@indigoai-us/hq-cli 5.194.1 → 5.195.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [5.195.1] — 2026-09-25
+
+### Fixed
+
+- A checkpoint run from inside an HQ lane no longer passes the lane's identity
+  (`HQ_LANE_ID`, `HQ_PROJECT_ID`, `HQ_STORY_ID`, `HQ_POLICY_WORKER_DIR`) to the
+  background sibling. Before, the lane drop-box hook delivered the lane's
+  operator messages to the sibling instead of the lane.
+
+## [5.195.0] — 2026-09-25
+
+### Fixed
+
+- Work Mesh transcript-watch quiet `session_end` for hook-covered sessions now
+  uses the shared sequence and counts hook turns (#818).
+
 ## [5.194.1] — 2026-09-25
 
 ### Fixed

package/dist/commands/core-checkpoint.d.ts

@@ -81,6 +81,8 @@ export declare function autoBackendPreference(): SpawnableBackend[];
  * (Claude Code does) agrees with a host that does not.
  */
 export declare function siblingEnabledBySetting(liveRoot: string): boolean;
+/** The sibling's environment: the caller's, minus lane identity. */
+export declare function siblingEnv(base: NodeJS.ProcessEnv, backend: SpawnableBackend): NodeJS.ProcessEnv;
 export declare function siblingArgs(backend: SpawnableBackend, prompt: string): string[];
 /** Attach the native checkpoint command to the hidden `hq core` group. */
 export declare function registerCoreCheckpointCommand(core: Command): void;

package/dist/commands/core-checkpoint.js

@@ -780,6 +780,24 @@ function resolveBackend(requested, liveRoot) {
     // failure is a weaker signal than running no maintenance sibling at all.
     return available.find((name) => !crashed.has(name)) ?? available[0];
 }
+/**
+ * Lane identity a checkpoint caller may carry. The sibling is HQ maintenance,
+ * not the lane: with HQ_LANE_ID set, the lane drop-box hook hands the lane's
+ * operator messages to the sibling, and the lane never sees them.
+ */
+const LANE_ENV_KEYS = ["HQ_LANE_ID", "HQ_PROJECT_ID", "HQ_STORY_ID", "HQ_POLICY_WORKER_DIR"];
+/** The sibling's environment: the caller's, minus lane identity. */
+export function siblingEnv(base, backend) {
+    const vars = { ...base };
+    for (const name of LANE_ENV_KEYS)
+        delete vars[name];
+    // This prevents the scaffold Stop hook from recursively launching a
+    // sibling when the background agent itself finishes a turn.
+    vars.HQ_CHECKPOINT_SIBLING = "1";
+    if (backend === "claude")
+        vars.CLAUDE_EFFORT = CLAUDE_SIBLING_EFFORT;
+    return vars;
+}
 export function siblingArgs(backend, prompt) {
     switch (backend) {
         case "claude":
@@ -978,13 +996,7 @@ function startSibling(liveRoot, input, threadPath, backend) {
             detached: true,
             cwd: liveRoot,
             stdio: ["ignore", logFd, logFd],
-            // This prevents the scaffold Stop hook from recursively launching a
-            // sibling when the background agent itself finishes a turn.
-            env: {
-                ...process.env,
-                HQ_CHECKPOINT_SIBLING: "1",
-                ...(backend === "claude" ? { CLAUDE_EFFORT: CLAUDE_SIBLING_EFFORT } : {}),
-            },
+            env: siblingEnv(process.env, backend),
         });
     }
     finally {

package/dist/lib/lanes/text-scan.d.ts

@@ -0,0 +1,11 @@
+/** Secret-like values already redacted from lane report summaries. */
+export declare const SECRET_RE: RegExp;
+/** Paths that should not be copied into a report or tracker record. */
+export declare const SECRETS_PATH_RE: RegExp;
+/** Return only the category of a match; never expose matched text to callers. */
+export declare function findSecretText(text: string): {
+    kind: string;
+} | null;
+/** Refuse free text containing credentials without copying the matched value into the error. */
+export declare function assertNoSecretText(field: string, text: string): void;
+//# sourceMappingURL=text-scan.d.ts.map

package/dist/lib/lanes/text-scan.js

@@ -0,0 +1,103 @@
+import { LanesError } from "./errors.js";
+/** Secret-like values already redacted from lane report summaries. */
+export const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._\-+=/]+)|(?:sk-[A-Za-z0-9]{8,})|(?:ghp_[A-Za-z0-9]{8,})|(?:github_pat_[A-Za-z0-9_]{8,})|(?:xox[baprs]-[A-Za-z0-9-]{8,})|(?:AKIA[0-9A-Z]{8,})|(?:op:\/\/[^\s"]+)/gi;
+/** Paths that should not be copied into a report or tracker record. */
+export const SECRETS_PATH_RE = /(?:^|[\s"'`])((?:~|\/|\.\/|\.\.\/)?(?:[\w.-]+\/)*(?:\.env(?:\.[A-Za-z0-9._-]+)?|secrets(?:\/[\w.-]+)*|id_rsa|credentials(?:\.json)?|\.netrc|\.npmrc))/gi;
+const TOKEN_SHAPED_SECRET_PATTERNS = [
+    // Keep the report-summary short-token thresholds, but require a true left boundary.
+    {
+        kind: "stripe_api_key",
+        pattern: /(?:^|[^a-zA-Z0-9_-])(?:sk|rk)_(?:live|test)_[a-zA-Z0-9]{16,}/i,
+    },
+    { kind: "api_key", pattern: /(?:^|[^a-zA-Z0-9_-])sk-[a-zA-Z0-9._-]{8,}/i },
+    { kind: "github_pat", pattern: /(?:^|[^a-zA-Z0-9_-])ghp_[a-zA-Z0-9]{8,}/i },
+    {
+        kind: "fine_grained_github_pat",
+        pattern: /(?:^|[^a-zA-Z0-9_-])github_pat_[a-zA-Z0-9_]{8,}/i,
+    },
+    { kind: "slack_token", pattern: /(?:^|[^a-zA-Z0-9_-])xox[baprs]-[a-zA-Z0-9-]{8,}/i },
+    { kind: "aws_access_key", pattern: /(?:^|[^a-zA-Z0-9_-])AKIA[0-9A-Z]{8,}/i },
+    { kind: "onepassword_reference", pattern: /(?:^|[^a-zA-Z0-9_-])op:\/\/[^\s"]+/i },
+    // The hook's Bearer rule requires a token-shaped value of at least 20 characters.
+    { kind: "bearer_token", pattern: /(?:^|[^a-zA-Z0-9_-])Bearer\s+[a-zA-Z0-9._-]{20,}/i },
+    {
+        kind: "private_key",
+        pattern: /(?:^|[^a-zA-Z0-9_-])-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+    },
+    { kind: "gitlab_pat", pattern: /(?:^|[^a-zA-Z0-9_-])glpat-[a-zA-Z0-9_-]{20,}/ },
+    { kind: "github_oauth_token", pattern: /(?:^|[^a-zA-Z0-9_-])gho_[a-zA-Z0-9]{36,}/ },
+    {
+        kind: "fine_grained_github_pat",
+        pattern: /(?:^|[^a-zA-Z0-9_-])github_pat_[a-zA-Z0-9_]{22,}/,
+    },
+];
+const SENSITIVE_URL_PARAMETER_NAMES = new Set([
+    "code",
+    "token",
+    "otp",
+    "magic",
+    "auth",
+    "session",
+    "signature",
+]);
+const URL_RE = /\b[A-Za-z][A-Za-z0-9+.-]*:\/\/[^\s<>"'`]+/g;
+const ONE_TIME_CODE_RE = /\b(?:(?:one[- ]time|verification|login|sign[- ]in|security|auth)\s+code|otp)\b\s*(?:(?:is|:|=)\s*)?(?:\d{4,8}|\d{3,4}[- ]\d{3,4})\b|\bcode(?:\s*:\s*|\s+is\s+)(?:\d{6}|\d{3,4}[- ]\d{3,4})\b/i;
+function hasSensitiveUrlParameter(urlText) {
+    let url;
+    try {
+        url = new URL(urlText);
+    }
+    catch {
+        return false;
+    }
+    const queryParts = [url.search.slice(1)];
+    const fragment = url.hash.slice(1);
+    if (fragment) {
+        const queryStart = fragment.indexOf("?");
+        queryParts.push(queryStart >= 0 ? fragment.slice(queryStart + 1) : fragment);
+    }
+    for (const part of queryParts) {
+        for (const [name, value] of new URLSearchParams(part)) {
+            const normalizedName = name
+                .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+                .toLowerCase();
+            const hasSensitiveName = SENSITIVE_URL_PARAMETER_NAMES.has(normalizedName) ||
+                /(?:^|[_-])(?:code|token|otp|magic|auth|session|signature)(?:$|[_-])/.test(normalizedName);
+            if (hasSensitiveName &&
+                value.trim().length > 0) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** Return only the category of a match; never expose matched text to callers. */
+export function findSecretText(text) {
+    const secretPathPattern = new RegExp(SECRETS_PATH_RE.source, "gi");
+    const pathScanText = text.replace(/(^|[\s"'`])~\//g, "$1./");
+    for (const pathMatch of pathScanText.matchAll(secretPathPattern)) {
+        const candidate = pathMatch[1] ?? "";
+        if (candidate.startsWith("~") || candidate.includes("/")) {
+            return { kind: "secrets_path" };
+        }
+    }
+    for (const candidate of TOKEN_SHAPED_SECRET_PATTERNS) {
+        if (candidate.pattern.test(text))
+            return { kind: candidate.kind };
+    }
+    for (const match of text.matchAll(URL_RE)) {
+        if (hasSensitiveUrlParameter(match[0]))
+            return { kind: "sign_in_link" };
+    }
+    if (ONE_TIME_CODE_RE.test(text))
+        return { kind: "one_time_code" };
+    return null;
+}
+/** Refuse free text containing credentials without copying the matched value into the error. */
+export function assertNoSecretText(field, text) {
+    const match = findSecretText(text);
+    if (!match)
+        return;
+    throw new LanesError("secret_text_refused", `Sensitive text refused for ${field} (${match.kind})`, { field, kind: match.kind });
+}
+//# sourceMappingURL=text-scan.js.map

package/dist/lib/mesh/live/daemon/run.js

@@ -33,7 +33,7 @@ import { daemonDir } from "./paths.js";
 import { PresenceClient, defaultMqttConnect, } from "./presence.js";
 import { defaultDaemonState, patchDaemonState, readDaemonState, writeDaemonState, } from "./state.js";
 import { workMeshHeldPath } from "../paths.js";
-import { noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
+import { defaultTranscriptFs, noteHookSessionsFromSpoolFile, TRANSCRIPT_WATCH_INTERVAL_MS, TranscriptWatcher, } from "./transcript-watch.js";
 import { resolveMeshEmitMode, runsEmitPath, } from "./mode.js";
 import { hasCliVersionDrift, readInstalledCliVersion } from "./version-drift.js";
 import { resolveRunningCliEntry } from "./install.js";
@@ -550,6 +550,7 @@ export async function runMeshDaemon(deps = {}) {
     let watcher = null;
     /** Shared with transcript watcher: sessionIds seen on the hook/spool path. */
     const lastHookEventAt = new Map();
+    const lastHookTurnEndAt = new Map();
     let transcriptWatcher = null;
     const requestRestartForVersionDrift = () => {
         if (stopped || restartRequested)
@@ -574,6 +575,7 @@ export async function runMeshDaemon(deps = {}) {
             fs: deps.transcriptFs,
             now: () => now().getTime(),
             lastHookEventAt,
+            lastHookTurnEndAt,
             // Transcript watch has no direct state writer: reconcile owns its write
             // and merges local fields. Surface transient lookup failures as throws so
             // reconcile defers without turning them into an authoritative denial.
@@ -628,8 +630,8 @@ export async function runMeshDaemon(deps = {}) {
                 }
                 // Record hook-emitted session ids from spool/held before claim/rename.
                 const at = now().getTime();
-                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at);
-                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at);
+                noteHookSessionsFromSpoolFile(workMeshSpoolPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
+                noteHookSessionsFromSpoolFile(workMeshHeldPath(meshRoot), lastHookEventAt, at, defaultTranscriptFs, lastHookTurnEndAt);
                 const summary = await flushFn(shutdownController.signal);
                 try {
                     const replay = await replayFn();
@@ -760,6 +762,9 @@ export async function runMeshDaemon(deps = {}) {
                 summary.turns > 0 ||
                 summary.ended > 0) {
                 log(dir, `transcript-watch: started=${summary.started} turns=${summary.turns} ended=${summary.ended} skippedHook=${summary.skippedHookCovered}`);
+                for (const sessionId of summary.endedSessionIds) {
+                    log(dir, `transcript-watch quiet session_end sessionId=${sessionId}`);
+                }
                 scheduleDebouncedFlush();
             }
         }

package/dist/lib/mesh/live/daemon/transcript-watch.d.ts

@@ -26,12 +26,17 @@
  * localHarness is no longer written (harness carries claude-desktop on the wire).
  *
  * Hook-covered sessions (durable hook-written state, or a hook event within
- * TRANSCRIPT_HOOK_COVER_MS) do not get synthesized session_start / turn_end —
- * hooks own those. The watcher still tracks last activity (transcript mtime or
- * hook events) and enqueues session_end after TRANSCRIPT_SESSION_END_MS of
- * quiet so the channel work report has a trigger (US-050b). Resume resets the
- * timer. A hook event within TRANSCRIPT_HOOK_COVER_MS of our own emit is the
- * SessionEnd hook catching up and is not treated as resume.
+ * TRANSCRIPT_HOOK_COVER_MS) do not get synthesized session_start — hooks own
+ * that. The watcher still tracks last activity (transcript mtime or hook
+ * events). It enqueues turn_end when hooks never did (Stop often never fires
+ * for a live Claude Code session sitting at the prompt; server turnCount
+ * stays 0) and session_end after TRANSCRIPT_SESSION_END_MS of quiet so the
+ * channel work report has a trigger (US-050b / US-051c). Both events take
+ * seq from the shared ~/.hq/work-mesh/seq/<sid> file the hooks use; an
+ * in-memory counter restarting at 1 is dropped by the server as a duplicate
+ * of session_start. Resume resets the timer. A hook event within
+ * TRANSCRIPT_HOOK_COVER_MS of our own emit is the SessionEnd hook catching
+ * up and is not treated as resume.
  */
 import * as fs from "node:fs";
 import type { MembershipValidationResult } from "../../../work-context/config.js";
@@ -111,6 +116,11 @@ export interface TranscriptWatchDeps {
      * TRANSCRIPT_HOOK_COVER_MS are not synthesized.
      */
     lastHookEventAt?: Map<string, number>;
+    /**
+     * Last hook-emitted turn_end per sessionId (epoch ms). Used so we do not
+     * synthesize a second turn_end when Stop already landed.
+     */
+    lastHookTurnEndAt?: Map<string, number>;
     /** Injectable enqueue (tests). */
     enqueue?: typeof enqueueSessionEvent;
     /** Injectable state read/write (tests). */
@@ -137,6 +147,8 @@ export interface TranscriptWatchTickResult {
     ended: number;
     skippedHookCovered: number;
     skippedStale: number;
+    /** sessionIds that received a synthesized session_end this tick (quiet path). */
+    endedSessionIds: string[];
     /** Dir stats + readdir children + file stats examined this tick. */
     entriesExamined: number;
     durationMs: number;
@@ -253,7 +265,7 @@ export declare function resolveTranscriptRegistration(input: {
  */
 export declare function noteHookSessionsFromSpoolFile(spoolPath: string, lastHookEventAt: Map<string, number>, atMs: number, tfs?: Pick<TranscriptFs, "existsSync"> & {
     readFileSync?: (p: string, enc: "utf8") => string;
-}): string[];
+}, lastHookTurnEndAt?: Map<string, number>): string[];
 export declare class TranscriptWatcher {
     private readonly tracked;
     private readonly deps;
@@ -276,11 +288,11 @@ export declare class TranscriptWatcher {
     noteHookEvent(sessionId: string, atMs?: number): void;
     tick(): Promise<TranscriptWatchTickResult>;
     /**
-     * Hook-covered sessions already emit start/turns. Still track last activity
-     * and enqueue session_end after TRANSCRIPT_SESSION_END_MS of quiet so the
-     * channel work report has a trigger (US-050b). Resume (mtime or a later hook
-     * event) resets the timer. A hook event shortly after our own emit is the
-     * SessionEnd hook catching up — do not treat it as resume.
+     * Hook-covered sessions already emit start. Still track last activity,
+     * fill in turn_end when Stop never did, and enqueue session_end after
+     * TRANSCRIPT_SESSION_END_MS of quiet (US-050b / US-051c). Resume (mtime or a
+     * later hook event) resets the timer. A hook event shortly after our own
+     * emit is the SessionEnd hook catching up — do not treat it as resume.
      */
     private tickHookCoveredQuietEnd;
     /**
@@ -292,6 +304,11 @@ export declare class TranscriptWatcher {
      * enqueue session_start. Never overwrites a hook-written state.
      */
     private emitStart;
+    /**
+     * Seq comes from the shared per-session file hooks also write. Restarting
+     * at 1 here is dropped server-side as a duplicate of session_start (US-051c).
+     */
+    private seqEnv;
     private emitKind;
 }
 /**

package/dist/lib/mesh/live/daemon/transcript-watch.js

@@ -26,12 +26,17 @@
  * localHarness is no longer written (harness carries claude-desktop on the wire).
  *
  * Hook-covered sessions (durable hook-written state, or a hook event within
- * TRANSCRIPT_HOOK_COVER_MS) do not get synthesized session_start / turn_end —
- * hooks own those. The watcher still tracks last activity (transcript mtime or
- * hook events) and enqueues session_end after TRANSCRIPT_SESSION_END_MS of
- * quiet so the channel work report has a trigger (US-050b). Resume resets the
- * timer. A hook event within TRANSCRIPT_HOOK_COVER_MS of our own emit is the
- * SessionEnd hook catching up and is not treated as resume.
+ * TRANSCRIPT_HOOK_COVER_MS) do not get synthesized session_start — hooks own
+ * that. The watcher still tracks last activity (transcript mtime or hook
+ * events). It enqueues turn_end when hooks never did (Stop often never fires
+ * for a live Claude Code session sitting at the prompt; server turnCount
+ * stays 0) and session_end after TRANSCRIPT_SESSION_END_MS of quiet so the
+ * channel work report has a trigger (US-050b / US-051c). Both events take
+ * seq from the shared ~/.hq/work-mesh/seq/<sid> file the hooks use; an
+ * in-memory counter restarting at 1 is dropped by the server as a duplicate
+ * of session_start. Resume resets the timer. A hook event within
+ * TRANSCRIPT_HOOK_COVER_MS of our own emit is the SessionEnd hook catching
+ * up and is not treated as resume.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -44,6 +49,7 @@ import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../../../work-con
 import { isHookWrittenSessionState, readSessionState, writeSessionState, } from "../../../work-context/state.js";
 import { enqueueSessionEvent } from "../enqueue.js";
 import { isValidSessionId } from "../session-identity.js";
+import { reserveSessionSeq } from "../session-seq.js";
 export const TRANSCRIPT_WATCH_INTERVAL_MS = 30_000;
 /** Ceiling for adaptive backoff after heavy ticks. */
 export const TRANSCRIPT_WATCH_INTERVAL_MAX_MS = 120_000;
@@ -512,7 +518,7 @@ export function resolveTranscriptRegistration(input) {
  * Scan a spool/held jsonl for hook-emitted session ids (not transcript-watch).
  * Reads spool metadata only — never a transcript file.
  */
-export function noteHookSessionsFromSpoolFile(spoolPath, lastHookEventAt, atMs, tfs = defaultTranscriptFs) {
+export function noteHookSessionsFromSpoolFile(spoolPath, lastHookEventAt, atMs, tfs = defaultTranscriptFs, lastHookTurnEndAt) {
     if (!tfs.existsSync(spoolPath))
         return [];
     const readFile = tfs.readFileSync ?? ((p, enc) => fs.readFileSync(p, enc));
@@ -546,6 +552,12 @@ export function noteHookSessionsFromSpoolFile(spoolPath, lastHookEventAt, atMs,
             if (prev === undefined || eventAt > prev) {
                 lastHookEventAt.set(ev.sessionId, eventAt);
             }
+            if (ev.kind === "turn_end" && lastHookTurnEndAt) {
+                const prevEnd = lastHookTurnEndAt.get(ev.sessionId);
+                if (prevEnd === undefined || eventAt > prevEnd) {
+                    lastHookTurnEndAt.set(ev.sessionId, eventAt);
+                }
+            }
             noted.push(ev.sessionId);
         }
         catch {
@@ -599,6 +611,7 @@ export class TranscriptWatcher {
             ended: 0,
             skippedHookCovered: 0,
             skippedStale: 0,
+            endedSessionIds: [],
             entriesExamined: 0,
             durationMs: 0,
             capped: false,
@@ -624,6 +637,7 @@ export class TranscriptWatcher {
                 ended: 0,
                 skippedHookCovered: 0,
                 skippedStale: 0,
+                endedSessionIds: [],
                 entriesExamined: 0,
                 durationMs: 0,
                 capped: false,
@@ -708,16 +722,20 @@ export class TranscriptWatcher {
                 }
                 if (track.pendingTurn &&
                     nowMs - track.lastChangeAtMs >= TRANSCRIPT_TURN_QUIET_MS) {
-                    this.emitKind(track, "turn_end", nowMs);
-                    track.pendingTurn = false;
-                    result.turns += 1;
+                    if (this.emitKind(track, "turn_end", nowMs)) {
+                        track.pendingTurn = false;
+                        result.turns += 1;
+                    }
                 }
                 if (track.started &&
                     !track.ended &&
                     nowMs - track.lastChangeAtMs >= TRANSCRIPT_SESSION_END_MS) {
-                    this.emitKind(track, "session_end", nowMs);
-                    track.ended = true;
-                    result.ended += 1;
+                    if (this.emitKind(track, "session_end", nowMs)) {
+                        track.ended = true;
+                        track.endedAtMs = nowMs;
+                        result.ended += 1;
+                        result.endedSessionIds.push(track.sessionId);
+                    }
                 }
             }
             // Sessions that disappeared from disk: end if still open. Skip when the
@@ -727,9 +745,12 @@ export class TranscriptWatcher {
                     if (seenPaths.has(p))
                         continue;
                     if (track.started && !track.ended) {
-                        this.emitKind(track, "session_end", nowMs);
-                        track.ended = true;
-                        result.ended += 1;
+                        if (this.emitKind(track, "session_end", nowMs)) {
+                            track.ended = true;
+                            track.endedAtMs = nowMs;
+                            result.ended += 1;
+                            result.endedSessionIds.push(track.sessionId);
+                        }
                     }
                     this.tracked.delete(p);
                 }
@@ -745,16 +766,18 @@ export class TranscriptWatcher {
         }
     }
     /**
-     * Hook-covered sessions already emit start/turns. Still track last activity
-     * and enqueue session_end after TRANSCRIPT_SESSION_END_MS of quiet so the
-     * channel work report has a trigger (US-050b). Resume (mtime or a later hook
-     * event) resets the timer. A hook event shortly after our own emit is the
-     * SessionEnd hook catching up — do not treat it as resume.
+     * Hook-covered sessions already emit start. Still track last activity,
+     * fill in turn_end when Stop never did, and enqueue session_end after
+     * TRANSCRIPT_SESSION_END_MS of quiet (US-050b / US-051c). Resume (mtime or a
+     * later hook event) resets the timer. A hook event shortly after our own
+     * emit is the SessionEnd hook catching up — do not treat it as resume.
      */
     tickHookCoveredQuietEnd(d, nowMs, result) {
         result.skippedHookCovered += 1;
         const hookAt = this.deps.lastHookEventAt?.get(d.sessionId);
+        const hookTurnEndAt = this.deps.lastHookTurnEndAt?.get(d.sessionId);
         const lastActivity = Math.max(d.mtimeMs, hookAt ?? 0);
+        const hookTurnCovers = (mtimeMs) => hookTurnEndAt !== undefined && hookTurnEndAt >= mtimeMs;
         let track = this.tracked.get(d.path);
         if (!track) {
             // Cold transcripts stay silent. Hook-covered sessions that already sat
@@ -772,7 +795,7 @@ export class TranscriptWatcher {
                 lastChangeAtMs: lastActivity,
                 started: true,
                 ended: false,
-                pendingTurn: false,
+                pendingTurn: !hookTurnCovers(d.mtimeMs),
                 seq: 0,
                 startRetryAttempts: 0,
                 nextStartRetryAtMs: 0,
@@ -782,6 +805,7 @@ export class TranscriptWatcher {
         if (d.mtimeMs > track.lastMtimeMs) {
             track.lastMtimeMs = d.mtimeMs;
             track.lastChangeAtMs = nowMs;
+            track.pendingTurn = !hookTurnCovers(d.mtimeMs);
             if (track.ended)
                 track.ended = false;
         }
@@ -795,13 +819,25 @@ export class TranscriptWatcher {
                     track.ended = false;
             }
         }
+        if (hookTurnCovers(track.lastMtimeMs)) {
+            track.pendingTurn = false;
+        }
+        if (track.pendingTurn &&
+            nowMs - track.lastChangeAtMs >= TRANSCRIPT_TURN_QUIET_MS) {
+            if (this.emitKind(track, "turn_end", nowMs)) {
+                track.pendingTurn = false;
+                result.turns += 1;
+            }
+        }
         if (track.started &&
             !track.ended &&
             nowMs - track.lastChangeAtMs >= TRANSCRIPT_SESSION_END_MS) {
-            this.emitKind(track, "session_end", nowMs);
-            track.ended = true;
-            track.endedAtMs = nowMs;
-            result.ended += 1;
+            if (this.emitKind(track, "session_end", nowMs)) {
+                track.ended = true;
+                track.endedAtMs = nowMs;
+                result.ended += 1;
+                result.endedSessionIds.push(track.sessionId);
+            }
         }
     }
     /**
@@ -857,14 +893,38 @@ export class TranscriptWatcher {
             track.ended = true;
             return false;
         }
-        this.emitKind(track, "session_start", nowMs);
+        if (!this.emitKind(track, "session_start", nowMs))
+            return false;
         track.started = true;
         track.startRetryAttempts = 0;
         track.nextStartRetryAtMs = 0;
         return true;
     }
+    /**
+     * Seq comes from the shared per-session file hooks also write. Restarting
+     * at 1 here is dropped server-side as a duplicate of session_start (US-051c).
+     */
+    seqEnv() {
+        const env = { ...(this.deps.env ?? {}) };
+        if (!env.WORK_MESH_SEQ_DIR?.trim()) {
+            const root = this.deps.workMeshRoot ??
+                (this.deps.home
+                    ? path.join(this.deps.home, ".hq", "work-mesh")
+                    : undefined);
+            if (root)
+                env.WORK_MESH_SEQ_DIR = path.join(root, "seq");
+        }
+        return env;
+    }
     emitKind(track, kind, nowMs) {
-        track.seq += 1;
+        let seq;
+        try {
+            seq = reserveSessionSeq(track.sessionId, 1, this.seqEnv());
+        }
+        catch {
+            return false;
+        }
+        track.seq = seq;
         const opts = {
             kind,
             sessionId: track.sessionId,
@@ -872,7 +932,7 @@ export class TranscriptWatcher {
             adapterVersion: TRANSCRIPT_ADAPTER_VERSION,
             source: TRANSCRIPT_EVENT_SOURCE,
             at: new Date(nowMs).toISOString(),
-            seq: track.seq,
+            seq,
             cwd: track.cwd,
             hqRoot: this.deps.hqRoot,
             root: this.deps.workMeshRoot,
@@ -880,7 +940,13 @@ export class TranscriptWatcher {
             now: () => new Date(nowMs),
             ...(kind === "session_end" ? { transcriptPath: track.path } : {}),
         };
-        this.enqueueFn(opts);
+        try {
+            this.enqueueFn(opts);
+            return true;
+        }
+        catch {
+            return false;
+        }
     }
 }
 /**

package/dist/lib/mesh/live/report-summary.js

@@ -8,11 +8,10 @@ import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { SECRET_RE, SECRETS_PATH_RE } from "../../lanes/text-scan.js";
 export const REPORT_SUMMARY_MAX_CHARS = 140;
 export const REPORT_SUMMARY_SCHEMA_MAX = 280;
 export const REPORT_TRANSCRIPT_TAIL_BYTES = 256 * 1024;
-const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._\-+=/]+)|(?:sk-[A-Za-z0-9]{8,})|(?:ghp_[A-Za-z0-9]{8,})|(?:github_pat_[A-Za-z0-9_]{8,})|(?:xox[baprs]-[A-Za-z0-9-]{8,})|(?:AKIA[0-9A-Z]{8,})|(?:op:\/\/[^\s"]+)/gi;
-const SECRETS_PATH_RE = /(?:^|[\s"'`])((?:~|\/|\.\/|\.\.\/)?(?:[\w.-]+\/)*(?:\.env(?:\.[A-Za-z0-9._-]+)?|secrets(?:\/[\w.-]+)*|id_rsa|credentials(?:\.json)?|\.netrc|\.npmrc))/gi;
 const PR_URL_RE = /https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+/g;
 export function redactReportSummary(text) {
     let out = text.replace(SECRET_RE, "[redacted]");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.194.1",
+  "version": "5.195.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {