@indigoai-us/hq-cli 5.228.1 → 5.228.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.228.3] — 2026-09-27
+
+### Fixed
+
+- Work Mesh tracker rows use the local record fields. Missing blocker
+  `opened_at` values use `createdAt`, and invalid mesh rows identify Work Mesh
+  as their source.
+- KPI and OKR records retain their status when read from Work Mesh, including in
+  `kpi list`, `okr list`, and `team --json` output.
+
+## [5.228.2] — 2026-09-27
+
 ## [5.228.1] — 2026-09-27
 
 ### Fixed

package/dist/commands/lanes-checks.js

@@ -435,7 +435,17 @@ function readTeamInputs(root, company, projects, lanes) {
 export function pathForTrackerRecord(projectDirectory, kind, id) {
     return path.join(projectDirectory, "tracker", kind, `${id}.json`);
 }
-function recordInvalid(kind, record, projectDirectory, field) {
+function recordInvalid(kind, record, projectDirectory, field, source = "local") {
+    if (source === "Work Mesh") {
+        return fail("tracker_checks_record_invalid", `Work Mesh tracker ${kind} record ${record.id} has invalid ${field}`, {
+            source,
+            record_id: record.id,
+            kind,
+            company: record.company,
+            project_id: record.project_id,
+            field,
+        });
+    }
     return fail("tracker_checks_record_invalid", `Tracker ${kind} record has invalid ${field}`, {
         kind,
         id: record.id,
@@ -443,10 +453,18 @@ function recordInvalid(kind, record, projectDirectory, field) {
         path: pathForTrackerRecord(projectDirectory, kind, record.id),
     });
 }
-function requiredRecordDate(kind, record, projectDirectory, field) {
+function requiredRecordDate(kind, record, projectDirectory, field, source = "local") {
     const value = record[field];
     if (typeof value !== "string" || !Number.isFinite(Date.parse(value)))
-        return recordInvalid(kind, record, projectDirectory, field);
+        return recordInvalid(kind, record, projectDirectory, field, source);
+    return value;
+}
+function requiredRecordTimestamp(kind, record, projectDirectory, field, value, source) {
+    if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) {
+        if (source === "Work Mesh")
+            return recordInvalid(kind, record, projectDirectory, field, source);
+        return parseTimestamp(value, field, pathForTrackerRecord(projectDirectory, kind, record.id));
+    }
     return value;
 }
 export function listTrackerRecords(projectDirectory, kind) {
@@ -509,6 +527,7 @@ async function readTrackerCheckRecords(root, company, projects, deps) {
     const kpis = [];
     const directives = [];
     const useMesh = await deps.trackerMeshEnabled(company);
+    const source = useMesh ? "Work Mesh" : "local";
     for (const project of projects) {
         const absoluteDirectory = path.join(root, "companies", company.slug, "projects", project.projectId);
         const store = useMesh
@@ -522,40 +541,40 @@ async function readTrackerCheckRecords(root, company, projects, deps) {
         for (const record of records.blocker) {
             if (record.company !== company.slug || record.project_id !== project.projectId)
                 continue;
-            const openedAt = requiredRecordDate("blocker", record, absoluteDirectory, "opened_at");
+            const openedAt = requiredRecordDate("blocker", record, absoluteDirectory, "opened_at", source);
             const resolvedAt = record.resolved_at;
             if (resolvedAt !== null && (typeof resolvedAt !== "string" || !Number.isFinite(Date.parse(resolvedAt))))
-                recordInvalid("blocker", record, absoluteDirectory, "resolved_at");
+                recordInvalid("blocker", record, absoluteDirectory, "resolved_at", source);
             const nextStep = record.next_step;
             if (nextStep !== undefined && nextStep !== null && typeof nextStep !== "string")
-                recordInvalid("blocker", record, absoluteDirectory, "next_step");
+                recordInvalid("blocker", record, absoluteDirectory, "next_step", source);
             blockers.push({ id: record.id, opened_at: openedAt, resolved_at: resolvedAt, next_step: typeof nextStep === "string" ? nextStep : null });
         }
         for (const record of records.kpi) {
             if (record.company !== company.slug || record.project_id !== project.projectId)
                 continue;
-            const createdAt = requiredRecordDate("kpi", record, absoluteDirectory, "created_at");
+            const createdAt = requiredRecordDate("kpi", record, absoluteDirectory, "created_at", source);
             if (!Array.isArray(record.values))
-                recordInvalid("kpi", record, absoluteDirectory, "values");
+                recordInvalid("kpi", record, absoluteDirectory, "values", source);
             const values = record.values.map((value) => {
                 if (!isObject(value))
-                    recordInvalid("kpi", record, absoluteDirectory, "values");
-                return { at: parseTimestamp(value.at, "values.at", pathForTrackerRecord(absoluteDirectory, "kpi", record.id)) };
+                    recordInvalid("kpi", record, absoluteDirectory, "values", source);
+                return { at: requiredRecordTimestamp("kpi", record, absoluteDirectory, "values[].at", value.at, source) };
             });
             kpis.push({ id: record.id, created_at: createdAt, values });
         }
         for (const record of records.directive) {
             if (record.company !== company.slug || record.project_id !== project.projectId)
                 continue;
-            const createdAt = requiredRecordDate("directive", record, absoluteDirectory, "created_at");
+            const createdAt = requiredRecordDate("directive", record, absoluteDirectory, "created_at", source);
             if (!Array.isArray(record.teams) || record.teams.some((team) => typeof team !== "string"))
-                recordInvalid("directive", record, absoluteDirectory, "teams");
+                recordInvalid("directive", record, absoluteDirectory, "teams", source);
             if (!Array.isArray(record.acknowledgements))
-                recordInvalid("directive", record, absoluteDirectory, "acknowledgements");
+                recordInvalid("directive", record, absoluteDirectory, "acknowledgements", source);
             const acknowledgements = record.acknowledgements.map((ack) => {
                 if (!isObject(ack) || typeof ack.team !== "string" || typeof ack.lane_id !== "string")
-                    recordInvalid("directive", record, absoluteDirectory, "acknowledgements");
-                return { team: ack.team, lane_id: ack.lane_id, at: parseTimestamp(ack.at, "acknowledgements.at", pathForTrackerRecord(absoluteDirectory, "directive", record.id)) };
+                    recordInvalid("directive", record, absoluteDirectory, "acknowledgements", source);
+                return { team: ack.team, lane_id: ack.lane_id, at: requiredRecordTimestamp("directive", record, absoluteDirectory, "acknowledgements[].at", ack.at, source) };
             });
             directives.push({ id: record.id, created_at: createdAt, teams: record.teams, acknowledgements });
         }

package/dist/lib/flag-registry-worker-mode-cache.d.ts

@@ -3,6 +3,13 @@ interface CachedWorkerMode {
     version: number;
     value: boolean;
 }
+export type FlagRegistryWorkerModeCacheOperation = "read" | "write";
+export type FlagRegistryWorkerModeCacheStep = "mkdir" | "write_temp" | "link" | "unlink" | "prune" | "readdir" | "read";
+/** Build bounded filesystem diagnostics without exposing the state directory. */
+export declare function flagRegistryWorkerModeCacheFailureContext(error: unknown, operation: FlagRegistryWorkerModeCacheOperation, filePath: string, env?: NodeJS.ProcessEnv): {
+    exception: unknown;
+    tags: Record<string, string>;
+};
 /** Keep the last server snapshot decision for this one startup-mode flag. */
 export declare function flagRegistryWorkerModeCachePath(stateDir: string, scopeIdentifiers: readonly string[]): string;
 /** A missing, invalid, or inaccessible cache never enables the rollout. */

package/dist/lib/flag-registry-worker-mode-cache.js

@@ -1,8 +1,116 @@
+import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 export const FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG = "cli.flag-worker-self-contained";
+class FlagRegistryWorkerModeCacheStepError extends Error {
+    cacheStep;
+    originalError;
+    constructor(cacheStep, originalError) {
+        super(`Flag registry worker-mode cache failed at ${cacheStep}`);
+        this.cacheStep = cacheStep;
+        this.originalError = originalError;
+        this.name = "FlagRegistryWorkerModeCacheStepError";
+    }
+}
+const KNOWN_ERRNOS = new Set([
+    "EACCES",
+    "EBUSY",
+    "EEXIST",
+    "EIO",
+    "EISDIR",
+    "EMFILE",
+    "ENFILE",
+    "ENOENT",
+    "ENOSPC",
+    "ENOTDIR",
+    "EPERM",
+    "EROFS",
+]);
+function withCacheFsStep(cacheStep, operation) {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof FlagRegistryWorkerModeCacheStepError)
+            throw error;
+        throw new FlagRegistryWorkerModeCacheStepError(cacheStep, error);
+    }
+}
+function originalCacheError(error) {
+    return error instanceof FlagRegistryWorkerModeCacheStepError
+        ? error.originalError
+        : error;
+}
+function cacheErrorCode(error) {
+    const original = originalCacheError(error);
+    return typeof original === "object" && original !== null && "code" in original
+        ? original.code
+        : undefined;
+}
+function directoryHasUchg(directory) {
+    if (process.platform !== "darwin")
+        return "unknown";
+    try {
+        const rawFlags = execFileSync("/usr/bin/stat", ["-f", "%f", directory], { timeout: 1000 }).toString("utf8").trim();
+        if (!/^\d+$/.test(rawFlags))
+            return "unknown";
+        const flags = Number(rawFlags);
+        if (!Number.isSafeInteger(flags))
+            return "unknown";
+        return String((flags & 0x00000002) !== 0 || (flags & 0x00020000) !== 0);
+    }
+    catch {
+        // This bounded diagnostic is best-effort; preserve unknown and the original cache error.
+        return "unknown";
+    }
+}
+/** Build bounded filesystem diagnostics without exposing the state directory. */
+export function flagRegistryWorkerModeCacheFailureContext(error, operation, filePath, env = process.env) {
+    const cacheError = error instanceof FlagRegistryWorkerModeCacheStepError
+        ? error
+        : undefined;
+    const directory = path.dirname(filePath);
+    let dirExists = "unknown";
+    let stats;
+    try {
+        stats = fs.statSync(directory);
+        dirExists = "true";
+    }
+    catch (metadataError) {
+        if (cacheErrorCode(metadataError) === "ENOENT")
+            dirExists = "false";
+        // Keep inaccessible metadata unknown; diagnostics must not hide the cache error.
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    const ownerMatches = typeof uid === "number" && typeof stats?.uid === "number"
+        ? String(stats.uid === uid)
+        : "unknown";
+    const dirMode = typeof stats?.mode === "number"
+        ? (stats.mode & 0o777).toString(8).padStart(3, "0")
+        : "unknown";
+    const dirHasUchg = directoryHasUchg(directory);
+    const rawErrno = cacheErrorCode(error);
+    const errno = typeof rawErrno === "string" && KNOWN_ERRNOS.has(rawErrno)
+        ? rawErrno
+        : "UNKNOWN";
+    const stateDirSource = env.HQ_STATE_DIR?.trim() ? "env" : "home";
+    return {
+        exception: originalCacheError(error),
+        tags: {
+            cache_op: operation,
+            cache_step: cacheError?.cacheStep ?? (operation === "read" ? "read" : "write_temp"),
+            errno,
+            state_dir_source: stateDirSource,
+            dir_exists: dirExists,
+            dir_owner_matches_uid: ownerMatches,
+            dir_mode: dirMode,
+            dir_has_uchg: dirHasUchg,
+            cache_path_kind: "<stateDir>/flags/<basename>",
+        },
+    };
+}
 /** Keep the last server snapshot decision for this one startup-mode flag. */
 export function flagRegistryWorkerModeCachePath(stateDir, scopeIdentifiers) {
     const basename = scopeIdentifiers.length === 0
@@ -17,11 +125,11 @@ export function flagRegistryWorkerModeCachePath(stateDir, scopeIdentifiers) {
 export function readCachedFlagRegistryWorkerMode(filePath) {
     let latest = readCacheRecordIfPresent(filePath);
     const directory = path.dirname(filePath);
-    if (!fs.existsSync(directory))
+    if (!withCacheFsStep("read", () => fs.existsSync(directory)))
         return latest;
     const basename = path.basename(filePath);
     const versionedPrefix = `${basename}.v`;
-    for (const entry of fs.readdirSync(directory)) {
+    for (const entry of withCacheFsStep("readdir", () => fs.readdirSync(directory))) {
         if (!entry.startsWith(versionedPrefix) || !entry.endsWith(".json"))
             continue;
         const versionedPath = path.join(directory, entry);
@@ -32,7 +140,7 @@ export function readCachedFlagRegistryWorkerMode(filePath) {
     return latest;
 }
 export function writeCachedFlagRegistryWorkerMode(filePath, snapshot) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    withCacheFsStep("mkdir", () => fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 }));
     const existing = readCachedFlagRegistryWorkerMode(filePath);
     if (existing && snapshot.version < existing.version)
         return;
@@ -42,26 +150,27 @@ export function writeCachedFlagRegistryWorkerMode(filePath, snapshot) {
     const versionedPath = `${filePath}.v${snapshot.version}.json`;
     const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
     try {
-        fs.writeFileSync(tempPath, `${JSON.stringify(snapshot)}\n`, {
+        withCacheFsStep("write_temp", () => fs.writeFileSync(tempPath, `${JSON.stringify(snapshot)}\n`, {
             encoding: "utf8",
             mode: 0o600,
             flag: "wx",
-        });
+        }));
         try {
-            fs.linkSync(tempPath, versionedPath);
+            withCacheFsStep("link", () => fs.linkSync(tempPath, versionedPath));
         }
         catch (error) {
             if (!isAlreadyExistsError(error))
                 throw error;
             const existingVersion = readCacheRecord(versionedPath);
             if (existingVersion.value !== snapshot.value) {
-                throw new Error("Conflicting flag-registry worker cache values share a version");
+                throw new FlagRegistryWorkerModeCacheStepError("link", new Error("Conflicting flag-registry worker cache values share a version"));
             }
         }
     }
     finally {
-        if (fs.existsSync(tempPath))
-            fs.unlinkSync(tempPath);
+        if (withCacheFsStep("unlink", () => fs.existsSync(tempPath))) {
+            withCacheFsStep("unlink", () => fs.unlinkSync(tempPath));
+        }
     }
     pruneOlderCacheRecords(filePath);
 }
@@ -76,7 +185,8 @@ function isCachedWorkerMode(value) {
         "value" in value && typeof value.value === "boolean";
 }
 function readCacheRecord(filePath) {
-    const value = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    const contents = withCacheFsStep("read", () => fs.readFileSync(filePath, "utf8"));
+    const value = JSON.parse(contents);
     if (!isCachedWorkerMode(value)) {
         throw new Error("Cached flag-registry worker mode has an invalid shape");
     }
@@ -97,14 +207,14 @@ function pruneOlderCacheRecords(filePath) {
     const directory = path.dirname(filePath);
     const basename = path.basename(filePath);
     const versionedPrefix = `${basename}.v`;
-    for (const entry of fs.readdirSync(directory)) {
+    for (const entry of withCacheFsStep("readdir", () => fs.readdirSync(directory))) {
         if (!entry.startsWith(versionedPrefix) || !entry.endsWith(".json"))
             continue;
         const recordPath = path.join(directory, entry);
         const record = readCacheRecordIfPresent(recordPath);
         if (record && record.version < latest.version) {
             try {
-                fs.unlinkSync(recordPath);
+                withCacheFsStep("prune", () => fs.unlinkSync(recordPath));
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -112,11 +222,11 @@ function pruneOlderCacheRecords(filePath) {
             }
         }
     }
-    if (fs.existsSync(filePath)) {
+    if (withCacheFsStep("prune", () => fs.existsSync(filePath))) {
         const legacyRecord = readCacheRecordIfPresent(filePath);
         if (legacyRecord && legacyRecord.version < latest.version) {
             try {
-                fs.unlinkSync(filePath);
+                withCacheFsStep("prune", () => fs.unlinkSync(filePath));
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -136,11 +246,9 @@ function readCacheRecordIfPresent(filePath) {
     }
 }
 function isAlreadyExistsError(error) {
-    return typeof error === "object" && error !== null &&
-        "code" in error && error.code === "EEXIST";
+    return cacheErrorCode(error) === "EEXIST";
 }
 function isNotFoundError(error) {
-    return typeof error === "object" && error !== null &&
-        "code" in error && error.code === "ENOENT";
+    return cacheErrorCode(error) === "ENOENT";
 }
 //# sourceMappingURL=flag-registry-worker-mode-cache.js.map

package/dist/lib/flag-registry.js

@@ -14,7 +14,7 @@ import { workContextRoot } from "./work-context/paths.js";
 import { readCompaniesManifestMap } from "./work-context/repo-remote.js";
 import { loadCachedTokens, resolveDefaultHqRoot } from "../utils/cognito-session.js";
 import { resolveFlagRegistryEndpoint, } from "./flag-registry-endpoint.js";
-import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
+import { FLAG_REGISTRY_SELF_CONTAINED_WORKER_FLAG, flagRegistryWorkerModeCacheFailureContext, flagRegistryStateDir, flagRegistryWorkerModeCachePath, readCachedFlagRegistryWorkerMode, writeCachedFlagRegistryWorkerMode, } from "./flag-registry-worker-mode-cache.js";
 import { FLAG_REGISTRY_WORKER_SOURCE } from "./flag-registry-worker-source.generated.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
 const COMPANY_UID_RE = /^cmp_[A-Za-z0-9]{3,128}$/;
@@ -140,8 +140,13 @@ function selfContainedWorkerEnabled(company) {
         return readCachedFlagRegistryWorkerMode(filePath)?.value ?? false;
     }
     catch (error) {
-        Sentry.captureException(error, {
-            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        const failure = flagRegistryWorkerModeCacheFailureContext(error, "read", filePath);
+        Sentry.captureException(failure.exception, {
+            tags: {
+                component: "flag-registry-worker-mode-cache",
+                worker: "flag-registry",
+                ...failure.tags,
+            },
         });
         return false;
     }
@@ -165,8 +170,14 @@ function cacheWorkerModeFromSnapshot(snapshot, company) {
         writeCachedFlagRegistryWorkerMode(flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes), { version: snapshot.version, value: decision.value });
     }
     catch (error) {
-        Sentry.captureException(error, {
-            tags: { component: "flag-registry-worker-mode-cache", worker: "flag-registry" },
+        const filePath = flagRegistryWorkerModeCachePath(flagRegistryStateDir(), scopes);
+        const failure = flagRegistryWorkerModeCacheFailureContext(error, "write", filePath);
+        Sentry.captureException(failure.exception, {
+            tags: {
+                component: "flag-registry-worker-mode-cache",
+                worker: "flag-registry",
+                ...failure.tags,
+            },
         });
     }
 }

package/dist/lib/lanes/tracker-mesh.js

@@ -3,6 +3,12 @@ import { meshJson, requireToken } from "../mesh/client.js";
 import { LanesError } from "./errors.js";
 const ROOT = "/v1/work-mesh/tracker/records";
 const MAX_RECORD_PAGES = 20;
+const RECORD_FIELDS = {
+    blocker: ["story_id", "what", "waiting_on", "next_step", "opened_at", "resolved_at", "resolution", "import_key", "source_path", "source_item_id"],
+    kpi: ["name", "definition", "unit", "target", "direction", "status", "approved_by", "approved_at", "values", "import_key", "source_path", "source_item_id"],
+    okr: ["objective", "period", "key_results", "status", "approved_by", "approved_at", "import_key", "source_path", "source_item_id"],
+    directive: ["text", "date", "source_url", "teams", "policy_path", "acknowledgements", "import_key", "source_path", "source_item_id"],
+};
 function fail(error, message, details = {}) {
     throw new LanesError(error, message, details);
 }
@@ -50,23 +56,30 @@ function fromMesh(value) {
 }
 function recordFromMeta(raw, company, projectId, expectedKind) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        return fail("tracker_mesh_response_invalid", "Work Mesh returned a malformed tracker record", { project_id: projectId, kind: expectedKind });
+        return fail("tracker_mesh_response_invalid", "Work Mesh returned a malformed tracker record", {
+            source: "Work Mesh", kind: expectedKind, company: company.slug, project_id: projectId,
+        });
     }
     const meta = raw;
     if (meta.companyUid !== company.uid || meta.projectId !== projectId || meta.kind !== expectedKind || typeof meta.threadId !== "string" || !meta.threadId) {
-        return fail("tracker_mesh_response_invalid", "Work Mesh tracker record identity did not match the requested company, project, and kind", { project_id: projectId, kind: expectedKind });
+        return fail("tracker_mesh_response_invalid", "Work Mesh tracker record identity did not match the requested company, project, and kind", {
+            source: "Work Mesh",
+            ...(typeof meta.threadId === "string" && meta.threadId ? { record_id: meta.threadId } : {}),
+            kind: expectedKind,
+            company: company.slug,
+            project_id: projectId,
+        });
     }
     const fields = fromMesh(meta);
     const createdAt = typeof meta.createdAt === "string" ? meta.createdAt : "";
     const updatedAt = typeof meta.lastActivityAt === "string" ? meta.lastActivityAt : createdAt;
     const version = meta.version;
     if (!Number.isSafeInteger(version) || version < 1 || !Number.isFinite(Date.parse(createdAt)) || !Number.isFinite(Date.parse(updatedAt))) {
-        return fail("tracker_mesh_response_invalid", "Work Mesh tracker record has invalid version or timestamps", { record_id: meta.threadId, kind: expectedKind });
+        return fail("tracker_mesh_response_invalid", "Work Mesh tracker record has invalid version or timestamps", {
+            source: "Work Mesh", record_id: meta.threadId, kind: expectedKind, company: company.slug, project_id: projectId,
+        });
     }
-    const { company_uid: _companyUid, project_id: _projectId, thread_id: _threadId, thread_status: threadStatus, ...rest } = fields;
     const record = {
-        ...rest,
-        ...(typeof threadStatus === "string" && rest.status === undefined ? { status: threadStatus } : {}),
         schema_version: "hq-lanes-tracker-record.v1",
         kind: expectedKind,
         id: meta.threadId,
@@ -76,6 +89,16 @@ function recordFromMeta(raw, company, projectId, expectedKind) {
         created_at: createdAt,
         updated_at: updatedAt,
     };
+    for (const field of RECORD_FIELDS[expectedKind]) {
+        if (Object.hasOwn(fields, field))
+            record[field] = fields[field];
+    }
+    // hq-pro stores KPI and OKR status in the shared threadStatus metadata field.
+    if ((expectedKind === "kpi" || expectedKind === "okr") && !Object.hasOwn(record, "status") && Object.hasOwn(fields, "thread_status")) {
+        record.status = fields.thread_status;
+    }
+    if (expectedKind === "blocker" && !Object.hasOwn(record, "opened_at"))
+        record.opened_at = createdAt;
     return record;
 }
 function identityMatches(record, kind, id, company, projectId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.228.1",
+  "version": "5.228.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {