@indigoai-us/hq-cli 5.192.1 → 5.193.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.193.0] — 2026-09-25
+
+### Fixed
+
+- `hq secrets set` now handles a closed stdin descriptor during terminal cleanup.
+
+### Improved
+
+- Sentry reports for failed skill-wrapper replacement now include bounded ownership-state tags.
+
+## [5.192.2] — 2026-09-25
+
+### Fixed
+
+- Create, resume, automatic repair, and apply now read
+  `lanes.claude-account-balance` from hq-flags. `HQ_FLAG_*` remains the local
+  override, and a registry read failure keeps the gate off. The
+  `accounts balance --json` report includes `balance_gate_enabled`.
+- `hq lanes accounts balance --apply` now honors each lane's company-scoped
+  gate, skips disabled company lanes, and rechecks the gate before moving.
+
 ## [5.192.1] — 2026-09-25
 
 ### Fixed

package/dist/commands/lanes.d.ts

@@ -86,8 +86,8 @@ export interface LanesCommandDeps {
     isSsmOwnerDispatch?: () => boolean;
     /** Test seam for changing a lane between pre-lock and locked grant reads. */
     withGrantHireLocks?: typeof withLaneHireLocks;
-    /** Test seam for the default-off Claude account-balancing gate. */
-    laneClaudeAccountBalanceEnabled?: () => boolean;
+    /** Test seam for the Claude account-balancing gate. */
+    laneClaudeAccountBalanceEnabled?: (company?: LaneCompanyRef | null) => boolean | Promise<boolean>;
 }
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 export declare function parseSeniorRef(raw: string): SeniorRef;

package/dist/commands/lanes.js

@@ -57,8 +57,10 @@ export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 function defaultLanePlacementEnabled() {
     return resolveProcessFlagGate(LANE_OUTPOST_LOAD_BALANCING_FLAG, { fallback: false }, () => false);
 }
-function defaultLaneClaudeAccountBalanceEnabled() {
-    return resolveProcessFlagGate(CLAUDE_ACCOUNT_BALANCE_FLAG, { fallback: false }, () => false);
+function defaultLaneClaudeAccountBalanceEnabled(company) {
+    // Keep the local HQ_FLAG override and the registry reader's fail-closed
+    // behavior, matching the lane hire-grants gate.
+    return readLanesRegistryFlag(CLAUDE_ACCOUNT_BALANCE_FLAG, { company });
 }
 function defaultLaneHireGrantsEnabled(company) {
     return readLanesRegistryFlag(LANE_HIRE_GRANTS_FLAG, { company });
@@ -2516,7 +2518,7 @@ async function runCreate(ctx, opts) {
     }
     const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
     let accountSelection;
-    if (provider === "claude" && ctx.laneClaudeAccountBalanceEnabled()) {
+    if (provider === "claude" && await ctx.laneClaudeAccountBalanceEnabled(company)) {
         const targetHost = placementHostOverride ?? (outpostId !== undefined
             ? { kind: "outpost", id: outpostId }
             : laneHostFromCtx(ctx));
@@ -4841,7 +4843,7 @@ async function prepareAccountMove(ctx, lane, input) {
 async function selectAutomaticClaudeResumeAccount(ctx, lane) {
     if (lane.provider !== "claude")
         return undefined;
-    if (!ctx.laneClaudeAccountBalanceEnabled()) {
+    if (!await ctx.laneClaudeAccountBalanceEnabled(lane.company)) {
         if (lane.account === undefined)
             return undefined;
         const config = loadLanesConfig(ctx.hqRoot());
@@ -5245,6 +5247,7 @@ async function applyClaudeBalanceMove(ctx, suggestion) {
         return { lane_id: suggestion.lane_id, host: suggestion.host, from: suggestion.from, to: suggestion.to, state: suggestion.state };
     }
     const lane = laneWithRecoveredProviderSession(ctx.hqRoot(), readLane(ctx.hqRoot(), suggestion.lane_id));
+    assertBalanceApplyEnabled(await ctx.laneClaudeAccountBalanceEnabled(lane.company));
     if (lane.state === "running") {
         throw new LanesError("lane_running", `Lane ${lane.lane_id} is running; balance never moves a running turn`, {
             lane_id: lane.lane_id,
@@ -5273,8 +5276,8 @@ async function applyClaudeBalanceMove(ctx, suggestion) {
     return { lane_id: moved.lane.lane_id, host: moved.lane.host, from: moved.from ?? suggestion.from, to: moved.to, state: moved.lane.state };
 }
 async function runClaudeBalanceMoveTarget(ctx, laneId, opts) {
-    assertBalanceApplyEnabled(ctx.laneClaudeAccountBalanceEnabled());
     const lane = laneWithRecoveredProviderSession(ctx.hqRoot(), readLane(ctx.hqRoot(), laneId));
+    assertBalanceApplyEnabled(await ctx.laneClaudeAccountBalanceEnabled(lane.company));
     assertLaneRunsHereForOperatorMutation(ctx, lane, "balance-move-target");
     if (lane.provider !== "claude") {
         throw new LanesError("claude_account_balance_provider_mismatch", `Lane ${laneId} does not use Claude`, {
@@ -6873,11 +6876,30 @@ async function runAccountsBalance(ctx, opts) {
             accepted: ["claude"],
         });
     }
-    if (opts.apply)
-        assertBalanceApplyEnabled(ctx.laneClaudeAccountBalanceEnabled());
     const hqRoot = ctx.hqRoot();
     const config = loadLanesConfig(hqRoot);
     const loaded = await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config);
+    const laneBalanceGateEnabled = new Map();
+    const companyBalanceGateEnabled = new Map();
+    const lanes = loaded.snapshots.flatMap((host) => host.lanes);
+    for (const lane of lanes) {
+        const companyKey = JSON.stringify([lane.company?.uid ?? null, lane.company?.slug ?? null]);
+        let enabled = companyBalanceGateEnabled.get(companyKey);
+        if (enabled === undefined) {
+            enabled = await ctx.laneClaudeAccountBalanceEnabled(lane.company);
+            companyBalanceGateEnabled.set(companyKey, enabled);
+        }
+        laneBalanceGateEnabled.set(lane.lane_id, enabled);
+    }
+    // With no lanes there is no tenant scope to resolve, so report and enforce
+    // the unscoped/default gate. Otherwise the report reflects whether any
+    // represented lane company has the gate enabled.
+    if (lanes.length === 0) {
+        companyBalanceGateEnabled.set(JSON.stringify([null, null]), await ctx.laneClaudeAccountBalanceEnabled());
+    }
+    const balanceGateEnabled = [...companyBalanceGateEnabled.values()].some(Boolean);
+    if (opts.apply)
+        assertBalanceApplyEnabled(balanceGateEnabled);
     const loads = accountLoadsForReport({ hosts: loaded.snapshots, config });
     const suggestions = planClaudeBalanceMoves({ hosts: loaded.snapshots, config });
     const selections = loaded.snapshots.map((host) => {
@@ -6939,6 +6961,16 @@ async function runAccountsBalance(ctx, opts) {
                 });
                 continue;
             }
+            if (laneBalanceGateEnabled.get(suggestion.lane_id) !== true) {
+                skipped.push({
+                    lane_id: suggestion.lane_id,
+                    host: suggestion.host,
+                    from: suggestion.from,
+                    to: suggestion.to,
+                    reason: "claude_account_balance_disabled",
+                });
+                continue;
+            }
             try {
                 moved.push(await applyClaudeBalanceMove(ctx, suggestion));
             }
@@ -6957,6 +6989,7 @@ async function runAccountsBalance(ctx, opts) {
         ok: true,
         action: "accounts.balance",
         provider: "claude",
+        balance_gate_enabled: balanceGateEnabled,
         accounts,
         selections,
         unavailable_hosts: loaded.unavailableHosts,

package/dist/commands/secrets.js

@@ -188,12 +188,23 @@ function promptSecretInteractively() {
         let value = "";
         process.stdin.setEncoding("utf8");
         const cleanup = () => {
-            if (process.stdin.isTTY) {
-                process.stdin.setRawMode(false);
+            try {
+                if (process.stdin.isTTY) {
+                    try {
+                        process.stdin.setRawMode(false);
+                    }
+                    catch (error) {
+                        if (error?.code !== "EBADF") {
+                            throw error;
+                        }
+                    }
+                }
+            }
+            finally {
+                process.stdin.removeListener("data", onData);
+                process.stdin.removeListener("end", onEnd);
+                process.stdin.pause();
             }
-            process.stdin.removeListener("data", onData);
-            process.stdin.removeListener("end", onEnd);
-            process.stdin.pause();
         };
         const onEnd = () => {
             cleanup();

package/dist/lib/company-skill-wrapper.d.ts

@@ -1,4 +1,13 @@
 import * as fs from "node:fs";
+export interface CompanySkillWrapperOwnershipDiagnostics {
+    kind: "directory" | "symlink" | "file" | "other";
+    bridgeState: "all_live" | "partial" | "none" | "empty" | "not_applicable";
+    markerState: "bound" | "missing" | "invalid" | "unbound" | "unavailable" | "not_applicable";
+    linkTarget: "company_skills" | "outside_company_skills" | "unavailable" | "not_applicable";
+    platform: "win32" | "darwin" | "linux" | "other";
+    nameEncoding: "percent_encoded" | "literal";
+}
+export declare function companySkillWrapperSentryTagsFor(error: unknown): Record<string, string> | undefined;
 export interface SurfaceCompanySkillInput {
     hqRoot: string;
     companySlug: string;

package/dist/lib/company-skill-wrapper.js

@@ -62,20 +62,6 @@ function symlinkTarget(linkPath) {
 function generatedMarkerPath(wrapperPath) {
     return path.join(path.dirname(wrapperPath), WRAPPER_MARKER_DIR, `${path.basename(wrapperPath)}.json`);
 }
-function hasBoundGeneratedMarker(wrapperPath, companySlug) {
-    try {
-        const marker = JSON.parse(fs.readFileSync(generatedMarkerPath(wrapperPath), "utf8"));
-        const wrapper = fs.lstatSync(wrapperPath);
-        return (marker.version === 2 &&
-            marker.companySlug === companySlug &&
-            marker.wrapperDev === wrapper.dev &&
-            marker.wrapperIno === wrapper.ino &&
-            marker.wrapperBirthtimeMs === wrapper.birthtimeMs);
-    }
-    catch {
-        return false;
-    }
-}
 function writeGeneratedMarker(wrapperPath, companySlug, skillSlug) {
     const markerPath = generatedMarkerPath(wrapperPath);
     try {
@@ -104,21 +90,116 @@ function removeGeneratedMarker(wrapperPath) {
         // never sufficient to surface content on its own.
     }
 }
-function isGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
+const COMPANY_SKILL_WRAPPER_DIAGNOSTICS = Symbol("company-skill-wrapper-diagnostics");
+function companySkillWrapperOwnershipError(wrapperPath, diagnostics) {
+    const error = new Error(`Cannot replace '${wrapperPath}' because it is not an HQ-generated skill wrapper.`);
+    Object.defineProperty(error, COMPANY_SKILL_WRAPPER_DIAGNOSTICS, {
+        value: diagnostics,
+    });
+    return error;
+}
+export function companySkillWrapperSentryTagsFor(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    const diagnostics = error[COMPANY_SKILL_WRAPPER_DIAGNOSTICS];
+    if (!diagnostics)
+        return undefined;
+    return {
+        hq_cli_skill_wrapper_kind: diagnostics.kind,
+        hq_cli_skill_wrapper_bridge_state: diagnostics.bridgeState,
+        hq_cli_skill_wrapper_marker_state: diagnostics.markerState,
+        hq_cli_skill_wrapper_link_target: diagnostics.linkTarget,
+        hq_cli_skill_wrapper_platform: diagnostics.platform,
+        hq_cli_skill_wrapper_name_encoding: diagnostics.nameEncoding,
+    };
+}
+function inspectGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
     const companySkillsRoot = path.join(hqRoot, "companies", companySlug, "skills");
-    const wrapperTarget = symlinkTarget(wrapperPath);
-    if (wrapperTarget)
-        return isWithin(companySkillsRoot, wrapperTarget);
-    const wrapper = lstat(wrapperPath);
-    if (!wrapper?.isDirectory())
-        return false;
+    const wrapperEntry = lstat(wrapperPath);
+    if (wrapperEntry?.isSymbolicLink()) {
+        const target = symlinkTarget(wrapperPath);
+        const linkTarget = target === undefined
+            ? "unavailable"
+            : isWithin(companySkillsRoot, target)
+                ? "company_skills"
+                : "outside_company_skills";
+        return {
+            owned: linkTarget === "company_skills",
+            diagnostics: {
+                kind: "symlink",
+                bridgeState: "not_applicable",
+                markerState: "not_applicable",
+                linkTarget,
+            },
+        };
+    }
+    if (!wrapperEntry?.isDirectory()) {
+        return {
+            owned: false,
+            diagnostics: {
+                kind: wrapperEntry?.isFile() ? "file" : "other",
+                bridgeState: "not_applicable",
+                markerState: "not_applicable",
+                linkTarget: "not_applicable",
+            },
+        };
+    }
     const entries = fs.readdirSync(wrapperPath).filter((entry) => !entry.startsWith("."));
-    const containsOnlyLiveBridges = (entries.length > 0 &&
-        entries.every((entry) => {
-            const target = symlinkTarget(path.join(wrapperPath, entry));
-            return target !== undefined && isWithin(companySkillsRoot, target);
-        }));
-    return containsOnlyLiveBridges || hasBoundGeneratedMarker(wrapperPath, companySlug);
+    const liveBridgeCount = entries.reduce((count, entry) => {
+        const target = symlinkTarget(path.join(wrapperPath, entry));
+        return count + (target !== undefined && isWithin(companySkillsRoot, target) ? 1 : 0);
+    }, 0);
+    const bridgeState = entries.length === 0
+        ? "empty"
+        : liveBridgeCount === entries.length
+            ? "all_live"
+            : liveBridgeCount > 0
+                ? "partial"
+                : "none";
+    const markerState = generatedMarkerState(wrapperPath, companySlug);
+    return {
+        owned: bridgeState === "all_live" || markerState === "bound",
+        diagnostics: {
+            kind: "directory",
+            bridgeState,
+            markerState,
+            linkTarget: "not_applicable",
+        },
+    };
+}
+function isGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug) {
+    return inspectGeneratedNamespacedWrapper(wrapperPath, hqRoot, companySlug).owned;
+}
+function generatedMarkerState(wrapperPath, companySlug) {
+    let markerContents;
+    try {
+        markerContents = fs.readFileSync(generatedMarkerPath(wrapperPath), "utf8");
+    }
+    catch (error) {
+        return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT"
+            ? "missing"
+            : "unavailable";
+    }
+    let marker;
+    try {
+        marker = JSON.parse(markerContents);
+    }
+    catch {
+        return "invalid";
+    }
+    try {
+        const wrapper = fs.lstatSync(wrapperPath);
+        return marker.version === 2 &&
+            marker.companySlug === companySlug &&
+            marker.wrapperDev === wrapper.dev &&
+            marker.wrapperIno === wrapper.ino &&
+            marker.wrapperBirthtimeMs === wrapper.birthtimeMs
+            ? "bound"
+            : "unbound";
+    }
+    catch {
+        return "unavailable";
+    }
 }
 function isGeneratedLegacyEntry(legacyPath, sourceDir, skillFile) {
     const target = symlinkTarget(legacyPath);
@@ -224,8 +305,19 @@ export function surfaceCompanySkill(input) {
         const backupPath = `${stagingPath}.previous`;
         let previousMoved = false;
         if (currentWrapper) {
-            if (!isGeneratedNamespacedWrapper(wrapperPath, input.hqRoot, input.companySlug)) {
-                throw new Error(`Cannot replace '${wrapperPath}' because it is not an HQ-generated skill wrapper.`);
+            const ownership = inspectGeneratedNamespacedWrapper(wrapperPath, input.hqRoot, input.companySlug);
+            if (!ownership.owned) {
+                const runtimePlatform = process.platform;
+                const platform = win32
+                    ? "win32"
+                    : runtimePlatform === "darwin" || runtimePlatform === "linux"
+                        ? runtimePlatform
+                        : "other";
+                throw companySkillWrapperOwnershipError(wrapperPath, {
+                    ...ownership.diagnostics,
+                    platform,
+                    nameEncoding: win32 ? "percent_encoded" : "literal",
+                });
             }
             renameEntry(wrapperPath, backupPath);
             previousMoved = true;

package/dist/sentry.js

@@ -5,6 +5,7 @@ import { beforeBreadcrumb } from "./utils/breadcrumb-buffer.js";
 import { CLI_VERSION } from "./cli-version.js";
 import { getCachedSentryUser } from "./utils/sentry-identity.js";
 import { isEpipe } from "./utils/epipe.js";
+import { companySkillWrapperSentryTagsFor } from "./lib/company-skill-wrapper.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { incompleteInstallCaptureContext, incompleteInstallMessage, } from "./utils/incomplete-install-error.js";
 import { installTreeTornSentryTagsFor, sentryFingerprintFor, sentryMcpCollisionContextFor, } from "./utils/sentry-fingerprint.js";
@@ -84,6 +85,10 @@ export function epipeAwareBeforeSend(event, hint) {
         if (fingerprint)
             event.fingerprint = fingerprint;
     }
+    const skillWrapperTags = companySkillWrapperSentryTagsFor(hint?.originalException);
+    if (skillWrapperTags) {
+        event.tags = { ...event.tags, ...skillWrapperTags };
+    }
     const installTreeTags = installTreeTornSentryTagsFor(hint?.originalException);
     if (installTreeTags) {
         event.tags = { ...event.tags, ...installTreeTags };

package/dist/utils/contribution-table.d.ts

@@ -99,5 +99,5 @@ export declare const CONTRIBUTION_KEYS: ContributionKey[];
  */
 export declare function payloadFor(key: ContributionKey, item: string): string;
 /** Keys whose contributions are wired by a host symlink (skip `merge` rows). */
-export declare const SYMLINK_KEYS: ("workers" | "mcp" | "knowledge" | "skills" | "commands" | "hooks" | "policies" | "scripts")[];
+export declare const SYMLINK_KEYS: ("workers" | "mcp" | "skills" | "knowledge" | "commands" | "hooks" | "policies" | "scripts")[];
 //# sourceMappingURL=contribution-table.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.192.1",
+  "version": "5.193.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {