@indigoai-us/hq-cli 5.141.0 → 5.143.0

package/dist/commands/mesh.js

@@ -400,7 +400,30 @@ async function runProjectRegister(projectId, opts) {
     }
     const { token, company } = await withCompany(opts);
     const principalUid = await resolveMeshPrincipalUid(token, loadCachedTokens());
-    const registration = await registerMeshProject(token, company.companyUid, projectId);
+    const companyRef = company.companySlug || company.companyUid;
+    try {
+        const board = await getProjectView(token, company.companyUid, projectId);
+        if (board.companyUid !== company.companyUid || board.projectId !== projectId) {
+            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
+        }
+    }
+    catch (err) {
+        if (httpStatus(err) === 404) {
+            fail(`Work mesh project ${projectId} has no Board view in company ${companyRef}. Create the Board before registering it.`);
+        }
+        throw err;
+    }
+    let registration;
+    try {
+        registration = await registerMeshProject(token, company.companyUid, projectId);
+    }
+    catch (err) {
+        const failure = err;
+        if (failure.status === 403 && failure.code === "PROJECT_NOT_IN_COMPANY") {
+            fail(`Work mesh project ${projectId} could not be registered in company ${companyRef}: the Board or its genesis thread is missing. Run "hq mesh project ensure ${projectId} --company ${companyRef} --stories-file <prd.json>" to create or restore them.`);
+        }
+        throw err;
+    }
     const boardState = "registered";
     if (opts.json) {
         console.log(JSON.stringify({ ok: true, action: "project.register", principalUid, boardState, ...registration }, null, 2));
@@ -1601,7 +1624,7 @@ export function registerMeshCommand(program) {
         .action((projectId, opts) => wrap(() => runProjectEnsure(projectId, opts))());
     project
         .command("register <projectId>")
-        .description("POST project registration to create or bind its project channel and Board")
+        .description("Register an existing Board and bind its project channel; use project ensure to create or repair a Board")
         .requiredOption("--company <slug|uid>", "Company slug or cloud uid")
         .option("--channel <channelId>", "Reserved: the current server chooses the project channel")
         .option("--json", "Print machine-readable JSON")

package/dist/commands/report.d.ts

@@ -1,8 +1,9 @@
 import { Command } from "commander";
 import { buildReportTarball, deployOrgContext, type ChannelReport, type DeployAccessPolicy, type ReportDeployment, type ReportPatch } from "../lib/report-publish.js";
+type ReportPatchInput = ReportPatch | ((current: ChannelReport) => ReportPatch);
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export declare function resolveReport(token: string, reportId: string, requestedChannelId?: string): Promise<ChannelReport>;
-export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatch): Promise<ChannelReport>;
+export declare function patchReport(token: string, report: ChannelReport, patch: ReportPatchInput): Promise<ChannelReport>;
 export declare function resolveCompanySlug(token: string, companyUid: string): Promise<string>;
 export declare function deployReportStatic(token: string, input: {
     slug: string;
@@ -12,4 +13,5 @@ export declare function deployReportStatic(token: string, input: {
 }): Promise<ReportDeployment>;
 export declare function registerReportCommand(program: Command): void;
 export declare function runReportCommand(action: () => Promise<void>): Promise<void>;
+export {};
 //# sourceMappingURL=report.d.ts.map

package/dist/commands/report.js

@@ -86,10 +86,39 @@ function print(value, json) {
     else
         console.log(typeof value === "string" ? value : JSON.stringify(value, null, 2));
 }
+async function listReportChannels(token) {
+    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels" });
+    if (!channels.ok)
+        throw new ReportPublishError("Could not resolve the report channel.");
+    const listed = await channels.json();
+    return Array.isArray(listed.channels) ? listed.channels : [];
+}
+function isCompanyReportChannel(channel) {
+    return channel.scope === "company"
+        || (typeof channel.scope !== "string" && Boolean(channel.companyUid));
+}
+function requireCompanyReportChannel(channels, channelId) {
+    const channel = channels.find((row) => row.channelId === channelId);
+    if (!channel)
+        throw new ReportPublishError("Report channel was not found in your channels.");
+    if (!isCompanyReportChannel(channel))
+        throw new ReportPublishError("Channel reports require a company channel.");
+}
+async function readReportInChannel(token, channelId, reportId) {
+    const res = await vaultApiFetch({ token, path: reportPath(channelId, reportId) });
+    if (!res.ok)
+        return undefined;
+    const body = await res.json();
+    if (!body.report)
+        throw new ReportPublishError("Report response was incomplete.");
+    return body.report;
+}
 /** Explicit context has priority; discovery is the authenticated fallback for normal CLI use. */
 export async function resolveReport(token, reportId, requestedChannelId) {
     const explicit = requestedChannelId ?? process.env.HQ_REPORT_CHANNEL_ID;
+    const channels = await listReportChannels(token);
     if (explicit) {
+        requireCompanyReportChannel(channels, explicit);
         const res = await vaultApiFetch({ token, path: reportPath(explicit, reportId) });
         if (!res.ok)
             throw new ReportPublishError("Report was not found in the supplied channel context.");
@@ -100,24 +129,20 @@ export async function resolveReport(token, reportId, requestedChannelId) {
     }
     const recordedChannel = locallyRecordedChannel(reportId);
     if (recordedChannel) {
-        const res = await vaultApiFetch({ token, path: reportPath(recordedChannel, reportId) });
-        if (res.ok) {
-            const body = await res.json();
-            if (body.report)
-                return body.report;
-        }
+        requireCompanyReportChannel(channels, recordedChannel);
+        const recorded = await readReportInChannel(token, recordedChannel, reportId);
+        if (recorded)
+            return recorded;
     }
     // The report API is intentionally channel-scoped. Discover only among the
     // caller's existing channels, using list endpoints so missing reports never
     // become one server-side 404 per channel.
-    const channels = await vaultApiFetch({ token, path: "/v1/notify/channels" });
-    if (!channels.ok)
-        throw new ReportPublishError("Could not resolve the report channel.");
-    const listed = await channels.json();
     let scannedChannels = 0;
-    for (const row of listed.channels ?? []) {
+    for (const row of channels) {
         if (!row.channelId)
             continue;
+        if (!isCompanyReportChannel(row))
+            continue;
         if (scannedChannels >= MAX_REPORT_DISCOVERY_CHANNELS)
             break;
         scannedChannels += 1;
@@ -125,19 +150,45 @@ export async function resolveReport(token, reportId, requestedChannelId) {
         if (!res.ok)
             continue;
         const body = await res.json();
-        const match = body.reports?.find((report) => report.reportId === reportId);
+        const reports = Array.isArray(body.reports) ? body.reports : [];
+        const match = reports.find((report) => report.reportId === reportId);
         if (match)
             return match;
     }
     throw new ReportPublishError(notFoundMessage(scannedChannels));
 }
 export async function patchReport(token, report, patch) {
-    const res = await vaultApiFetch({ token, path: reportPath(report.channelId, report.reportId), method: "PATCH", body: patch });
+    if (!report.companyUid)
+        throw new ReportPublishError("Channel reports require a company channel.");
+    const patchOnce = (current) => vaultApiFetch({
+        token,
+        path: reportPath(current.channelId, current.reportId),
+        method: "PATCH",
+        body: {
+            ...(typeof patch === "function" ? patch(current) : patch),
+            revision: current.revision,
+        },
+    });
+    let res = await patchOnce(report);
     if (res.status === 409) {
         const body = await res.json().catch(() => ({}));
         if (body.error === "already-running")
             throw new ReportPublishError("already running", "already-running");
-        throw new ReportPublishError("Report changed while it was being updated.");
+        if (body.error !== "revision-mismatch")
+            throw new ReportPublishError("Report changed while it was being updated.", "revision-conflict");
+        const latest = await readReportInChannel(token, report.channelId, report.reportId);
+        if (!latest)
+            throw new ReportPublishError("Could not reread the report after it changed.", "revision-conflict");
+        if (typeof patch !== "function") {
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
+        res = await patchOnce(latest);
+        if (res.status === 409) {
+            const retryBody = await res.json().catch(() => ({}));
+            if (retryBody.error === "already-running")
+                throw new ReportPublishError("already running", "already-running");
+            throw new ReportPublishError("Report changed while it was being updated; refresh and retry.", "revision-conflict");
+        }
     }
     if (!res.ok)
         throw new ReportPublishError("Could not update the report record.");
@@ -267,7 +318,10 @@ async function discardDraftAction(reportId, options) {
         if (!res.ok && res.status !== 404)
             throw new ReportPublishError("Could not remove the draft deployment.");
     }
-    const updated = await patchReport(token, report, { draft: null, state: report.url ? "live" : "draft-pending" });
+    const updated = await patchReport(token, report, (current) => ({
+        draft: null,
+        state: current.url ? "live" : "draft-pending",
+    }));
     print(updated, options.json === true);
 }
 async function accessAction(reportId, options) {

package/dist/lib/agent-kit/mcp/tools.js

@@ -17,6 +17,7 @@
  */
 import { CLI_VERSION } from "../../../cli-version.js";
 import { peekIdToken } from "../../../utils/id-token.js";
+import { isRecipientUid } from "../../../lib/notify-recipient.js";
 import { markInboxDone, mergeAgentInbox, readDoneIds, summarizeInboxEntry } from "../inbox-state.js";
 import { errorResult, McpToolInputError, textResult } from "./jsonrpc.js";
 export const MAX_TOOL_OUTPUT_CHARS = 40_000;
@@ -222,7 +223,7 @@ export function buildAgentMcpTools(clients) {
                 const message = str(args, "message", { required: true, max: 20_000 }).trim();
                 const body = /^[^\s]+@[^\s]+$/.test(to)
                     ? { toEmail: to.toLowerCase(), body: message }
-                    : /^(prs|agt)_[A-Za-z0-9_-]+$/.test(to)
+                    : isRecipientUid(to)
                         ? { toPersonUid: to, body: message }
                         : (() => {
                             throw new McpToolInputError('"to" must be an email, prs_… or agt_… uid');

package/dist/lib/bot/api.d.ts

@@ -143,6 +143,10 @@ export declare class BotApiError extends Error {
     readonly tokenAgentUid?: string | undefined;
     constructor(status: number, path: string, code?: string | undefined, detail?: string | undefined, retryAfterMs?: number | undefined, tokenAgentUid?: string | undefined);
 }
+export declare class InvalidDmRecipientError extends Error {
+    readonly recipient: string;
+    constructor(recipient: string);
+}
 /** Parse a Retry-After header (delta-seconds or HTTP-date) to milliseconds. */
 export declare function retryAfterHeaderMs(value: string | null | undefined, nowMs?: number): number | undefined;
 export interface BotApiOptions {

package/dist/lib/bot/api.js

@@ -8,6 +8,7 @@
 import { vaultApiFetch } from "../../utils/vault-api.js";
 import { tokenAgentUid } from "../heartbeat-identity.js";
 import { assertNoSecretKeys } from "./local-config.js";
+import { isRecipientUid } from "../notify-recipient.js";
 export class BotApiError extends Error {
     status;
     path;
@@ -26,6 +27,14 @@ export class BotApiError extends Error {
         this.name = "BotApiError";
     }
 }
+export class InvalidDmRecipientError extends Error {
+    recipient;
+    constructor(recipient) {
+        super(`Invalid DM recipient '${recipient}': expected a prs_ or agt_ uid.`);
+        this.recipient = recipient;
+        this.name = "InvalidDmRecipientError";
+    }
+}
 /** Parse a Retry-After header (delta-seconds or HTTP-date) to milliseconds. */
 export function retryAfterHeaderMs(value, nowMs = Date.now()) {
     if (!value)
@@ -141,7 +150,10 @@ export class BotApi {
     }
     /** POST /v1/notify/dm — send as the bot (agent identity). */
     async sendDm(input) {
-        const payload = { toPersonUid: input.toPersonUid, body: input.body };
+        const recipient = input.toPersonUid.trim();
+        if (!isRecipientUid(recipient))
+            throw new InvalidDmRecipientError(input.toPersonUid);
+        const payload = { toPersonUid: recipient, body: input.body };
         if (input.rootEventId)
             payload.rootEventId = input.rootEventId;
         const { body } = await this.call("/v1/notify/dm", { method: "POST", body: payload });

package/dist/lib/lanes/effort.d.ts

@@ -19,7 +19,7 @@
  */
 import type { LaneProvider } from "./types.js";
 export declare const PROVIDER_EFFORT_LEVELS: Record<LaneProvider, readonly string[]>;
-export declare const EFFORT_SOURCES: readonly ["cli", "account", "provider", "default_rule", "none"];
+export declare const EFFORT_SOURCES: readonly ["cli", "profile", "account", "provider", "default_rule", "none"];
 export type EffortSource = (typeof EFFORT_SOURCES)[number];
 export interface ResolvedEffort {
     effort?: string;
@@ -35,9 +35,10 @@ export declare function parseConfigEffort(provider: LaneProvider, raw: unknown,
  * Keyed on the model already chosen for the lane; it does not pick a model.
  */
 export declare function defaultEffortForModel(model: string | undefined): string | undefined;
-/** Precedence: `--effort`, then the account, then the provider, then the default rule. */
+/** Precedence: `--effort`, profile, account, provider, then the default rule. */
 export declare function resolveLaneEffort(input: {
     cliEffort?: string;
+    profileEffort?: string;
     accountEffort?: string;
     providerEffort?: string;
     model?: string;

package/dist/lib/lanes/effort.js

@@ -25,6 +25,7 @@ export const PROVIDER_EFFORT_LEVELS = {
 };
 export const EFFORT_SOURCES = [
     "cli",
+    "profile",
     "account",
     "provider",
     "default_rule",
@@ -65,10 +66,13 @@ export function defaultEffortForModel(model) {
     }
     return undefined;
 }
-/** Precedence: `--effort`, then the account, then the provider, then the default rule. */
+/** Precedence: `--effort`, profile, account, provider, then the default rule. */
 export function resolveLaneEffort(input) {
     if (input.cliEffort !== undefined)
         return { effort: input.cliEffort, source: "cli" };
+    if (input.profileEffort !== undefined) {
+        return { effort: input.profileEffort, source: "profile" };
+    }
     if (input.accountEffort !== undefined) {
         return { effort: input.accountEffort, source: "account" };
     }

package/dist/lib/lanes/errors.d.ts

@@ -34,6 +34,6 @@ export declare class AccountResolutionError extends LanesError {
     constructor(error: "unknown_account" | "account_disabled" | "no_enabled_account" | "account_model_unavailable" | "account_quota_exhausted", message: string, details?: Record<string, unknown>);
 }
 export declare class WorkerResolutionError extends LanesError {
-    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "package_workers_unmounted" | "worker_registry_unreadable", message: string, details?: Record<string, unknown>);
+    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable", message: string, details?: Record<string, unknown>);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/lanes/index.d.ts

@@ -45,6 +45,8 @@ export type { KnownModels, KnownModelsDeps, ProbeCommand, ProbeResult } from "./
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export type { SessionCopyPlan, SessionCopyResult } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export type { WorkerProfile, WorkerProfileMeta, WorkerProfileRuntime, } from "./profile.js";
 export type { RegistryWorkerEntry, ResolvedLaneWorker, WorkerTenancy, WorkerYaml, } from "./registry.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export type { QuestionBody, RaiseLaneQuestionInput } from "./questions.js";

package/dist/lib/lanes/index.js

@@ -25,6 +25,7 @@ export { PROVIDER_REJECTED_REASON, PROVIDER_REJECTION_MESSAGE_CAP, parseClaudeRe
 export { CODEX_MODELS_CACHE_NAME, MODEL_PROBE_TIMEOUT_MS, claudeKnownModels, codexKnownModels, defaultProbe, grokKnownModels, knownModels, modelIsKnown, parseClaudeHelpModels, parseGrokModelsOutput, validateLaneModel, } from "./models.js";
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export { LANE_DELIVERY_MECHANISMS, LAUNCH_TRIGGERS, PROVIDER_SESSION_RESUME, RESUMABLE_LANE_STATES, RESUME_COMMAND_STATES, SESSION_ID_ABSENT_REASONS, claimableStatesFor, deliveryRefusalReason, hasRecordedSessionId, isResumableLaneState, isResumeCommandState, laneDeliveryMechanism, parseClaudeResultOutput, parseCodexEventOutput, parseWorkerRunOutput, planLaneLaunch, providerSupportsSessionResume, readWorkerRunResult, resumeCommandRefusal, } from "./delivery.js";
 export { DROPBOX_DIR, INBOX_NAME, appendDropboxMessage, answerDropboxMessage, drainDropbox, dropboxDir, dropboxInboxPath, formatOperatorInstruction, hookAdditionalContextJson, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneIdForAnswerDelivery, operatorMessageRefusalReason, readToolActivity, recordToolActivity, runDrainHook, toolActivityPath, TOOL_ACTIVITY_NAME, } from "./dropbox.js";

package/dist/lib/lanes/mesh-events.d.ts

@@ -80,11 +80,10 @@ export interface CreateLaneMeshOptions {
     token?: () => Promise<string>;
 }
 export declare function createLaneMesh(opts?: CreateLaneMeshOptions): LaneMesh;
-/** Company + thread present. A core/personal lane (company null) emits nothing. */
-export declare function laneCanEmit(lane: Pick<LaneRecord, "company" | "thread_id">): lane is Pick<LaneRecord, "company" | "thread_id"> & {
-    company: LaneCompanyRef;
-    thread_id: string;
-};
+/** Resolve the explicit mesh attribution before falling back to the lane tenant. */
+export declare function laneMeshCompany(lane: Pick<LaneRecord, "company" | "mesh_company">): LaneCompanyRef | undefined;
+/** Company attribution + thread present. Unscoped personal lanes emit nothing. */
+export declare function laneCanEmit(lane: Pick<LaneRecord, "company" | "mesh_company" | "thread_id">): boolean;
 /**
  * Spec §8 terminal-envelope events. `done` → lane_done and story → review;
  * `blocked` → lane_blocked; `ask` → lane_ask with the queue ids. The story is

package/dist/lib/lanes/mesh-events.js

@@ -186,9 +186,13 @@ export function createLaneMesh(opts = {}) {
         },
     };
 }
-/** Company + thread present. A core/personal lane (company null) emits nothing. */
+/** Resolve the explicit mesh attribution before falling back to the lane tenant. */
+export function laneMeshCompany(lane) {
+    return lane.mesh_company ?? lane.company ?? undefined;
+}
+/** Company attribution + thread present. Unscoped personal lanes emit nothing. */
 export function laneCanEmit(lane) {
-    return lane.company !== null && lane.company !== undefined && !!lane.thread_id;
+    return laneMeshCompany(lane) !== undefined && !!lane.thread_id;
 }
 function baseIdentity(lane) {
     const lastMove = lane.account_history?.[lane.account_history.length - 1];
@@ -209,8 +213,10 @@ function baseIdentity(lane) {
 export async function emitLaneDecisionEvents(mesh, lane, envelope, opts = {}) {
     if (!laneCanEmit(lane))
         return;
-    const company = lane.company;
+    const company = laneMeshCompany(lane);
     const threadId = lane.thread_id;
+    if (!company || !threadId)
+        return;
     switch (envelope.decision) {
         case "done": {
             const outcomes = await Promise.allSettled([
@@ -260,7 +266,11 @@ export async function emitLaneDecisionEvents(mesh, lane, envelope, opts = {}) {
 export async function emitLaneProgressEvent(mesh, lane, detail, signal) {
     if (!laneCanEmit(lane))
         return;
-    await mesh.appendThreadEvent(lane.company, lane.thread_id, "lane_progress", {
+    const company = laneMeshCompany(lane);
+    const threadId = lane.thread_id;
+    if (!company || !threadId)
+        return;
+    await mesh.appendThreadEvent(company, threadId, "lane_progress", {
         ...baseIdentity(lane),
         detail,
     }, signal);

package/dist/lib/lanes/profile.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Reusable lane worker profiles stored under personal/workers/<id>.
+ *
+ * A profile is deliberately independent from the worker registry. The
+ * registry describes a worker persona that can be resolved from the company
+ * and package trees; this module describes the provider launch contract that
+ * must be re-read for every spawn.
+ */
+import { type LaneProvider } from "./types.js";
+export interface WorkerProfileMeta {
+    version?: string;
+    provider: LaneProvider;
+    model: string;
+    account: string;
+    effort: string;
+    fast_mode: boolean;
+    max_concurrent?: number;
+    source?: string;
+    accounts?: string[];
+}
+export interface WorkerProfile {
+    id: string;
+    dir: string;
+    meta: WorkerProfileMeta;
+    systemPrompt: string;
+    settings?: Record<string, unknown>;
+    policyFiles: string[];
+    hookFiles: string[];
+    contentHash: string;
+}
+export interface WorkerProfileRuntime {
+    settingsPath?: string;
+    hooksDir?: string;
+}
+export declare function personalWorkerProfileDir(hqRoot: string, id: string): string;
+/** A meta.yaml file is the explicit marker for a personal worker profile. */
+export declare function workerProfileMarker(hqRoot: string, id: string): "absent" | "present";
+export declare function loadWorkerProfile(hqRoot: string, id: string): WorkerProfile;
+export declare function workerProfilePrompt(profile: WorkerProfile): string;
+export declare function ignoredWorkerProfileFields(provider: LaneProvider): string[];
+/**
+ * Materialize provider settings and hook files in the lane run directory.
+ * The path is intentionally run-local so every fresh, resumed, moved, and
+ * repair spawn gets the profile currently on disk without mutating an account
+ * home or a shared provider configuration.
+ */
+export declare function materializeWorkerProfile(profile: WorkerProfile, runDir: string): WorkerProfileRuntime;
+//# sourceMappingURL=profile.d.ts.map