --model` is validated against the provider's own model
+  list before anything is written: codex from the account home's
+  `models_cache.json`, grok from `grok models`, claude from the aliases and
+  full-name prefix in `claude --help`. An unknown id is refused with
+  `model_unsupported` naming the provider, the value, the source and the
+  accepted ids. A provider whose list cannot be read (missing, corrupt, or
+  unreadable cache; failed probe) is not validated. Validation runs before
+  the mesh thread is ensured and before the admission lock is taken, so a
+  refusal leaves nothing behind and a slow provider probe never holds the
+  lock. An unpinned create reads the list of every enabled account the
+  balanced choice could land on before the lock; the account is still chosen
+  under the lock, restricted to the accounts whose list accepted the model,
+  so nothing is refused once the mesh thread exists and no probe or catalog
+  read runs while the lock is held. A `grok models` or `claude --help` probe that exits nonzero
+  is not a catalog, whatever it printed, and skips validation. Every outpost
+  lane is validated at pickup on the executing host, after its account
+  binds, and fails with `model_unsupported` there; a lane cancelled during
+  the pickup probe stays cancelled and is not spawned. A picked-up lane is
+  stored ineligible for admission (`pickup_validation_pending`) until its
+  account binds, so the reconcile pass cannot spawn it while the probe is
+  out, and the failure write refuses an already-terminal or running record
+  inside its compare-and-swap.
+- A codex `turn.failed` or grok error with status 429, or with no status and
+  a usage-limit or rate-limit message, now reaches the quota path (reset time
+  and account hold recorded) instead of ending `interrupted`, and skips the
+  envelope repair turn so the hold applies at once; an explicit non-429
+  status wins over quota-sounding text. The reconcile pass applies the same
+  routing when it recovers a lane whose worker and watcher both died. The
+  provider's output is scanned from the tail one line at a time, so a long
+  run's events are never all parsed and held at once. A 429 whose message
+  names no reset time holds the account for the provider's
+  `quota_default_hold_ms` (fifteen minutes unless configured), recorded with
+  `reset_source: default_hold`; a message with a reset time keeps that time.
+
+### Fixed
+
+- `hq lanes reconcile install` no longer copies the installing shell's PATH
+  into the systemd unit. The unit PATH is, per resolved provider, the
+  directory holding the command name and the real binary's directory when a
+  symlink points elsewhere, then the hq binary's directory, then the node
+  binary's directory, then `/usr/local/bin:/usr/bin:/bin`, deduplicated; directories synced from
+  another machine's profile are left out.
+
+## [5.131.0] — 2026-09-22
+
+### Added
+
+- `hq files share` can post the share record to a project channel instead of a
+  DM: `--channel <name>` names the channel and `--mention <person>` (repeatable)
+  tags people in it. Using `--mention` without `--channel` is an error. If you
+  or a mentioned person are not members of that channel, access is still
+  granted and the record falls back to a DM, with a short note on the CLI.
+- Offline preflight results the CLI can emit are published at
+  `contracts/preflight/v1/schema.json` and `fixtures.json` (included in the
+  package). `hq mesh contract preflight --print-fixtures` prints the same
+  document. A test fails if the committed fixtures drift from the emitter.
+  contractVersion stays pinned at 1 until hq-core's vendored copy moves with it.
+
+### Fixed
+
+## [Unreleased]
+
+- Held-event repair no longer treats a later event timestamp as proof that
+  metadata belongs to the current session instance. A reused session id stays
+  unresolved when the held event's binding episode does not match the current
+  one. A CLI self-update now records the verified HQ root and rewrites a
+  legacy daemon unit (no `HQ_ROOT`, or `Restart=on-failure`) before restarting
+  it, so the new process does not come up with an empty root allowlist.
+
+## [Unreleased]
+
+- A machine credential (fleet box or local bot) no longer posts mesh events
+  with no company. `HQ_SPAWN_COMPANY`, the bot's company, or the identity
+  file is sent with the event. When none of those is set, the event is held
+  as `needs_company` and `hq mesh daemon doctor` shows the held count.
+  A membership probe that a machine token cannot answer leaves the company
+  in place and retries, instead of clearing it.
+
+## [Unreleased]
+
+- Expected caller errors from company resolution, membership, and qmd lookups
+  no longer create Sentry issues. Windows filesystem failures remain visible
+  and now include redacted path context plus a sync-aware diagnostic.
+
+- An acknowledged Work Mesh register keeps the company on the session even
+  when there is no project, or a project and no task. The next flush posts a
+  held event for that session instead of leaving it held for lack of a company.
+  Tests cover each acked-register branch.
+
+- `hq mesh project set` sends the project version it just read (`If-Match` and
+  `expectedVersion`). A 409 prints "The Board changed while you were editing.
+  Re-run to pick up the latest." and exits non-zero. `--json` includes
+  `VERSION_CONFLICT`.
+
+- `hq mesh session` prints each rejected event's server code (and `--json`
+  includes `rejections`). A flush dead-letter row for a per-event rejection
+  stores that code next to `reason`.
+
+- A Cognito refresh that comes back for a different subject is refused and the
+  active `cognito-tokens.json` is left unchanged. `hq mesh daemon doctor`
+  prints the whoami subject and the subject the daemon is using.
+
+### Changed
+
+- Local bots can reply to other people and bots in direct messages and in
+  connected rooms without an owner-only sender restriction. Each DM
+  correspondent has a separate conversation, and the owner's private context
+  stays out of other people's conversations. Bots retain their configured
+  owner and check suspicious requests before taking sensitive actions.
+
 ## [5.130.0] — 2026-09-22
 
 ### Fixed
@@ -313,7 +463,11 @@
   with its tenant intact, the write reflects the true classification, and no
   `projectId`, `taskId`, or binding episode is fabricated on partial paths.
   Note: a company resolved by slug only (no uid) is still not attributed on
-  either path.
+  either path. Tests disable each of those two writers in turn
+  (`writeAckedRegisterState`, and the post-ack `writeSessionState`) and
+  require the other one to still land the company for a company-only ack
+  and a company-plus-project ack. The production write itself landed in
+  `28aee9e` (#670).
 
 - The setup bot no longer posts the same question twice when a turn takes a
   while: a question asked in an interim update is held back if the final

package/contracts/preflight/v1/fixtures.json

@@ -0,0 +1,87 @@
+{
+  "contractVersion": 1,
+  "source": "hq-cli contracts/preflight/v1/fixtures.json",
+  "classifications": [
+    "unresolved",
+    "needs_company",
+    "company_conflict",
+    "needs_project",
+    "needs_task",
+    "bound",
+    "untracked"
+  ],
+  "fixtures": [
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "unresolved",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "needs_company",
+      "classification": "needs_company",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "company_conflict",
+      "classification": "company_conflict",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "needs_project",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "needs_task",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme",
+      "projectId": "dispatch-proj"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "queued",
+      "classification": "bound",
+      "delivery": "queued",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture",
+      "companySlug": "acme",
+      "companyUid": "cmp_acme",
+      "projectId": "dispatch-proj",
+      "taskId": "US-9"
+    },
+    {
+      "contractVersion": 1,
+      "kind": "untracked",
+      "classification": "untracked",
+      "delivery": "clean",
+      "lifecycle": "open",
+      "sessionId": "sid-preflight-fixture",
+      "clientOperationId": "op-preflight-fixture"
+    }
+  ]
+}

package/contracts/preflight/v1/schema.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hq.getindigo.ai/schemas/work-context/preflight/v1/schema.json",
+  "title": "Offline preflight ContextResult",
+  "description": "Shapes hq mesh context reconcile --offline emits. Hook consumers must accept every fixture and reject any classification outside this enum. Bump contractVersion together with hq-core core/hooks/SessionStart/preflight-fixtures.json.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "contractVersion",
+    "kind",
+    "classification",
+    "delivery",
+    "lifecycle",
+    "sessionId",
+    "clientOperationId"
+  ],
+  "properties": {
+    "contractVersion": { "type": "integer", "const": 1 },
+    "kind": {
+      "type": "string",
+      "enum": [
+        "queued",
+        "needs_company",
+        "company_conflict",
+        "untracked",
+        "bound",
+        "needs_project",
+        "needs_task",
+        "error"
+      ]
+    },
+    "classification": {
+      "type": "string",
+      "enum": [
+        "unresolved",
+        "needs_company",
+        "company_conflict",
+        "needs_project",
+        "needs_task",
+        "bound",
+        "untracked"
+      ]
+    },
+    "delivery": {
+      "type": "string",
+      "enum": ["clean", "queued", "acked", "quarantined"]
+    },
+    "lifecycle": { "type": "string", "enum": ["open", "terminal"] },
+    "sessionId": { "type": "string", "minLength": 1 },
+    "clientOperationId": { "type": "string", "minLength": 1 },
+    "companySlug": { "type": "string", "minLength": 1 },
+    "companyUid": { "type": "string", "minLength": 1 },
+    "projectId": { "type": "string", "minLength": 1 },
+    "taskId": { "type": "string", "minLength": 1 },
+    "bindingEpisodeId": { "type": "string", "minLength": 1 },
+    "errorCode": { "type": "string", "minLength": 1 }
+  }
+}

package/dist/command-catalog.generated.d.ts

@@ -1677,6 +1677,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--no-open";
             readonly description: "Print the share-session URL but do not launch the browser";
+        }, {
+            readonly flags: "--channel <name>";
+            readonly description: "Post the share record to this named channel instead of a DM";
+        }, {
+            readonly flags: "--mention <person>";
+            readonly description: "Mention a person on the channel share record (repeatable)";
         }];
         readonly subcommands: readonly [];
     }, {
@@ -5984,6 +5990,27 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "contract";
+        readonly description: "Print versioned work-mesh contracts for other repositories";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "preflight";
+            readonly description: "Offline preflight ContextResult contract (contracts/preflight/v1)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--print-fixtures";
+                readonly description: "Write the fixture file JSON to stdout";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "session";
         readonly description: "Local session-event spool: enqueue (printf-compatible), flush, and live status";
@@ -6753,6 +6780,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--story <id>";
             readonly description: "Re-point story attribution from this message";
+        }, {
+            readonly flags: "--account <id>";
+            readonly description: "Move the lane's session to this account of its provider before the message resumes it";
+        }, {
+            readonly flags: "--model <id>";
+            readonly description: "Model for the moved lane (with --account only)";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this message";
@@ -6781,6 +6814,12 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--story <id>";
             readonly description: "Re-point story attribution from this resume";
+        }, {
+            readonly flags: "--account <id>";
+            readonly description: "Move the lane's session to this account of its provider before resuming";
+        }, {
+            readonly flags: "--model <id>";
+            readonly description: "Model for the moved lane (with --account only)";
         }, {
             readonly flags: "--no-compact";
             readonly description: "Skip the resume-time compaction check for this resume";

package/dist/command-catalog.generated.js

@@ -2138,6 +2138,14 @@ export const COMMAND_CATALOG = [
                     {
                         "flags": "--no-open",
                         "description": "Print the share-session URL but do not launch the browser"
+                    },
+                    {
+                        "flags": "--channel <name>",
+                        "description": "Post the share record to this named channel instead of a DM"
+                    },
+                    {
+                        "flags": "--mention <person>",
+                        "description": "Mention a person on the channel share record (repeatable)"
                     }
                 ],
                 "subcommands": []
@@ -7725,6 +7733,32 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "contract",
+                "description": "Print versioned work-mesh contracts for other repositories",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "preflight",
+                        "description": "Offline preflight ContextResult contract (contracts/preflight/v1)",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--print-fixtures",
+                                "description": "Write the fixture file JSON to stdout"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "session",
                 "description": "Local session-event spool: enqueue (printf-compatible), flush, and live status",
@@ -8729,6 +8763,14 @@ export const COMMAND_CATALOG = [
                         "flags": "--story <id>",
                         "description": "Re-point story attribution from this message"
                     },
+                    {
+                        "flags": "--account <id>",
+                        "description": "Move the lane's session to this account of its provider before the message resumes it"
+                    },
+                    {
+                        "flags": "--model <id>",
+                        "description": "Model for the moved lane (with --account only)"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this message"
@@ -8766,6 +8808,14 @@ export const COMMAND_CATALOG = [
                         "flags": "--story <id>",
                         "description": "Re-point story attribution from this resume"
                     },
+                    {
+                        "flags": "--account <id>",
+                        "description": "Move the lane's session to this account of its provider before resuming"
+                    },
+                    {
+                        "flags": "--model <id>",
+                        "description": "Model for the moved lane (with --account only)"
+                    },
                     {
                         "flags": "--no-compact",
                         "description": "Skip the resume-time compaction check for this resume"

package/dist/commands/dm.d.ts

@@ -190,6 +190,8 @@ export declare function buildConnectionActionBody(identifier: string, matched: C
 } | {
     withEmail: string;
 };
+/** Fetch the caller's channels (GET /v1/notify/channels). */
+export declare function fetchChannels(token: string): Promise<ChannelSummary[]>;
 /** One incoming DM as returned by GET /v1/notify/inbox. */
 export interface DmInboxEvent {
     eventId: string;

package/dist/commands/dm.js

@@ -489,7 +489,7 @@ async function runGroupSend(recipients, message) {
     }
 }
 /** Fetch the caller's channels (GET /v1/notify/channels). */
-async function fetchChannels(token) {
+export async function fetchChannels(token) {
     const res = await vaultApiFetch({ token, path: "/v1/notify/channels" });
     if (!res.ok) {
         const err = (await res.json().catch(() => ({})));