@indigoai-us/hq-cli 5.224.0 → 5.226.0

package/dist/lib/bot/inbox-poll-backoff-flag.js

@@ -0,0 +1,132 @@
+import { loadCachedTokens } from "@indigoai-us/hq-cloud";
+import { createFlagClient, } from "@indigoai-us/hq-flags-client";
+import { resolveFlagGate, resolveProcessFlagCompanyContext } from "../flag-registry.js";
+import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
+import { effectiveBotCompanies, effectiveBotKind } from "./config.js";
+export const INBOX_POLL_BACKOFF_FLAG = "agents.inbox-poll-backoff-local-cli";
+export const INBOX_POLL_BACKOFF_FLAG_FALLBACK = false;
+export const INBOX_POLL_BACKOFF_FLAG_TIMEOUT_MS = 150;
+export const INBOX_POLL_BACKOFF_FLAG_CACHE_MS = 3 * 60_000;
+const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
+export function safeErrorClass(error) {
+    const name = error instanceof Error ? error.name : "UnknownError";
+    return /^[A-Za-z][A-Za-z0-9]{0,63}$/.test(name) ? name : "UnknownError";
+}
+function reportFlagFailure(error) {
+    process.stderr.write(`HQ local bot inbox poll backoff flag lookup failed (${safeErrorClass(error)}); using default off.\n`);
+}
+function companyContexts(config, env) {
+    if (effectiveBotKind(config) !== "company")
+        return [{}];
+    const slugs = effectiveBotCompanies(config);
+    const fallbackSlug = config.companySlug?.trim();
+    if (slugs.length === 0 && fallbackSlug)
+        slugs.push(fallbackSlug);
+    if (slugs.length === 0)
+        return null;
+    const contexts = [];
+    for (const slug of slugs) {
+        const company = resolveProcessFlagCompanyContext({
+            ...env,
+            HQ_COMPANY_UID: "",
+            HQ_COMPANY_SLUG: slug,
+            HQ_ROOT: config.hqRoot,
+        });
+        if (!company.companyUid || !COMPANY_UID_RE.test(company.companyUid))
+            return null;
+        contexts.push({ companyUid: company.companyUid, companyIdentifiers: [slug] });
+    }
+    return contexts;
+}
+/**
+ * Create a per-bot reader. The flag client is opened at most once per three
+ * minutes; a missing identity, failed request, or malformed snapshot keeps
+ * idle polling at its existing two-second interval.
+ */
+export function createInboxPollBackoffFlagReader(config, dependencies = {}) {
+    const env = dependencies.env ?? process.env;
+    const contexts = companyContexts(config, env);
+    const endpoint = resolveFlagRegistryEndpoint(undefined, env);
+    const now = dependencies.now ?? Date.now;
+    const createClient = dependencies.createClient ?? createFlagClient;
+    const getToken = dependencies.getToken ?? (() => loadCachedTokens()?.idToken ?? "");
+    const doFetch = dependencies.fetch ?? globalThis.fetch;
+    const report = dependencies.reportFailure ?? reportFlagFailure;
+    let cachedValue = INBOX_POLL_BACKOFF_FLAG_FALLBACK;
+    let lastReadAt = Number.NEGATIVE_INFINITY;
+    let pending = null;
+    const readContext = async (context) => {
+        let client;
+        let failed = false;
+        let failureReported = false;
+        let enabled = INBOX_POLL_BACKOFF_FLAG_FALLBACK;
+        const reportFailureOnce = (error) => {
+            failed = true;
+            if (failureReported)
+                return;
+            failureReported = true;
+            report(error);
+        };
+        try {
+            client = createClient({
+                endpoint,
+                ...(context.companyUid ? { companyUid: context.companyUid } : {}),
+                ...(context.companyIdentifiers ? { companyIdentifiers: context.companyIdentifiers } : {}),
+                env: {},
+                getToken,
+                ...(doFetch ? { fetch: doFetch } : {}),
+                refreshIntervalMs: 0,
+                requestTimeoutMs: INBOX_POLL_BACKOFF_FLAG_TIMEOUT_MS,
+                onError: reportFailureOnce,
+            });
+            await client.ready();
+            if (!failed) {
+                enabled = resolveFlagGate(client, INBOX_POLL_BACKOFF_FLAG, { fallback: INBOX_POLL_BACKOFF_FLAG_FALLBACK }, () => INBOX_POLL_BACKOFF_FLAG_FALLBACK);
+            }
+        }
+        catch (error) {
+            reportFailureOnce(error);
+        }
+        finally {
+            try {
+                client?.close();
+            }
+            catch (error) {
+                reportFailureOnce(error);
+            }
+        }
+        return failed ? INBOX_POLL_BACKOFF_FLAG_FALLBACK : enabled;
+    };
+    const read = async () => {
+        if (!contexts || contexts.length === 0) {
+            report(new Error("local bot inbox poll backoff flag has no resolvable company identity"));
+            return INBOX_POLL_BACKOFF_FLAG_FALLBACK;
+        }
+        const values = await Promise.all(contexts.map(readContext));
+        return values.every(Boolean);
+    };
+    return () => {
+        const currentTime = now();
+        if (pending)
+            return pending;
+        if (currentTime - lastReadAt < INBOX_POLL_BACKOFF_FLAG_CACHE_MS) {
+            return Promise.resolve(cachedValue);
+        }
+        lastReadAt = currentTime;
+        pending = read()
+            .then((value) => {
+            cachedValue = value;
+            return value;
+        })
+            .catch((error) => {
+            report(error);
+            cachedValue = INBOX_POLL_BACKOFF_FLAG_FALLBACK;
+            return cachedValue;
+        })
+            .finally(() => {
+            pending = null;
+        });
+        return pending;
+    };
+}
+//# sourceMappingURL=inbox-poll-backoff-flag.js.map

package/dist/lib/bot/run.d.ts

@@ -104,7 +104,7 @@ export declare const UNDELIVERABLE_JOB_REPORT_TEXT = "This scheduled run finishe
  * instead of waiting, with no explanation, behind two long jobs.
  */
 export declare const MAX_PARALLEL_JOB_TURNS = 1;
-export type SleepFn = (ms: number) => Promise<void>;
+export type SleepFn = (ms: number, signal?: AbortSignal) => Promise<void>;
 export interface BotRunDeps {
     dir: string;
     config: BotConfig;
@@ -118,6 +118,8 @@ export interface BotRunDeps {
     pid?: number;
     isProcessAlive?: (pid: number) => boolean;
     inboxIntervalMs?: number;
+    /** Cached, default-off reader for the local inbox polling gate. */
+    inboxPollBackoffEnabled?: () => Promise<boolean>;
     heartbeatIntervalMs?: number;
     /** Override the rendered system prompt (tests). */
     systemPromptOverride?: string;

package/dist/lib/bot/run.js

@@ -76,6 +76,7 @@ import { clearBotSession, readBotSession, writeBotSession } from "./session.js";
 import { defaultBotStatus, patchBotStatus, readBotStatus } from "./status.js";
 import { CLI_VERSION } from "../../cli-version.js";
 import { CLI_UPDATE_RESTART_EXIT_CODE } from "./cli-update.js";
+import { createInboxPollBackoffFlagReader, safeErrorClass } from "./inbox-poll-backoff-flag.js";
 export const INBOX_POLL_INTERVAL_MS = 2_000;
 export const HEARTBEAT_INTERVAL_MS = 30_000;
 /** First 429/5xx wait when Retry-After is absent (inbox polls at 2s). */
@@ -224,8 +225,20 @@ class FailureWindow {
         return this.count(nowMs) >= this.limit;
     }
 }
-function defaultSleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+function defaultSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(done, ms);
+        function done() {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", done);
+            resolve();
+        }
+        signal?.addEventListener("abort", done, { once: true });
+    });
 }
 /**
  * A body posted as several parts where an early part got through and a later
@@ -262,6 +275,7 @@ export async function runBot(deps) {
     const { dir, config, api, runtime } = deps;
     const runTurn = deps.runTurn ?? ((rt, input) => runRuntimeTurn(rt, input));
     const inboxIntervalMs = deps.inboxIntervalMs ?? INBOX_POLL_INTERVAL_MS;
+    const inboxPollBackoffEnabled = deps.inboxPollBackoffEnabled ?? createInboxPollBackoffFlagReader(config);
     const heartbeatIntervalMs = deps.heartbeatIntervalMs ?? HEARTBEAT_INTERVAL_MS;
     const exit = deps.exit ?? ((code) => process.exit(code));
     const fallback = () => defaultBotStatus(pid, config.runtime, now);
@@ -312,6 +326,16 @@ export async function runBot(deps) {
     const cliVersion = deps.cliUpdate?.runningVersion ?? CLI_VERSION;
     /** Set once an update restart is due: no new turns, then exit for the supervisor. */
     let cliUpdatePending = null;
+    const pollForCliUpdate = () => {
+        const update = deps.cliUpdate?.poll(log) ?? null;
+        if (!update)
+            return false;
+        cliUpdatePending = update;
+        stopping = true;
+        const busy = running.size;
+        log("info", `hq-cli updated ${update.from} -> ${update.to}; restarting to load it${busy ? ` after ${busy} running turn${busy === 1 ? "" : "s"} finish${busy === 1 ? "es" : ""}` : ""}`);
+        return true;
+    };
     // ── Preflight: creds, pid lock, owner verification ─────────────────────────
     const credsProblem = preflightCreds(dir, config);
     if (credsProblem) {
@@ -506,6 +530,45 @@ export async function runBot(deps) {
     })();
     // ── Inbox loop ─────────────────────────────────────────────────────────────
     const attempts = new Map();
+    const inboxBackoffSteps = [inboxIntervalMs, 10_000, 20_000, 30_000];
+    let inboxBackoffIndex = 0;
+    let inboxWaitGeneration = 0;
+    let activeInboxWait = null;
+    const resetInboxBackoff = () => {
+        inboxBackoffIndex = 0;
+        inboxWaitGeneration += 1;
+        activeInboxWait?.abort();
+    };
+    const waitForInbox = async (delayMs, adaptive) => {
+        if (!adaptive) {
+            await sleep(delayMs);
+            return;
+        }
+        let remainingMs = delayMs;
+        let observedGeneration = inboxWaitGeneration;
+        while (remainingMs > 0 && !stopping && state === "running") {
+            const controller = new AbortController();
+            activeInboxWait = controller;
+            const chunkMs = Math.min(inboxIntervalMs, remainingMs);
+            await sleep(chunkMs, controller.signal);
+            if (activeInboxWait === controller)
+                activeInboxWait = null;
+            if (stopping || state !== "running")
+                break;
+            if (hasPromotionHold(dir))
+                break;
+            if (observedGeneration !== inboxWaitGeneration || controller.signal.aborted) {
+                observedGeneration = inboxWaitGeneration;
+                remainingMs = inboxIntervalMs;
+                continue;
+            }
+            remainingMs -= chunkMs;
+            // Keep the install watcher at its original two-second cadence even when
+            // the inbox itself is waiting longer between empty polls.
+            if (remainingMs > 0 && pollForCliUpdate())
+                break;
+        }
+    };
     /** Build the user turn for a room trigger: header + recent transcript + the message. */
     const buildRoomTurn = async (item, target, text) => {
         const name = (item.channelName ?? "").trim() || target.channelId;
@@ -1551,6 +1614,7 @@ export async function runBot(deps) {
                 log("warn", `inbox item ${item.messageId} failed: ${err instanceof Error ? err.message : String(err)}`);
             })
                 .finally(() => {
+                resetInboxBackoff();
                 busyLanes.delete(lane);
                 pending.delete(item.messageId);
                 running.delete(task);
@@ -1588,14 +1652,8 @@ export async function runBot(deps) {
             // The install under this process was updated: take nothing new, let the
             // turns already running finish, then exit so the supervisor loads it.
             // Queued items were never started or acked; the next process gets them.
-            const update = deps.cliUpdate?.poll(log) ?? null;
-            if (update) {
-                cliUpdatePending = update;
-                stopping = true;
-                const busy = running.size;
-                log("info", `hq-cli updated ${update.from} -> ${update.to}; restarting to load it${busy ? ` after ${busy} running turn${busy === 1 ? "" : "s"} finish${busy === 1 ? "es" : ""}` : ""}`);
+            if (pollForCliUpdate())
                 break;
-            }
             // A kickoff held for a sign-in retries on the same timer as messages.
             if (busyLanes.size === 0 &&
                 (!signInIssue || now().getTime() >= nextSignInRetryAt) &&
@@ -1609,17 +1667,26 @@ export async function runBot(deps) {
             // Completions the cloud has not accepted yet: re-send the report (never
             // the work), alongside the poll rather than in front of it.
             kickCompletionRetries();
+            const useInboxBackoff = await inboxPollBackoffEnabled().catch((error) => {
+                log("warn", `inbox poll backoff flag lookup failed (${safeErrorClass(error)}); using default-off`);
+                return false;
+            });
+            let items;
             try {
-                const items = await api.pullInbox(config.agentUid);
+                items = await api.pullInbox(config.agentUid);
                 inboxFails = 0;
                 setStatus({ lastInboxPollAt: now().toISOString(), lastInboxPollOk: true, lastInboxError: undefined });
                 // One catch-up per job per wake: when several runs of the same job are
                 // pending, the newest runs and the older ones are reported skipped.
                 for (const id of planJobRuns(items, handledJobFires).superseded)
                     supersededJobRuns.add(id);
+                if (items.length > 0)
+                    resetInboxBackoff();
                 for (const item of items)
                     enqueue(item);
                 pump();
+                if (stopping || state !== "running")
+                    break;
             }
             catch (err) {
                 inboxFails += 1;
@@ -1633,7 +1700,17 @@ export async function runBot(deps) {
             }
             if (stopping || state !== "running")
                 break;
-            await sleep(inboxIntervalMs);
+            if (!useInboxBackoff) {
+                inboxBackoffIndex = 0;
+                await waitForInbox(inboxIntervalMs, false);
+                continue;
+            }
+            const delayMs = items.length > 0
+                ? inboxIntervalMs
+                : inboxBackoffSteps[Math.min(inboxBackoffIndex, inboxBackoffSteps.length - 1)];
+            if (items.length === 0)
+                inboxBackoffIndex = Math.min(inboxBackoffIndex + 1, inboxBackoffSteps.length - 1);
+            await waitForInbox(delayMs, true);
         }
         // Stop, drain and promotion wait for the turns already running. Queued
         // messages were never started or acked, so the inbox delivers them again.
@@ -1655,6 +1732,7 @@ export async function runBot(deps) {
             return;
         }
         stopping = true;
+        activeInboxWait?.abort();
         // End the turn in progress; its message gets "did not finish", not silence.
         // Promotion instead drains that turn, including its reply and ACK, before
         // the coordinator snapshots memory and starts the cloud consumer.

package/dist/lib/doctor/client-health-flag-token.d.ts

@@ -0,0 +1,15 @@
+export declare const CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS = 1000;
+export declare class MissingFlagTokenError extends Error {
+    constructor();
+}
+export declare class ClientHealthFlagTokenTimeoutError extends Error {
+    constructor(timeoutMs: number);
+}
+export type ClientHealthFlagTokenProvider = (signal: AbortSignal) => string | Promise<string>;
+/**
+ * Obtain a non-interactive ID token, separately bounded from the flag read.
+ * ensureCognitoIdToken refreshes expired person sessions and selects machine
+ * identity credentials when the current installation is a machine.
+ */
+export declare function getClientHealthFlagToken(provider?: ClientHealthFlagTokenProvider, timeoutMs?: number, callerSignal?: AbortSignal): Promise<string>;
+//# sourceMappingURL=client-health-flag-token.d.ts.map

package/dist/lib/doctor/client-health-flag-token.js

@@ -0,0 +1,66 @@
+import { ensureCognitoIdToken } from "../../utils/cognito-session.js";
+export const CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS = 1_000;
+export class MissingFlagTokenError extends Error {
+    constructor() {
+        super("No cached HQ identity token is available");
+        this.name = "MissingFlagTokenError";
+    }
+}
+export class ClientHealthFlagTokenTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`Client-health flag token acquisition exceeded its ${timeoutMs} ms bound`);
+        this.name = "ClientHealthFlagTokenTimeoutError";
+    }
+}
+/**
+ * Obtain a non-interactive ID token, separately bounded from the flag read.
+ * ensureCognitoIdToken refreshes expired person sessions and selects machine
+ * identity credentials when the current installation is a machine.
+ */
+export async function getClientHealthFlagToken(provider, timeoutMs = CLIENT_HEALTH_FLAG_TOKEN_TIMEOUT_MS, callerSignal) {
+    if (callerSignal?.aborted) {
+        throw callerSignal.reason ?? new Error("Token acquisition was aborted");
+    }
+    const controller = new AbortController();
+    const signal = callerSignal ? AbortSignal.any([callerSignal, controller.signal]) : controller.signal;
+    const timeout = new ClientHealthFlagTokenTimeoutError(timeoutMs);
+    const timer = setTimeout(() => controller.abort(timeout), timeoutMs);
+    let onAbort;
+    const aborted = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason ?? new Error("Token acquisition was aborted"));
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+        const acquire = provider ?? ((requestSignal) => ensureCognitoIdToken({ interactive: false, signal: requestSignal }));
+        const acquisition = Promise.resolve().then(() => {
+            if (signal.aborted) {
+                throw signal.reason ?? new Error("Token acquisition was aborted");
+            }
+            return acquire(signal);
+        });
+        const token = await Promise.race([acquisition, aborted]);
+        if (signal.aborted) {
+            throw signal.reason ?? new Error("Token acquisition was aborted");
+        }
+        if (typeof token !== "string" || token.trim().length === 0) {
+            throw new MissingFlagTokenError();
+        }
+        return token;
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.message.startsWith("No valid HQ session and interactive login is disabled")) {
+            throw new MissingFlagTokenError();
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        if (onAbort)
+            signal.removeEventListener("abort", onAbort);
+    }
+}
+//# sourceMappingURL=client-health-flag-token.js.map

package/dist/lib/doctor/client-health-reason-codes-flag.d.ts

@@ -7,6 +7,7 @@ export interface ClientHealthReasonCodesFlagDependencies {
     env?: NodeJS.ProcessEnv;
     createClient?: (options: FlagClientOptions) => ClientHealthFlagClient;
     getToken?: FlagClientOptions["getToken"];
+    tokenTimeoutMs?: number;
     fetch?: typeof fetch;
     reportFailure?: (error: unknown) => void;
 }

package/dist/lib/doctor/client-health-reason-codes-flag.js

@@ -1,6 +1,6 @@
-import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { createFlagClient, } from "@indigoai-us/hq-flags-client";
 import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
+import { getClientHealthFlagToken } from "./client-health-flag-token.js";
 export const CLIENT_HEALTH_REASON_CODES_FLAG = "client-health-sync-reason-codes";
 export const CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK = false;
 export const CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS = 150;
@@ -39,9 +39,8 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
     }
     const companySlug = company.companySlug?.trim() || "";
-    const deadline = AbortSignal.timeout(CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS);
-    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
-    const doFetch = dependencies.fetch ?? globalThis.fetch;
+    if (callerSignal?.aborted)
+        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
     let client;
     let failed = false;
     let failureReported = false;
@@ -53,6 +52,18 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
         failureReported = true;
         (dependencies.reportFailure ?? reportFlagFailure)(error);
     };
+    let token;
+    try {
+        token = await getClientHealthFlagToken(dependencies.getToken, dependencies.tokenTimeoutMs, callerSignal);
+    }
+    catch (error) {
+        if (!callerSignal?.aborted)
+            reportFailureOnce(error);
+        return CLIENT_HEALTH_REASON_CODES_FLAG_FALLBACK;
+    }
+    const deadline = AbortSignal.timeout(CLIENT_HEALTH_REASON_CODES_FLAG_TIMEOUT_MS);
+    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
+    const doFetch = dependencies.fetch ?? globalThis.fetch;
     try {
         client = (dependencies.createClient ?? createFlagClient)({
             endpoint,
@@ -61,7 +72,7 @@ export async function clientHealthReasonCodesEnabledForCompany(company, dependen
                 ? { companyIdentifiers: [companySlug] }
                 : {}),
             env: {},
-            getToken: dependencies.getToken ?? (() => loadCachedTokens()?.idToken ?? ""),
+            getToken: () => token,
             fetch: (input, init) => doFetch(input, {
                 ...init,
                 signal: combineSignals(init?.signal ?? undefined, signal),

package/dist/lib/doctor/client-health-sentry-flag.d.ts

@@ -7,6 +7,7 @@ export interface ClientHealthSentryFlagDependencies {
     env?: NodeJS.ProcessEnv;
     createClient?: (options: FlagClientOptions) => ClientHealthFlagClient;
     getToken?: FlagClientOptions["getToken"];
+    tokenTimeoutMs?: number;
     fetch?: typeof fetch;
     reportFailure?: (error: unknown) => void;
 }

package/dist/lib/doctor/client-health-sentry-flag.js

@@ -1,6 +1,6 @@
-import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { createFlagClient, } from "@indigoai-us/hq-flags-client";
 import { resolveFlagRegistryEndpoint } from "../flag-registry-endpoint.js";
+import { getClientHealthFlagToken } from "./client-health-flag-token.js";
 export const CLIENT_HEALTH_SENTRY_DIRECT_FLAG = "client-health.sentry-direct";
 export const CLIENT_HEALTH_SENTRY_DIRECT_FALLBACK = false;
 export const CLIENT_HEALTH_SENTRY_DIRECT_TIMEOUT_MS = 150;
@@ -31,10 +31,8 @@ export async function clientHealthSentryDirectEnabledForCompany(company, depende
     if (!/^cmp_[A-Za-z0-9]{3,128}$/.test(companyUid)) {
         return CLIENT_HEALTH_SENTRY_DIRECT_FALLBACK;
     }
-    const companySlug = company.companySlug?.trim() || "";
-    const deadline = AbortSignal.timeout(CLIENT_HEALTH_SENTRY_DIRECT_TIMEOUT_MS);
-    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
-    const doFetch = dependencies.fetch ?? globalThis.fetch;
+    if (callerSignal?.aborted)
+        return CLIENT_HEALTH_SENTRY_DIRECT_FALLBACK;
     let client;
     let failed = false;
     let failureReported = false;
@@ -46,6 +44,19 @@ export async function clientHealthSentryDirectEnabledForCompany(company, depende
         failureReported = true;
         (dependencies.reportFailure ?? reportFlagFailure)(error);
     };
+    let token;
+    try {
+        token = await getClientHealthFlagToken(dependencies.getToken, dependencies.tokenTimeoutMs, callerSignal);
+    }
+    catch (error) {
+        if (!callerSignal?.aborted)
+            reportFailureOnce(error);
+        return CLIENT_HEALTH_SENTRY_DIRECT_FALLBACK;
+    }
+    const companySlug = company.companySlug?.trim() || "";
+    const deadline = AbortSignal.timeout(CLIENT_HEALTH_SENTRY_DIRECT_TIMEOUT_MS);
+    const signal = callerSignal ? AbortSignal.any([callerSignal, deadline]) : deadline;
+    const doFetch = dependencies.fetch ?? globalThis.fetch;
     try {
         client = (dependencies.createClient ?? createFlagClient)({
             endpoint: resolveFlagRegistryEndpoint(undefined, env),
@@ -54,7 +65,7 @@ export async function clientHealthSentryDirectEnabledForCompany(company, depende
                 ? { companyIdentifiers: [companySlug] }
                 : {}),
             env: {},
-            getToken: dependencies.getToken ?? (() => loadCachedTokens()?.idToken ?? ""),
+            getToken: () => token,
             fetch: (input, init) => doFetch(input, {
                 ...init,
                 signal: combineSignals(init?.signal ?? undefined, signal),

package/dist/lib/lanes/dropbox.d.ts

@@ -50,6 +50,8 @@ export interface DrainDeps {
     afterRead?: () => void;
     /** Prefix marks archives that belong to one provider turn. */
     archivePrefix?: string;
+    /** Terminal messages with no permitted delivery path are kept separately. */
+    archiveDirectory?: "delivered" | "undeliverable";
 }
 export interface LaneDrainHookInput {
     transcript_path?: string | null;
@@ -68,6 +70,13 @@ export declare function mintClaimId(): string;
 export declare function assertSafeLaneId(laneId: string): void;
 export declare function dropboxDir(hqRoot: string, laneId: string): string;
 export declare function dropboxInboxPath(hqRoot: string, laneId: string): string;
+/** A recovery drain can claim the inbox, draining files, or dead inflight files. */
+export declare function dropboxInboxHasMessages(hqRoot: string, laneId: string): boolean;
+/**
+ * Return a failed recovery claim to the append-only inbox without replacing
+ * messages appended while resume validation or spawn was in progress.
+ */
+export declare function requeueDropboxMessages(hqRoot: string, laneId: string, messages: readonly DropboxMessage[]): void;
 /**
  * Worker tool-call liveness (watcher.ts reads it). A Claude worker run with
  * `--output-format json` writes nothing to worker.out until it exits, so the

package/dist/lib/lanes/dropbox.js

@@ -65,6 +65,75 @@ export function dropboxDir(hqRoot, laneId) {
 export function dropboxInboxPath(hqRoot, laneId) {
     return path.join(dropboxDir(hqRoot, laneId), INBOX_NAME);
 }
+function directoryHasRecoverableFiles(dir, nestedInboxOnly = false) {
+    let names;
+    try {
+        names = fs.readdirSync(dir).filter((name) => !name.startsWith("."));
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+    for (const name of names) {
+        const candidate = path.join(dir, name);
+        let stat;
+        try {
+            stat = fs.statSync(candidate);
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                continue;
+            throw err;
+        }
+        if (nestedInboxOnly) {
+            if (!stat.isDirectory())
+                continue;
+            try {
+                const inbox = fs.statSync(path.join(candidate, INBOX_NAME));
+                if (inbox.isFile() && inbox.size > 0)
+                    return true;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw err;
+            }
+        }
+        else if (stat.isFile() && stat.size > 0) {
+            return true;
+        }
+    }
+    return false;
+}
+function fileHasBytes(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        return stat.isFile() && stat.size > 0;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+/** A recovery drain can claim the inbox, draining files, or dead inflight files. */
+export function dropboxInboxHasMessages(hqRoot, laneId) {
+    const box = dropboxDir(hqRoot, laneId);
+    return fileHasBytes(path.join(box, INBOX_NAME)) ||
+        directoryHasRecoverableFiles(path.join(box, DRAINING_DIR)) ||
+        directoryHasRecoverableFiles(path.join(box, INFLIGHT_DIR), true);
+}
+/**
+ * Return a failed recovery claim to the append-only inbox without replacing
+ * messages appended while resume validation or spawn was in progress.
+ */
+export function requeueDropboxMessages(hqRoot, laneId, messages) {
+    if (messages.length === 0)
+        return;
+    const inbox = dropboxInboxPath(hqRoot, laneId);
+    fs.mkdirSync(path.dirname(inbox), { recursive: true });
+    fs.appendFileSync(inbox, messages.map((message) => `${JSON.stringify(message)}\n`).join(""), "utf8");
+}
 /**
  * Worker tool-call liveness (watcher.ts reads it). A Claude worker run with
  * `--output-format json` writes nothing to worker.out until it exits, so the
@@ -220,7 +289,7 @@ export function drainDropboxAtPath(box, depsInput = {}) {
         return [];
     const inbox = path.join(box, INBOX_NAME);
     const draining = path.join(box, DRAINING_DIR);
-    const delivered = path.join(box, DELIVERED_DIR);
+    const delivered = path.join(box, deps.archiveDirectory ?? DELIVERED_DIR);
     const inflightRoot = path.join(box, INFLIGHT_DIR);
     try {
         deps.mkdirSync(box, { recursive: true });

package/dist/lib/lanes/reconcile.d.ts

@@ -81,6 +81,8 @@ export interface ReconcileDeps {
     readRegistryFlag?: typeof readLanesRegistryFlag;
     /** Active-company fallback for questions raised from an unscoped lane. */
     resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
+    /** Resume queued messages after this pass wins a local dead-worker CAS. */
+    recoverQueuedMessages?: (lane: LaneRecord) => Promise<void>;
     /** Detached mesh seam for dead-watcher recovery. */
     mesh?: LaneMesh | null;
     /** Bound on one terminal mesh emit during dead-host recovery. Default 10 s. */

package/dist/lib/lanes/reconcile.js

@@ -1172,6 +1172,18 @@ async function heartbeatAndDeadHosts(hqRoot, lanes, summary, deps, now) {
                             }
                         }
                     }
+                    if (!deps.dryRun && deps.recoverQueuedMessages) {
+                        try {
+                            await deps.recoverQueuedMessages(result.record);
+                        }
+                        catch (err) {
+                            markDirty(summary, {
+                                kind: "lane",
+                                id: lane.lane_id,
+                                why: `queued message recovery failed: ${err instanceof Error ? err.message : String(err)}`,
+                            });
+                        }
+                    }
                 }
             }
             catch (err) {