@indigoai-us/hq-cli 5.218.0 → 5.220.0

package/dist/lib/flag-registry.d.ts

@@ -17,7 +17,10 @@ interface WorkerLike {
 }
 export interface FlagRegistryDependencies {
     endpoint?: string;
-    createWorker?: (filename: URL, options: WorkerOptions) => WorkerLike;
+    createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
+    /** Test seam for exercising the no-source fail-open path. */
+    workerSource?: string;
+    captureWorkerFailure?: (error: Error, tags: Record<string, string>) => void;
 }
 export interface ProcessFlagCompanyContext {
     companyUid?: string;

package/dist/lib/flag-registry.js

@@ -12,8 +12,10 @@ import { readMachineCompanyBinding } from "./work-context/company.js";
 import { readSessionState } from "./work-context/state.js";
 import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
-import { resolveDefaultHqRoot } from "../utils/cognito-session.js";
+import { loadCachedTokens, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
+import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
+import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
 const COMPANY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -99,6 +101,75 @@ function processSnapshotReader(companyIdentifiers) {
         },
     };
 }
+function personSubjectForWorkerMode(idToken) {
+    if (typeof idToken !== "string")
+        return null;
+    const payload = idToken.split(".")[1];
+    if (!payload)
+        return null;
+    try {
+        const subject = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub;
+        return typeof subject === "string" && subject.trim() ? subject : null;
+    }
+    catch {
+        Sentry.captureMessage("Could not scope cached flag-registry worker mode because the cached ID token payload is invalid", { level: "warning", tags: { component: "flag-registry-worker-mode-cache" } });
+        return null;
+    }
+}
+/** Scope a persisted rollout value to the same identity that fetched it. */
+function workerModeCacheScopes(company) {
+    const tokens = loadCachedTokens();
+    const personSubject = tokens ? personSubjectForWorkerMode(tokens.idToken) : null;
+    if (tokens && !personSubject)
+        return null;
+    return [
+        ...(company.companyUid ? [`company:${company.companyUid}`] : []),
+        ...(company.companySlug ? [`company-slug:${company.companySlug}`] : []),
+        ...(personSubject ? [`person:${personSubject}`] : []),
+    ];
+}
+function selfContainedWorkerEnabled(company) {
+    const localOverride = readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env);
+    if (localOverride !== null)
+        return localOverride;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return false;
+    const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
+    try {
+        return readCachedFlagRegistryWorkerMode(filePath)?.value ?? false;
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+        return false;
+    }
+}
+function cacheWorkerModeFromSnapshot(snapshot, company) {
+    // A developer's local hq-flags override is process-local and must not become
+    // the value selected by a future process.
+    if (readLocalOverride(FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, process.env) !== null)
+        return;
+    const scopes = workerModeCacheScopes(company);
+    if (!scopes)
+        return;
+    const decision = resolveFlag({
+        flagKey: FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG,
+        env: {},
+        snapshot,
+        companyIdentifiers: [company.companyUid, company.companySlug].filter((value) => Boolean(value)),
+        lookup: { fallback: false },
+    });
+    try {
+        writeCachedFlagRegistryWorkerMode(flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes), { version: snapshot.version, value: decision.value });
+    }
+    catch (error) {
+        Sentry.captureException(error, {
+            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        });
+    }
+}
 /**
  * Begin one registry refresh without awaiting it or retaining the CLI process.
  *
@@ -117,23 +188,43 @@ export function kickFlagRegistryReadiness(dependencies = {}) {
     const companyIdentifiers = [companyUid, company.companySlug].filter((value) => Boolean(value));
     processReader = processSnapshotReader(companyIdentifiers);
     try {
+        let workerSource = new URL("./flag-registry-worker.js", import.meta.url);
+        let workerOptions = { workerData: {
+                endpoint,
+                ...(companyUid ? { companyUid } : {}),
+                ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
+            } };
+        if (selfContainedWorkerEnabled(company)) {
+            // The worker source is generated and embedded in this parent module at
+            // build time. It is already resident before company, identity, and cache
+            // reads can yield to an updater replacing this package tree.
+            const embeddedSource = dependencies.workerSource ?? FLAG_REGISTRY_WORKER_SOURCE;
+            if (embeddedSource.length === 0) {
+                (dependencies.captureWorkerFailure ?? ((error, tags) => {
+                    Sentry.captureException(error, { tags });
+                }))(new Error("Self-contained flag-registry worker source is unavailable"), {
+                    component: "flag-registry-worker-startup",
+                    worker: "flag-registry",
+                    flag_worker_failure: "embedded_source_unavailable",
+                });
+                return processReader;
+            }
+            workerSource = embeddedSource;
+            workerOptions = { ...workerOptions, eval: true };
+        }
         // The SDK's child-process integration captures every Worker error unless
         // its process-wide captureWorkerErrors option is disabled. Scope only this
         // worker so the reporting boundary can classify its startup errors without
         // changing capture for unrelated workers.
         const worker = Sentry.withScope((scope) => {
             scope.setTag("worker", "flag-registry");
-            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(new URL("./flag-registry-worker.js", import.meta.url), {
-                workerData: {
-                    endpoint,
-                    ...(companyUid ? { companyUid } : {}),
-                    ...(company.companySlug ? { companyIdentifiers: [company.companySlug] } : {}),
-                },
-            });
+            return (dependencies.createWorker ?? ((filename, options) => new Worker(filename, options)))(workerSource, workerOptions);
         });
         worker.on("message", (value) => {
-            if (isFlagSnapshot(value))
+            if (isFlagSnapshot(value)) {
                 heldSnapshot = value;
+                cacheWorkerModeFromSnapshot(value, company);
+            }
         });
         // A failed background refresh must stay invisible to an offline CLI.
         worker.on("error", () => { });

package/dist/lib/lanes/config.d.ts

@@ -7,7 +7,7 @@
  * that resolve to the same home are refused (identity-keyed-cap rule).
  */
 import * as fs from "node:fs";
-import { type AccountConfig, type LaneProvider, type LanesConfig, type LivenessWindows, type ProviderConfig } from "./types.js";
+import { type AccountConfig, type LaneProvider, type LanesConfig, type LivenessWindows, type ProviderConfig, type TrackerChecksConfig } from "./types.js";
 export declare const LANES_CONFIG_REL: string;
 export declare const DEFAULT_MAX_QUEUED = 3;
 export declare const DEFAULT_CPU_BUSY_PAUSE = 0.85;
@@ -39,6 +39,7 @@ export declare const DEFAULT_TURN_START_LOST_MS: number;
 export declare const DEFAULT_SILENT_LOST_MS: number;
 /** Unanswered session questions move to the next audience after 10 minutes. */
 export declare const DEFAULT_SESSION_QUESTION_TIMEOUT_SECS: number;
+export declare const DEFAULT_TRACKER_CHECKS: TrackerChecksConfig;
 export declare const DEFAULT_LIVENESS_WINDOWS: LivenessWindows;
 export declare const DEFAULT_PROVIDER_MAX_RUNNING: Record<LaneProvider, number>;
 export declare const DEFAULT_ACCOUNT_HOMES: Record<LaneProvider, string>;

package/dist/lib/lanes/config.js

@@ -43,6 +43,15 @@ export const DEFAULT_TURN_START_LOST_MS = 2 * 60 * 60 * 1000;
 export const DEFAULT_SILENT_LOST_MS = 12 * 60 * 60 * 1000;
 /** Unanswered session questions move to the next audience after 10 minutes. */
 export const DEFAULT_SESSION_QUESTION_TIMEOUT_SECS = 10 * 60;
+export const DEFAULT_TRACKER_CHECKS = {
+    owner_question_surface_ms: 10 * 60 * 1000,
+    open_question_age_ms: 2 * 60 * 60 * 1000,
+    status_stale_ms: 90 * 60 * 1000,
+    task_list_stale_ms: 120 * 60 * 1000,
+    blocker_max_age_ms: 24 * 60 * 60 * 1000,
+    kpi_value_max_age_ms: 24 * 60 * 60 * 1000,
+    directive_ack_timeout_ms: 30 * 60 * 1000,
+};
 export const DEFAULT_LIVENESS_WINDOWS = {
     live_within_ms: DEFAULT_LIVE_WITHIN_MS,
     turn_start_lost_ms: DEFAULT_TURN_START_LOST_MS,
@@ -362,6 +371,25 @@ function parseLiveness(raw) {
         silent_lost_ms: positiveInt(obj.silent_lost_ms, "liveness.silent_lost_ms", DEFAULT_SILENT_LOST_MS),
     };
 }
+function parseTrackerChecks(raw) {
+    const tracker = raw === undefined ? {} : raw;
+    if (!isPlainObject(tracker)) {
+        throw new LanesConfigError("invalid_config", "tracker must be an object");
+    }
+    const checks = tracker.checks === undefined ? {} : tracker.checks;
+    if (!isPlainObject(checks)) {
+        throw new LanesConfigError("invalid_config", "tracker.checks must be an object");
+    }
+    return {
+        owner_question_surface_ms: positiveInt(checks.owner_question_surface_ms, "tracker.checks.owner_question_surface_ms", DEFAULT_TRACKER_CHECKS.owner_question_surface_ms),
+        open_question_age_ms: positiveInt(checks.open_question_age_ms, "tracker.checks.open_question_age_ms", DEFAULT_TRACKER_CHECKS.open_question_age_ms),
+        status_stale_ms: positiveInt(checks.status_stale_ms, "tracker.checks.status_stale_ms", DEFAULT_TRACKER_CHECKS.status_stale_ms),
+        task_list_stale_ms: positiveInt(checks.task_list_stale_ms, "tracker.checks.task_list_stale_ms", DEFAULT_TRACKER_CHECKS.task_list_stale_ms),
+        blocker_max_age_ms: positiveInt(checks.blocker_max_age_ms, "tracker.checks.blocker_max_age_ms", DEFAULT_TRACKER_CHECKS.blocker_max_age_ms),
+        kpi_value_max_age_ms: positiveInt(checks.kpi_value_max_age_ms, "tracker.checks.kpi_value_max_age_ms", DEFAULT_TRACKER_CHECKS.kpi_value_max_age_ms),
+        directive_ack_timeout_ms: positiveInt(checks.directive_ack_timeout_ms, "tracker.checks.directive_ack_timeout_ms", DEFAULT_TRACKER_CHECKS.directive_ack_timeout_ms),
+    };
+}
 export function documentedDefaultConfig(deps = defaultDeps()) {
     const providers = {};
     for (const provider of LANE_PROVIDERS) {
@@ -384,6 +412,7 @@ export function documentedDefaultConfig(deps = defaultDeps()) {
             min_available_mem_mb: DEFAULT_MIN_AVAILABLE_MEM_MB,
         },
         liveness: { ...DEFAULT_LIVENESS_WINDOWS },
+        tracker: { checks: { ...DEFAULT_TRACKER_CHECKS } },
         session_question_timeout_secs: DEFAULT_SESSION_QUESTION_TIMEOUT_SECS,
     };
 }
@@ -425,6 +454,7 @@ export function parseLanesConfig(raw, deps = defaultDeps()) {
         providers,
         throttle: parseThrottle(raw.throttle),
         liveness: parseLiveness(raw.liveness),
+        tracker: { checks: parseTrackerChecks(raw.tracker) },
         session_question_timeout_secs: positiveInt(raw.session_question_timeout_secs, "session_question_timeout_secs", DEFAULT_SESSION_QUESTION_TIMEOUT_SECS),
     };
 }

package/dist/lib/lanes/questions.d.ts

@@ -3,7 +3,7 @@
  * path and for envelope `decision: "ask"` ingestion. Two writers here would
  * drift on hop, origin, raised_via, body store, and routing_history.
  */
-import { type LaneEnvelope, type LaneRecord, type QuestionBodyStore, type QuestionKind, type QuestionRecord, type RaisedVia } from "./types.js";
+import { type LaneEnvelope, type LaneRecord, type LaneCompanyRef, type QuestionBodyStore, type QuestionKind, type QuestionRecord, type RaisedVia } from "./types.js";
 export interface QuestionBody {
     question: string;
     context: string;
@@ -11,8 +11,20 @@ export interface QuestionBody {
     recommended?: string;
     notes?: string;
 }
+export declare function assertQuestionBodySecretSafe(body: QuestionBody): void;
+/** Errors that make an envelope ask unsafe or impossible to persist. */
+export declare function questionRecordRefusalCode(err: unknown): "secret_text_refused" | "question_company_unavailable" | null;
 export declare function parseQuestionBodyStore(value: unknown): QuestionBodyStore;
-export declare function bodyStoreForLane(lane: Pick<LaneRecord, "company">): QuestionBodyStore;
+export declare function bodyStoreForLane(lane: Pick<LaneRecord, "company" | "mesh_company">, resolvedCompany?: LaneCompanyRef): QuestionBodyStore;
+export declare function resolveQuestionCompany(lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, activeCompany?: LaneCompanyRef | null, hqRoot?: string): LaneCompanyRef;
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export declare function resolveProjectQuestionCompany(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "project_id">): LaneCompanyRef | null;
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export declare function resolveQuestionCompanyWithFallback(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "company" | "mesh_company" | "project_id">, resolveActiveCompany?: () => Promise<LaneCompanyRef | null>): Promise<LaneCompanyRef>;
 export declare function questionBodyRef(questionId: string): string;
 export declare function sha256Text(text: string): string;
 /** Tenant-store path for a question body (spec §6.2 / §10). Never the personal vault for company prose. */
@@ -28,6 +40,7 @@ export interface RaiseLaneQuestionInput {
     body: QuestionBody;
     raisedVia: RaisedVia;
     at: string;
+    activeCompany?: LaneCompanyRef | null;
     questionId?: string;
 }
 /**
@@ -43,15 +56,15 @@ export declare function raiseLaneQuestion(input: RaiseLaneQuestionInput): Questi
  */
 export declare function classifyQuestionKind(options: readonly string[]): QuestionKind | undefined;
 /** The store a lane's question bodies live in, derived from the lane and never the reverse. */
-export declare function questionBodyPathForLane(hqRoot: string, lane: Pick<LaneRecord, "company">, questionId: string): string;
+export declare function questionBodyPathForLane(hqRoot: string, lane: Pick<LaneRecord, "company" | "mesh_company">, questionId: string): string;
 /**
  * Free-text notes the operator attached with `questions answer --notes`.
  * Read from the lane's own store (spec §6.5): the company store for a company
  * lane, the personal store otherwise. Returns undefined when the answer has
- * no notes_ref or the body carries no notes; a body the host cannot read is
- * reported and skipped rather than failing the resume.
+ * no notes_ref or the body carries no notes. An unavailable or malformed body
+ * fails the resume so the lane cannot continue without its answer notes.
  */
-export declare function readAnswerNotes(hqRoot: string, lane: Pick<LaneRecord, "company">, question: Pick<QuestionRecord, "question_id" | "answer">): string | undefined;
+export declare function readAnswerNotes(hqRoot: string, lane: Pick<LaneRecord, "company" | "mesh_company">, question: Pick<QuestionRecord, "question_id" | "company" | "body" | "answer">): string | undefined;
 export interface AnsweredQuestionEntry {
     question_id: string;
     choice: string | undefined;
@@ -66,10 +79,11 @@ export interface AnsweredQuestionEntry {
  * directory on the executing host.
  */
 export declare function answeredQuestionEntries(hqRoot: string, lane: Pick<LaneRecord, "lane_id" | "company">, questions: QuestionRecord[]): AnsweredQuestionEntry[];
+export declare function markAnsweredQuestionsDelivered(hqRoot: string, laneId: string, questionIds: readonly string[], deliveredAt: string): QuestionRecord[];
 export declare function envelopeQuestionId(laneId: string, envelopeRef: string, index: number): string;
 /**
  * Spec §6.1: each envelope questions[] entry becomes one queue record, via
  * raiseLaneQuestion (the same function the CLI ask path uses).
  */
-export declare function raiseEnvelopeQuestions(hqRoot: string, lane: LaneRecord, envelope: LaneEnvelope, envelopeRef: string, at: string, questionIndexes?: readonly number[]): QuestionRecord[];
+export declare function raiseEnvelopeQuestions(hqRoot: string, lane: LaneRecord, envelope: LaneEnvelope, envelopeRef: string, at: string, questionIndexes?: readonly number[], activeCompany?: LaneCompanyRef | null): QuestionRecord[];
 //# sourceMappingURL=questions.d.ts.map

package/dist/lib/lanes/questions.js

@@ -7,8 +7,29 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { LanesError } from "./errors.js";
+import { assertNoSecretText } from "./text-scan.js";
+import { readCompaniesManifestMap } from "../work-context/repo-remote.js";
 import { appendCappedHistory, createQuestion, retryUpdateQuestion, } from "./store.js";
 import { QUESTION_BODY_STORES, } from "./types.js";
+export function assertQuestionBodySecretSafe(body) {
+    assertNoSecretText("question", body.question);
+    assertNoSecretText("context", body.context);
+    body.options.forEach((option, index) => assertNoSecretText(`option[${index}]`, option));
+    if (body.recommended !== undefined) {
+        assertNoSecretText("recommended", body.recommended);
+    }
+    if (body.notes !== undefined)
+        assertNoSecretText("answer notes", body.notes);
+}
+/** Errors that make an envelope ask unsafe or impossible to persist. */
+export function questionRecordRefusalCode(err) {
+    if (!(err instanceof LanesError))
+        return null;
+    if (err.error === "secret_text_refused" || err.error === "question_company_unavailable") {
+        return err.error;
+    }
+    return null;
+}
 export function parseQuestionBodyStore(value) {
     if (typeof value === "string" &&
         QUESTION_BODY_STORES.includes(value)) {
@@ -16,8 +37,93 @@ export function parseQuestionBodyStore(value) {
     }
     throw new LanesError("unknown_body_store", `Unknown question body store ${JSON.stringify(value)}. Accepted: ${QUESTION_BODY_STORES.join(", ")}`, { accepted: [...QUESTION_BODY_STORES], value });
 }
-export function bodyStoreForLane(lane) {
-    return lane.company ? "company" : "personal";
+export function bodyStoreForLane(lane, resolvedCompany) {
+    return lane.company || lane.mesh_company || resolvedCompany ? "company" : "personal";
+}
+export function resolveQuestionCompany(lane, activeCompany, hqRoot) {
+    const laneCompany = lane.company ?? lane.mesh_company;
+    if (laneCompany !== null && laneCompany !== undefined) {
+        return requireQuestionCompany(laneCompany, lane.lane_id, "lane");
+    }
+    if (hqRoot) {
+        const projectCompany = resolveProjectQuestionCompany(hqRoot, lane);
+        if (projectCompany)
+            return projectCompany;
+    }
+    const company = activeCompany;
+    if (!company || !company.slug.trim() || !company.uid.trim()) {
+        throw new LanesError("question_company_unavailable", `Cannot raise a question for lane ${lane.lane_id}: no lane, project, or active company could be resolved`, { lane_id: lane.lane_id, resolution: "active_company_required" });
+    }
+    return company;
+}
+function requireQuestionCompany(company, laneId, source) {
+    if (!company.slug.trim() || !company.uid.trim()) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the ${source} company for lane ${laneId}: its slug or uid is missing`, { lane_id: laneId, resolution: `${source}_company_invalid` });
+    }
+    return company;
+}
+/**
+ * Resolve project ownership only when exactly one manifest company contains
+ * the project's directory. Multiple matches are unresolved so the caller can
+ * continue to an explicit active-company choice without picking an owner.
+ */
+export function resolveProjectQuestionCompany(hqRoot, lane) {
+    const projectId = lane.project_id?.trim();
+    if (!projectId)
+        return null;
+    if (projectId === "." || projectId === ".." || /[\\/\0]/.test(projectId)) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its project id is invalid`, { lane_id: lane.lane_id, resolution: "project_id_invalid" });
+    }
+    const manifestPath = path.join(hqRoot, "companies", "manifest.yaml");
+    if (!fs.existsSync(manifestPath))
+        return null;
+    const companies = readCompaniesManifestMap(hqRoot);
+    if (!companies) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: companies/manifest.yaml is unreadable or malformed`, { lane_id: lane.lane_id, resolution: "company_manifest_unavailable" });
+    }
+    const matches = [];
+    for (const [slug, entry] of Object.entries(companies)) {
+        if (!entry || typeof entry !== "object" || !slug || /[\\/\0]/.test(slug))
+            continue;
+        const projectDir = path.join(hqRoot, "companies", slug, "projects", projectId);
+        let isDirectory = false;
+        try {
+            isDirectory = fs.statSync(projectDir).isDirectory();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT" && err.code !== "ENOTDIR") {
+                throw new LanesError("question_company_unavailable", `Cannot verify project ownership for lane ${lane.lane_id}`, { lane_id: lane.lane_id, resolution: "project_directory_unavailable" });
+            }
+        }
+        if (!isDirectory)
+            continue;
+        const uid = typeof entry.cloud_uid === "string" ? entry.cloud_uid.trim() : "";
+        matches.push({ slug, uid });
+    }
+    if (matches.length > 1)
+        return null;
+    const match = matches[0];
+    if (!match)
+        return null;
+    if (!match.uid) {
+        throw new LanesError("question_company_unavailable", `Cannot resolve the project company for lane ${lane.lane_id}: its manifest company has no cloud uid`, { lane_id: lane.lane_id, resolution: "project_company_uid_missing" });
+    }
+    return requireQuestionCompany({ slug: match.slug, uid: match.uid }, lane.lane_id, "project");
+}
+/** Resolve the lane/project company before lazily consulting active HQ scope. */
+export async function resolveQuestionCompanyWithFallback(hqRoot, lane, resolveActiveCompany) {
+    try {
+        return resolveQuestionCompany(lane, null, hqRoot);
+    }
+    catch (err) {
+        if (!(err instanceof LanesError) ||
+            err.error !== "question_company_unavailable" ||
+            err.details.resolution !== "active_company_required" ||
+            !resolveActiveCompany) {
+            throw err;
+        }
+        return resolveQuestionCompany(lane, await resolveActiveCompany(), hqRoot);
+    }
 }
 export function questionBodyRef(questionId) {
     return path.posix.join("lanes", "questions", `${questionId}.json`);
@@ -37,6 +143,7 @@ export function questionBodyAbsPath(hqRoot, question) {
     return path.join(hqRoot, "personal", "lanes", "questions", `${question.question_id}.json`);
 }
 export function writeQuestionBody(hqRoot, question, body) {
+    assertQuestionBodySecretSafe(body);
     const store = parseQuestionBodyStore(question.body.store);
     const filePath = questionBodyAbsPath(hqRoot, question);
     const serialized = `${JSON.stringify(body, null, 2)}\n`;
@@ -53,12 +160,14 @@ export function writeQuestionBody(hqRoot, question, body) {
  * tenant body, then CAS routing_history with reason `asked`.
  */
 export function raiseLaneQuestion(input) {
-    const store = bodyStoreForLane(input.lane);
+    assertQuestionBodySecretSafe(input.body);
+    const company = resolveQuestionCompany(input.lane, input.activeCompany, input.hqRoot);
+    const store = bodyStoreForLane(input.lane, company);
     let questionId = input.questionId;
     if (!questionId) {
         const created = createQuestion(input.hqRoot, {
             lane_id: input.lane.lane_id,
-            company: input.lane.company,
+            company,
             project_id: input.lane.project_id,
             story_id: input.lane.story_id,
             thread_id: input.lane.thread_id,
@@ -77,7 +186,7 @@ export function raiseLaneQuestion(input) {
             createQuestion(input.hqRoot, {
                 question_id: questionId,
                 lane_id: input.lane.lane_id,
-                company: input.lane.company,
+                company,
                 project_id: input.lane.project_id,
                 story_id: input.lane.story_id,
                 thread_id: input.lane.thread_id,
@@ -97,7 +206,7 @@ export function raiseLaneQuestion(input) {
         }
     }
     const stored = writeQuestionBody(input.hqRoot, {
-        company: input.lane.company,
+        company,
         question_id: questionId,
         body: { store, ref: "", digest: "" },
     }, input.body);
@@ -149,34 +258,40 @@ export function questionBodyPathForLane(hqRoot, lane, questionId) {
  * Free-text notes the operator attached with `questions answer --notes`.
  * Read from the lane's own store (spec §6.5): the company store for a company
  * lane, the personal store otherwise. Returns undefined when the answer has
- * no notes_ref or the body carries no notes; a body the host cannot read is
- * reported and skipped rather than failing the resume.
+ * no notes_ref or the body carries no notes. An unavailable or malformed body
+ * fails the resume so the lane cannot continue without its answer notes.
  */
 export function readAnswerNotes(hqRoot, lane, question) {
     if (!question.answer?.notes_ref)
         return undefined;
-    const filePath = questionBodyPathForLane(hqRoot, lane, question.question_id);
+    const bodyStore = parseQuestionBodyStore(question.body.store);
+    const company = question.company ?? (bodyStore === "company" ? lane.company ?? lane.mesh_company ?? null : null);
+    if (bodyStore === "personal" && company !== question.company) {
+        throw new LanesError("question_answer_notes_store_mismatch", `Answer notes for question ${question.question_id} cannot use lane company attribution for a personal-store body`, { question_id: question.question_id });
+    }
+    const filePath = questionBodyAbsPath(hqRoot, { ...question, company });
     let text;
     try {
         text = fs.readFileSync(filePath, "utf8");
     }
     catch (err) {
-        const code = err.code;
-        process.stderr.write(`hq lanes: answer notes for ${question.question_id} unreadable at ${filePath} (${code ?? (err instanceof Error ? err.message : String(err))})\n`);
-        return undefined;
+        throw new LanesError("question_answer_notes_unavailable", `Answer notes for question ${question.question_id} are unavailable on the owning host`, { question_id: question.question_id, code: err.code });
     }
     let parsed;
     try {
         parsed = JSON.parse(text);
     }
     catch (err) {
-        process.stderr.write(`hq lanes: answer notes for ${question.question_id} at ${filePath} is not JSON: ${err instanceof Error ? err.message : String(err)}\n`);
-        return undefined;
+        throw new LanesError("question_answer_notes_invalid", `Answer notes for question ${question.question_id} are not valid JSON`, { question_id: question.question_id });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new LanesError("question_answer_notes_invalid", `Answer notes for question ${question.question_id} have an invalid body`, { question_id: question.question_id });
     }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return undefined;
     const notes = parsed.notes;
-    return typeof notes === "string" && notes.length > 0 ? notes : undefined;
+    if (typeof notes !== "string") {
+        throw new LanesError("question_answer_notes_invalid", `Answer notes for question ${question.question_id} are missing from the body`, { question_id: question.question_id });
+    }
+    return notes.length > 0 ? notes : undefined;
 }
 /**
  * The `answered-questions.json` a resumed worker is handed (spec §6.5). Ids,
@@ -200,6 +315,22 @@ export function answeredQuestionEntries(hqRoot, lane, questions) {
         return entry;
     });
 }
+export function markAnsweredQuestionsDelivered(hqRoot, laneId, questionIds, deliveredAt) {
+    if (!Number.isFinite(Date.parse(deliveredAt))) {
+        throw new LanesError("question_delivery_timestamp_invalid", "Cannot mark an answer delivered with an invalid timestamp", { lane_id: laneId });
+    }
+    return [...new Set(questionIds)].map((questionId) => retryUpdateQuestion(hqRoot, questionId, (current) => {
+        if (current.lane_id !== laneId || current.origin.id !== laneId) {
+            throw new LanesError("question_lane_mismatch", `Question ${questionId} does not belong to the resumed lane ${laneId}`, { lane_id: laneId, question_id: questionId });
+        }
+        if (current.status !== "answered" || !current.answer) {
+            throw new LanesError("question_not_answered", `Question ${questionId} is not answered and cannot be marked delivered`, { lane_id: laneId, question_id: questionId });
+        }
+        if (current.delivered_at)
+            return current;
+        return { ...current, delivered_at: deliveredAt };
+    }));
+}
 export function envelopeQuestionId(laneId, envelopeRef, index) {
     const stem = path.basename(envelopeRef, ".json").replace(/[^A-Za-z0-9_-]/g, "");
     const digest = createHash("sha256")
@@ -222,8 +353,15 @@ function envelopeQuestionBody(item) {
  * Spec §6.1: each envelope questions[] entry becomes one queue record, via
  * raiseLaneQuestion (the same function the CLI ask path uses).
  */
-export function raiseEnvelopeQuestions(hqRoot, lane, envelope, envelopeRef, at, questionIndexes) {
+export function raiseEnvelopeQuestions(hqRoot, lane, envelope, envelopeRef, at, questionIndexes, activeCompany) {
     const items = envelope.questions ?? [];
+    const presentItems = items.filter((item) => item !== undefined);
+    if (presentItems.length === 0)
+        return [];
+    for (const item of presentItems) {
+        assertQuestionBodySecretSafe(envelopeQuestionBody(item));
+    }
+    resolveQuestionCompany(lane, activeCompany, hqRoot);
     const raised = [];
     for (let i = 0; i < items.length; i += 1) {
         const item = items[i];
@@ -236,6 +374,7 @@ export function raiseEnvelopeQuestions(hqRoot, lane, envelope, envelopeRef, at,
             raisedVia: "envelope",
             at,
             questionId: envelopeQuestionId(lane.lane_id, envelopeRef, questionIndexes?.[i] ?? i),
+            activeCompany,
         }));
     }
     return raised;

package/dist/lib/lanes/reconcile.d.ts

@@ -10,7 +10,7 @@ import { type EnvelopeRepairSpawnInput, type SpawnLaneDeps } from "./spawn.js";
 import { type ThrottleDeps } from "./throttle.js";
 import { readLanesRegistryFlag } from "./registry-flag.js";
 import { type KeepAliveBlockedReason } from "./keep-alive.js";
-import type { LaneRecord, LivenessState, QueuedReason, QuestionRecord, SeniorRef } from "./types.js";
+import type { LaneCompanyRef, LaneRecord, LivenessState, QueuedReason, QuestionRecord, SeniorRef } from "./types.js";
 import { type LaneMesh } from "./mesh-events.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export declare const QUESTION_AGE_MS: number;
@@ -79,6 +79,8 @@ export interface ReconcileDeps {
     env?: NodeJS.ProcessEnv;
     /** Flag reader seam used to assert rollout reads happen before admission locks. */
     readRegistryFlag?: typeof readLanesRegistryFlag;
+    /** Active-company fallback for questions raised from an unscoped lane. */
+    resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
     /** Detached mesh seam for dead-watcher recovery. */
     mesh?: LaneMesh | null;
     /** Bound on one terminal mesh emit during dead-host recovery. Default 10 s. */

package/dist/lib/lanes/reconcile.js

@@ -24,7 +24,7 @@ import { readLanesRegistryFlag } from "./registry-flag.js";
 import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_INTERRUPTED_RESUME_TEXT, LEAD_LANE_KEEP_ALIVE_MAX_RESUMES, LEAD_LANE_KEEP_ALIVE_RESUME_TEXT, keepAliveExclusion, loadRetiredLaneIds, leadLaneKeepAliveBackoffMs, } from "./keep-alive.js";
 import { providerSupportsSessionResume } from "./delivery.js";
 import { applyDefaultQuotaHold, readQuotaSignal, recordAccountQuota } from "./quota.js";
-import { answeredQuestionEntries, raiseEnvelopeQuestions } from "./questions.js";
+import { answeredQuestionEntries, questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { SILENCE_MS, classifyLaneExit, isPidAlive, missingExpectedEnvelopeFile, readLatestEnvelopeFile, readLatestEnvelopeRecord, watcherEventsPath, watcherOutLogPath, writeWatcherDecision, } from "./watcher.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshCompany, } from "./mesh-events.js";
 import { laneStories, storyStatusForEnvelope } from "./stories.js";
@@ -1010,9 +1010,10 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     if (!repairCandidate.missing)
                         invalidEnvelope = { errors: repair.errors };
                 }
-                const repairedClassification = invalidEnvelope
+                let repairedClassification = invalidEnvelope
                     ? classifyLaneExit({ envelope: null, hasPartialOutput: false, invalidEnvelope })
                     : classification;
+                let questionRefusalCode = null;
                 const accountRetryReason = quota
                     ? "usage_limit"
                     : providerRejection && classification.reason === "account_not_logged_in"
@@ -1052,7 +1053,21 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                     classification.state === "awaiting_input" &&
                     latest &&
                     (latest.envelope.questions?.length ?? 0) > 0) {
-                    raiseEnvelopeQuestions(hqRoot, readLane(hqRoot, lane.lane_id), latest.envelope, latest.ref, nowIso);
+                    const questionLane = readLane(hqRoot, lane.lane_id);
+                    try {
+                        const activeCompany = await resolveQuestionCompanyWithFallback(hqRoot, questionLane, deps.resolveQuestionActiveCompany);
+                        raiseEnvelopeQuestions(hqRoot, questionLane, latest.envelope, latest.ref, nowIso, undefined, activeCompany);
+                    }
+                    catch (err) {
+                        questionRefusalCode = questionRecordRefusalCode(err);
+                        if (questionRefusalCode === null)
+                            throw err;
+                        repairedClassification = {
+                            state: "failed",
+                            reason: `question_record_refused:${questionRefusalCode}`,
+                        };
+                        process.stderr.write(`hq lanes reconcile: terminal ask refused for ${lane.lane_id}: ${questionRefusalCode}\n`);
+                    }
                 }
                 const result = casLaneIf(hqRoot, lane.lane_id, (current) => current.state === "running", (current) => {
                     const next = {
@@ -1100,7 +1115,7 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                         to: repairedClassification.state,
                         reason: repairedClassification.reason ?? "host_lost",
                     });
-                    if (latest?.envelope) {
+                    if (latest?.envelope && questionRefusalCode === null) {
                         const mesh = deps.mesh === undefined ? createLaneMesh({ interactive: false }) : deps.mesh;
                         if (mesh) {
                             const meshEmitTimeoutMs = deps.meshEmitTimeoutMs ?? 10_000;
@@ -2030,10 +2045,12 @@ async function resumeAwaiting(hqRoot, lanes, questions, summary, deps, onlyLaneI
         }
         catch (err) {
             terminalizeModelUnsupported(hqRoot, lane, err);
+            const errorName = err instanceof LanesError ? `${err.error}: ` : "";
+            const errorMessage = err instanceof Error ? err.message : String(err);
             markDirty(summary, {
                 kind: "lane",
                 id: lane.lane_id,
-                why: `resume failed: ${err instanceof Error ? err.message : String(err)}`,
+                why: `resume failed: ${errorName}${errorMessage}`,
             });
         }
     }