@indigoai-us/hq-cli 5.254.0 → 5.256.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.256.0] — 2026-09-28
+
+## [5.255.0] — 2026-09-28
+
+### Changed
+
+- Internal: moved watch, monitor-check, and wait handlers to src/commands/lanes-watch.ts; behavior is unchanged.
+
 ## [5.254.0] — 2026-09-28
 
 ### Added
@@ -14,9 +22,13 @@
 ### Fixed
 
 - The end-of-session work report is no longer dropped when the background
+  transcript watcher polls late or adopts a session after a restart. A
+  synthesized `turn_end` now carries the transcript time, capped at now, and
+  is never earlier than the last event sent for the session.
 - `hq db sql --remote` is hidden because remote SQL is not available in this
   CLI build. Existing scripts get a clear error, and local SQL remains
   available without `--remote`.
+- `hq secrets` and `hq run` now use cached secrets during a temporary server outage, up to each secret’s configured cache lifetime. The default is three hours; revoked and high-security secrets still fail closed.
 
 ## [5.253.0] — 2026-09-27
 

package/dist/commands/integrations-import.js

@@ -350,7 +350,9 @@ export function registerImportCommands(integrations) {
         }
         const secretNames = [...Object.values({ ...(manifest.env ?? {}), ...(manifest.headers ?? {}) }), ...(manifest.args ?? [])]
             .flatMap((value) => [...value.matchAll(/\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]*)*)\}/g)].map((match) => match[1]));
-        const secrets = await loadRevealedSecrets(token, companyUid, secretNames);
+        const secrets = await loadRevealedSecrets(token, companyUid, secretNames, undefined, {
+            allowOfflineFallback: false,
+        });
         const result = registerServer({
             name: safeName,
             manifest,

package/dist/commands/lanes-shared.d.ts

@@ -7,6 +7,7 @@ import type { WatcherLoopDeps } from "../lib/lanes/watcher.js";
 import type { RunCompactionFn } from "../lib/lanes/compaction.js";
 import type { LaneMesh, LaneMeshEvent } from "../lib/lanes/mesh-events.js";
 import type { BalanceHostGap, BalanceHostSnapshot } from "../lib/lanes/claude-balance.js";
+import type { HostCapacitySnapshot } from "../lib/lanes/host-capacity.js";
 import { type ResolvedEffort } from "../lib/lanes/effort.js";
 import type { SessionCopyResult } from "../lib/lanes/move-account.js";
 import type { WorkerProfile } from "../lib/lanes/profile.js";
@@ -223,6 +224,32 @@ export interface Ctx {
     laneTrackerEnabled: (company: LaneCompanyRef) => boolean | Promise<boolean>;
     trackerActor: () => string | null;
 }
+export interface LaneWaitCommandOptions {
+    any?: string[];
+    for?: string[];
+    timeout?: string;
+    json?: boolean;
+}
+export interface MonitorCheckOptions {
+    session?: string;
+    engine?: string;
+    json?: boolean;
+    reminder?: boolean;
+}
+export interface LaneWatchOptions {
+    intervalMs?: string;
+    json?: boolean;
+}
+export interface LaneWatchHandlerDeps {
+    laneHostFromCtx(ctx: Ctx): LaneRecord["host"];
+    loadAllLanes(hqRoot: string): LaneRecord[];
+    loadClaudeBalanceHostSnapshots(ctx: Ctx, hqRoot: string, config: LanesConfig): Promise<{
+        snapshots: BalanceHostSnapshot[];
+        unavailableHosts: BalanceHostGap[];
+    }>;
+    printJson(value: unknown): void;
+    readOutpostCapacity(ctx: Ctx, outpostId: string): Promise<HostCapacitySnapshot>;
+}
 export interface PrimaryOwnedOutpostQuestion {
     question: QuestionRecord;
     lane: LaneRecord;

package/dist/commands/lanes-watch.d.ts

@@ -0,0 +1,7 @@
+import type { Ctx, MonitorCheckOptions, LaneWaitCommandOptions, LaneWatchHandlerDeps, LaneWatchOptions } from "./lanes-shared.js";
+export declare function createLaneWatchHandlers(deps: LaneWatchHandlerDeps): {
+    runWatch: (ctx: Ctx, laneIds: string[], opts: LaneWatchOptions) => Promise<number>;
+    runMonitorCheck: (ctx: Ctx, opts: MonitorCheckOptions) => Promise<number>;
+    runWait: (ctx: Ctx, opts: LaneWaitCommandOptions) => Promise<number>;
+};
+//# sourceMappingURL=lanes-watch.d.ts.map

package/dist/commands/lanes-watch.js

@@ -0,0 +1,215 @@
+import { accountStatus, coveredLaneIds, loadLanesConfig, MAX_WATCHED_LANES, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, monitorReminderText, runLaneWatch, } from "../lib/lanes/index.js";
+import { LEAD_LANE_KEEP_ALIVE_FLAG } from "../lib/lanes/keep-alive.js";
+import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
+import { isLanesError, LanesError } from "../lib/lanes/errors.js";
+import { LANE_WAIT_INVALID_INPUT_EXIT_CODE, LANE_WAIT_TIMEOUT_EXIT_CODE, runLaneWait, } from "../lib/lanes/wait.js";
+const MONITOR_ACTIVE_LANE_STATES = new Set([
+    "running",
+    "queued",
+    "awaiting_input",
+    "blocked",
+]);
+function resolveMonitorEngine(requested, env) {
+    const value = requested?.trim().toLowerCase() ||
+        env.HQ_CONDUCT_ENGINE?.trim().toLowerCase() ||
+        "claude";
+    if (!MONITOR_ENGINES.includes(value)) {
+        throw new LanesError("monitor_invalid_engine", `Unknown monitor-check engine ${JSON.stringify(value)}. Accepted: ${MONITOR_ENGINES.join(", ")}`, { accepted: [...MONITOR_ENGINES], value });
+    }
+    return value;
+}
+function monitorCallsForLaneIds(laneIds) {
+    const calls = [];
+    for (let offset = 0; offset < laneIds.length; offset += MAX_WATCHED_LANES) {
+        const chunk = laneIds.slice(offset, offset + MAX_WATCHED_LANES);
+        calls.push({
+            command: `hq lanes watch ${chunk.join(" ")}`,
+            timeout_ms: MONITOR_MAX_TIMEOUT_MS,
+            persistent: true,
+        });
+    }
+    return calls;
+}
+function laneWaitHumanLine(result) {
+    const details = Object.entries(result.change)
+        .filter(([key]) => key !== "type")
+        .map(([key, value]) => `${key}=${String(value)}`)
+        .join(" ");
+    return `lane=${result.lane_id} change=${result.change.type}${details ? ` ${details}` : ""} at=${result.at}`;
+}
+export function createLaneWatchHandlers(deps) {
+    const { laneHostFromCtx, loadAllLanes, loadClaudeBalanceHostSnapshots, printJson, readOutpostCapacity, } = deps;
+    async function runWatch(ctx, laneIds, opts) {
+        const rawInterval = opts.intervalMs === undefined ? undefined : Number(opts.intervalMs);
+        const hqRoot = ctx.hqRoot();
+        await runLaneWatch(hqRoot, laneIds, {
+            intervalMs: rawInterval,
+            sleep: ctx.sleep,
+            keepAliveEnabled: (lane) => readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_FLAG, {
+                company: lane.company,
+                env: ctx.env,
+            }),
+            readAccountStatuses: async (lanes) => {
+                if (lanes.length === 0)
+                    return [];
+                const config = loadLanesConfig(hqRoot);
+                const currentHost = laneHostFromCtx(ctx);
+                const currentHostname = ctx.hostname().trim();
+                const isCurrentHost = (host) => (host.kind === currentHost.kind && host.id === currentHost.id) ||
+                    (host.kind === "local" && host.id === currentHostname);
+                const remoteOutpostIds = [...new Set(lanes
+                        .filter((lane) => lane.host.kind === "outpost" && !isCurrentHost(lane.host))
+                        .map((lane) => lane.host.id))];
+                const remoteOutposts = await Promise.all(remoteOutpostIds.map(async (id) => [id, await readOutpostCapacity(ctx, id)]));
+                const outpostSnapshots = new Map(remoteOutposts);
+                const remoteLocalLanes = lanes.filter((lane) => lane.host.kind === "local" && !isCurrentHost(lane.host));
+                const remoteLocalHosts = remoteLocalLanes.length > 0
+                    ? await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config)
+                    : undefined;
+                const localStatusCache = new Map();
+                return lanes.map((lane) => {
+                    if (config.providers[lane.provider].accounts[lane.account] === undefined) {
+                        throw new LanesError("watch_account_unconfigured", `Lane ${lane.lane_id} records unconfigured ${lane.provider} account ${lane.account}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
+                    }
+                    let loggedIn;
+                    if (isCurrentHost(lane.host)) {
+                        const key = JSON.stringify([lane.provider, lane.account, currentHost.kind, currentHost.id]);
+                        if (!localStatusCache.has(key)) {
+                            localStatusCache.set(key, accountStatus(lane.provider, lane.account, config, {
+                                existsSync: ctx.existsSync,
+                                probe: ctx.probeProvider,
+                                env: ctx.env,
+                                hostname: currentHostname,
+                            }).logged_in);
+                        }
+                        loggedIn = localStatusCache.get(key);
+                    }
+                    else if (lane.host.kind === "outpost") {
+                        loggedIn = outpostSnapshots.get(lane.host.id)?.providers[lane.provider].accounts[lane.account]?.logged_in;
+                    }
+                    else {
+                        const snapshot = remoteLocalHosts?.snapshots.find((candidate) => candidate.capacity.host.kind === lane.host.kind &&
+                            candidate.capacity.host.id === lane.host.id);
+                        if (!snapshot) {
+                            const gap = remoteLocalHosts?.unavailableHosts.find((candidate) => candidate.host.kind === lane.host.kind && candidate.host.id === lane.host.id);
+                            throw new LanesError("watch_account_host_unavailable", `Cannot check ${lane.provider} account ${lane.account} on ${lane.host.kind}:${lane.host.id}${gap ? `: ${gap.reason}` : ""}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
+                        }
+                        loggedIn = snapshot.capacity.providers[lane.provider].accounts[lane.account]?.logged_in;
+                    }
+                    if (loggedIn === undefined) {
+                        throw new LanesError("watch_account_unconfigured", `Lane ${lane.lane_id} records unconfigured ${lane.provider} account ${lane.account} on ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
+                    }
+                    return {
+                        lane_id: lane.lane_id,
+                        provider: lane.provider,
+                        account: lane.account,
+                        host: lane.host,
+                        logged_in: loggedIn,
+                    };
+                });
+            },
+            writeLine: (line) => console.log(opts.json ? JSON.stringify({ event: line }) : line),
+            writeAccountEvent: (event) => console.log(opts.json ? JSON.stringify(event) : `account_logged_out provider=${event.provider} account=${event.account} host=${event.host.kind}:${event.host.id} lane_ids=${event.lane_ids.join(",")}`),
+            writeError: (line) => process.stderr.write(`${line}\n`),
+        });
+        return 0;
+    }
+    async function runMonitorCheck(ctx, opts) {
+        if (opts.reminder) {
+            console.log(monitorReminderText());
+            return 0;
+        }
+        const sessionId = opts.session?.trim();
+        if (!sessionId) {
+            throw new LanesError("monitor_session_required", "hq lanes monitor-check requires --session <id> unless --reminder is used");
+        }
+        const engine = resolveMonitorEngine(opts.engine, ctx.env);
+        const activeLanes = loadAllLanes(ctx.hqRoot()).filter((lane) => lane.senior.kind === "session" &&
+            lane.senior.id === sessionId &&
+            MONITOR_ACTIVE_LANE_STATES.has(lane.state));
+        if (engine !== "claude") {
+            if (opts.json) {
+                printJson({
+                    ok: true,
+                    action: "monitor-check",
+                    session_id: sessionId,
+                    engine,
+                    active_lane_ids: activeLanes.map((lane) => lane.lane_id),
+                    covered_lane_ids: [],
+                    uncovered_lane_ids: [],
+                    skipped: "engine_has_no_claude_monitor",
+                });
+            }
+            return 0;
+        }
+        if (activeLanes.length === 0) {
+            if (opts.json) {
+                printJson({
+                    ok: true,
+                    action: "monitor-check",
+                    session_id: sessionId,
+                    engine,
+                    active_lane_ids: [],
+                    covered_lane_ids: [],
+                    uncovered_lane_ids: [],
+                });
+            }
+            return 0;
+        }
+        const evidence = await ctx.monitorEvidence(sessionId);
+        if (evidence.sessionId !== sessionId) {
+            throw new LanesError("monitor_evidence_session_mismatch", `Monitor evidence was for ${JSON.stringify(evidence.sessionId)}, expected ${JSON.stringify(sessionId)}`);
+        }
+        const covered = coveredLaneIds(evidence, ctx.now());
+        const activeIds = activeLanes.map((lane) => lane.lane_id);
+        const uncovered = activeIds.filter((laneId) => !covered.has(laneId));
+        const monitorCalls = monitorCallsForLaneIds(uncovered);
+        if (opts.json) {
+            printJson({
+                ok: uncovered.length === 0,
+                action: "monitor-check",
+                session_id: sessionId,
+                engine,
+                active_lane_ids: activeIds,
+                covered_lane_ids: activeIds.filter((laneId) => covered.has(laneId)),
+                uncovered_lane_ids: uncovered,
+                monitor_call: monitorCalls.length === 1 ? monitorCalls[0] : null,
+                monitor_calls: monitorCalls,
+            });
+        }
+        else if (uncovered.length > 0) {
+            for (const laneId of uncovered)
+                console.log(`uncovered lane: ${laneId}`);
+            for (const monitorCall of monitorCalls) {
+                console.log(`Monitor(command=${JSON.stringify(monitorCall.command)}, timeout_ms=${monitorCall.timeout_ms}, persistent=true)`);
+            }
+        }
+        return uncovered.length > 0 ? MONITOR_UNCOVERED_EXIT_CODE : 0;
+    }
+    async function runWait(ctx, opts) {
+        const timeoutSeconds = opts.timeout === undefined ? Number.NaN : Number(opts.timeout);
+        try {
+            const result = await runLaneWait(ctx.hqRoot(), opts.any ?? [], opts.for ?? [], timeoutSeconds * 1000, { now: ctx.now, sleep: ctx.sleep });
+            if (result) {
+                console.log(opts.json ? JSON.stringify(result) : laneWaitHumanLine(result));
+                return 0;
+            }
+            console.log(opts.json
+                ? JSON.stringify({ ok: false, error: "wait_timeout" })
+                : "wait_timeout");
+            return LANE_WAIT_TIMEOUT_EXIT_CODE;
+        }
+        catch (err) {
+            if (!isLanesError(err) || err.error !== "wait_invalid_input")
+                throw err;
+            const output = { ok: false, error: err.error, message: err.message };
+            if (opts.json)
+                console.log(JSON.stringify(output));
+            else
+                process.stderr.write(`${err.message}\n`);
+            return LANE_WAIT_INVALID_INPUT_EXIT_CODE;
+        }
+    }
+    return { runWatch, runMonitorCheck, runWait };
+}
+//# sourceMappingURL=lanes-watch.js.map

package/dist/commands/lanes.js

@@ -15,6 +15,7 @@ import { createLaneAccountsHandlers } from "./lanes-accounts.js";
 import { createLaneMessageHandlers } from "./lanes-message.js";
 import { createLaneQuestionsHandlers } from "./lanes-questions.js";
 import { createLaneResumeHandlers } from "./lanes-resume.js";
+import { createLaneWatchHandlers } from "./lanes-watch.js";
 export { resolveAnswerChoice } from "./lanes-questions.js";
 import { registerOutpostPrunerCommand } from "./outpost-pruner.js";
 import { registerLaneChecksCommand } from "./lanes-checks.js";
@@ -45,16 +46,15 @@ import { assertNoSecretText } from "../lib/lanes/text-scan.js";
 import { createLaneMesh, emitLaneDecisionEvents, emitLaneTerminalStateEvent, laneMeshEventIdentity, } from "../lib/lanes/mesh-events.js";
 import { sessionIdFromEnv } from "../lib/mesh/live/session-identity.js";
 import { effectiveAccountHome } from "../lib/lanes/account-home.js";
-import { AccountResolutionError, compareLaneQueueOrder, coveredLaneIds, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, MAX_WATCHED_LANES, monitorReminderText, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, runLaneWatch, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
+import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STATES, QUESTION_STATUSES, SENIOR_KINDS, accountStatus, appendCappedHistory, canonicalizeHome, createLane, decideAdmission, defaultLivenessDeps, defaultSystemdUserDir, defaultThrottleDeps, installReconcileTimer, providerPathEnv, probeDrainHookRegistration, isLanesError, isLaneVersionConflict, isTerminalLaneState, aliveDirectChildren, assignedChildHireGrants, hireGrantCapacityError, planHireGrantBackfill, terminalChildResumeHireGrantError, withHireGrantAdmission, laneStoryLedgerEnabled, validateProjectStories, buildLaneStatusSnapshot, formatLaneStatusHuman, listLaneIds, listQuestionIds, loadLanesConfig, laneRunsHere, MAX_LANE_DEPTH, MONITOR_ERROR_EXIT_CODE, readLiveMonitorEvidence, resolveMachineIdentity as lookupMachineIdentity, loadLivenessIndex, parseLaneProvider, parseLaneRecord, parseLaneState, parseQuestionRecord, parseSeniorKind, readLane, retryUpdateLane, syncLaneRecordFromOwner, readQuestion, resolveAccount, resolveLaneWorker, ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, registryWorkerRecord, runReconcilePass, sessionLiveness, tryReadLane, uninstallReconcileTimer, updateLane, updateQuestion, dropboxDir, laneDeliveryMechanism, hasActiveAdmissionReservation, hasActivePendingResume, hasRecordedSessionId, hasEarlierEligibleQueuedLane, laneAdmissionCapReason, providerSupportsSessionResume, providerSessionPortable, sessionNotPortableMessage, withLaneAdmissionLock, withAllLaneAdmissionLocks, withLaneHireLocks, raiseLaneQuestion, sha256Text, } from "../lib/lanes/index.js";
 import { activeLaneStories, laneStories, laneStory, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
-import { keepAliveExclusion, LEAD_LANE_KEEP_ALIVE_FLAG, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
+import { keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
 import { questionBodyAbsPath, resolveQuestionCompanyWithFallback, resolveProjectQuestionCompany, } from "../lib/lanes/questions.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
 import { parseCliEffort, resolveLaneEffort, } from "../lib/lanes/effort.js";
 import { LanesError } from "../lib/lanes/errors.js";
-import { LANE_WAIT_INVALID_INPUT_EXIT_CODE, LANE_WAIT_TIMEOUT_EXIT_CODE, runLaneWait, } from "../lib/lanes/wait.js";
 import { loadQuotaState, quotaBlockFor } from "../lib/lanes/quota.js";
 import { SESSION_MOVE_REASON } from "../lib/lanes/move-account.js";
 import { managerStatusGateEnabledForLane, resolveManagerStatusGateForLane, } from "../lib/lanes/manager-status-gate.js";
@@ -1196,180 +1196,6 @@ function assertPlacementEnabled(ctx) {
 function loadAllQuestions(hqRoot) {
     return listQuestionIds(hqRoot).map((id) => readQuestion(hqRoot, id));
 }
-const MONITOR_ACTIVE_LANE_STATES = new Set([
-    "running",
-    "queued",
-    "awaiting_input",
-    "blocked",
-]);
-function resolveMonitorEngine(requested, env) {
-    const value = requested?.trim().toLowerCase() ||
-        env.HQ_CONDUCT_ENGINE?.trim().toLowerCase() ||
-        "claude";
-    if (!MONITOR_ENGINES.includes(value)) {
-        throw new LanesError("monitor_invalid_engine", `Unknown monitor-check engine ${JSON.stringify(value)}. Accepted: ${MONITOR_ENGINES.join(", ")}`, { accepted: [...MONITOR_ENGINES], value });
-    }
-    return value;
-}
-async function runWatch(ctx, laneIds, opts) {
-    const rawInterval = opts.intervalMs === undefined ? undefined : Number(opts.intervalMs);
-    const hqRoot = ctx.hqRoot();
-    await runLaneWatch(hqRoot, laneIds, {
-        intervalMs: rawInterval,
-        sleep: ctx.sleep,
-        keepAliveEnabled: (lane) => readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_FLAG, {
-            company: lane.company,
-            env: ctx.env,
-        }),
-        readAccountStatuses: async (lanes) => {
-            if (lanes.length === 0)
-                return [];
-            const config = loadLanesConfig(hqRoot);
-            const currentHost = laneHostFromCtx(ctx);
-            const currentHostname = ctx.hostname().trim();
-            const isCurrentHost = (host) => (host.kind === currentHost.kind && host.id === currentHost.id) ||
-                (host.kind === "local" && host.id === currentHostname);
-            const remoteOutpostIds = [...new Set(lanes
-                    .filter((lane) => lane.host.kind === "outpost" && !isCurrentHost(lane.host))
-                    .map((lane) => lane.host.id))];
-            const remoteOutposts = await Promise.all(remoteOutpostIds.map(async (id) => [id, await readOutpostCapacity(ctx, id)]));
-            const outpostSnapshots = new Map(remoteOutposts);
-            const remoteLocalLanes = lanes.filter((lane) => lane.host.kind === "local" && !isCurrentHost(lane.host));
-            const remoteLocalHosts = remoteLocalLanes.length > 0
-                ? await loadClaudeBalanceHostSnapshots(ctx, hqRoot, config)
-                : undefined;
-            const localStatusCache = new Map();
-            return lanes.map((lane) => {
-                if (config.providers[lane.provider].accounts[lane.account] === undefined) {
-                    throw new LanesError("watch_account_unconfigured", `Lane ${lane.lane_id} records unconfigured ${lane.provider} account ${lane.account}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
-                }
-                let loggedIn;
-                if (isCurrentHost(lane.host)) {
-                    const key = JSON.stringify([lane.provider, lane.account, currentHost.kind, currentHost.id]);
-                    if (!localStatusCache.has(key)) {
-                        localStatusCache.set(key, accountStatus(lane.provider, lane.account, config, {
-                            existsSync: ctx.existsSync,
-                            probe: ctx.probeProvider,
-                            env: ctx.env,
-                            hostname: currentHostname,
-                        }).logged_in);
-                    }
-                    loggedIn = localStatusCache.get(key);
-                }
-                else if (lane.host.kind === "outpost") {
-                    loggedIn = outpostSnapshots.get(lane.host.id)?.providers[lane.provider].accounts[lane.account]?.logged_in;
-                }
-                else {
-                    const snapshot = remoteLocalHosts?.snapshots.find((candidate) => candidate.capacity.host.kind === lane.host.kind &&
-                        candidate.capacity.host.id === lane.host.id);
-                    if (!snapshot) {
-                        const gap = remoteLocalHosts?.unavailableHosts.find((candidate) => candidate.host.kind === lane.host.kind && candidate.host.id === lane.host.id);
-                        throw new LanesError("watch_account_host_unavailable", `Cannot check ${lane.provider} account ${lane.account} on ${lane.host.kind}:${lane.host.id}${gap ? `: ${gap.reason}` : ""}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
-                    }
-                    loggedIn = snapshot.capacity.providers[lane.provider].accounts[lane.account]?.logged_in;
-                }
-                if (loggedIn === undefined) {
-                    throw new LanesError("watch_account_unconfigured", `Lane ${lane.lane_id} records unconfigured ${lane.provider} account ${lane.account} on ${lane.host.kind}:${lane.host.id}`, { lane_id: lane.lane_id, provider: lane.provider, account: lane.account, host: lane.host });
-                }
-                return {
-                    lane_id: lane.lane_id,
-                    provider: lane.provider,
-                    account: lane.account,
-                    host: lane.host,
-                    logged_in: loggedIn,
-                };
-            });
-        },
-        writeLine: (line) => console.log(opts.json ? JSON.stringify({ event: line }) : line),
-        writeAccountEvent: (event) => console.log(opts.json ? JSON.stringify(event) : `account_logged_out provider=${event.provider} account=${event.account} host=${event.host.kind}:${event.host.id} lane_ids=${event.lane_ids.join(",")}`),
-        writeError: (line) => process.stderr.write(`${line}\n`),
-    });
-    return 0;
-}
-function monitorCallsForLaneIds(laneIds) {
-    const calls = [];
-    for (let offset = 0; offset < laneIds.length; offset += MAX_WATCHED_LANES) {
-        const chunk = laneIds.slice(offset, offset + MAX_WATCHED_LANES);
-        calls.push({
-            command: `hq lanes watch ${chunk.join(" ")}`,
-            timeout_ms: MONITOR_MAX_TIMEOUT_MS,
-            persistent: true,
-        });
-    }
-    return calls;
-}
-async function runMonitorCheck(ctx, opts) {
-    if (opts.reminder) {
-        console.log(monitorReminderText());
-        return 0;
-    }
-    const sessionId = opts.session?.trim();
-    if (!sessionId) {
-        throw new LanesError("monitor_session_required", "hq lanes monitor-check requires --session <id> unless --reminder is used");
-    }
-    const engine = resolveMonitorEngine(opts.engine, ctx.env);
-    const activeLanes = loadAllLanes(ctx.hqRoot()).filter((lane) => lane.senior.kind === "session" &&
-        lane.senior.id === sessionId &&
-        MONITOR_ACTIVE_LANE_STATES.has(lane.state));
-    if (engine !== "claude") {
-        if (opts.json) {
-            printJson({
-                ok: true,
-                action: "monitor-check",
-                session_id: sessionId,
-                engine,
-                active_lane_ids: activeLanes.map((lane) => lane.lane_id),
-                covered_lane_ids: [],
-                uncovered_lane_ids: [],
-                skipped: "engine_has_no_claude_monitor",
-            });
-        }
-        return 0;
-    }
-    if (activeLanes.length === 0) {
-        if (opts.json) {
-            printJson({
-                ok: true,
-                action: "monitor-check",
-                session_id: sessionId,
-                engine,
-                active_lane_ids: [],
-                covered_lane_ids: [],
-                uncovered_lane_ids: [],
-            });
-        }
-        return 0;
-    }
-    const evidence = await ctx.monitorEvidence(sessionId);
-    if (evidence.sessionId !== sessionId) {
-        throw new LanesError("monitor_evidence_session_mismatch", `Monitor evidence was for ${JSON.stringify(evidence.sessionId)}, expected ${JSON.stringify(sessionId)}`);
-    }
-    const covered = coveredLaneIds(evidence, ctx.now());
-    const activeIds = activeLanes.map((lane) => lane.lane_id);
-    const uncovered = activeIds.filter((laneId) => !covered.has(laneId));
-    const monitorCalls = monitorCallsForLaneIds(uncovered);
-    if (opts.json) {
-        printJson({
-            ok: uncovered.length === 0,
-            action: "monitor-check",
-            session_id: sessionId,
-            engine,
-            active_lane_ids: activeIds,
-            covered_lane_ids: activeIds.filter((laneId) => covered.has(laneId)),
-            uncovered_lane_ids: uncovered,
-            monitor_call: monitorCalls.length === 1 ? monitorCalls[0] : null,
-            monitor_calls: monitorCalls,
-        });
-    }
-    else if (uncovered.length > 0) {
-        for (const laneId of uncovered)
-            console.log(`uncovered lane: ${laneId}`);
-        for (const monitorCall of monitorCalls) {
-            console.log(`Monitor(command=${JSON.stringify(monitorCall.command)}, timeout_ms=${monitorCall.timeout_ms}, persistent=true)`);
-        }
-    }
-    return uncovered.length > 0 ? MONITOR_UNCOVERED_EXIT_CODE : 0;
-}
 function sessionMetaPath(hqRoot, sessionId) {
     return path.join(hqRoot, "workspace", "sessions", sessionId, "meta.yaml");
 }
@@ -1858,37 +1684,6 @@ function assertKnownOutpost(requested, known) {
  */
 export const ASK_BACKOFF_MS = [5_000, 15_000];
 export const ASK_ATTEMPTS = ASK_BACKOFF_MS.length + 1;
-function laneWaitHumanLine(result) {
-    const details = Object.entries(result.change)
-        .filter(([key]) => key !== "type")
-        .map(([key, value]) => `${key}=${String(value)}`)
-        .join(" ");
-    return `lane=${result.lane_id} change=${result.change.type}${details ? ` ${details}` : ""} at=${result.at}`;
-}
-async function runWait(ctx, opts) {
-    const timeoutSeconds = opts.timeout === undefined ? Number.NaN : Number(opts.timeout);
-    try {
-        const result = await runLaneWait(ctx.hqRoot(), opts.any ?? [], opts.for ?? [], timeoutSeconds * 1000, { now: ctx.now, sleep: ctx.sleep });
-        if (result) {
-            console.log(opts.json ? JSON.stringify(result) : laneWaitHumanLine(result));
-            return 0;
-        }
-        console.log(opts.json
-            ? JSON.stringify({ ok: false, error: "wait_timeout" })
-            : "wait_timeout");
-        return LANE_WAIT_TIMEOUT_EXIT_CODE;
-    }
-    catch (err) {
-        if (!isLanesError(err) || err.error !== "wait_invalid_input")
-            throw err;
-        const output = { ok: false, error: err.error, message: err.message };
-        if (opts.json)
-            console.log(JSON.stringify(output));
-        else
-            process.stderr.write(`${err.message}\n`);
-        return LANE_WAIT_INVALID_INPUT_EXIT_CODE;
-    }
-}
 function withCasRetry(fn, attempts = 5) {
     let last;
     for (let i = 0; i < attempts; i += 1) {
@@ -7050,6 +6845,14 @@ export function registerLanesCommand(parent, deps = {}) {
         validateResumeProfileModel,
         withResumeHireAdmission,
     });
+    const watchHandlerDeps = {
+        laneHostFromCtx,
+        loadAllLanes,
+        loadClaudeBalanceHostSnapshots,
+        printJson,
+        readOutpostCapacity,
+    };
+    const watchHandlers = createLaneWatchHandlers(watchHandlerDeps);
     const lanes = parent
         .command("lanes", { hidden: true })
         .description("Create, supervise, and steer worker lanes; routed decision queue");
@@ -7253,13 +7056,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--for <change-type>", "envelope | question | state", collectRepeatable, [])
         .option("--timeout <seconds>", "Positive timeout in seconds")
         .option("--json", "JSON output")
-        .action(wrapText(async (opts) => runWait(ctx, opts)));
+        .action(wrapText(async (opts) => watchHandlers.runWait(ctx, opts)));
     lanes
         .command("watch")
         .description("Watch lane state and question changes until all lanes are terminal")
         .argument("<lane-id...>", "Lane ids to watch")
         .option("--interval-ms <ms>", "Polling interval, bounded to 100ms–30s", "5000")
-        .action(wrapText(async (laneIds, opts) => runWatch(ctx, laneIds, opts)));
+        .action(wrapText(async (laneIds, opts) => watchHandlers.runWatch(ctx, laneIds, opts)));
     lanes
         .command("monitor-check")
         .description("Check that active Claude senior lanes have live Monitor watch tasks")
@@ -7267,7 +7070,7 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--engine <engine>", "claude | codex | grok; defaults to HQ_CONDUCT_ENGINE or claude")
         .option("--reminder", "Print the senior Monitor reminder text")
         .option("--json", "JSON on stdout")
-        .action(wrapText(async (opts) => runMonitorCheck(ctx, opts)));
+        .action(wrapText(async (opts) => watchHandlers.runMonitorCheck(ctx, opts)));
     lanes
         .command("show")
         .description("Show one lane")

package/dist/commands/pack-install.js

@@ -1421,7 +1421,9 @@ export async function makeInstallSecretResolver(secretNames, company) {
                 return () => null;
             [scopeUid] = scopes;
         }
-        const authorized = await loadRevealedSecrets(token, scopeUid, names);
+        const authorized = await loadRevealedSecrets(token, scopeUid, names, undefined, {
+            allowOfflineFallback: false,
+        });
         return (name) => authorized.get(name) ?? null;
     }
     catch {

package/dist/commands/run.js

@@ -2,9 +2,10 @@ import { spawn } from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { internal } from 'varlock';
-import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { cognitoCachePrincipalUid, ensureCognitoToken } from '../utils/cognito-session.js';
 import { apiKeyCapabilityGateMessage, peekHqApiKey, } from '../utils/resolve-vault-credential.js';
 import { computeSha256 } from '../utils/integrity.js';
+import { isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from '../utils/secret-load-availability.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
@@ -82,7 +83,9 @@ export function registerRunCommand(program) {
                 throw new Error('company slug not set. Add # @hqCompany("slug") to your .env.schema or pass --company <slug>.');
             }
             const token = await ensureCognitoToken();
-            const uid = await getCompanyUid(token, slug);
+            const uid = await getCompanyUid(token, slug, undefined, {
+                allowOfflineScopeFallback: true,
+            });
             const usage = await buildRunUsage(opts.script, opts.scriptId);
             const fetchBatch = async (companyUid, names, requestUsage) => {
                 const res = await vaultApiFetch({
@@ -99,6 +102,9 @@ export function registerRunCommand(program) {
                         : typeof body.error === 'string'
                             ? body.error
                             : res.statusText;
+                    if (isUnavailableSecretLoadHttpStatus(res.status)) {
+                        throw new SecretLoadUnavailableError(`Failed to batch-load secrets: ${message}`);
+                    }
                     if (res.status >= 400 &&
                         res.status < 500 &&
                         typeof body.code === 'string') {
@@ -110,6 +116,8 @@ export function registerRunCommand(program) {
             };
             const pluginOpts = {
                 companyOverride: opts.company,
+                principalUid: cognitoCachePrincipalUid(token) ?? undefined,
+                allowOfflineFallback: true,
                 resolveCompanyUid: async () => uid,
                 usage,
                 fetchBatch,