@indigoai-us/hq-cli 5.184.0 → 5.185.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [5.185.1] — 2026-09-25
+
+### Fixed
+
+- `lanes.hire-grants` resolves its company-scoped hq-flags value before gating.
+  A valid local override wins; missing rows or failed reads leave enforcement
+  off. Backfills check the unscoped value and each target company's value
+  before writing. `hire_grant_exhausted` names the grantor and includes the
+  same recovery message in JSON and on stderr.
+
+## [5.185.0] — 2026-09-25
+
+### Fixed
+
+- Local bots no longer post their no-reply signal, narration, blank messages, or raw model errors into rooms. On a room message that does not mention the bot, in-between messages and the working notice are held until the turn ends, and nothing is posted when the reply is the `{"action":"no_reply"}` signal or empty. Any model failure on such a turn (not only a Grok `reasoning_only` empty response, but every model error) is now silent instead of leaking "I didn't finish that — <model> stopped with an error: <raw excerpt>" into the room. When the turn does produce content, the held in-between messages are posted alongside the final answer, so a bot that answers mid-turn and ends with a short sign-off (claude/codex) no longer loses the answer; a Grok final that just concatenates the in-between messages still posts once with no duplication. The signal is never posted as progress anywhere. DMs and @-mentions still stream and still get a reply; a `reasoning_only` failure there now says "the model returned no answer" instead of the raw internal error, and other failures there keep the existing "did not finish" message. The room prompt also tells the model to produce no output rather than explain that it is staying silent.
+
 ## [5.184.0] — 2026-09-25
 
 ### Fixed
@@ -13,6 +29,8 @@
 
 - `hq doctor --json` includes stable sync `reasonCode` enums. Client-health reports add `checkId: reasonCode` pairs only when the company-scoped `client-health-sync-reason-codes` hq-flags gate is enabled. `hq doctor --fix --json` reports refresh-sync outcomes without raw error details.
 
+- Repair known stale QMD collection paths behind the default-off `qmd.collection-path-repair` hq-flags canary while preserving collection metadata.
+
 ## [5.183.0] — 2026-09-25
 
 ### Added

package/dist/commands/lanes.d.ts

@@ -79,7 +79,7 @@ export interface LanesCommandDeps {
     /** Test seam for the default-off outpost placement rollout flag. */
     lanePlacementEnabled?: () => boolean;
     /** Test seam for the default-off lane hire-grants rollout gate. */
-    laneHireGrantsEnabled?: () => boolean;
+    laneHireGrantsEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
 }
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 export declare function parseSeniorRef(raw: string): SeniorRef;

package/dist/commands/lanes.js

@@ -13,6 +13,7 @@ import * as path from "node:path";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
@@ -52,8 +53,8 @@ export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 function defaultLanePlacementEnabled() {
     return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
 }
-function defaultLaneHireGrantsEnabled() {
-    return resolveProcessFlagGate(LANE_HIRE_GRANTS_FLAG, { fallback: false }, () => false);
+function defaultLaneHireGrantsEnabled(company) {
+    return readLanesRegistryFlag(LANE_HIRE_GRANTS_FLAG, { company });
 }
 function withoutProviderHome(value) {
     if (Array.isArray(value))
@@ -73,6 +74,9 @@ function printJson(value) {
 }
 function failJson(err) {
     if (isLanesError(err)) {
+        if (err.error === "hire_grant_exhausted") {
+            process.stderr.write(`hq lanes: ${err.message}\n`);
+        }
         printJson(err.toJSON());
         process.exit(1);
     }
@@ -515,12 +519,14 @@ const OUTPOST_HIRE_SUMMARY_WAIT_MS = 15_000;
 const OUTPOST_HIRE_SUMMARY_CONCURRENCY = 4;
 async function laneHirePresentation(ctx, lane, lanes) {
     const local = laneHireFields(lane, lanes);
-    if (!ctx.laneHireGrantsEnabled() ||
-        lane.host.kind !== "outpost" ||
+    if (lane.host.kind !== "outpost" ||
         isTerminalLaneState(lane.state) ||
         laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
         return { ...local, hire_source: "local" };
     }
+    if (!await ctx.laneHireGrantsEnabled(lane.company)) {
+        return { ...local, hire_source: "local" };
+    }
     try {
         return { ...(await ownerLaneHireFields(ctx, lane)), hire_source: "owner" };
     }
@@ -548,14 +554,15 @@ async function mapWithConcurrency(values, concurrency, map) {
     await Promise.all(workers);
     return results;
 }
-function withResumeHireAdmission(ctx, lane, fn) {
+async function withResumeHireAdmission(ctx, lane, fn) {
     const hqRoot = ctx.hqRoot();
-    if (!ctx.laneHireGrantsEnabled() ||
-        !isTerminalLaneState(lane.state) ||
+    if (!isTerminalLaneState(lane.state) ||
         lane.senior.kind !== "lane" ||
         !lane.senior.id) {
         return fn();
     }
+    if (!await ctx.laneHireGrantsEnabled(lane.company))
+        return fn();
     return withHireGrantAdmission(hqRoot, lane.senior.id, ({ parent, children, parentGrant, availableChildGrant }) => {
         const current = readLane(hqRoot, lane.lane_id);
         // A different resume already reactivated this lane; it occupies the slot
@@ -588,11 +595,33 @@ function withResumeHireAdmission(ctx, lane, fn) {
 }
 function hireGrantCapacityError(parent, children) {
     const grant = parent.hire_grant ?? 0;
-    return new LanesError("hire_grant_exhausted", `Senior lane ${parent.lane_id} has hire grant ${grant} and ${children.length} alive direct children (${children.map((child) => child.lane_id).join(", ") || "none"}). Ask its senior for more: write an ask envelope with the desired total grant and why; the senior runs hq lanes grant ${parent.lane_id} --hire <n>.`, {
+    const grantor = (parent.senior.kind === "lane" || parent.senior.kind === "session") &&
+        parent.senior.id
+        ? { kind: parent.senior.kind, id: parent.senior.id }
+        : null;
+    const grantorReason = grantor
+        ? undefined
+        : parent.senior.kind === "user"
+            ? "senior_is_user"
+            : "parent_senior_missing_id";
+    const capacity = children.length === grant
+        ? `is at its hire grant (${children.length} of ${grant} alive children)`
+        : `has exhausted its hire grant (${children.length} alive children; grant ${grant})`;
+    const grantCommand = `hq lanes grant ${parent.lane_id} --hire <n>`;
+    const authorityGuidance = grantor
+        ? `Its senior ${grantor.kind} ${grantor.id} can raise it with: ${grantCommand}`
+        : parent.senior.kind === "user"
+            ? `Its senior is the user and can raise it with: ${grantCommand}`
+            : `No senior is recorded, so an operator must resolve ownership before running: ${grantCommand}`;
+    const message = `Lane ${parent.lane_id} ${capacity}. ${authorityGuidance}`;
+    return new LanesError("hire_grant_exhausted", message, {
         senior_lane_id: parent.lane_id,
         parent_grant: grant,
         alive_children: children.map((child) => child.lane_id),
         alive_child_count: children.length,
+        grantor,
+        ...(grantorReason ? { grantor_reason: grantorReason } : {}),
+        message,
         ask_guidance: {
             envelope: "decision=ask; include the desired total grant and the reason",
             senior_command: `hq lanes grant ${parent.lane_id} --hire <n>`,
@@ -1858,7 +1887,12 @@ async function runCreate(ctx, opts) {
     }
     const senior = opts.senior ? parseSeniorRef(opts.senior) : defaultSenior(ctx);
     assertSeniorExists(hqRoot, senior, ctx);
-    const hireGrantsEnabled = ctx.laneHireGrantsEnabled();
+    // Resolve tenant context before the registry read so the flag evaluator
+    // applies the same company scope as this lane.
+    const company = companyFlag
+        ? await ctx.resolveCompany(companyFlag)
+        : null;
+    const hireGrantsEnabled = await ctx.laneHireGrantsEnabled(company);
     if (requestedHireGrant !== undefined &&
         !callerMatchesSenior(ctx, senior)) {
         throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(senior)} may set a lane's hire grant`, { senior, hire_grant: requestedHireGrant });
@@ -1874,9 +1908,6 @@ async function runCreate(ctx, opts) {
         throw new LanesError("max_lane_depth", `Lane depth ${laneDepth} exceeds cap ${MAX_LANE_DEPTH}`, { depth: laneDepth, max: MAX_LANE_DEPTH });
     }
     // A no-company lane must not call company resolution (openMeshTransport).
-    const company = companyFlag
-        ? await ctx.resolveCompany(companyFlag)
-        : null;
     let meshCompany = company;
     if (meshCompanyFlag) {
         const resolvedMeshCompany = await ctx.resolveCompany(meshCompanyFlag);
@@ -3024,6 +3055,17 @@ async function runList(ctx, opts) {
         return true;
     })
         .sort(compareLaneQueueOrder);
+    const companyContexts = new Map();
+    for (const lane of selectedLanes) {
+        if (lane.host.kind !== "outpost" ||
+            isTerminalLaneState(lane.state) ||
+            laneRunsHere(lane, host)) {
+            continue;
+        }
+        const company = lane.company;
+        companyContexts.set(JSON.stringify([company?.uid ?? null, company?.slug ?? null]), company);
+    }
+    await Promise.all([...companyContexts.values()].map((company) => ctx.laneHireGrantsEnabled(company)));
     const hireByLane = new Map(await mapWithConcurrency(selectedLanes, OUTPOST_HIRE_SUMMARY_CONCURRENCY, async (lane) => [
         lane.lane_id,
         await laneHirePresentation(ctx, lane, allLanes),
@@ -3545,6 +3587,7 @@ async function runGrant(ctx, laneId, opts) {
         await dispatchOutpostLaneCommand(ctx, initial, "grant", { hire: String(hireGrant) });
         return;
     }
+    const enforce = await ctx.laneHireGrantsEnabled(initial.company);
     const lockedLaneIds = [
         laneId,
         ...(initial.senior.kind === "lane" && initial.senior.id
@@ -3557,7 +3600,6 @@ async function runGrant(ctx, laneId, opts) {
             throw new LanesError("hire_grant_unauthorized", `Only senior ${seniorKey(current.senior)} may change lane ${laneId}'s hire grant`, { lane_id: laneId, senior: current.senior });
         }
         const hierarchy = loadAllLanes(hqRoot);
-        const enforce = ctx.laneHireGrantsEnabled();
         if (enforce && current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
@@ -3611,7 +3653,7 @@ async function runBackfillGrants(ctx, opts) {
     }
     const apply = Boolean(opts.apply);
     const hqRoot = ctx.hqRoot();
-    if (apply && ctx.laneHireGrantsEnabled()) {
+    if (apply && await ctx.laneHireGrantsEnabled(null)) {
         throw new LanesError("hire_grant_backfill_gate_enabled", "Backfill must be applied and verified before lanes.hire-grants is enabled", { flag: LANE_HIRE_GRANTS_FLAG });
     }
     if (apply && ctx.env.HQ_LANE_ID?.trim()) {
@@ -3642,6 +3684,24 @@ async function runBackfillGrants(ctx, opts) {
     }
     let rows = planHireGrantBackfill(allLanes, profileMaxConcurrent);
     if (apply) {
+        const lanesById = new Map(allLanes.map((lane) => [lane.lane_id, lane]));
+        const targetCompanies = new Map();
+        for (const row of rows) {
+            if (row.action === "unchanged")
+                continue;
+            const lane = lanesById.get(row.lane_id);
+            if (!lane) {
+                throw new LanesError("hire_grant_backfill_target_changed", `Backfill target lane ${row.lane_id} is unavailable`, { lane_id: row.lane_id });
+            }
+            const company = lane.company;
+            if (!company)
+                continue;
+            targetCompanies.set(JSON.stringify([company.uid ?? null, company.slug ?? null]), company);
+        }
+        const companyGates = await Promise.all([...targetCompanies.values()].map((company) => ctx.laneHireGrantsEnabled(company)));
+        if (companyGates.some(Boolean)) {
+            throw new LanesError("hire_grant_backfill_gate_enabled", "Backfill must be applied and verified before lanes.hire-grants is enabled", { flag: LANE_HIRE_GRANTS_FLAG });
+        }
         const shortfalls = rows.filter((row) => row.grant_shortfall > 0);
         if (shortfalls.length > 0) {
             throw new LanesError("hire_grant_backfill_allocation_shortfall", "Existing parent grants do not cover the grants allocated to alive children; resolve these rows before applying the backfill", { lanes: shortfalls });
@@ -4009,7 +4069,7 @@ async function prepareAccountMove(ctx, lane, input) {
         if (admission.action === "refuse" && admission.error)
             throw admission.error;
         const queued = admission.action === "queue";
-        const moved = withResumeHireAdmission(ctx, lane, () => casUpdateLane(hqRoot, laneId, (current) => {
+        const moved = await withResumeHireAdmission(ctx, lane, () => casUpdateLane(hqRoot, laneId, (current) => {
             // The copy and every check above were made from `lane`; a record
             // that moved on since (another move, a spawn, a cancel) invalidates
             // them, so the write is refused rather than applied to a state it
@@ -4061,7 +4121,7 @@ async function runMessage(ctx, laneId, opts) {
     assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
     // Check before transcript recovery, account probing, or message writes.
     // The final state transition repeats this check under the senior lock.
-    withResumeHireAdmission(ctx, lane, () => undefined);
+    await withResumeHireAdmission(ctx, lane, () => undefined);
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     // An account move is refused on its own terms first: a running lane and a
     // provider without session resume get the move's named errors, not the
@@ -4341,7 +4401,7 @@ async function runResume(ctx, laneId, opts) {
     }
     // Fail before provider/session work if a terminal child would consume a
     // slot that its senior has already assigned elsewhere.
-    withResumeHireAdmission(ctx, lane, () => undefined);
+    await withResumeHireAdmission(ctx, lane, () => undefined);
     assertLaneRunsHereForOperatorMutation(ctx, lane, "resume");
     lane = laneWithRecoveredProviderSession(hqRoot, lane);
     if (opts.model !== undefined && opts.account === undefined) {
@@ -4913,14 +4973,19 @@ async function runReparent(ctx, laneId, opts) {
     const nextSenior = parseSeniorRef(opts.senior);
     assertSeniorExists(hqRoot, nextSenior, ctx);
     const initial = readLane(hqRoot, laneId);
+    const needsHireGrantGate = nextSenior.kind === "lane" &&
+        seniorKey(initial.senior) !== seniorKey(nextSenior);
+    const hireGrantsEnabled = needsHireGrantGate
+        ? await ctx.laneHireGrantsEnabled(initial.company)
+        : false;
     const lockIds = [
         laneId,
         ...(initial.senior.kind === "lane" && initial.senior.id ? [initial.senior.id] : []),
         ...(nextSenior.kind === "lane" && nextSenior.id ? [nextSenior.id] : []),
     ];
-    withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts));
+    withLaneHireLocks(hqRoot, lockIds, () => runReparentLocked(ctx, laneId, opts, hireGrantsEnabled));
 }
-function runReparentLocked(ctx, laneId, opts) {
+function runReparentLocked(ctx, laneId, opts, hireGrantsEnabled) {
     const hqRoot = ctx.hqRoot();
     if (!opts.senior) {
         throw new LanesError("missing_senior", "--senior is required", {});
@@ -4934,7 +4999,7 @@ function runReparentLocked(ctx, laneId, opts) {
     }
     const seniorCompany = companyOfSenior(hqRoot, nextSenior, ctx);
     assertSameTenant(lane.company, nextSenior, seniorCompany, { lane_id: laneId });
-    if (ctx.laneHireGrantsEnabled() &&
+    if (hireGrantsEnabled &&
         nextSenior.kind === "lane" &&
         seniorKey(lane.senior) !== seniorKey(nextSenior)) {
         const parent = readLane(hqRoot, nextSenior.id);

package/dist/lib/bot/progress.d.ts

@@ -42,9 +42,18 @@ export interface ProgressPosterOptions {
     minGapMs?: number;
     workingNoticeMs?: number;
     workingNoticeText?: string;
+    /**
+     * Unmentioned room turn: hold every in-between message and the working
+     * notice, and post nothing until the turn ends. `finish` then posts the
+     * in-between messages followed by the final answer when it adds something
+     * (when the turn is not silent); `abandon` posts nothing.
+     */
+    buffer?: boolean;
 }
 /** Whitespace-insensitive form used to recognise repeated text. */
 export declare function normalizeForCompare(text: string): string;
+/** Matches {"action":"no_reply"} anywhere in a model reply, with or without preamble text. */
+export declare function containsNoReplySentinel(text: string): boolean;
 export declare class ProgressPoster {
     private readonly send;
     private readonly sendFinalFn?;
@@ -55,6 +64,7 @@ export declare class ProgressPoster {
     private readonly minGapMs;
     private readonly workingNoticeMs;
     private readonly workingNoticeText;
+    private readonly buffer;
     private pending;
     /** In-between questions, held until the turn ends (see the header). */
     private heldQuestions;

package/dist/lib/bot/progress.js

@@ -31,6 +31,10 @@ export const WORKING_NOTICE_TEXT = "Working on it — I'll reply here when it's
 export function normalizeForCompare(text) {
     return text.replace(/\s+/g, "");
 }
+/** Matches {"action":"no_reply"} anywhere in a model reply, with or without preamble text. */
+export function containsNoReplySentinel(text) {
+    return /\{\s*"action"\s*:\s*"no_reply"\s*\}/.test(text);
+}
 export class ProgressPoster {
     send;
     sendFinalFn;
@@ -41,6 +45,7 @@ export class ProgressPoster {
     minGapMs;
     workingNoticeMs;
     workingNoticeText;
+    buffer;
     pending = [];
     /** In-between questions, held until the turn ends (see the header). */
     heldQuestions = [];
@@ -63,9 +68,12 @@ export class ProgressPoster {
         this.minGapMs = opts.minGapMs ?? PROGRESS_MIN_GAP_MS;
         this.workingNoticeMs = opts.workingNoticeMs ?? WORKING_NOTICE_MS;
         this.workingNoticeText = opts.workingNoticeText ?? WORKING_NOTICE_TEXT;
+        this.buffer = opts.buffer ?? false;
     }
     /** Arm the one-time "working on it" note. Call when the turn starts. */
     start() {
+        if (this.buffer)
+            return;
         if (this.finished || this.noticeTimer !== null || this.workingNoticeMs <= 0)
             return;
         this.noticeTimer = this.setTimer(() => {
@@ -81,8 +89,16 @@ export class ProgressPoster {
         const t = text.trim();
         if (this.finished || !t)
             return;
+        // Never treat the no_reply sentinel as something the model "said": it is a
+        // silence signal, not content, and must never be posted as progress.
+        if (containsNoReplySentinel(t))
+            return;
         this.cancelNotice();
         this.said.push(t);
+        // An unmentioned room turn holds every in-between message: nothing is posted
+        // until the turn ends, and then only the final answer.
+        if (this.buffer)
+            return;
         if (t.includes("?")) {
             this.heldQuestions.push(t);
             return;
@@ -112,6 +128,34 @@ export class ProgressPoster {
         this.cancelNotice();
         this.cancelFlush();
         const final = finalText.trim();
+        // Buffered (unmentioned room): nothing was posted during the turn. Post the
+        // collected in-between messages (the sentinel is already excluded from
+        // `said`), then the final answer when it adds something the in-between
+        // messages did not already say — mirroring the streaming path's
+        // repeatsSaid logic. claude/codex answer mid-turn and end with a short
+        // sign-off, so dropping the in-between messages would lose the real answer;
+        // Grok's final is every message concatenated, so it repeats and is skipped.
+        // A silent turn (run.ts decides via sentinel/empty) never reaches here.
+        if (this.buffer) {
+            this.pending = [];
+            this.heldQuestions = [];
+            for (const s of this.said) {
+                if (!containsNoReplySentinel(s))
+                    this.pending.push(s);
+            }
+            if (final && !containsNoReplySentinel(final) && !this.repeatsSaid(final)) {
+                if (this.sendFinalFn) {
+                    // Keep the audience split: collected messages go through send, the
+                    // final reply through sendFinal.
+                    this.flushNow();
+                    this.enqueueWith(final, this.sendFinalFn);
+                    return this.chain;
+                }
+                this.pending.push(final);
+            }
+            this.flushNow();
+            return this.chain;
+        }
         const held = this.heldQuestions;
         this.heldQuestions = [];
         const shouldAddFinal = Boolean(final && !this.repeatsSaid(final));
@@ -141,6 +185,13 @@ export class ProgressPoster {
         this.finished = true;
         this.cancelNotice();
         this.cancelFlush();
+        // Buffered turns never post salvage: nothing streamed, so there is nothing
+        // to salvage, and the caller decides whether to post anything.
+        if (this.buffer) {
+            this.pending = [];
+            this.heldQuestions = [];
+            return this.chain;
+        }
         this.pending.push(...this.heldQuestions);
         this.heldQuestions = [];
         this.flushNow();
@@ -174,6 +225,10 @@ export class ProgressPoster {
         this.enqueueWith(body, this.send);
     }
     enqueueWith(body, sendFn) {
+        // Defence in depth: never let the silence sentinel reach the chat, whatever
+        // path built this body.
+        if (containsNoReplySentinel(body))
+            return;
         this.lastPostAt = this.now();
         this.chain = this.chain.then(async () => {
             try {

package/dist/lib/bot/prompt.js

@@ -288,7 +288,9 @@ export function buildSystemPrompt(input) {
         `Your owner can also add you to group chats and channels. A message that starts with a \`[#channel · N members · from Name]\` line ` +
         `comes from a room with other people in it (a "Recent messages:" block may follow for context; the last part is the message you are answering). ` +
         `Answer for the room: reply to the person who asked, keep it short, and never repeat your private memory, your owner's files, ` +
-        `or anything from your DMs to other people.`);
+        `or anything from your DMs to other people. ` +
+        `If the message is not addressed to you, is routine automated output, or you have nothing meaningful to add, produce zero output (completely empty response). ` +
+        `Do not narrate your reasoning, do not print JSON, do not explain that you are staying silent. Just produce nothing.`);
     // Only company bots: the cloud's jobs routes refuse a personal bot's per_
     // company claim today, so telling a personal bot it can schedule work makes
     // it promise its owner something that then fails. Drop this condition when

package/dist/lib/bot/run.d.ts

@@ -47,7 +47,7 @@
 import { type OwnerContext } from "./owner-context.js";
 import { type BotApi, type InboxItem } from "./api.js";
 import type { BotConfig, BotKind } from "./config.js";
-import { type ProgressPosterOptions } from "./progress.js";
+import { containsNoReplySentinel, type ProgressPosterOptions } from "./progress.js";
 import { type BotLogger } from "./log.js";
 import { type BotRuntime, type RuntimeTurnInput, type RuntimeTurnResult } from "./runtime/index.js";
 import type { VaultObjectDownloader } from "../agent-kit/attachment-download.js";
@@ -188,6 +188,9 @@ export declare function turnEnv(base: NodeJS.ProcessEnv, kind: BotKind, agentUid
 export declare const SETUP_WORKER_ID = "setup";
 /** The one message a person gets when a turn on their message did not finish. */
 export declare function didNotFinishText(reason: string, progressPosted: boolean): string;
+export { containsNoReplySentinel };
+/** Grok emits is_error with this message when the model produces only reasoning tokens. */
+export declare function isReasoningOnlyError(excerpt: string): boolean;
 /** Owner stop, `hq bot stop` or `hq bot restart`: all arrive as the same signal. */
 export declare const STOPPED_BY_OWNER_REASON = "I was stopped before I was done";
 export declare const RESTARTED_REASON = "I was restarted while I was working on it";

package/dist/lib/bot/run.js

@@ -57,7 +57,7 @@ import { ensureBotSessionMeta } from "./company-bind.js";
 import { readBotCredsIdentity } from "./creds.js";
 import { isProcessed, markProcessed, readInboxState } from "./inbox-state.js";
 import { clearInflight, patchInflight, readInflight, readInflightTurns, writeInflight } from "./inflight.js";
-import { ProgressPoster } from "./progress.js";
+import { containsNoReplySentinel, ProgressPoster } from "./progress.js";
 import { splitBody } from "./split.js";
 import { createBotLogger } from "./log.js";
 import { buildSystemPrompt, introDmText, readPromptSources } from "./prompt.js";
@@ -178,6 +178,11 @@ export function didNotFinishText(reason, progressPosted) {
     const r = reason.trim().replace(/[.\s]+$/, "");
     return `I didn't finish that — ${r}.${progressPosted ? " The messages above show how far I got." : ""}`;
 }
+export { containsNoReplySentinel };
+/** Grok emits is_error with this message when the model produces only reasoning tokens. */
+export function isReasoningOnlyError(excerpt) {
+    return excerpt.includes("reasoning_only");
+}
 /** Owner stop, `hq bot stop` or `hq bot restart`: all arrive as the same signal. */
 export const STOPPED_BY_OWNER_REASON = "I was stopped before I was done";
 export const RESTARTED_REASON = "I was restarted while I was working on it";
@@ -646,6 +651,7 @@ export async function runBot(deps) {
         writeInflight(dir, { v: 1, ...args.marker, startedAt: now().toISOString() });
         let running = true;
         let posted = 0;
+        const silenceable = args.silenceable === true;
         const makeSendFn = (fn) => async (body) => {
             try {
                 await fn(body);
@@ -662,7 +668,8 @@ export async function runBot(deps) {
         };
         const poster = new ProgressPoster({
             ...deps.progress,
-            ...(args.workingNotice === false ? { workingNoticeMs: 0 } : {}),
+            ...(args.workingNotice === false || silenceable ? { workingNoticeMs: 0 } : {}),
+            ...(silenceable ? { buffer: true } : {}),
             send: makeSendFn(args.send),
             ...(args.sendFinal ? { sendFinal: makeSendFn(args.sendFinal) } : {}),
         });
@@ -679,8 +686,21 @@ export async function runBot(deps) {
                 ...(args.readDirs?.length ? { readDirs: args.readDirs } : {}),
             });
             running = false;
-            await poster.finish(turn.text);
-            return { outcome: { ok: true, reply: turn.text.trim() || "(no reply)" }, poster };
+            const sentinelOrEmpty = containsNoReplySentinel(turn.text) || !turn.text.trim();
+            // Unmentioned room turn: a no_reply sentinel (bare, fenced, or with
+            // preamble) or an empty/whitespace reply means stay quiet. Abandon the
+            // poster (it posts nothing) and return a silent outcome; the caller acks
+            // without posting anything.
+            if (silenceable && sentinelOrEmpty) {
+                await poster.abandon();
+                return { outcome: { ok: true, reply: "", silent: true }, poster };
+            }
+            // DM or @-mentioned room: the person asked directly and must get a reply.
+            // Strip the silence sentinel so its raw JSON never posts, then let the
+            // poster produce its "(no reply)" fallback when there is nothing else.
+            const finalText = sentinelOrEmpty ? "" : turn.text;
+            await poster.finish(finalText);
+            return { outcome: { ok: true, reply: finalText.trim() }, poster };
         }
         catch (err) {
             running = false;
@@ -984,6 +1004,7 @@ export async function runBot(deps) {
         });
         await clearThinking();
         if (outcome.ok) {
+            // The kickoff never runs silenceable, so outcome.silent is never set here.
             if (poster.postedCount === 0) {
                 patchInflight(dir, KICKOFF_MESSAGE_ID, saved(outcome.reply));
                 log("warn", "kickoff reply failed to send; it is posted on the next start");
@@ -1334,12 +1355,23 @@ export async function runBot(deps) {
             send,
             sendFinal,
             workingNotice: !isSetupBot,
+            silenceable: target.kind === "room" && !target.mentioned,
             ...(readDirs.length ? { readDirs } : {}),
             ...(target.kind === "room"
                 ? { afterProgressPost: () => api.postAgentStatus(target.channelId, ROOM_THINKING_STATUS, target.rootEventId) }
                 : {}),
         });
         if (outcome.ok) {
+            // A no_reply sentinel or intentionally empty reply: ack silently, post nothing.
+            if (outcome.silent) {
+                markProcessed(dir, id, now().toISOString());
+                await api.ackInbox(config.agentUid, id);
+                clearInflight(dir, id);
+                attempts.delete(id);
+                await clearThinking();
+                log("info", `no_reply sentinel or empty reply for ${id} (${where}); acked silently`);
+                return;
+            }
             // Known gap (#614, not changed here): a progress post counts, so a final answer that fails after one is not resent.
             if (poster.postedCount === 0) {
                 // The work finished but nothing reached the chat: keep the answer —
@@ -1400,8 +1432,31 @@ export async function runBot(deps) {
         // The model started: it may already have done things, so never re-run.
         if (!outcome.aborted)
             recordTurnFailure(outcome.error, sessionScope);
+        // reasoning_only means the model produced only reasoning tokens and no text.
+        const reasoningOnly = !outcome.aborted && isReasoningOnlyError(outcome.excerpt);
+        const silenceableTurn = target.kind === "room" && !target.mentioned;
+        // Unmentioned room turn that posted nothing and was not stopped by the
+        // owner: any model failure (reasoning_only or otherwise) is a silent
+        // no-reply. The failure is already recorded above via recordTurnFailure,
+        // so we just ack quietly and never leak the raw error into the room.
+        if (!outcome.aborted && poster.postedCount === 0 && silenceableTurn) {
+            markProcessed(dir, id, now().toISOString());
+            await api.ackInbox(config.agentUid, id);
+            clearInflight(dir, id);
+            attempts.delete(id);
+            await clearThinking();
+            log("info", `unmentioned room turn ${id} failed with no post (${where}); acked silently`);
+            if (failures.exceeded(now().getTime())) {
+                await finish("failed", 0, `${FAILURE_LIMIT} model failures in 10 minutes; last: ${outcome.excerpt}`);
+            }
+            return;
+        }
         try {
-            await send(didNotFinishText(failureReason(outcome), poster.postedCount > 0));
+            // DM or @-mentioned room reasoning_only: the person asked directly, so
+            // still say we did not finish — but with a plain reason, never the raw
+            // internal error string.
+            const reason = reasoningOnly ? "the model returned no answer" : failureReason(outcome);
+            await send(didNotFinishText(reason, poster.postedCount > 0));
         }
         catch (err) {
             // Leave it un-acked with the marker: the next poll says it did not finish.

package/dist/lib/lanes/registry-flag.d.ts

@@ -0,0 +1,27 @@
+import { type FlagClientOptions, type FlagResolution } from "@indigoai-us/hq-flags-client";
+import type { LaneCompanyRef } from "./types.js";
+export declare const LANES_FLAG_API_DEFAULT_ENDPOINT = "https://hqapi.hq.computer";
+export declare const LANES_FLAG_READ_TIMEOUT_MS = 5000;
+export interface LanesFlagClient {
+    ready(): Promise<void>;
+    explain(flagKey: string, options?: {
+        fallback?: boolean;
+    }): FlagResolution;
+    close(): void;
+}
+export type LanesFlagClientFactory = (options: FlagClientOptions) => LanesFlagClient;
+export interface ReadLanesFlagOptions {
+    company?: LaneCompanyRef | null;
+    env?: NodeJS.ProcessEnv;
+    createClient?: LanesFlagClientFactory;
+    getToken?: () => string | Promise<string>;
+    reportFailure?: (error: unknown) => void;
+}
+/**
+ * Read a lanes flag once for each company identity in this CLI process. The
+ * cache contains only an in-flight or settled boolean promise; it is never
+ * written to disk. A local override is checked on every call and wins first.
+ */
+export declare function readLanesRegistryFlag(flagKey: string, options?: ReadLanesFlagOptions): Promise<boolean>;
+export declare function _resetLanesRegistryFlagCacheForTests(): void;
+//# sourceMappingURL=registry-flag.d.ts.map

package/dist/lib/lanes/registry-flag.js

@@ -0,0 +1,129 @@
+import { createFlagClient, readLocalOverride, } from "@indigoai-us/hq-flags-client";
+import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
+export const LANES_FLAG_API_DEFAULT_ENDPOINT = "https://hqapi.hq.computer";
+export const LANES_FLAG_READ_TIMEOUT_MS = 5_000;
+const registryReads = new Map();
+class MissingFlagTokenError extends Error {
+    constructor() {
+        super("No cached HQ identity token is available");
+        this.name = "MissingFlagTokenError";
+    }
+}
+class MissingFlagRowError extends Error {
+    constructor(flagKey) {
+        super(`The hq-flags registry did not resolve ${flagKey}`);
+        this.name = "MissingFlagRowError";
+    }
+}
+function errorClass(error) {
+    return error instanceof Error ? error.name : "UnknownError";
+}
+function reportReadFailure(flagKey, error) {
+    const suffix = flagKey.replace(/^lanes\./, "").replaceAll(/[^a-zA-Z0-9]+/g, "_");
+    process.stderr.write(`${JSON.stringify({
+        event: `lanes.${suffix}.flag_read_failed`,
+        flag: flagKey,
+        error: errorClass(error),
+        fallback: false,
+    })}\n`);
+}
+function cacheKey(flagKey, company, endpoint) {
+    return JSON.stringify([
+        flagKey,
+        endpoint,
+        company?.uid ?? null,
+        company?.slug ?? null,
+    ]);
+}
+/**
+ * Read a lanes flag once for each company identity in this CLI process. The
+ * cache contains only an in-flight or settled boolean promise; it is never
+ * written to disk. A local override is checked on every call and wins first.
+ */
+export async function readLanesRegistryFlag(flagKey, options = {}) {
+    const env = options.env ?? process.env;
+    const localOverride = readLocalOverride(flagKey, env);
+    if (localOverride !== null)
+        return localOverride;
+    const endpoint = env.HQ_FLAGS_API_URL?.trim() || LANES_FLAG_API_DEFAULT_ENDPOINT;
+    const key = cacheKey(flagKey, options.company, endpoint);
+    const cached = registryReads.get(key);
+    if (cached)
+        return cached;
+    const pending = readRegistryValue(flagKey, endpoint, options);
+    registryReads.set(key, pending);
+    return pending;
+}
+async function readRegistryValue(flagKey, endpoint, options) {
+    const company = options.company;
+    const companyUid = company?.uid?.trim();
+    const companySlug = company?.slug?.trim();
+    let client;
+    let enabled = false;
+    let failed = false;
+    let reported = false;
+    const reportFailure = (error) => {
+        failed = true;
+        if (reported)
+            return;
+        reported = true;
+        (options.reportFailure ?? ((cause) => reportReadFailure(flagKey, cause)))(error);
+    };
+    try {
+        const acquireToken = options.getToken ?? (async () => {
+            try {
+                return await ensureCognitoIdToken({ interactive: false });
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    error.message.startsWith("No valid HQ session")) {
+                    throw new MissingFlagTokenError();
+                }
+                throw error;
+            }
+        });
+        const getToken = async () => {
+            const token = await acquireToken();
+            if (typeof token !== "string" || token.trim().length === 0) {
+                throw new MissingFlagTokenError();
+            }
+            return token;
+        };
+        client = (options.createClient ?? createFlagClient)({
+            endpoint,
+            getToken,
+            env: {},
+            refreshIntervalMs: 0,
+            requestTimeoutMs: LANES_FLAG_READ_TIMEOUT_MS,
+            ...(companyUid ? { companyUid } : {}),
+            ...(companySlug ? { companyIdentifiers: [companySlug] } : {}),
+            onError: reportFailure,
+        });
+        await client.ready();
+        const resolution = client.explain(flagKey, { fallback: false });
+        if (failed)
+            return false;
+        if (resolution.source !== "snapshot" && resolution.source !== "local-override") {
+            reportFailure(new MissingFlagRowError(flagKey));
+        }
+        else {
+            enabled = resolution.value;
+        }
+    }
+    catch (error) {
+        reportFailure(error);
+    }
+    finally {
+        try {
+            client?.close();
+        }
+        catch (error) {
+            reportFailure(error);
+        }
+    }
+    return failed ? false : enabled;
+}
+export function _resetLanesRegistryFlagCacheForTests() {
+    registryReads.clear();
+}
+//# sourceMappingURL=registry-flag.js.map

package/dist/lib/search-index/collection-path-repair-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const QMD_COLLECTION_PATH_REPAIR_FLAG = "qmd.collection-path-repair";
+/** Keep collection-path repair off unless the hq-flags registry enables a canary. */
+export declare function qmdCollectionPathRepairEnabled(): boolean;
+//# sourceMappingURL=collection-path-repair-flag.d.ts.map

package/dist/lib/search-index/collection-path-repair-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from '../flag-registry.js';
+export const QMD_COLLECTION_PATH_REPAIR_FLAG = 'qmd.collection-path-repair';
+/** Keep collection-path repair off unless the hq-flags registry enables a canary. */
+export function qmdCollectionPathRepairEnabled() {
+    return resolveProcessFlagGate(QMD_COLLECTION_PATH_REPAIR_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=collection-path-repair-flag.js.map

package/dist/lib/search-index/index.d.ts

@@ -537,10 +537,14 @@ export declare function deriveCollections(hqRoot: string): SearchCollection[];
 export type ReconcileCollectionsOptions = {
     bin?: string;
     runner?: QmdProcessRunner;
+    /** Test seam for the default-off collection-path repair rollout. */
+    repairPathDrift?: boolean;
 };
 /**
  * Register expected collections that qmd does not yet know about, returning the
  * collections this call actually created (a `collection add` that exited 0).
+ * When the default-off hq-flags rollout is enabled, it also replaces a registered
+ * collection whose path matches a known prior HQ-managed layout.
  *
  * A same-name idempotent duplicate — qmd already owns the exact requested name
  * in its YAML config (`Collection '<name>' already exists.`), while the

package/dist/lib/search-index/index.js

@@ -3,6 +3,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { dump, load } from 'js-yaml';
 import { isQmdModelDownloadError } from '../../utils/qmd-model-download-error.js';
 import { isQmdModuleMissingError } from '../../utils/qmd-module-missing-error.js';
 import { isQmdNativeBindingError } from '../../utils/qmd-native-binding-error.js';
@@ -12,6 +13,8 @@ import { isQmdStoreUnopenableError } from '../../utils/qmd-store-unopenable-erro
 import { markExpectedUserError } from '../../utils/expected-cli-error.js';
 import { redactErrorText } from '../../utils/redact-error-text.js';
 import { planCommandSpawn } from '../../utils/windows-spawn.js';
+import { resolveQmdConfigPath } from './max-doc-bytes.js';
+import { qmdCollectionPathRepairEnabled } from './collection-path-repair-flag.js';
 /** The `path` implementation for a (possibly injected) platform. */
 function pathFor(platform) {
     return platform === 'win32' ? path.win32 : path.posix;
@@ -1350,9 +1353,90 @@ export function deriveCollections(hqRoot) {
     }
     return collections;
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function qmdConfigPath(hqRoot) {
+    const env = {
+        ...process.env,
+        HOME: process.env.HOME ?? process.env.USERPROFILE ?? os.homedir(),
+    };
+    return resolveQmdConfigPath({ env, startDir: hqRoot });
+}
+/** Read qmd's configured collection metadata from the same config file its CLI uses. */
+function configuredCollections(hqRoot) {
+    const configPath = qmdConfigPath(hqRoot);
+    if (!configPath || !fs.existsSync(configPath))
+        return new Map();
+    const document = load(fs.readFileSync(configPath, 'utf8'));
+    if (!isRecord(document) || !isRecord(document.collections))
+        return new Map();
+    return new Map(Object.entries(document.collections).flatMap(([name, config]) => isRecord(config) && typeof config.path === 'string' ? [[name, config]] : []));
+}
+/** Restore existing collection options after qmd's add command rewrites the entry. */
+function restoreCollectionMetadata(hqRoot, collection, previousConfig) {
+    const configPath = qmdConfigPath(hqRoot);
+    if (!configPath || !fs.existsSync(configPath)) {
+        throw new Error(`QMD config disappeared while repairing collection '${collection.name}'`);
+    }
+    const document = load(fs.readFileSync(configPath, 'utf8'));
+    if (!isRecord(document) || !isRecord(document.collections)) {
+        throw new Error(`QMD config has no collections map while repairing '${collection.name}'`);
+    }
+    const currentConfig = document.collections[collection.name];
+    document.collections[collection.name] = {
+        ...(isRecord(currentConfig) ? currentConfig : {}),
+        ...previousConfig,
+        path: collection.path,
+    };
+    fs.writeFileSync(configPath, dump(document, { lineWidth: 0 }));
+}
+function resolvedPath(value) {
+    const absolutePath = path.resolve(value);
+    try {
+        return fs.realpathSync(absolutePath);
+    }
+    catch {
+        return absolutePath;
+    }
+}
+function comparablePath(value) {
+    return process.platform === 'win32' ? value.toLowerCase() : value;
+}
+/** Repair a known HQ-managed path, including the former company knowledge mirror layout. */
+function isPreviousHqManagedPath(hqRoot, collection, configuredPath) {
+    const root = resolvedPath(hqRoot);
+    const expectedPath = resolvedPath(collection.path);
+    const managedRelativePath = path.relative(root, expectedPath);
+    if (!managedRelativePath ||
+        path.isAbsolute(managedRelativePath) ||
+        managedRelativePath === '..' ||
+        managedRelativePath.startsWith(`..${path.sep}`)) {
+        return false;
+    }
+    const actualPath = resolvedPath(path.resolve(hqRoot, configuredPath));
+    const suffix = `${path.sep}${managedRelativePath}`;
+    const actualForComparison = comparablePath(actualPath);
+    const suffixForComparison = comparablePath(suffix);
+    const prefixLength = actualForComparison.length - suffixForComparison.length;
+    if (prefixLength > path.parse(actualPath).root.length && actualForComparison.endsWith(suffixForComparison)) {
+        return true;
+    }
+    const expectedParts = managedRelativePath.split(path.sep);
+    if (expectedParts.length !== 3 || expectedParts[0] !== 'companies' || expectedParts[2] !== 'knowledge') {
+        return false;
+    }
+    const slug = expectedParts[1];
+    if (!slug)
+        return false;
+    const formerMirrorPath = resolvedPath(path.join(root, 'repos', 'private', `knowledge-${slug}`));
+    return comparablePath(actualPath) === comparablePath(formerMirrorPath);
+}
 /**
  * Register expected collections that qmd does not yet know about, returning the
  * collections this call actually created (a `collection add` that exited 0).
+ * When the default-off hq-flags rollout is enabled, it also replaces a registered
+ * collection whose path matches a known prior HQ-managed layout.
  *
  * A same-name idempotent duplicate — qmd already owns the exact requested name
  * in its YAML config (`Collection '<name>' already exists.`), while the
@@ -1368,11 +1452,29 @@ export function deriveCollections(hqRoot) {
 export function reconcileCollections(hqRoot, options = {}) {
     const runOptions = { bin: options.bin, runner: options.runner, cwd: hqRoot };
     const registered = listRegisteredCollections(hqRoot, runOptions);
-    const missing = deriveCollections(hqRoot).filter((collection) => !registered.has(collection.name));
+    const expected = deriveCollections(hqRoot);
+    const repairPathDrift = options.repairPathDrift ?? qmdCollectionPathRepairEnabled();
+    const configured = repairPathDrift ? configuredCollections(hqRoot) : new Map();
+    const stale = repairPathDrift
+        ? expected.filter((collection) => {
+            const previousConfig = configured.get(collection.name);
+            return previousConfig !== undefined
+                && comparablePath(resolvedPath(path.resolve(hqRoot, previousConfig.path))) !== comparablePath(resolvedPath(collection.path))
+                && isPreviousHqManagedPath(hqRoot, collection, previousConfig.path);
+        })
+        : [];
+    for (const collection of stale) {
+        runQmd(['collection', 'remove', collection.name], runOptions);
+        registered.delete(collection.name);
+    }
+    const missing = expected.filter((collection) => !registered.has(collection.name));
     const created = [];
     for (const collection of missing) {
         try {
             runQmd(['collection', 'add', collection.path, '--name', collection.name, '--mask', collection.mask], runOptions);
+            const previousConfig = configured.get(collection.name);
+            if (previousConfig)
+                restoreCollectionMetadata(hqRoot, collection, previousConfig);
             created.push(collection);
         }
         catch (error) {
@@ -1381,6 +1483,9 @@ export function reconcileCollections(hqRoot, options = {}) {
             // different collection — stays fatal.
             if (!(error instanceof QmdCollectionExistsError) || error.collectionName !== collection.name)
                 throw error;
+            const previousConfig = configured.get(collection.name);
+            if (previousConfig)
+                restoreCollectionMetadata(hqRoot, collection, previousConfig);
         }
         runQmd(['context', 'add', `qmd://${collection.name}`, collection.context], runOptions);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.184.0",
+  "version": "5.185.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {