@indigoai-us/hq-cli 5.256.0 → 5.258.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [5.258.0] — 2026-09-28
+
+### Fixed
+
+- Envelope repair runs through the currently installed CLI so a long-lived
+  watcher cannot use stale worker-profile validation.
+- Updated the external-agent CLI guide to match the kit services, probe checks,
+  shipped skills, and MCP tools.
+- Fixed the Docker agent-kit launcher to supervise configured services through
+  `hq agent kit run all`.
+- `hq packages list` and `hq packs list` return an error when run outside an HQ tree.
+- `hq index collections` prints a summary when no collections are expected or registered.
+
+## [5.257.0] — 2026-09-28
+
+### Added
+
+- Add `hq lanes hold` to record company-scoped repository merge holds and
+  refuse recognized merge commands while the `lanes.repo-merge-hold` gate is
+  enabled. Hold history and release reasons stay in the local record. Checks
+  fail open with a named error when they cannot parse a command or read a hold,
+  and recognize pull-request URLs plus assignment, `env`, and `timeout` forms.
+
 ## [5.256.0] — 2026-09-28
 
 ## [5.255.0] — 2026-09-28

package/dist/command-catalog.generated.d.ts

@@ -7375,6 +7375,102 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Emit JSON instead of the team page text";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "hold";
+        readonly description: "Set and enforce repository merge holds";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "set";
+            readonly description: "Set or replace a repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company that owns this repository hold";
+            }, {
+                readonly flags: "--reason <text>";
+                readonly description: "Why merges are held";
+            }, {
+                readonly flags: "--until <time>";
+                readonly description: "Expiry as an ISO timestamp or duration such as 4h";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "list";
+            readonly description: "List active and expired repository merge holds";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "show";
+            readonly description: "Show a repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "release";
+            readonly description: "Release an existing repository merge hold";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <repo>";
+            readonly arguments: readonly [{
+                readonly name: "repo";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--reason <text>";
+                readonly description: "Why the hold is being released";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "check";
+            readonly description: "Refuse merge commands targeting an actively held repository";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--command <shell-command>";
+                readonly description: "Command to inspect without executing it";
+            }, {
+                readonly flags: "--json";
+                readonly description: "Print JSON";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "outpost-pruner";
         readonly description: "Inspect, install, and run safe outpost worktree pruning";
@@ -8084,6 +8180,18 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "_spawn-envelope-repair";
+        readonly description: "";
+        readonly aliases: readonly [];
+        readonly hidden: true;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "JSON on stdout (always)";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "_monitor-message";
         readonly description: "";

package/dist/command-catalog.generated.js

@@ -9534,6 +9534,130 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "hold",
+                "description": "Set and enforce repository merge holds",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "set",
+                        "description": "Set or replace a repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company that owns this repository hold"
+                            },
+                            {
+                                "flags": "--reason <text>",
+                                "description": "Why merges are held"
+                            },
+                            {
+                                "flags": "--until <time>",
+                                "description": "Expiry as an ISO timestamp or duration such as 4h"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "list",
+                        "description": "List active and expired repository merge holds",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "show",
+                        "description": "Show a repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "release",
+                        "description": "Release an existing repository merge hold",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <repo>",
+                        "arguments": [
+                            {
+                                "name": "repo",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--reason <text>",
+                                "description": "Why the hold is being released"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "check",
+                        "description": "Refuse merge commands targeting an actively held repository",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--command <shell-command>",
+                                "description": "Command to inspect without executing it"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "outpost-pruner",
                 "description": "Inspect, install, and run safe outpost worktree pruning",
@@ -10457,6 +10581,21 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "_spawn-envelope-repair",
+                "description": "",
+                "aliases": [],
+                "hidden": true,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "JSON on stdout (always)"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "_monitor-message",
                 "description": "",

package/dist/commands/agent-kit.d.ts

@@ -4,13 +4,15 @@
  *
  *   sync       company vault pull loop            → component-sync
  *   inbox      inbox poller (mirror + optional ack) → component-inbox
- *   heartbeat  60 s POST /v1/agents/{uid}/heartbeat with the three above
+ *   heartbeat  60 s POST /v1/agents/{uid}/heartbeat with enabled component status
  *
- * `install` renders one user-level unit per service (LaunchAgent on macOS,
- * systemd --user on Linux), each of which just runs
- * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Hosts where the service manager is unusable (no systemd user
- * session bus, permission refused, launchd unavailable) fall back to one
+ * `install` renders one user-level unit per enabled service (LaunchAgent on
+ * macOS, systemd --user on Linux), each of which just runs
+ * `node hq agent kit run <service>`. The Docker entrypoint runs
+ * `hq agent kit run all`, which supervises the services enabled in kit.json,
+ * including sync only when file mirroring is configured. Hosts where the
+ * service manager is unusable, such as a missing systemd user session bus or
+ * unavailable launchd, fall back to one
  * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
  * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.

package/dist/commands/agent-kit.js

@@ -4,13 +4,15 @@
  *
  *   sync       company vault pull loop            → component-sync
  *   inbox      inbox poller (mirror + optional ack) → component-inbox
- *   heartbeat  60 s POST /v1/agents/{uid}/heartbeat with the three above
+ *   heartbeat  60 s POST /v1/agents/{uid}/heartbeat with enabled component status
  *
- * `install` renders one user-level unit per service (LaunchAgent on macOS,
- * systemd --user on Linux), each of which just runs
- * `node hq agent kit run <service>`; the Docker image runs the same four
- * commands. Hosts where the service manager is unusable (no systemd user
- * session bus, permission refused, launchd unavailable) fall back to one
+ * `install` renders one user-level unit per enabled service (LaunchAgent on
+ * macOS, systemd --user on Linux), each of which just runs
+ * `node hq agent kit run <service>`. The Docker entrypoint runs
+ * `hq agent kit run all`, which supervises the services enabled in kit.json,
+ * including sync only when file mirroring is configured. Hosts where the
+ * service manager is unusable, such as a missing systemd user session bus or
+ * unavailable launchd, fall back to one
  * detached `hq agent kit run all` supervisor (pid in ~/.hq-agent/kit.pid,
  * output in ~/.hq-agent/logs/kit.log). Logs: ~/.hq-agent/logs/<service>.log. Skills:
  * ~/.hq-agent/skills/<name>/SKILL.md.

package/dist/commands/index-cmd.js

@@ -131,7 +131,11 @@ export function registerIndexCommand(program, dependencies = defaults) {
         .action((options) => {
         const hqRoot = resolveRoot(options.hqRoot);
         const registered = dependencies.listRegisteredCollections(hqRoot);
-        for (const line of collectionStatusLines(dependencies.deriveCollections(hqRoot), registered))
+        const expected = dependencies.deriveCollections(hqRoot);
+        const lines = collectionStatusLines(expected, registered);
+        if (lines.length === 0)
+            console.log(collectionSummary(expected, registered));
+        for (const line of lines)
             console.log(line);
     });
     index

package/dist/commands/lanes-hold.d.ts

@@ -0,0 +1,41 @@
+import type { Command } from "commander";
+import type { LaneCompanyRef } from "../lib/lanes/types.js";
+export declare const LANES_REPO_MERGE_HOLD_FLAG = "lanes.repo-merge-hold";
+export declare const REPO_MERGE_HOLDS_REL: string;
+declare const HOLD_SCHEMA_VERSION = "hq-lanes-repo-merge-hold.v1";
+interface HoldHistoryEntry {
+    set_at: string;
+    until: string;
+    reason: string;
+    set_by_lane: string | null;
+    set_by_session: string | null;
+    released_at?: string;
+    released_reason?: string;
+}
+export interface RepoMergeHold {
+    schema_version: typeof HOLD_SCHEMA_VERSION;
+    repo: string;
+    company: LaneCompanyRef;
+    reason: string;
+    set_at: string;
+    until: string;
+    set_by_lane: string | null;
+    set_by_session: string | null;
+    released_at?: string;
+    released_reason?: string;
+    history: HoldHistoryEntry[];
+}
+export interface LaneRepoMergeHoldDeps {
+    hqRoot: () => string;
+    resolveCompany: (company?: string) => Promise<LaneCompanyRef>;
+    now: () => Date;
+    env: NodeJS.ProcessEnv;
+    mergeHoldEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
+}
+type WrapHandler = <Args extends unknown[]>(action: (...args: Args) => Promise<void>) => (...args: Args) => Promise<void>;
+export declare function repoMergeHoldPath(hqRoot: string, repo: string): string;
+/** Serialize the read-modify-write cycle so concurrent set/release calls cannot overwrite each other. */
+export declare function withRepoMergeHoldRecordLock<T>(recordPath: string, action: () => T | Promise<T>): Promise<T>;
+export declare function registerLaneRepoMergeHoldCommand(lanes: Command, deps: LaneRepoMergeHoldDeps, wrap: WrapHandler): void;
+export {};
+//# sourceMappingURL=lanes-hold.d.ts.map