@indigoai-us/hq-cli 5.274.0 → 5.275.0

package/CHANGELOG.md

@@ -2,6 +2,58 @@
 
 ## [Unreleased]
 
+## [5.275.0] — 2026-09-28
+
+### Fixed
+
+- `hq lanes` accepts full Claude model ids such as `claude-sonnet-5-5` and
+  `claude-opus-5-5` (spawn, `resume --from-failed`, account moves) when
+  `claude --help` names only the aliases. Before, the model check refused them
+  with `model_unsupported`.
+
+### Added
+
+- Outpost daemons can take over running services after a CLI update instead
+  of restarting all of them, behind the `daemon.supervisor-handoff` flag (off
+  by default). On Linux, the updated daemon adopts the services the previous
+  one left running and replaces only the ones whose command changed, one at a
+  time. Bots finish their running turns first. hq-cloud services keep running,
+  and the remote-control hosts restart their session once it is quiet. This
+  needs the systemd unit from this release: run `sudo hq daemon install` again
+  on each outpost.
+- Company owners can turn the checkpoint Stop gate off or on for their company:
+  `hq company settings set --checkpoint-gate-enabled false|true`. Any member can
+  read the value with `hq company settings get`. The Stop gate reads a local
+  cache (`~/.hq/cache/checkpoint-gate/<company>.json`, refreshed in the
+  background at most every ten minutes by `hq core checkpoint-gate-setting
+  --refresh`) and skips the checkpoint block only when the session's company has
+  the gate turned off. Unset, unreachable with no cache, and sessions with no
+  company keep today's behaviour; `HQ_CHECKPOINT_GATE` still wins. Gated by the
+  hq-flag `checkpoint.gate.company-setting` (default off).
+
+### Changed
+
+- The systemd system unit now uses `KillMode=process`, so systemd signals only
+  the daemon. The daemon still stops its services on `systemctl stop`, and it
+  stops any service left over from a crashed daemon before starting new ones.
+
+### Fixed
+
+- `hq lanes create --placement auto` now runs on the caller when it is the best
+  capacity candidate. It matches the host id, machine identity or registered
+  Outpost id. Explicit `--outpost` self-targets still return
+  `outpost_self_target`.
+- `hq sync status` validates an explicit `--hq-root` and continues to read
+  journals from the configured state directory, which it now prints.
+
+## [5.274.1] — 2026-09-28
+
+### Fixed
+
+- With lineage-aware supersession enabled, same-profile workers under the same
+  session senior no longer supersede each other. The recorded senior can
+  message its worker if it is later superseded.
+
 ## [5.274.0] — 2026-09-28
 
 ### Fixed

package/assets/scaffold/core/scripts/checkpoint-stop-gate.sh

@@ -137,6 +137,72 @@ exec 3>&2
     return 0
   }
 
+  # checkpoint_gate_bound_company <hq-root> <session-id> — the session's
+  # declared company slug: scope-capability.json first, then meta.yaml. Prints
+  # empty when the session has no binding.
+  checkpoint_gate_bound_company() {
+    local root="$1" sid="$2" co="" cap meta
+    [ -n "$sid" ] || return 0
+    cap="$root/workspace/sessions/$sid/scope-capability.json"
+    if [ -r "$cap" ]; then
+      co="$(jq -r '.company_slug // empty' "$cap" 2>/dev/null || true)"
+    fi
+    if [ -z "$co" ]; then
+      meta="$root/workspace/sessions/$sid/meta.yaml"
+      if [ -r "$meta" ]; then
+        co="$(awk '
+          $1 == "company_slug:" {
+            sub(/^[^:]+:[[:space:]]*/, "")
+            gsub(/^"|"$/, "")
+            print
+            exit
+          }
+        ' "$meta" 2>/dev/null || true)"
+      fi
+    fi
+    printf '%s' "$co"
+  }
+
+  # checkpoint_gate_company_off <hq-root> <session-id> — succeeds only when the
+  # session's company owner has turned the checkpoint gate off
+  # (companySettings.checkpointGateEnabled = false) according to the local
+  # cache written by `hq core checkpoint-gate-setting --refresh`. The hook
+  # never calls the network: a missing or stale cache starts one detached,
+  # rate-limited refresh and the current turn uses whatever the cache holds.
+  # On, unset, no cache, no company, `personal`, or anything unreadable keeps
+  # the gate on. The refresh removes the cache while the
+  # `checkpoint.gate.company-setting` hq-flag is off, so the setting has no
+  # effect until the flag is on.
+  checkpoint_gate_company_off() {
+    local co dir cache stamp value fetched now stamp_mtime
+    co="$(checkpoint_gate_bound_company "$1" "$2")"
+    case "$co" in
+      ""|personal) return 1 ;;
+      *[!a-z0-9-]*) return 1 ;;
+    esac
+    [ -n "${HOME:-}" ] || return 1
+    dir="${HOME}/.hq/cache/checkpoint-gate"
+    cache="$dir/$co.json"
+    stamp="$dir/$co.refresh"
+    value=""
+    fetched=""
+    if [ -r "$cache" ]; then
+      value="$(jq -r 'if .checkpointGateEnabled == false then "off" elif .checkpointGateEnabled == true then "on" else "" end' "$cache" 2>/dev/null || true)"
+      fetched="$(jq -r '.fetched_at // empty | numbers | floor' "$cache" 2>/dev/null || true)"
+    fi
+    now="$(date +%s 2>/dev/null || true)"
+    case "$now" in ''|*[!0-9]*) now="" ;; esac
+    case "$fetched" in ''|*[!0-9]*) fetched=0 ;; esac
+    if [ -n "$now" ] && [ $((now - fetched)) -gt 600 ] && command -v hq >/dev/null 2>&1; then
+      stamp_mtime="$(stat -c %Y "$stamp" 2>/dev/null || stat -f %m "$stamp" 2>/dev/null || printf 0)"
+      case "$stamp_mtime" in ''|*[!0-9]*) stamp_mtime=0 ;; esac
+      if [ $((now - stamp_mtime)) -gt 600 ] && mkdir -p "$dir" 2>/dev/null && touch "$stamp" 2>/dev/null; then
+        (nohup hq core checkpoint-gate-setting --refresh --company "$co" >/dev/null 2>&1 3>&- &)
+      fi
+    fi
+    [ "$value" = off ]
+  }
+
   input="$(cat 2>/dev/null || printf '{}')"
   input_reply_evidence="$(printf '%s' "$input" | jq -r '
     if has("last_assistant_message") then
@@ -201,24 +267,7 @@ exec 3>&2
         fi
         if [ "$gate_match" = 1 ]; then
           gate_root="${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$self_hq}}"
-          bound_co=""
-          gate_cap="$gate_root/workspace/sessions/$gate_session_id/scope-capability.json"
-          if [ -r "$gate_cap" ]; then
-            bound_co="$(jq -r '.company_slug // empty' "$gate_cap" 2>/dev/null || true)"
-          fi
-          if [ -z "$bound_co" ]; then
-            gate_meta="$gate_root/workspace/sessions/$gate_session_id/meta.yaml"
-            if [ -r "$gate_meta" ]; then
-              bound_co="$(awk '
-                $1 == "company_slug:" {
-                  sub(/^[^:]+:[[:space:]]*/, "")
-                  gsub(/^"|"$/, "")
-                  print
-                  exit
-                }
-              ' "$gate_meta" 2>/dev/null || true)"
-            fi
-          fi
+          bound_co="$(checkpoint_gate_bound_company "$gate_root" "$gate_session_id")"
           # A binding satisfies the gate only when it names a REAL scope: the
           # reserved `personal`, or an actual tenant directory. hq-session will
           # still store a typo'd or invented slug (it validates only the
@@ -239,6 +288,13 @@ exec 3>&2
       ;;
   esac
 
+  # Company setting: an owner can turn the checkpoint requirement off for
+  # their company's sessions. An explicit operator switch (0 or 1) wins over it.
+  if [ -z "$gate_switch" ] &&
+    checkpoint_gate_company_off "${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-$self_hq}}" "$session_id"; then
+    exit 0
+  fi
+
   runtime="${HQ_CHECKPOINT_RUNTIME:-claude}"
 
   # Operator switches precede runtime and identity eligibility. A forced gate

package/dist/command-catalog.generated.d.ts

@@ -3818,7 +3818,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly options: readonly [];
         readonly subcommands: readonly [{
             readonly name: "set";
-            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled.";
+            readonly description: "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.";
             readonly aliases: readonly [];
             readonly hidden: false;
             readonly usage: "[options]";
@@ -3832,6 +3832,21 @@ export declare const COMMAND_CATALOG: readonly [{
             }, {
                 readonly flags: "--accounting-enabled <true|false>";
                 readonly description: "Enable/disable the accounting pack for this company";
+            }, {
+                readonly flags: "--checkpoint-gate-enabled <true|false>";
+                readonly description: "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "get";
+            readonly description: "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--json";
+                readonly description: "Print the result as JSON";
             }];
             readonly subcommands: readonly [];
         }];
@@ -5191,6 +5206,24 @@ export declare const COMMAND_CATALOG: readonly [{
             }];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "checkpoint-gate-setting";
+        readonly description: "Refresh the local cache of a company's checkpoint gate setting (used by the Stop gate)";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--company <slug>";
+            readonly description: "company whose setting to read";
+        }, {
+            readonly flags: "--refresh";
+            readonly description: "read the setting from HQ and update the local cache";
+        }, {
+            readonly flags: "--json";
+            readonly description: "print the result as JSON";
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "generate-workers-registry";
         readonly description: "Regenerate the derived workers registry";

package/dist/command-catalog.generated.js

@@ -4926,7 +4926,7 @@ export const COMMAND_CATALOG = [
                 "subcommands": [
                     {
                         "name": "set",
-                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled.",
+                        "description": "Set per-company settings (PUT /company-settings). Require at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled.",
                         "aliases": [],
                         "hidden": false,
                         "usage": "[options]",
@@ -4943,6 +4943,25 @@ export const COMMAND_CATALOG = [
                             {
                                 "flags": "--accounting-enabled <true|false>",
                                 "description": "Enable/disable the accounting pack for this company"
+                            },
+                            {
+                                "flags": "--checkpoint-gate-enabled <true|false>",
+                                "description": "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "get",
+                        "description": "Show whether the checkpoint Stop gate is on for this company (GET /company-settings/checkpoint-gate; any member may read it).",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--json",
+                                "description": "Print the result as JSON"
                             }
                         ],
                         "subcommands": []
@@ -6713,6 +6732,29 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "checkpoint-gate-setting",
+                "description": "Refresh the local cache of a company's checkpoint gate setting (used by the Stop gate)",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--company <slug>",
+                        "description": "company whose setting to read"
+                    },
+                    {
+                        "flags": "--refresh",
+                        "description": "read the setting from HQ and update the local cache"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "print the result as JSON"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "generate-workers-registry",
                 "description": "Regenerate the derived workers registry",

package/dist/commands/cloud.js

@@ -1061,8 +1061,18 @@ export function registerCloudCommands(program) {
         .command("status")
         .description("Show local sync journal summary")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
-        .action((options) => {
+        .action((options, command) => {
+        const explicitHqRoot = command.getOptionValueSource("hqRoot") === "cli";
         try {
+            const hqRoot = options.hqRoot;
+            if (explicitHqRoot) {
+                if (!fs.existsSync(hqRoot)) {
+                    throw new Error(`HQ root does not exist: ${hqRoot}`);
+                }
+                if (!fs.statSync(hqRoot).isDirectory()) {
+                    throw new Error(`HQ root is not a directory: ${hqRoot}`);
+                }
+            }
             // The engine SHARDS the journal by slug — the personal-vault fanout
             // slot, one shard per cloud company, and the legacy "personal" shard.
             // Enumerate EVERY shard the engine can write (via the engine's own
@@ -1071,13 +1081,7 @@ export function registerCloudCommands(program) {
             // looked at `sync-journal._Users_<user>_hq.json` — a slug the engine
             // never writes — and printed "No sync journal yet" right after a
             // successful sync (feedback_9fbf1f82 / feedback_46288b7b).
-            const journals = listJournals();
-            if (journals.length === 0) {
-                console.log(chalk.dim("No sync journal yet — run `hq sync now`, `hq sync push`, or `hq sync pull` to create one."));
-                console.log(chalk.dim(`  Looked in: ${getStateDir()} (sync-journal.*.json)`));
-                return;
-            }
-            const configPath = path.join(options.hqRoot, ".hq", "config.json");
+            const configPath = path.join(hqRoot, ".hq", "config.json");
             let activeCompany;
             if (fs.existsSync(configPath)) {
                 try {
@@ -1088,13 +1092,22 @@ export function registerCloudCommands(program) {
                     // ignore
                 }
             }
+            // Journals live in the machine-wide state directory, independently
+            // of the HQ content root selected for this status display.
+            const stateDir = getStateDir();
+            const journals = listJournals();
             let grandFiles = 0;
             let grandBytes = 0;
             let grandLastSync = "";
             console.log(chalk.bold("\nHQ Sync — Status"));
-            console.log(`  HQ root:        ${options.hqRoot}`);
+            console.log(`  HQ root:        ${hqRoot}`);
             console.log(`  Active company: ${activeCompany ?? chalk.dim("(none)")}`);
+            console.log(`  State dir:      ${stateDir}`);
             console.log(`  Journals:       ${journals.length}`);
+            if (journals.length === 0) {
+                console.log(chalk.dim("No sync journal yet — run `hq sync now`, `hq sync push`, or `hq sync pull` to create one."));
+                return;
+            }
             for (const j of journals) {
                 const entries = Object.entries(j.journal.files ?? {});
                 // Tombstones record removed files — exclude them from "tracked".

package/dist/commands/company.js

@@ -2,6 +2,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { registerCompanyTransferCommand } from "./company-transfer.js";
+import { describeRefreshOutcome, refreshCheckpointGateSetting, } from "./core-checkpoint-gate-setting.js";
 /**
  * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
  * passes the raw string; we validate strictly so a typo never silently writes
@@ -28,10 +29,12 @@ export function registerCompanyCommand(program) {
     settings
         .command("set")
         .description("Set per-company settings (PUT /company-settings). Require at least one " +
-        "of --crm-enabled / --ontology-enabled / --accounting-enabled.")
+        "of --crm-enabled / --ontology-enabled / --accounting-enabled / " +
+        "--checkpoint-gate-enabled.")
         .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
         .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
         .option("--accounting-enabled <true|false>", "Enable/disable the accounting pack for this company")
+        .option("--checkpoint-gate-enabled <true|false>", "Require (true) or stop requiring (false) a checkpoint before HQ sessions in this company end a turn")
         .action(async (opts) => {
         try {
             const companySlug = company.opts().company;
@@ -41,8 +44,9 @@ export function registerCompanyCommand(program) {
             }
             if (opts.crmEnabled === undefined &&
                 opts.ontologyEnabled === undefined &&
-                opts.accountingEnabled === undefined) {
-                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled."));
+                opts.accountingEnabled === undefined &&
+                opts.checkpointGateEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled / --accounting-enabled / --checkpoint-gate-enabled."));
                 process.exit(1);
             }
             const body = {};
@@ -55,6 +59,9 @@ export function registerCompanyCommand(program) {
             if (opts.accountingEnabled !== undefined) {
                 body.accountingEnabled = parseBoolFlag(opts.accountingEnabled, "--accounting-enabled");
             }
+            if (opts.checkpointGateEnabled !== undefined) {
+                body.checkpointGateEnabled = parseBoolFlag(opts.checkpointGateEnabled, "--checkpoint-gate-enabled");
+            }
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, { companySlug });
             body.companyUid = companyUid;
@@ -78,6 +85,62 @@ export function registerCompanyCommand(program) {
                 .map(([k, v]) => `${k}=${v}`)
                 .join(", ");
             console.log(chalk.green(`Company settings updated for ${companySlug}: ${applied}`));
+            if (body.checkpointGateEnabled !== undefined) {
+                // Update this machine's Stop gate cache now instead of waiting up to
+                // ten minutes. Other machines pick the change up on their next refresh.
+                try {
+                    const outcome = await refreshCheckpointGateSetting(companySlug);
+                    console.log(chalk.dim(describeRefreshOutcome(outcome)));
+                }
+                catch {
+                    // The setting is saved; the cache refreshes on the next Stop.
+                }
+            }
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    settings
+        .command("get")
+        .description("Show whether the checkpoint Stop gate is on for this company " +
+        "(GET /company-settings/checkpoint-gate; any member may read it).")
+        .option("--json", "Print the result as JSON")
+        .action(async (opts) => {
+        try {
+            const companySlug = company.opts().company;
+            if (!companySlug) {
+                console.error(chalk.red("Error: --company <slug> is required."));
+                process.exit(1);
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, { companySlug });
+            const res = await vaultApiFetch({
+                token,
+                path: "/company-settings/checkpoint-gate",
+                query: { companyUid },
+            });
+            const resBody = (await res.json().catch(() => ({})));
+            if (!res.ok) {
+                if (res.status === 403) {
+                    console.error(chalk.red("Requires membership of this company to read its settings."));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`Failed to read company settings: ${resBody.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const enabled = resBody.checkpointGateEnabled;
+            if (typeof enabled !== "boolean") {
+                console.error(chalk.red("Failed to read company settings: no checkpointGateEnabled in the response."));
+                process.exit(1);
+            }
+            if (opts.json) {
+                console.log(JSON.stringify({ company: companySlug, checkpointGateEnabled: enabled }));
+            }
+            else {
+                console.log(`checkpointGateEnabled=${enabled}`);
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));

package/dist/commands/core-checkpoint-gate-setting.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `hq core checkpoint-gate-setting` — keeps the local cache that lets a
+ * company owner turn the checkpoint Stop gate off for their company (CO-58).
+ *
+ * The owner sets `companySettings.checkpointGateEnabled` on hq-pro
+ * (`hq company settings set --checkpoint-gate-enabled false`, or the console
+ * Settings page). The Stop gate script never calls the network: it reads
+ * `~/.hq/cache/checkpoint-gate/<slug>.json` and, when that is missing or older
+ * than ten minutes, starts this command detached with `--refresh`.
+ *
+ * `--refresh` reads the setting through the member-readable
+ * `GET /company-settings/checkpoint-gate` route and writes the cache only while
+ * the hq-flag `checkpoint.gate.company-setting` is on for the company. With the
+ * flag off it removes the cache, so the gate keeps today's behaviour. Any
+ * failure (no login, API unreachable, timeout) leaves the cache as it was: the
+ * gate then uses the last known value, or today's behaviour when there is none.
+ * Only the named company's setting is ever read.
+ */
+import { Command } from "commander";
+export declare const CHECKPOINT_GATE_SETTING_FLAG = "checkpoint.gate.company-setting";
+/** The refresh gives up after this long; the gate keeps the cached value. */
+export declare const CHECKPOINT_GATE_REFRESH_TIMEOUT_MS = 3000;
+export declare function assertCompanySlug(slug: string): void;
+export interface CheckpointGateCacheEntry {
+    company: string;
+    checkpointGateEnabled: boolean;
+    /** Unix seconds. The gate treats an entry older than 600 s as stale. */
+    fetched_at: number;
+}
+export declare function checkpointGateCacheDir(home?: string): string;
+export declare function checkpointGateCachePath(slug: string, home?: string): string;
+export type CheckpointGateRefreshOutcome = {
+    status: "written";
+    company: string;
+    checkpointGateEnabled: boolean;
+} | {
+    status: "removed";
+    company: string;
+    reason: "flag_off";
+} | {
+    status: "kept";
+    company: string;
+    reason: string;
+};
+export interface CheckpointGateRefreshDeps {
+    home?: string;
+    now?: () => Date;
+    timeoutMs?: number;
+    getToken?: () => Promise<string>;
+    resolveCompanyUid?: (token: string, slug: string) => Promise<string>;
+    /** Returns the company's effective setting; throws on any failure. */
+    fetchSetting?: (token: string, companyUid: string, signal: AbortSignal) => Promise<boolean>;
+    /** Returns the rollout flag, or null when the registry could not be read. */
+    readFlag?: (slug: string, companyUid: string) => Promise<boolean | null>;
+}
+/**
+ * `readLanesRegistryFlag` resolves a failed registry read to `false`. The
+ * refresh must not treat that as "flag off" and delete a valid cache, so a
+ * reported failure becomes null (unknown).
+ */
+export declare function readCheckpointGateSettingFlag(slug: string, companyUid: string): Promise<boolean | null>;
+/**
+ * Refresh one company's cache entry. Never throws for a network or auth
+ * failure: those return `kept` and leave the cache untouched.
+ */
+export declare function refreshCheckpointGateSetting(slug: string, deps?: CheckpointGateRefreshDeps): Promise<CheckpointGateRefreshOutcome>;
+export declare function describeRefreshOutcome(outcome: CheckpointGateRefreshOutcome): string;
+export declare function registerCoreCheckpointGateSettingCommand(core: Command): void;
+//# sourceMappingURL=core-checkpoint-gate-setting.d.ts.map