@indigoai-us/hq-cli 5.276.0 → 5.277.0

package/dist/commands/secrets.d.ts

@@ -1,4 +1,4 @@
-import { Command } from "commander";
+import type { Command } from "commander";
 import { writeSync } from "node:fs";
 import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
@@ -88,5 +88,20 @@ export declare function loadRevealedSecrets(token: string, companyUid: string, k
  * `exit` and `write` are injectable for tests; production uses the real ones.
  */
 export declare function emitEnvExportsAndExit(payload: string, exit?: (code: number) => never, write?: typeof writeSync): never;
+/**
+ * Shared `secrets env` action for Commander and the default-off lightweight
+ * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
+ * server authorization, cache-fallback, redaction, and output code.
+ */
+export declare function runSecretsEnvCommand(opts: {
+    only: string[];
+    script?: string;
+    scriptId?: string;
+}, parentScope: {
+    company?: string;
+    personal?: boolean;
+}, options?: {
+    fallbackOnAuthFailure?: boolean;
+}): Promise<"handled" | "fallback">;
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,10 +1,8 @@
 import chalk from "chalk";
-import * as readline from "node:readline";
-import { spawn } from "node:child_process";
 import { writeSync } from "node:fs";
 import * as nodePath from "node:path";
 import { cognitoCachePrincipalUid, ensureCognitoToken } from "../utils/cognito-session.js";
-import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
+import { isAuthError } from "../utils/auth-error.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, hasCacheEntry, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
@@ -12,7 +10,6 @@ import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, format
 import { vaultApiFetch, getCompanyUid, getEntityUid, looksLikeCompanyUid, } from "../utils/vault-api.js";
 import { HQ_API_KEY_PREFIX, formatApiKeyCapabilityDenial, requireApiKeyCapability, resolveVaultCredentialForCapability, } from "../utils/resolve-vault-credential.js";
 import { CACHED_SECRETS_SERVER_UNAVAILABLE_MESSAGE, isSecretLoadUnavailable, isUnavailableSecretLoadHttpStatus, SecretLoadUnavailableError, } from "../utils/secret-load-availability.js";
-import { SandboxRunnerClient, } from "../utils/sandbox-runner-client.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
 /**
  * Mirrors `RESOURCE_SURFACES` in hq-pro
@@ -159,14 +156,16 @@ function parseDuration(input) {
     return null;
 }
 function confirmPrompt(message) {
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(`${message} [y/N] `, (answer) => {
-            rl.close();
-            resolve(answer.trim().toLowerCase() === "y");
+    return import("node:readline").then(({ createInterface }) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        return new Promise((resolve) => {
+            rl.question(`${message} [y/N] `, (answer) => {
+                rl.close();
+                resolve(answer.trim().toLowerCase() === "y");
+            });
         });
     });
 }
@@ -821,6 +820,61 @@ export function emitEnvExportsAndExit(payload, exit = process.exit, write = writ
     }
     return exit(0);
 }
+/**
+ * Shared `secrets env` action for Commander and the default-off lightweight
+ * entrypoint. The fast entrypoint still runs the same credential, usage-audit,
+ * server authorization, cache-fallback, redaction, and output code.
+ */
+export async function runSecretsEnvCommand(opts, parentScope, options = {}) {
+    let secretLoadStarted = false;
+    try {
+        const redact = process.stdout.isTTY;
+        if (redact) {
+            console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
+        }
+        const keys = parseSecretNameList(opts.only);
+        const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
+        const companyUid = cred.kind === "api-key"
+            ? "__api_key__"
+            : await getEntityUid(cred.token, scopeOpts(parentScope), {
+                allowOfflineScopeFallback: true,
+            });
+        const usage = cred.kind === "cognito"
+            ? await buildSecretUsage("env", opts.script, opts.scriptId)
+            : undefined;
+        secretLoadStarted = true;
+        const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, usage, { allowOfflineFallback: true });
+        let payload = "";
+        for (const key of keys) {
+            const value = revealed.get(key);
+            // loadRevealedSecrets throws on any unresolved key, so a miss here is
+            // unreachable — guard rather than print an `undefined` export line.
+            if (value === undefined) {
+                throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
+            }
+            const out = redact ? "[REDACTED]" : value;
+            payload += `export ${key}=${shellSingleQuote(out)}\n`;
+        }
+        // Write synchronously and exit unconditionally — never depend on the
+        // event loop draining or the stdout write callback firing. See
+        // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
+        emitEnvExportsAndExit(payload);
+        return "handled";
+    }
+    catch (err) {
+        if (options.fallbackOnAuthFailure &&
+            !secretLoadStarted &&
+            (isAuthError(err) ||
+                (err instanceof Error &&
+                    (/^No valid HQ session\b/.test(err.message) ||
+                        /^HQ_API_KEY must start with /.test(err.message))))) {
+            return "fallback";
+        }
+        console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+        process.exit(1);
+        return "handled";
+    }
+}
 export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
@@ -1445,6 +1499,7 @@ export function registerSecretsCommand(program) {
             const token = await requireCognitoTokenForSecrets("secrets sandbox", "secrets:read");
             const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
             const companyUid = await getEntityUid(token, scope);
+            const { SandboxRunnerClient } = await import("../utils/sandbox-runner-client.js");
             const client = new SandboxRunnerClient();
             const started = await client.startJob(token, {
                 companyUid,
@@ -1504,9 +1559,14 @@ export function registerSecretsCommand(program) {
                 : undefined, { allowOfflineFallback: true });
             // API-key auth has no signed-in person identity for the CLI telemetry
             // endpoint. Do not attribute that read to an unrelated cached session.
-            const revealed = cred.kind === "cognito"
-                ? await withCliFeatureUsed("secret_read", readSecrets, companyUid)
-                : await readSecrets();
+            let revealed;
+            if (cred.kind === "cognito") {
+                const { withCliFeatureUsed } = await import("../utils/cli-telemetry.js");
+                revealed = await withCliFeatureUsed("secret_read", readSecrets, companyUid);
+            }
+            else {
+                revealed = await readSecrets();
+            }
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -1518,6 +1578,7 @@ export function registerSecretsCommand(program) {
                 secretEnv[key] = value;
             }
             const [childCmd, ...childCmdArgs] = childArgs;
+            const { spawn } = await import("node:child_process");
             const child = spawn(childCmd, childCmdArgs, {
                 stdio: "inherit",
                 env: { ...process.env, ...secretEnv },
@@ -1545,39 +1606,7 @@ export function registerSecretsCommand(program) {
         .option("--script <path>", "Attach local script identity for script-locked secrets")
         .option("--script-id <id>", "Stable script identifier approved by policy")
         .action(async (opts) => {
-        try {
-            const redact = process.stdout.isTTY;
-            if (redact) {
-                console.error(chalk.yellow("stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)"));
-            }
-            const keys = parseSecretNameList(opts.only);
-            const cred = await resolveVaultCredentialForCapability("secrets:read", "secrets env", secretsCredentialOptions());
-            const companyUid = cred.kind === "api-key"
-                ? "__api_key__"
-                : await getEntityUid(cred.token, scopeOpts(secrets.opts()), { allowOfflineScopeFallback: true });
-            const revealed = await loadRevealedSecrets(cred.token, companyUid, keys, cred.kind === "cognito"
-                ? await buildSecretUsage("env", opts.script, opts.scriptId)
-                : undefined, { allowOfflineFallback: true });
-            let payload = "";
-            for (const key of keys) {
-                const value = revealed.get(key);
-                // loadRevealedSecrets throws on any unresolved key, so a miss here is
-                // unreachable — guard rather than print an `undefined` export line.
-                if (value === undefined) {
-                    throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
-                }
-                const out = redact ? "[REDACTED]" : value;
-                payload += `export ${key}=${shellSingleQuote(out)}\n`;
-            }
-            // Write synchronously and exit unconditionally — never depend on the
-            // event loop draining or the stdout write callback firing. See
-            // emitEnvExportsAndExit for the full rationale (orphaned-process leak).
-            emitEnvExportsAndExit(payload);
-        }
-        catch (err) {
-            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
+        await runSecretsEnvCommand(opts, secrets.opts());
     });
     secrets
         .command("generate-link <name>")

package/dist/commands/sync-mode.d.ts

@@ -70,6 +70,15 @@ export interface SetSyncModeResult {
 export interface ShowSyncModesOptions {
     vaultClient: SyncModeVaultClient;
 }
+export interface GetSyncModeOptions {
+    companySlug: string;
+    vaultClient: SyncModeVaultClient;
+}
+export interface GetSyncModeResult {
+    membershipId: string;
+    companySlug: string;
+    config: MembershipSyncConfig;
+}
 export interface ShowSyncModesRow {
     companySlug: string;
     companyName?: string;
@@ -100,6 +109,8 @@ export declare function setSyncMode(options: SetSyncModeOptions): Promise<SetSyn
  * stable table output.
  */
 export declare function showSyncModes(options: ShowSyncModesOptions): Promise<ShowSyncModesRow[]>;
+/** Read one company's effective sync mode without hiding API read failures. */
+export declare function getSyncModeForCompany(options: GetSyncModeOptions): Promise<GetSyncModeResult>;
 /**
  * Render the `--show` table as plain text. No external dep — hq-cli doesn't
  * use cli-table3, so we hand-format columns to match the existing chalk +

package/dist/commands/sync-mode.js

@@ -163,6 +163,36 @@ export async function showSyncModes(options) {
     rows.sort((a, b) => a.companySlug.localeCompare(b.companySlug));
     return rows;
 }
+/** Read one company's effective sync mode without hiding API read failures. */
+export async function getSyncModeForCompany(options) {
+    const { companySlug, vaultClient } = options;
+    const memberships = await vaultClient.listMyMemberships();
+    const enriched = await Promise.all(memberships.map(async (membership) => {
+        try {
+            const entity = await vaultClient.entity.get(membership.companyUid);
+            return { ok: true, membership, slug: entity.slug };
+        }
+        catch (error) {
+            return { ok: false, membership, error };
+        }
+    }));
+    const match = enriched.find((row) => row.ok && row.slug === companySlug);
+    if (!match) {
+        const failedLookup = enriched.find((row) => !row.ok);
+        if (failedLookup && !failedLookup.ok)
+            throw failedLookup.error;
+        throw new Error(`No membership found for company '${companySlug}'.`);
+    }
+    for (const failedLookup of enriched) {
+        if (!failedLookup.ok) {
+            const detail = failedLookup.error instanceof Error ? failedLookup.error.message : String(failedLookup.error);
+            console.error(`getSyncModeForCompany: entity lookup failed for membership ${failedLookup.membership.membershipKey} while resolving '${companySlug}': ${detail}`);
+        }
+    }
+    const membershipId = match.membership.membershipKey;
+    const config = await vaultClient.getMembershipSyncConfig(membershipId);
+    return { membershipId, companySlug, config };
+}
 // ── Table rendering (used by CLI action, separable for tests) ──────────────
 /**
  * Render the `--show` table as plain text. No external dep — hq-cli doesn't

package/dist/fast-scaffold.d.ts

@@ -36,6 +36,23 @@ export type ParsedFastCore = {
     /** Everything after the command name, passed to the script verbatim. */
     args: string[];
 };
+export type ParsedSecretsEnvFastRequest = {
+    options: {
+        only: string[];
+        script?: string;
+        scriptId?: string;
+    };
+    scope: {
+        company?: string;
+        personal?: boolean;
+    };
+};
+/**
+ * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry
+ * fast path. Anything this parser does not understand stays with Commander in
+ * the full CLI, which remains the source of truth for help and errors.
+ */
+export declare function parseSecretsEnvFastRequest(argv: readonly string[]): ParsedSecretsEnvFastRequest | null;
 /**
  * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
  * fast-path script. Returns null for anything else so the caller defers to the

package/dist/fast-scaffold.js

@@ -21,6 +21,97 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
     },
 ];
+/**
+ * Parse the small, non-ambiguous `hq secrets env` surface for the gated entry
+ * fast path. Anything this parser does not understand stays with Commander in
+ * the full CLI, which remains the source of truth for help and errors.
+ */
+export function parseSecretsEnvFastRequest(argv) {
+    if (argv[2] !== "secrets")
+        return null;
+    let index = 3;
+    const scope = {};
+    let hasCompanyScope = false;
+    let hasPersonalScope = false;
+    while (index < argv.length && argv[index] !== "env") {
+        const arg = argv[index];
+        if (arg === "--company") {
+            const value = argv[index + 1];
+            if (!value || value.startsWith("-") || hasPersonalScope)
+                return null;
+            hasCompanyScope = true;
+            scope.company = value;
+            index += 2;
+            continue;
+        }
+        if (arg?.startsWith("--company=")) {
+            const value = arg.slice("--company=".length);
+            if (!value || hasPersonalScope)
+                return null;
+            hasCompanyScope = true;
+            scope.company = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--personal") {
+            if (hasCompanyScope)
+                return null;
+            hasPersonalScope = true;
+            scope.personal = true;
+            index += 1;
+            continue;
+        }
+        return null;
+    }
+    if (argv[index] !== "env")
+        return null;
+    index += 1;
+    const options = { only: [] };
+    let hasOnly = false;
+    while (index < argv.length) {
+        const arg = argv[index];
+        if (arg === "-h" || arg === "--help" || arg === "--")
+            return null;
+        let option;
+        let value;
+        if (arg === "--only" || arg === "--script" || arg === "--script-id") {
+            option = arg;
+            value = argv[index + 1];
+            if (value === undefined || value.startsWith("-"))
+                return null;
+            index += 2;
+        }
+        else if (arg?.startsWith("--only=")) {
+            option = "--only";
+            value = arg.slice("--only=".length);
+            index += 1;
+        }
+        else if (arg?.startsWith("--script=")) {
+            option = "--script";
+            value = arg.slice("--script=".length);
+            index += 1;
+        }
+        else if (arg?.startsWith("--script-id=")) {
+            option = "--script-id";
+            value = arg.slice("--script-id=".length);
+            index += 1;
+        }
+        else {
+            return null;
+        }
+        if (option === "--only") {
+            hasOnly = true;
+            options.only.push(...(value ?? "").split(",").map((key) => key.trim()).filter(Boolean));
+        }
+        else if (option === "--script") {
+            options.script = value;
+        }
+        else if (option === "--script-id") {
+            options.scriptId = value;
+        }
+    }
+    return hasOnly ? { options, scope } : null;
+}
 /**
  * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
  * fast-path script. Returns null for anything else so the caller defers to the

package/dist/index.js

@@ -6,7 +6,7 @@ import "./node-network-compat.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.
-import { isFastCoreRequest, parseFastCore } from "./fast-scaffold.js";
+import { isFastCoreRequest, parseFastCore, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
 // Also dependency-light: registers a process-level rejection boundary; its only
 // heavy import (main.js) is lazy and reached only when a rejection fires.
 import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.js";
@@ -45,6 +45,22 @@ else if (parseFastCore(process.argv)?.entry.kind === "native") {
         }
     });
 }
+else if (parseSecretsEnvFastRequest(process.argv)) {
+    const request = parseSecretsEnvFastRequest(process.argv);
+    void import("./secrets-env-fast-route.js").then(async (route) => {
+        await route.dispatchSecretsEnvFastRequest(request, {
+            isEnabled: () => route.secretsEnvFastRouteEnabled(request),
+            runFast: async () => {
+                const { runSecretsEnvFastPath } = await import("./secrets-env-fast-path.js");
+                return runSecretsEnvFastPath(request);
+            },
+            runCurrent: async () => {
+                const { runCli } = await import("./main.js");
+                await runCli();
+            },
+        });
+    });
+}
 else if (isFastCoreRequest(process.argv)) {
     // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
     // dispatches straight to the bundled-script runner, so it never pays for the

package/dist/lanes-drain-hook.js

@@ -1,4 +1,6 @@
-import { runDrainHook } from "./lib/lanes/dropbox.js";
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
 function parseHookInput(text) {
     if (text.trim() === "")
         return {};
@@ -24,6 +26,116 @@ function parseHookInput(text) {
         ...(typeof value.hook_event_name === "string" ? { hook_event_name: value.hook_event_name } : {}),
     };
 }
+function laneIdIsSafe(laneId) {
+    return laneId !== "" && laneId.trim() === laneId &&
+        !laneId.includes("/") && !laneId.includes("\\") &&
+        !laneId.includes("\0") && laneId !== "." && laneId !== ".." &&
+        !laneId.includes("..");
+}
+function fileExists(filePath) {
+    try {
+        fs.statSync(filePath);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+function listVisibleNames(dir) {
+    try {
+        return fs.readdirSync(dir).filter((name) => !name.startsWith("."));
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+}
+/** Return true whenever the full drainer may have work or a condition to report. */
+function dropboxMayNeedDrain(box) {
+    const inbox = path.join(box, "inbox.jsonl");
+    if (fileExists(inbox))
+        return true;
+    const draining = path.join(box, "draining");
+    if (listVisibleNames(draining).length > 0)
+        return true;
+    const inflightRoot = path.join(box, "inflight");
+    for (const name of listVisibleNames(inflightRoot)) {
+        const inflight = path.join(inflightRoot, name);
+        const stat = fs.statSync(inflight);
+        if (!stat.isDirectory())
+            return true;
+        if (listVisibleNames(inflight).length > 0)
+            return true;
+    }
+    return false;
+}
+function replayMayNeedWork(box, turnId, input) {
+    if (!/^[A-Za-z0-9-]{1,80}$/.test(turnId))
+        return false;
+    if (input.transcript_path)
+        return true;
+    let text;
+    const statePath = path.join(box, "message-compaction-replay.json");
+    try {
+        text = fs.readFileSync(statePath, "utf8");
+    }
+    catch {
+        // Keep the existing named replay error behavior for missing or unreadable state.
+        return true;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return true;
+        const state = parsed;
+        if (state.schema_version !== 1 ||
+            state.turn_id !== turnId ||
+            (state.last_compaction_marker !== null &&
+                (!Number.isSafeInteger(state.last_compaction_marker) || Number(state.last_compaction_marker) < 0)) ||
+            (state.transcript_offset !== undefined &&
+                (!Number.isSafeInteger(state.transcript_offset) || Number(state.transcript_offset) < 0)) ||
+            (state.transcript_path !== undefined && typeof state.transcript_path !== "string") ||
+            state.flag_enabled !== undefined) {
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+function recordToolActivity(hqRoot, laneId) {
+    try {
+        const activityPath = path.join(hqRoot, "workspace", "lanes-runs", laneId, "logs", "tool-activity.json");
+        fs.mkdirSync(path.dirname(activityPath), { recursive: true });
+        const record = {
+            at: new Date().toISOString(),
+            hook_pid: process.pid,
+            hook_event: "PreToolUse",
+        };
+        const tempPath = `${activityPath}.${process.pid}.${process.hrtime.bigint()}.${randomBytes(4).toString("hex")}.tmp`;
+        fs.writeFileSync(tempPath, `${JSON.stringify(record)}\n`, "utf8");
+        fs.renameSync(tempPath, activityPath);
+        return "";
+    }
+    catch (err) {
+        return `hq-lanes-drain: failed to record tool activity: ${err instanceof Error ? err.message : String(err)}\n`;
+    }
+}
+function finish(result, inputError) {
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (inputError || result.stderr)
+        process.stderr.write(`${inputError}${result.stderr}`);
+    process.exitCode = result.exitCode;
+}
+async function runFullPath(input, inputError) {
+    const { runDrainHook } = await import("./lib/lanes/dropbox.js");
+    finish(await runDrainHook(process.env, input), inputError);
+}
 async function main() {
     const chunks = [];
     for await (const chunk of process.stdin)
@@ -37,12 +149,47 @@ async function main() {
     catch (err) {
         inputError = `hq-lanes-drain: ${err instanceof Error ? err.message : String(err)}\n`;
     }
-    const result = await runDrainHook(process.env, input);
-    if (result.stdout)
-        process.stdout.write(result.stdout);
-    if (inputError || result.stderr)
-        process.stderr.write(`${inputError}${result.stderr}`);
-    process.exitCode = result.exitCode;
+    const laneId = process.env.HQ_LANE_ID ?? "";
+    if (laneId === "") {
+        finish({ exitCode: 0, stdout: "", stderr: "" }, inputError);
+        return;
+    }
+    const hqRoot = process.env.HQ_ROOT ?? "";
+    if (hqRoot === "" || !laneIdIsSafe(laneId)) {
+        await runFullPath(input, inputError);
+        return;
+    }
+    const box = path.join(hqRoot, "workspace", "lanes-runs", laneId, "dropbox");
+    let noWork = false;
+    try {
+        noWork = !dropboxMayNeedDrain(box) &&
+            !replayMayNeedWork(box, process.env.HQ_LANE_TURN_ID ?? "", input);
+    }
+    catch {
+        // Filesystem uncertainty must use the full path so it retains its named errors.
+    }
+    if (!noWork) {
+        await runFullPath(input, inputError);
+        return;
+    }
+    let stderr = recordToolActivity(hqRoot, laneId);
+    const directories = [
+        box,
+        path.join(box, "draining"),
+        path.join(box, "delivered"),
+        path.join(box, "inflight"),
+    ];
+    try {
+        for (const directory of directories)
+            fs.mkdirSync(directory, { recursive: true });
+    }
+    catch (err) {
+        const message = `Failed to open drop box ${box}: ${err instanceof Error ? err.message : String(err)}`;
+        stderr += `hq-lanes-drain: ${message}\n`;
+        finish({ exitCode: 1, stdout: "", stderr }, inputError);
+        return;
+    }
+    finish({ exitCode: 0, stdout: "", stderr }, inputError);
 }
 main().catch((err) => {
     process.stderr.write(`hq-lanes-drain: hook_runner_failed: ${err instanceof Error ? err.message : String(err)}\n`);

package/dist/lib/agent-kit/run/inbox.js

@@ -138,8 +138,9 @@ export async function pollInboxOnce(deps) {
     if (res.status !== 200) {
         writeComponentStatus(deps.paths, "inbox", "error");
         const url = res.url ?? agentInboxUrl(deps.apiBaseUrl, deps.agentUid);
-        const bodyText = truncateBody(res.bodyText ?? (res.body === undefined ? "" : JSON.stringify(res.body)));
-        deps.log("warn", `inbox poll GET ${url} → ${res.status}${bodyText ? ` body=${bodyText}` : ""}`);
+        // Non-OK bodies are not constrained to an error envelope and could carry
+        // inbox items. Keep the status and route, but do not copy the body to logs.
+        deps.log("warn", `inbox poll GET ${url} → ${res.status}`);
         return { ok: false, mirrored: 0 };
     }
     writeComponentStatus(deps.paths, "inbox", "ok");

package/dist/lib/checkpoint-ontology/apply.d.ts

@@ -53,6 +53,12 @@ export interface ApplyReport {
         canonical_name: string;
         path: string;
     }>;
+    /** Present only when `checkpoint.ontology.dominant-sibling-link` was on: knowledge links moved from a weak sibling to the dominant one. */
+    dominant_sibling_redirects?: Array<{
+        input: string;
+        from: string;
+        to: string;
+    }>;
     rejected: Array<{
         input: string;
         type: string;