@indigoai-us/hq-cli 5.270.0 → 5.272.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## [Unreleased]
 
+## [5.272.0] — 2026-09-28
+
+### Added
+
+- Add `hq core ontology merge-copies`, gated by
+  `checkpoint.ontology.merge-copies`. It merges each `<name> N.md` entity copy
+  into its own original (aliases, back-references, relationship links and
+  signal count), repoints links to the copy, and with `--delete` removes merged
+  copies from the vault. Dry run by default.
+
+## [5.271.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes create --outpost` reads `lanes.outpost-load-balancing` for the
+  resolved company, so enabled personal worker profiles can run on an Outpost.
+- Resolve host-suffixed lanes created on a registered Outpost for grant,
+  message, and resume commands while keeping senior authorization on the primary.
+- `hq lanes move-target` keeps the company placement gate, and unfiltered
+  `hq lanes list` resolves the active company for host capacity.
+
 ## [5.270.0] — 2026-09-28
 
 ### Fixed

package/dist/command-catalog.generated.d.ts

@@ -5148,6 +5148,33 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "HQ installation to operate on";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "merge-copies";
+            readonly description: "Merge '<name> N.md' entity copies into their original, then delete them from the vault (dry run by default)";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "company to change";
+            }, {
+                readonly flags: "--apply";
+                readonly description: "merge each copy into its original and re-point links (writes entity files)";
+            }, {
+                readonly flags: "--delete";
+                readonly description: "delete fully merged copies from the vault by exact key (after sync pushed the merge)";
+            }, {
+                readonly flags: "--limit <n>";
+                readonly description: "handle at most this many copies";
+            }, {
+                readonly flags: "--json";
+                readonly description: "print JSON";
+            }, {
+                readonly flags: "--hq-root <path>";
+                readonly description: "HQ installation to operate on";
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "apply";
             readonly description: "Validate the run's entity candidates and write them to the payload company";
@@ -7800,6 +7827,9 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [{
             readonly flags: "--hire <n>";
             readonly description: "Non-negative safe integer hire grant";
+        }, {
+            readonly flags: "--outpost <id>";
+            readonly description: "Confirm the registered Outpost hosting a native lane";
         }, {
             readonly flags: "--json";
             readonly description: "JSON on stdout (always)";

package/dist/command-catalog.generated.js

@@ -6657,6 +6657,41 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "merge-copies",
+                        "description": "Merge '<name> N.md' entity copies into their original, then delete them from the vault (dry run by default)",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "company to change"
+                            },
+                            {
+                                "flags": "--apply",
+                                "description": "merge each copy into its original and re-point links (writes entity files)"
+                            },
+                            {
+                                "flags": "--delete",
+                                "description": "delete fully merged copies from the vault by exact key (after sync pushed the merge)"
+                            },
+                            {
+                                "flags": "--limit <n>",
+                                "description": "handle at most this many copies"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "print JSON"
+                            },
+                            {
+                                "flags": "--hq-root <path>",
+                                "description": "HQ installation to operate on"
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "apply",
                         "description": "Validate the run's entity candidates and write them to the payload company",
@@ -10086,6 +10121,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--hire <n>",
                         "description": "Non-negative safe integer hire grant"
                     },
+                    {
+                        "flags": "--outpost <id>",
+                        "description": "Confirm the registered Outpost hosting a native lane"
+                    },
                     {
                         "flags": "--json",
                         "description": "JSON on stdout (always)"

package/dist/commands/core-ontology.d.ts

@@ -9,12 +9,15 @@
  */
 import { Command } from "commander";
 import { type FlagReader } from "../lib/checkpoint-ontology/plan.js";
+import { type DeleteVaultKey } from "../lib/checkpoint-ontology/merge-copies.js";
 export declare const ONTOLOGY_PAYLOAD_FILE = "payload.json";
 /** The hq-flags read, scoped to the payload company. */
 export declare const registryFlagReader: FlagReader;
 export interface OntologyCommandDeps {
     readFlag?: FlagReader;
     now?: () => Date;
+    /** Builds the exact-key vault delete for a company uid. */
+    vaultDeleter?: (companyUid: string) => Promise<DeleteVaultKey>;
 }
 export declare function runOntologyPlan(hqRoot: string, runDirOption: string | undefined, deps?: OntologyCommandDeps): Promise<string>;
 export declare function runOntologyApply(hqRoot: string, runDirOption: string | undefined, deps?: OntologyCommandDeps): string;
@@ -24,5 +27,18 @@ export declare function runOntologyApply(hqRoot: string, runDirOption: string |
  * `checkpoint.ontology.multi-writer`.
  */
 export declare function runOntologyDuplicates(hqRoot: string, slug: string | undefined, json: boolean, deps?: OntologyCommandDeps): Promise<string>;
+export interface MergeCopiesCommandOptions {
+    apply?: boolean;
+    delete?: boolean;
+    limit?: number;
+    json?: boolean;
+}
+/**
+ * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
+ * original (`--apply`), then delete merged copies from the vault
+ * (`--delete`). Without either it only reports. Gated by
+ * `checkpoint.ontology.merge-copies` and `checkpoint.ontology.multi-writer`.
+ */
+export declare function runOntologyMergeCopies(hqRoot: string, slug: string | undefined, options: MergeCopiesCommandOptions, deps?: OntologyCommandDeps): Promise<string>;
 export declare function registerCoreOntologyCommand(core: Command): void;
 //# sourceMappingURL=core-ontology.d.ts.map

package/dist/commands/core-ontology.js

@@ -16,6 +16,9 @@ import { applyOntologyRun, ApplyError } from "../lib/checkpoint-ontology/apply.j
 import { resolveOntologyCompany, WriteBoundsError } from "../lib/checkpoint-ontology/company.js";
 import { findDuplicateGroups, summarizeMergeBack, } from "../lib/checkpoint-ontology/multi-writer.js";
 import { buildEntityIndex } from "../lib/checkpoint-ontology/tree.js";
+import { MERGE_COPIES_FLAG, mergeCopies, } from "../lib/checkpoint-ontology/merge-copies.js";
+import { callDeleteEndpoint } from "./files.js";
+import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 export const ONTOLOGY_PAYLOAD_FILE = "payload.json";
 class OntologyUsageError extends Error {
 }
@@ -124,6 +127,72 @@ export async function runOntologyDuplicates(hqRoot, slug, json, deps = {}) {
     }
     return lines.join("\n");
 }
+/** Delete one exact company vault key, refusing when the server would match anything else. */
+async function companyVaultDeleter(companyUid) {
+    const token = (await resolveVaultCredential()).token;
+    return async (key) => {
+        const preview = await callDeleteEndpoint({ token, companyUid, prefix: key, dryRun: true });
+        if (preview.matched === 0)
+            return 0;
+        if (preview.matched !== 1 || preview.keys.length !== 1 || preview.keys[0] !== key) {
+            throw new Error(`vault preview matched ${preview.matched} object(s), not exactly ${key}`);
+        }
+        return (await callDeleteEndpoint({ token, companyUid, prefix: key, dryRun: false })).deleted;
+    };
+}
+function mergeCopiesSummary(report) {
+    const held = report.plans.filter((plan) => plan.held).length;
+    const lines = [
+        `ontology merge-copies (${report.mode.replace("_", " ")}) in ${report.company}: ${report.plans.length} of ${report.copies_found} copies, ${held} held, ${report.skipped.length} skipped`,
+        `  merged ${report.merged.length}, relinked ${report.relinked.length}, deleted ${report.deleted.length}, not ready ${report.not_ready.length}, errors ${report.errors.length}`,
+        `  duplicate groups ${report.duplicate_groups_before} -> ${report.duplicate_groups_after}; broken entity links ${report.broken_links_before} -> ${report.broken_links_after}`,
+    ];
+    for (const plan of report.plans.filter((entry) => entry.held))
+        lines.push(`  held ${plan.copy}: ${plan.held}`);
+    for (const error of report.errors)
+        lines.push(`  error ${error.path}: ${error.error}`);
+    return lines.join("\n");
+}
+/**
+ * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
+ * original (`--apply`), then delete merged copies from the vault
+ * (`--delete`). Without either it only reports. Gated by
+ * `checkpoint.ontology.merge-copies` and `checkpoint.ontology.multi-writer`.
+ */
+export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
+    if (options.apply && options.delete) {
+        throw new OntologyUsageError("ontology: run --apply first, let sync push the merged files, then run --delete");
+    }
+    if (options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1)) {
+        throw new OntologyUsageError("ontology: --limit must be a positive whole number");
+    }
+    const resolution = resolveOntologyCompany(hqRoot, slug);
+    if (!resolution.ok)
+        throw new OntologyUsageError(`ontology: company rejected: ${resolution.reason}`);
+    const company = resolution.company;
+    const readFlag = deps.readFlag ?? registryFlagReader;
+    for (const flag of [MERGE_COPIES_FLAG, MULTI_WRITER_FLAG]) {
+        if (!(await readFlag(flag, company))) {
+            return options.json ? JSON.stringify({ company: company.slug, skipped: `${flag} off` }) : `ontology merge-copies: skipped (${flag} is off)`;
+        }
+    }
+    const mode = options.apply ? "merge" : options.delete ? "delete" : "dry_run";
+    let deleteVaultKey;
+    if (mode === "delete") {
+        if (!company.cloudUid)
+            throw new OntologyUsageError("ontology: the company has no cloud_uid in the manifest");
+        deleteVaultKey = await (deps.vaultDeleter ?? companyVaultDeleter)(company.cloudUid);
+    }
+    const report = await mergeCopies({
+        hqRoot,
+        company,
+        mode,
+        now: deps.now?.() ?? new Date(),
+        ...(options.limit !== undefined ? { limit: options.limit } : {}),
+        ...(deleteVaultKey ? { deleteVaultKey } : {}),
+    });
+    return options.json ? JSON.stringify(report, null, 2) : mergeCopiesSummary(report);
+}
 function fail(error) {
     if (error instanceof OntologyUsageError || error instanceof ApplyError || error instanceof WriteBoundsError) {
         process.stderr.write(`${error.message}\n`);
@@ -163,6 +232,23 @@ export function registerCoreOntologyCommand(core) {
             fail(error);
         }
     });
+    ontology
+        .command("merge-copies")
+        .description("Merge '<name> N.md' entity copies into their original, then delete them from the vault (dry run by default)")
+        .requiredOption("--company <slug>", "company to change")
+        .option("--apply", "merge each copy into its original and re-point links (writes entity files)")
+        .option("--delete", "delete fully merged copies from the vault by exact key (after sync pushed the merge)")
+        .option("--limit <n>", "handle at most this many copies", (value) => Number(value))
+        .option("--json", "print JSON")
+        .option("--hq-root <path>", "HQ installation to operate on")
+        .action(async (options) => {
+        try {
+            process.stdout.write(`${await runOntologyMergeCopies(rootFor(options), options.company, options)}\n`);
+        }
+        catch (error) {
+            fail(error);
+        }
+    });
     ontology
         .command("apply")
         .description("Validate the run's entity candidates and write them to the payload company")

package/dist/commands/files.d.ts

@@ -62,6 +62,22 @@ export declare class FilesDeleteHttpError extends Error {
 export declare function formatFilesDeleteError(err: FilesDeleteHttpError, prefix: string): string;
 /** Injectable yes/no confirmation seam (stubbed in tests). */
 export type ConfirmFn = (message: string) => Promise<boolean>;
+/**
+ * POST /v1/files/delete. Throws FilesDeleteHttpError on any non-2xx so the one
+ * caller renders a single consistent error path.
+ *
+ * Scope is EITHER a company vault (`companyUid` set) OR the caller's personal
+ * vault (`personal: true`). For the personal case the server resolves the target
+ * person + bucket from the authenticated caller — we send NO uid, just the
+ * `personal` flag — so there is nothing for the client to get wrong or spoof.
+ */
+export declare function callDeleteEndpoint(params: {
+    token: string;
+    companyUid?: string;
+    personal?: boolean;
+    prefix: string;
+    dryRun: boolean;
+}): Promise<FilesDeleteResponse>;
 interface RunFilesDeleteParams {
     prefix: string;
     dryRun: boolean;

package/dist/commands/files.js

@@ -879,7 +879,7 @@ function realConfirm(message) {
  * person + bucket from the authenticated caller — we send NO uid, just the
  * `personal` flag — so there is nothing for the client to get wrong or spoof.
  */
-async function callDeleteEndpoint(params) {
+export async function callDeleteEndpoint(params) {
     const res = await vaultApiFetch({
         token: params.token,
         path: "/v1/files/delete",

package/dist/commands/lanes-message.js

@@ -65,9 +65,12 @@ export function createLaneMessageHandlers(deps) {
         if (!text) {
             throw new LanesError("missing_text", "--text is required", {});
         }
-        let lane = readLane(hqRoot, laneId);
-        if (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane)) {
-            await dispatchOutpostLaneCommand(ctx, lane, "message", opts);
+        const resolution = await deps.resolveCommandLane(ctx, laneId);
+        let lane = resolution.lane;
+        if (resolution.remoteOnly || (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane))) {
+            await dispatchOutpostLaneCommand(ctx, lane, "message", opts, resolution.remoteOnly
+                ? { syncPrimary: false, expectedOwnerHost: resolution.ownerHost }
+                : undefined);
             return;
         }
         assertLaneRunsHereForOperatorMutation(ctx, lane, "message");

package/dist/commands/lanes-resume.js

@@ -86,7 +86,8 @@ export function createLaneResumeHandlers(deps) {
      */
     async function runResume(ctx, laneId, opts) {
         const hqRoot = ctx.hqRoot();
-        let lane = readLane(hqRoot, laneId);
+        const resolution = await deps.resolveCommandLane(ctx, laneId);
+        let lane = resolution.lane;
         const failedResumeReason = opts.reason?.trim();
         if (opts.reason !== undefined && opts.fromFailed !== true) {
             throw new LanesError("failed_resume_reason_requires_flag", "--reason on hq lanes resume requires --from-failed", { lane_id: laneId });
@@ -122,9 +123,11 @@ export function createLaneResumeHandlers(deps) {
         if (opts.profileRepinContext !== undefined && !ctx.isSsmOwnerDispatch()) {
             throw new LanesError("worker_profile_hash_mismatch", "Profile re-pin context is only valid on an Outpost owner dispatch", { lane_id: laneId });
         }
-        if (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane)) {
+        if (resolution.remoteOnly || (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane))) {
             await withResumeHireAdmission(ctx, lane, () => undefined);
-            await dispatchOutpostLaneCommand(ctx, lane, "resume", opts);
+            await dispatchOutpostLaneCommand(ctx, lane, "resume", opts, resolution.remoteOnly
+                ? { syncPrimary: false, expectedOwnerHost: resolution.ownerHost }
+                : undefined);
             return;
         }
         // Fail before provider/session work if a terminal child would consume a

package/dist/commands/lanes-shared.d.ts

@@ -115,6 +115,21 @@ export declare function resolveResumeEffort(ctx: Ctx, lane: LaneRecord, input: {
     model?: string;
 }): ResolvedEffort | undefined;
 export declare function recordedResumeEffort(lane: LaneRecord): ResolvedEffort;
+export type CommandLaneResolution = {
+    lane: LaneRecord;
+    remoteOnly: false;
+} | {
+    lane: LaneRecord;
+    remoteOnly: true;
+    outpostId: string;
+    ownerHost: LaneRecord["host"];
+};
+export interface OutpostLaneDispatchBehavior {
+    /** Keep remote-only lanes out of the primary lane store. */
+    syncPrimary?: boolean;
+    /** Host identity returned by the remote record lookup for a remote-only lane. */
+    expectedOwnerHost?: LaneRecord["host"];
+}
 export interface LaneMessageHandlerDeps {
     archiveResumeMessage(hqRoot: string, laneId: string, message: {
         message_id: string;
@@ -128,7 +143,7 @@ export interface LaneMessageHandlerDeps {
         alreadyQueued?: boolean;
     }): Promise<AdmissionResult>;
     casUpdateLane(hqRoot: string, laneId: string, updater: (current: LaneRecord) => LaneRecord): LaneRecord;
-    dispatchOutpostLaneCommand(ctx: Ctx, lane: LaneRecord, action: "message" | "resume", options: LaneMessageOptions | LaneResumeOptions): Promise<void>;
+    dispatchOutpostLaneCommand(ctx: Ctx, lane: LaneRecord, action: "message" | "resume", options: LaneMessageOptions | LaneResumeOptions, behavior?: OutpostLaneDispatchBehavior): Promise<void>;
     drainHookStatusFor(ctx: Ctx, lane: LaneRecord): {
         registered: boolean;
         kind: string;
@@ -142,6 +157,7 @@ export interface LaneMessageHandlerDeps {
     persistClaudeAccountSelection(hqRoot: string, lane: LaneRecord, selection: LaneAccountSelection): LaneRecord;
     printJson(value: unknown): void;
     recordResumeSetup(ctx: Ctx, lane: LaneRecord, input: RecordResumeSetupInput): LaneRecord;
+    resolveCommandLane(ctx: Ctx, laneId: string): Promise<CommandLaneResolution>;
     resolveActiveQuestionCompany(ctx: Ctx, message?: string): Promise<LaneCompanyRef>;
     resolveResumeProfile(ctx: Ctx, lane: LaneRecord, workerId: string): ResolvedResumeProfile;
     selectAutomaticClaudeResumeAccount(ctx: Ctx, lane: LaneRecord, workerProfile?: ResolvedResumeProfile, options?: {
@@ -154,8 +170,8 @@ export interface LaneMessageHandlerDeps {
     validateResumeProfileModel(ctx: Ctx, lane: LaneRecord, profile: WorkerProfile): void;
     withResumeHireAdmission<T>(ctx: Ctx, lane: LaneRecord, fn: () => T, grantContext?: OutpostHireGrantContext): Promise<T>;
 }
-export interface LaneResumeHandlerDeps extends Pick<LaneMessageHandlerDeps, "archiveResumeMessage" | "assertLaneRunsHereForAdmission" | "assertLaneRunsHereForOperatorMutation" | "assessLaneAdmission" | "casUpdateLane" | "laneIsHostedHere" | "laneWithRecoveredProviderSession" | "mintMessageId" | "prepareAccountMove" | "persistClaudeAccountSelection" | "printJson" | "recordResumeSetup" | "resolveResumeProfile" | "selectAutomaticClaudeResumeAccount" | "validateResumeProfileModel" | "withResumeHireAdmission"> {
-    dispatchOutpostLaneCommand(ctx: Ctx, lane: LaneRecord, action: "resume", options: LaneResumeOptions): Promise<void>;
+export interface LaneResumeHandlerDeps extends Pick<LaneMessageHandlerDeps, "archiveResumeMessage" | "assertLaneRunsHereForAdmission" | "assertLaneRunsHereForOperatorMutation" | "assessLaneAdmission" | "casUpdateLane" | "laneIsHostedHere" | "laneWithRecoveredProviderSession" | "mintMessageId" | "prepareAccountMove" | "persistClaudeAccountSelection" | "printJson" | "recordResumeSetup" | "resolveCommandLane" | "resolveResumeProfile" | "selectAutomaticClaudeResumeAccount" | "validateResumeProfileModel" | "withResumeHireAdmission"> {
+    dispatchOutpostLaneCommand(ctx: Ctx, lane: LaneRecord, action: "resume", options: LaneResumeOptions, behavior?: OutpostLaneDispatchBehavior): Promise<void>;
     authorizeFailedResume(ctx: Ctx, lane: LaneRecord, encodedContext?: string): string;
     authorizeResumeProfileRepin(ctx: Ctx, lane: LaneRecord, profile: ResolvedResumeProfile | undefined, encodedContext: string | undefined): ResumeProfileRepinAuthorization | undefined;
     automaticBalanceMoveHistoryReason(ctx: Ctx, lane: LaneRecord): AccountHistoryEntry["reason"];
@@ -217,7 +233,7 @@ export interface Ctx {
     }) => Promise<OutpostDispatchResult>;
     backfillOutpostIdentity: (expectedId: string) => "created" | "unchanged";
     fetchText: (url: string) => Promise<string>;
-    lanePlacementEnabled: () => boolean;
+    lanePlacementEnabled: (company: LaneCompanyRef | undefined) => Promise<boolean>;
     storyLedgerEnabled: () => boolean;
     isSsmOwnerDispatch: () => boolean;
     withGrantHireLocks: typeof withLaneHireLocks;

package/dist/commands/lanes.d.ts

@@ -83,7 +83,7 @@ export interface LanesCommandDeps {
     locateTranscript?: (home: string, sessionId: string) => string | null;
     monitorEvidence?: MonitorEvidenceReader;
     /** Test seam for the default-off outpost placement rollout flag. */
-    lanePlacementEnabled?: () => boolean;
+    lanePlacementEnabled?: (company: LaneCompanyRef | undefined) => Promise<boolean>;
     /** Test seam for the default-off story ledger flag. */
     storyLedgerEnabled?: () => boolean;
     /** Test seam for the SSM-only Outpost owner grant path. */