@indigoai-us/hq-cli 5.225.0 → 5.226.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [5.226.0] — 2026-09-26
+
+### Added
+
+- `hq staff reset-test-account <email>` wipes a designated test account through
+  the hq-pro admin API. Defaults to a dry-run that lists what would be deleted;
+  `--execute` prompts for the typed email confirmation before wiping, and
+  `--yes` skips the prompt. Refuses to run for callers whose stored email is
+  not on the staff list.
+- `hq staff test-account add|remove|list` manages the designated-test-account
+  registry through the same admin API. `add` and `remove` require staff
+  callers; `list` returns the current registry entries.
+
+### Fixed
+
+- `hq lanes message` now probes the worker PID and start time before queueing.
+  Watcher and reconcile recover accepted inbox messages through the same
+  resume path after classifying an exited worker; undrained messages on done,
+  killed, retired, or superseded lanes are archived as undeliverable.
+- Failed queued-message recovery restores unaccepted claims to the inbox and
+  records the failure. Recovery also sees leftover draining and inflight files,
+  and synchronous classification shares watcher ownership to prevent duplicate
+  repair and resume work.
+- `hq agent enroll --name <bot>` now works on a computer where a person is signed in. It enrolls into `~/.hq-agent/<bot>/` and refuses only if that folder already holds an agent. Before, it refused because of the person's login and told you to pass `--name`, which you already had. Enrolling with no name on such a computer (the default local folder) had the same bug.
+- Pushes made as an agent now record the agent as the uploader. Before, on a computer where a person was also signed in, the files were stamped with the person's email and id.
+- When the server refuses some paths in a push (for example, another member's file in a private folder `foo/`), the warning now says the server refused them, in `hq sync push`, `hq sync now` and `hq sync push --all`. Before, it said the files were outside your write access and to ask an admin for a grant.
+
 ## [5.225.0] — 2026-09-26
 
 ### Changed
@@ -20,7 +47,13 @@
 
 ### Fixed
 
-- When `hq daemon pin-hq-cloud` names a version that is not installed yet, the daemon keeps running the newest installed hq-cloud instead of falling back to the older copy bundled with the CLI, and logs a warning naming the missing version. The updater then installs the pinned version and the daemon switches to it. Before, a pin that did not match the installed copy silently ran the bundled copy, which on one outpost meant a months-old sync runner without recent fixes.
+- When `hq daemon pin-hq-cloud` names a version that is not installed yet, the
+  daemon keeps running the newest installed hq-cloud instead of falling back
+  to the older copy bundled with the CLI, and logs a warning naming the
+  missing version. The updater then installs the pinned version and the
+  daemon switches to it. Before, a pin that did not match the installed copy
+  silently ran the bundled copy, which on one outpost meant a months-old sync
+  runner without recent fixes.
 
 ## [5.223.0] — 2026-09-26
 
@@ -34,6 +67,10 @@
   shares one local account probe across matching lanes per poll. Quota and
   model failures keep their existing account-selection path and reason.
 
+- Client-health flag checks refresh expired person identity and use machine
+  identity when available. Identity refresh has a separate bound, and failed
+  lookups keep the existing doctor fallback path.
+
 ## [5.222.0] — 2026-09-26
 
 - Checkpoint ontology, behind `checkpoint.ontology.multi-writer` (off by

package/dist/command-catalog.generated.d.ts

@@ -7961,6 +7961,22 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "_recover-queued-messages";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options] <lane-id>";
+        readonly arguments: readonly [{
+            readonly name: "lane-id";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "_monitor-message";
         readonly description: "";
@@ -9490,5 +9506,83 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly subcommands: readonly [];
     }];
+}, {
+    readonly name: "staff";
+    readonly description: "Staff-only commands (super-admin required)";
+    readonly aliases: readonly [];
+    readonly hidden: false;
+    readonly usage: "[options] [command]";
+    readonly arguments: readonly [];
+    readonly options: readonly [];
+    readonly subcommands: readonly [{
+        readonly name: "reset-test-account";
+        readonly description: "Reset a designated real-email test account (dry-run by default). Wraps POST /v1/admin/test-account/reset — super-admin only.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] <email>";
+        readonly arguments: readonly [{
+            readonly name: "email";
+            readonly required: true;
+            readonly variadic: false;
+        }];
+        readonly options: readonly [{
+            readonly flags: "--execute";
+            readonly description: "Actually delete artifacts. Prompts for a typed-email confirmation.";
+        }, {
+            readonly flags: "-y, --yes";
+            readonly description: "Skip the typed-email confirmation prompt (still sends confirmEmail).";
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "test-account";
+        readonly description: "Manage the designated test-account registry (super-admin only). Wraps /v1/admin/test-account-registry.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "add";
+            readonly description: "Add an email to the registry so `hq staff reset-test-account` will sweep it.";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <email>";
+            readonly arguments: readonly [{
+                readonly name: "email";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--note <text>";
+                readonly description: "Short reason recorded on the row";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "remove";
+            readonly description: "Soft-delete a registry entry (row stays with active: false).";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <email>";
+            readonly arguments: readonly [{
+                readonly name: "email";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "list";
+            readonly description: "List active registry entries.";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--include-inactive";
+                readonly description: "Also list soft-deleted rows (active: false).";
+            }];
+            readonly subcommands: readonly [];
+        }];
+    }];
 }];
 //# sourceMappingURL=command-catalog.generated.d.ts.map

package/dist/command-catalog.generated.js

@@ -10296,6 +10296,27 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "_recover-queued-messages",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options] <lane-id>",
+                "arguments": [
+                    {
+                        "name": "lane-id",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "_monitor-message",
                 "description": "",
@@ -12273,6 +12294,105 @@ export const COMMAND_CATALOG = [
                 "subcommands": []
             }
         ]
+    },
+    {
+        "name": "staff",
+        "description": "Staff-only commands (super-admin required)",
+        "aliases": [],
+        "hidden": false,
+        "usage": "[options] [command]",
+        "arguments": [],
+        "options": [],
+        "subcommands": [
+            {
+                "name": "reset-test-account",
+                "description": "Reset a designated real-email test account (dry-run by default). Wraps POST /v1/admin/test-account/reset — super-admin only.",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] <email>",
+                "arguments": [
+                    {
+                        "name": "email",
+                        "required": true,
+                        "variadic": false
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--execute",
+                        "description": "Actually delete artifacts. Prompts for a typed-email confirmation."
+                    },
+                    {
+                        "flags": "-y, --yes",
+                        "description": "Skip the typed-email confirmation prompt (still sends confirmEmail)."
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "test-account",
+                "description": "Manage the designated test-account registry (super-admin only). Wraps /v1/admin/test-account-registry.",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "add",
+                        "description": "Add an email to the registry so `hq staff reset-test-account` will sweep it.",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <email>",
+                        "arguments": [
+                            {
+                                "name": "email",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--note <text>",
+                                "description": "Short reason recorded on the row"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "remove",
+                        "description": "Soft-delete a registry entry (row stays with active: false).",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <email>",
+                        "arguments": [
+                            {
+                                "name": "email",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "list",
+                        "description": "List active registry entries.",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--include-inactive",
+                                "description": "Also list soft-deleted rows (active: false)."
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            }
+        ]
     }
 ];
 //# sourceMappingURL=command-catalog.generated.js.map

package/dist/command-registration-plan.d.ts

@@ -432,6 +432,24 @@ export declare const REGISTRATION_PLAN: readonly [{
     readonly parent: "program";
     readonly module: "./commands/report.js";
     readonly exportName: "registerReportCommand";
+}, {
+    readonly type: "group";
+    readonly root: "staff";
+    readonly id: "staff";
+    readonly name: "staff";
+    readonly description: "Staff-only commands (super-admin required)";
+}, {
+    readonly type: "registrar";
+    readonly root: "staff";
+    readonly parent: "staff";
+    readonly module: "./commands/staff/reset-test-account.js";
+    readonly exportName: "registerResetTestAccountCommand";
+}, {
+    readonly type: "registrar";
+    readonly root: "staff";
+    readonly parent: "staff";
+    readonly module: "./commands/staff/test-account.js";
+    readonly exportName: "registerTestAccountCommand";
 }];
 export declare function registerAllCommands(program: Command): Promise<void>;
 export declare function registerCommandRoot(program: Command, root: string): Promise<boolean>;

package/dist/command-registration-plan.js

@@ -74,6 +74,12 @@ export const REGISTRATION_PLAN = [
     { type: "registrar", root: "daemon", parent: "program", module: "./commands/daemon.js", exportName: "registerDaemonCommand", hidden: true },
     { type: "registrar", root: "bot", parent: "program", module: "./commands/bot.js", exportName: "registerBotCommand" },
     { type: "registrar", root: "report", parent: "program", module: "./commands/report.js", exportName: "registerReportCommand" },
+    // onboarding-test-accounts US-007 — super-admin staff CLI wrappers over the
+    // hq-pro admin surface. New wrappers land under this group; the reset
+    // command mirrors POST /v1/admin/test-account/reset.
+    { type: "group", root: "staff", id: "staff", name: "staff", description: "Staff-only commands (super-admin required)" },
+    { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/reset-test-account.js", exportName: "registerResetTestAccountCommand" },
+    { type: "registrar", root: "staff", parent: "staff", module: "./commands/staff/test-account.js", exportName: "registerTestAccountCommand" },
 ];
 async function executePlan(program, steps) {
     const parents = new Map([["program", program]]);

package/dist/commands/agent-enroll.d.ts

@@ -87,6 +87,8 @@ export interface EnrollDeps {
     env?: NodeJS.ProcessEnv;
     hostInfo?: HostInfo;
     generateKeyPair?: typeof generateHostKeyPair;
+    /** Home directory the enroll target resolves under (defaults to os.homedir()). */
+    home?: string;
 }
 export interface EnrollOptions {
     code: string;

package/dist/commands/agent-enroll.js

@@ -59,6 +59,17 @@ export function detectExistingIdentity(paths, env = process.env) {
     }
     return { kind: "none" };
 }
+/** Machine identity already enrolled in a local agent directory, if any. */
+function existingLocalIdentity(paths) {
+    if (!machineCredsFileExists(paths))
+        return { kind: "none" };
+    const existing = readExternalMachineCreds(paths);
+    return {
+        kind: "machine",
+        file: paths.machineCredsPath,
+        ...(existing ? { agentUid: existing.entityUid } : {}),
+    };
+}
 export function refusalMessage(existing) {
     switch (existing.kind) {
         case "none":
@@ -221,7 +232,7 @@ export async function enrollHost(opts, deps = {}) {
     const env = deps.env ?? process.env;
     const target = deps.paths
         ? { paths: deps.paths, local: false }
-        : resolveEnrollTarget({ name: opts.name, replace: opts.replace }, env);
+        : resolveEnrollTarget({ name: opts.name, replace: opts.replace }, env, deps.home);
     const paths = target.paths;
     const doFetch = deps.fetch ?? fetch;
     const apiBaseUrl = (opts.apiBaseUrl ?? env.HQ_VAULT_API_URL ?? DEFAULT_VAULT_API_URL).replace(/\/+$/, "");
@@ -229,7 +240,11 @@ export async function enrollHost(opts, deps = {}) {
     if (!isWellFormedEnrollmentCode(code)) {
         throw new EnrollError(`Enrollment code must be 24 base32 characters (shown as XXXX-XXXX-XXXX-XXXX-XXXX-XXXX); got ${code.length}.`);
     }
-    const existing = detectExistingIdentity(paths, env);
+    // A local target sits in its own ~/.hq-agent/<name>/ beside the person's
+    // login by design, so only an identity already in that directory blocks it.
+    const existing = target.local
+        ? existingLocalIdentity(paths)
+        : detectExistingIdentity(paths, env);
     const refusal = refusalMessage(existing);
     if (refusal && !opts.replace)
         throw new EnrollError(refusal);

package/dist/commands/cloud.d.ts

@@ -61,6 +61,14 @@ export declare function scopeExcludedWarning(count: number): string | null;
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
  */
 export declare function scopeExcludedPrefixDetail(prefixSet: readonly string[] | undefined): string | null;
+/**
+ * Every warning line for a push that dropped files, shared by `push`, `now`
+ * and `push --all`. With a client prefix scope the files fell outside the
+ * caller's write prefixes; without one (prefixSet undefined) the server
+ * refused them path by path — typically another member's child in a private
+ * folder foo/ — and grant advice would point the reader the wrong way.
+ */
+export declare function scopeExcludedLines(count: number, prefixSet: readonly string[] | undefined): string[];
 /**
  * Bound foreground waits for a watcher/manual sync that currently owns the
  * per-root operation lock. The cloud engine reads this environment value on
@@ -231,6 +239,8 @@ export interface PushAllOptions {
 export interface PushAllRow {
     slug: string;
     result?: ShareCallResult;
+    /** Client write-prefix scope this push ran under; undefined = none applied. */
+    prefixSet?: readonly string[];
     error?: string;
 }
 export interface PushAllResult {

package/dist/commands/cloud.js

@@ -16,8 +16,9 @@ import { isAccessDeniedError, accessDeniedKeyOf, formatAccessDenied, } from "../
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, getStateDir, listJournals, loadCachedTokens, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
+import { share, sync, getStateDir, listJournals, VaultClient, computePersonalVaultPaths, PERSONAL_VAULT_JOURNAL_SLUG, resolvePullScope, syncDoctor, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
+import { resolveUploadAuthor } from "../utils/upload-author.js";
 import { companyFolderExceedsThreshold, emitNarrowHint, isStrictRefusal, resolveBannerLevel, resolveNarrowHintPresentationLevel, resolveNarrowHintMinBytes, } from "../lib/narrow-hint-banner.js";
 import { beginSyncHealthReport, } from "../utils/client-health.js";
 /**
@@ -115,11 +116,39 @@ export function scopeExcludedWarning(count) {
  * dropped files — helps debug ACL vs scope-excluded mismatches (feedback_7e9c535e).
  */
 export function scopeExcludedPrefixDetail(prefixSet) {
-    if (!prefixSet || prefixSet.length === 0) {
+    // No client-side prefix scope applied: the server refused the paths one by
+    // one, and scopeExcludedLines' primary line already says so.
+    if (prefixSet === undefined)
+        return null;
+    if (prefixSet.length === 0) {
         return "  Granted write prefixes: (none — shared-mode membership with no explicit grants)";
     }
     return `  Granted write prefixes: ${prefixSet.join(", ")}`;
 }
+/**
+ * Every warning line for a push that dropped files, shared by `push`, `now`
+ * and `push --all`. With a client prefix scope the files fell outside the
+ * caller's write prefixes; without one (prefixSet undefined) the server
+ * refused them path by path — typically another member's child in a private
+ * folder foo/ — and grant advice would point the reader the wrong way.
+ */
+export function scopeExcludedLines(count, prefixSet) {
+    if (count <= 0)
+        return [];
+    if (prefixSet === undefined) {
+        return [
+            `⚠ ${count} file(s) were NOT uploaded — the server refused them. ` +
+                `A common cause is a file someone else created in a private folder ` +
+                `(foo/): only its creator can change it. They were skipped, not ` +
+                `synced. Re-run with --json to list them.`,
+        ];
+    }
+    const lines = [scopeExcludedWarning(count)];
+    const detail = scopeExcludedPrefixDetail(prefixSet);
+    if (detail)
+        lines.push(detail);
+    return lines;
+}
 /**
  * Resolve the `propagateDeletePolicy` for share() calls.
  *
@@ -445,7 +474,13 @@ export async function pushAll(options, deps) {
             result.bytesUploaded += r.bytesUploaded;
             result.filesDeleted += r.filesDeleted;
             result.filesExcludedByScope += r.filesExcludedByScope;
-            result.perCompany.push({ slug: entry.slug, result: r });
+            result.perCompany.push({
+                slug: entry.slug,
+                result: r,
+                ...(entry.shareOptions.prefixSet !== undefined
+                    ? { prefixSet: entry.shareOptions.prefixSet }
+                    : {}),
+            });
         }
         catch (err) {
             const message = formatSyncFailure(err);
@@ -803,7 +838,7 @@ export function registerCloudCommands(program) {
             // every row renders `—`. Resolved best-effort from the cached
             // idToken — pre-vended `--creds-from-stdin` paths still get author
             // attribution as long as the caller is logged in locally.
-            const author = resolveUploadAuthorFromCache();
+            const author = resolveUploadAuthor();
             let pushPrefixSet;
             if (!personalMode && scopeVaultConfig) {
                 const scopeClient = new VaultClient(scopeVaultConfig);
@@ -850,10 +885,9 @@ export function registerCloudCommands(program) {
             if (result.filesExcludedByScope > 0) {
                 log(chalk.yellow(`\n⚠ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ` +
                     `${result.filesSkipped} skipped, ${result.filesExcludedByScope} scope-excluded)`));
-                log(chalk.yellow(scopeExcludedWarning(result.filesExcludedByScope)));
-                const prefixDetail = scopeExcludedPrefixDetail(pushPrefixSet);
-                if (prefixDetail)
-                    log(chalk.yellow(prefixDetail));
+                for (const line of scopeExcludedLines(result.filesExcludedByScope, pushPrefixSet)) {
+                    log(chalk.yellow(line));
+                }
             }
             else {
                 log(chalk.green(`\n✓ Pushed ${result.filesUploaded} file(s) (${formatBytes(result.bytesUploaded)}, ${result.filesSkipped} skipped)`));
@@ -1342,7 +1376,7 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
         const accessToken = await ensureCognitoToken();
         const vaultConfig = buildVaultConfig(accessToken);
         const realClient = new VaultClient(vaultConfig);
-        const author = resolveUploadAuthorFromCache();
+        const author = resolveUploadAuthor();
         const adapter = {
             listMyMemberships: () => realClient.listMyMemberships(),
             listPersonEntities: () => realClient.entity.listByType("person"),
@@ -1420,8 +1454,11 @@ async function runPushAll(hqRoot, message, onConflict, skipPersonal) {
     console.log(errored > 0 || result.filesExcludedByScope > 0
         ? chalk.yellow(summary)
         : chalk.green(summary));
-    if (result.filesExcludedByScope > 0) {
-        console.log(chalk.yellow(scopeExcludedWarning(result.filesExcludedByScope)));
+    for (const row of result.perCompany) {
+        const excluded = row.result?.filesExcludedByScope ?? 0;
+        for (const line of scopeExcludedLines(excluded, row.prefixSet)) {
+            console.log(chalk.yellow(`${row.slug}: ${line}`));
+        }
     }
     if (errored > 0)
         throw new SyncExitError(1);
@@ -1434,7 +1471,7 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
     try {
         const accessToken = await ensureCognitoToken();
         const vaultConfig = buildVaultConfig(accessToken);
-        const author = resolveUploadAuthorFromCache();
+        const author = resolveUploadAuthor();
         // Resolve the target. For --personal, look up the canonical person and
         // route paths/journal through personalMode. Otherwise use the company arg
         // (or fall back to the active company inside share()/sync()).
@@ -1499,10 +1536,9 @@ async function runNowSingle(hqRoot, company, personal, message, onConflict, mode
             `${pushResult.filesDeleted} deleted, ${pushResult.filesExcludedByScope} scope-excluded` +
             (pushResult.aborted ? " — aborted" : ""));
         if (pushResult.filesExcludedByScope > 0) {
-            console.log(chalk.yellow(scopeExcludedWarning(pushResult.filesExcludedByScope)));
-            const prefixDetail = scopeExcludedPrefixDetail(nowPushPrefixSet);
-            if (prefixDetail)
-                console.log(chalk.yellow(prefixDetail));
+            for (const line of scopeExcludedLines(pushResult.filesExcludedByScope, nowPushPrefixSet)) {
+                console.log(chalk.yellow(line));
+            }
         }
         if (pushResult.aborted) {
             console.log(chalk.yellow("\n⚠ Sync now aborted on push leg; pull skipped."));
@@ -1689,35 +1725,4 @@ async function readAllStdin() {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
-/**
- * Resolve the syncing user's `UploadAuthor` (sub + email) from the cached
- * Cognito idToken. Returns `undefined` when no tokens are cached or the
- * token is missing the required claims — share() then skips the metadata
- * stamp gracefully (not an error).
- *
- * We deliberately decode the JWT here instead of verifying it: Cognito
- * already verified at issuance, and we only use the public claims to
- * label the upload's S3 user metadata (no auth decision rides on it).
- */
-function resolveUploadAuthorFromCache() {
-    const tokens = loadCachedTokens();
-    if (!tokens?.idToken)
-        return undefined;
-    const parts = tokens.idToken.split(".");
-    if (parts.length !== 3)
-        return undefined;
-    try {
-        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-        const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
-        const json = Buffer.from(padded, "base64").toString("utf-8");
-        const claims = JSON.parse(json);
-        if (claims.sub && claims.email) {
-            return { userSub: claims.sub, email: claims.email };
-        }
-        return undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 //# sourceMappingURL=cloud.js.map

package/dist/commands/lanes.d.ts

@@ -15,6 +15,7 @@ import { emitLaneDecisionEvents, type LaneMesh } from "../lib/lanes/mesh-events.
 import { LANE_HIRE_GRANTS_FLAG, MAX_LANE_DEPTH, withLaneHireLocks, type LaneCompanyRef, type QuestionBody, type LaneRecord, type QuestionRecord, type ResolvedLaneWorker, type SeniorRef, type LivenessDeps, type MachineIdentity, type MonitorEvidenceReader, type RunCommand, type ThrottleDeps } from "../lib/lanes/index.js";
 import { questionBodyAbsPath } from "../lib/lanes/questions.js";
 import { type RunCompactionFn } from "../lib/lanes/compaction.js";
+import type { WatcherLoopDeps } from "../lib/lanes/watcher.js";
 import { type KnownModelsDeps, type ProbeCommand } from "../lib/lanes/models.js";
 import { spawnLaneWorker, type KillProcessFn, type ProveDetachedFn, type SpawnProcessFn } from "../lib/lanes/spawn.js";
 export { spawnLaneWorker };
@@ -56,6 +57,10 @@ export interface LanesCommandDeps {
     proveDetached?: ProveDetachedFn;
     killProcess?: KillProcessFn;
     isAlive?: (pid: number) => boolean;
+    /** Test seam for worker PID identity checks. */
+    readStarttime?: (pid: number) => number | null;
+    /** Test seams for synchronous dead-worker classification and repair. */
+    watcherLoopDeps?: Pick<WatcherLoopDeps, "sleep" | "spawnRepair">;
     stopSleepMs?: (ms: number) => void;
     livenessDeps?: LivenessDeps;
     presenceConnected?: boolean;