@indigoai-us/hq-cli 5.283.0 → 5.284.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.284.0] — 2026-09-29
+- The existing Work Mesh MQTT subscriber can signal agent inbox wakes through a private local marker without persisting MQTT message contents.
+
+### Fixed
+
+- A remote `hq lanes list` read no longer dispatches owner hire summaries,
+  capacity probes, or mirror snapshots to other Outposts. Two Outposts that
+  each held a lane placed on the other ran `hq lanes list --json` on each other
+  without end, which filled both boxes with SSM commands.
+
 ## [5.283.0] — 2026-09-29
 
 ### Added

package/dist/commands/lanes.js

@@ -37,7 +37,7 @@ import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } fr
 import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
-import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, PICKUP_WAIT_MS, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
+import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, REMOTE_LANE_READ_ENV, outpostRejectedEffortOption, parseOutpostPickupPayload, PICKUP_WAIT_MS, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { outpostHireSummaryCacheKey, LANE_OUTPOST_SNAPSHOT_CACHE_FLAG, OUTPOST_HIRE_SUMMARY_CACHE_TTL_MS, readOutpostHireSummaryCache, readOutpostHireSummaryCacheIncludingStale, writeOutpostHireSummaryCache, } from "../lib/lanes/outpost-hire-cache.js";
 import { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "../lib/lanes/host-capacity.js";
 import { BALANCE_MOVABLE_STATES, selectClaudeAccount, } from "../lib/lanes/claude-balance.js";
@@ -4543,9 +4543,12 @@ async function runList(ctx, opts, fastRouteFlags) {
         });
         return;
     }
-    const remoteRefresh = await refreshRemoteLaneMirrors(ctx, hqRoot, laneSource, new Set(selectedLanes
-        .filter((lane) => !isTerminalLaneState(lane.state))
-        .map((lane) => lane.lane_id)));
+    const remoteRead = ctx.env[REMOTE_LANE_READ_ENV] === "1";
+    const remoteRefresh = remoteRead
+        ? { updated: new Map(), unverifiedRemote: new Map() }
+        : await refreshRemoteLaneMirrors(ctx, hqRoot, laneSource, new Set(selectedLanes
+            .filter((lane) => !isTerminalLaneState(lane.state))
+            .map((lane) => lane.lane_id)));
     for (const [laneId, updated] of remoteRefresh.updated) {
         const index = laneSource.findIndex((lane) => lane.lane_id === laneId);
         if (index >= 0)
@@ -4563,7 +4566,8 @@ async function runList(ctx, opts, fastRouteFlags) {
     }
     const ownerEligibleLaneIds = new Set();
     for (const lane of selectedLanes) {
-        if (lane.host.kind !== "outpost" ||
+        if (remoteRead ||
+            lane.host.kind !== "outpost" ||
             isTerminalLaneState(lane.state) ||
             laneRunsHere(lane, host)) {
             continue;
@@ -4713,8 +4717,8 @@ async function runList(ctx, opts, fastRouteFlags) {
         };
     });
     const placementCompany = company ?? processLanePlacementCompany(ctx);
-    const placementEnabled = fastRouteFlags?.lanePlacementEnabled ??
-        await readLanePlacementEnabled(ctx, placementCompany);
+    const placementEnabled = !remoteRead && (fastRouteFlags?.lanePlacementEnabled ??
+        await readLanePlacementEnabled(ctx, placementCompany));
     const host_capacity = placementEnabled
         ? (await loadHostCapacitySnapshots(ctx, hqRoot, undefined, allLanes)).entries
         : undefined;

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -81,6 +81,14 @@ export declare function parseOutpostPickupPayload(raw: unknown): OutpostPickupPa
 export declare function buildOutpostPickupCommand(payloadUrl: string): string;
 /** Bounded, read-only capacity query executed by the target Outpost CLI. */
 export declare function buildOutpostCapacityCommand(): string;
+/**
+ * Marks a lane list that runs on an Outpost for another host. Such a list
+ * answers from the box's own records and never dispatches to other Outposts:
+ * two boxes that each hold a lane placed on the other would otherwise run
+ * lists on each other without end. `env` keeps older CLIs working, since they
+ * ignore the variable instead of rejecting an unknown flag.
+ */
+export declare const REMOTE_LANE_READ_ENV = "HQ_LANES_REMOTE_READ";
 /** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export declare function buildOutpostLaneListCommand(input?: {
     hqBinary?: string;

package/dist/lib/lanes/outpost-dispatch.js

@@ -65,9 +65,19 @@ export function buildOutpostPickupCommand(payloadUrl) {
 export function buildOutpostCapacityCommand() {
     return withRemoteHqDir(joinCommandParts(["hq", "lanes", "capacity", "--json"]));
 }
+/**
+ * Marks a lane list that runs on an Outpost for another host. Such a list
+ * answers from the box's own records and never dispatches to other Outposts:
+ * two boxes that each hold a lane placed on the other would otherwise run
+ * lists on each other without end. `env` keeps older CLIs working, since they
+ * ignore the variable instead of rejecting an unknown flag.
+ */
+export const REMOTE_LANE_READ_ENV = "HQ_LANES_REMOTE_READ";
 /** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export function buildOutpostLaneListCommand(input = {}) {
     const args = [
+        "env",
+        `${REMOTE_LANE_READ_ENV}=1`,
         input.hqBinary?.trim() || "hq",
         "lanes",
         "list",

package/dist/lib/mesh/live/daemon/credentials.js

@@ -562,13 +562,21 @@ export function normalizePersonalRealtimeBundle(raw) {
     }
     if (!topics.dm && typeof r.topic === "string")
         topics.dm = r.topic;
+    const agentInboxTopic = typeof r.agentInboxTopic === "string" ? r.agentInboxTopic.trim() : "";
     const actorUid = (typeof r.principalUid === "string" && /^(?:prs|agt)_[A-Za-z0-9]+$/.test(r.principalUid)
         ? r.principalUid
         : undefined) ||
         actorUidFromPersonalTopic(topics.dm) ||
+        actorUidFromPersonalTopic(agentInboxTopic) ||
         "";
     if (!actorUid)
         throw new Error("contract-2 vend could not derive actorUid");
+    // hq-pro advertises the agent's own inbox topic as a top-level capability.
+    // Keep it only for the exact actor-owned topic; it reuses this personal MQTT
+    // session and never grants the subscriber a topic supplied by another actor.
+    if (actorUid.startsWith("agt_") && agentInboxTopic === `hq/${actorUid}/inbox`) {
+        topics.inbox = agentInboxTopic;
+    }
     // Only keep topics that belong to the vended principal.
     for (const [k, v] of Object.entries(topics)) {
         if (actorUidFromPersonalTopic(v) !== actorUid)

package/dist/lib/mesh/live/daemon/work-subscribe.d.ts

@@ -14,6 +14,7 @@ export interface WorkCacheMqtt {
 export interface WorkCacheSubscriber {
     stop: () => Promise<void>;
 }
+export declare const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
 export declare function startWorkCacheSubscriber(opts: {
     meshRoot: string;
     fetchCredentials?: PersonalCredentialsFetcher;

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -2,10 +2,57 @@
  * Contract-2 subscriber for the personal work topic.
  * Owns live-cache.json writes. Presence publish stays on PresenceClient.
  */
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { createPersonalRealtimeFetcher, } from "./credentials.js";
 import { presignIotWssUrl } from "./presign.js";
 import { applyProjectViewPush, parseProjectViewPush } from "./live-cache.js";
 import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
+export const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
+const INBOX_PUSH_HEARTBEAT_MS = 5_000;
+function readInboxWakeSequence(meshRoot, onInfo) {
+    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
+    try {
+        const info = fs.lstatSync(target);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            onInfo?.("agent inbox push state read ignored (not a regular file)");
+            return 0;
+        }
+        const parsed = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (Number.isSafeInteger(parsed.wakeSequence) && Number(parsed.wakeSequence) >= 0) {
+            return Number(parsed.wakeSequence);
+        }
+        onInfo?.("agent inbox push state read ignored (invalid wake sequence)");
+        return 0;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            onInfo?.(`agent inbox push state read failed (${name})`);
+        }
+        return 0;
+    }
+}
+function writeInboxPushState(meshRoot, state) {
+    fs.mkdirSync(meshRoot, { recursive: true, mode: 0o700 });
+    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
+    const temporary = `${target}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+        fs.chmodSync(temporary, 0o600);
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (cleanupError) {
+            if (cleanupError.code !== "ENOENT")
+                throw cleanupError;
+        }
+        throw error;
+    }
+}
 export async function startWorkCacheSubscriber(opts) {
     const fetchCredentials = opts.fetchCredentials ??
         (opts.token
@@ -28,10 +75,48 @@ export async function startWorkCacheSubscriber(opts) {
     let reconnectLogged = false;
     let attempt = 0;
     let timer = null;
+    let heartbeatTimer = null;
     let generation = 0;
+    let inboxSubscribed = false;
+    // Carry the sequence forward from the last state marker so a daemon restart
+    // cannot reuse a value the watcher has already consumed.
+    let wakeSequence = readInboxWakeSequence(opts.meshRoot, opts.onInfo);
+    const clearInboxHeartbeat = () => {
+        if (heartbeatTimer !== null)
+            timers.clearTimeout(heartbeatTimer);
+        heartbeatTimer = null;
+    };
+    const persistInboxState = (connected) => {
+        try {
+            writeInboxPushState(opts.meshRoot, {
+                connected,
+                heartbeatAtMs: now().getTime(),
+                wakeSequence,
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            opts.onInfo?.(`agent inbox push state write failed (${name})`);
+        }
+    };
+    const scheduleInboxHeartbeat = () => {
+        if (stopped || !inboxSubscribed)
+            return;
+        clearInboxHeartbeat();
+        heartbeatTimer = timers.setTimeout(() => {
+            heartbeatTimer = null;
+            if (!stopped && inboxSubscribed) {
+                persistInboxState(true);
+                scheduleInboxHeartbeat();
+            }
+        }, INBOX_PUSH_HEARTBEAT_MS);
+    };
     const connect = async () => {
         if (stopped)
             return;
+        inboxSubscribed = false;
+        clearInboxHeartbeat();
+        persistInboxState(false);
         const gen = ++generation;
         let bundle;
         try {
@@ -44,8 +129,12 @@ export async function startWorkCacheSubscriber(opts) {
         if (stopped || gen !== generation)
             return;
         const topic = bundle.topics.work;
-        if (!topic) {
-            opts.onInfo?.("work cache subscribe skipped: credentials have no work topic");
+        const inboxTopic = bundle.actorUid.startsWith("agt_") &&
+            bundle.topics.inbox === `hq/${bundle.actorUid}/inbox`
+            ? bundle.topics.inbox
+            : undefined;
+        if (!topic && !inboxTopic) {
+            opts.onInfo?.("work cache subscribe skipped: credentials have no supported topic");
             return;
         }
         const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
@@ -60,12 +149,55 @@ export async function startWorkCacheSubscriber(opts) {
             if (stopped || gen !== generation)
                 return;
             reconnectLogged = false;
-            attempt = 0;
-            next.subscribe(topic, { qos: 1 }, () => undefined);
+            let pendingSubscriptions = Number(Boolean(topic)) + Number(Boolean(inboxTopic));
+            let subscriptionFailed = false;
+            const finishSubscription = (err) => {
+                if (err) {
+                    if (subscriptionFailed)
+                        return;
+                    subscriptionFailed = true;
+                    schedule(err);
+                    next.end(true);
+                    return;
+                }
+                if (subscriptionFailed)
+                    return;
+                pendingSubscriptions -= 1;
+                if (pendingSubscriptions === 0)
+                    attempt = 0;
+            };
+            if (topic) {
+                next.subscribe(topic, { qos: 1 }, (err) => finishSubscription(err));
+            }
+            if (inboxTopic) {
+                next.subscribe(inboxTopic, { qos: 1 }, (err) => {
+                    if (stopped || gen !== generation)
+                        return;
+                    if (err) {
+                        inboxSubscribed = false;
+                        clearInboxHeartbeat();
+                        persistInboxState(false);
+                        opts.onInfo?.("agent inbox push subscribe failed");
+                        finishSubscription(err);
+                        return;
+                    }
+                    inboxSubscribed = true;
+                    persistInboxState(true);
+                    scheduleInboxHeartbeat();
+                    finishSubscription();
+                });
+            }
         });
         next.on("message", (_topic, payload) => {
             if (stopped || gen !== generation)
                 return;
+            if (inboxTopic && _topic === inboxTopic && inboxSubscribed) {
+                // A topic message is a doorbell only. Never parse, persist, or log its
+                // content; the authenticated inbox GET remains the source of truth.
+                wakeSequence += 1;
+                persistInboxState(true);
+                return;
+            }
             if (_topic !== topic)
                 return;
             const push = parseProjectViewPush(payload);
@@ -79,11 +211,14 @@ export async function startWorkCacheSubscriber(opts) {
         next.on("close", () => {
             if (stopped || gen !== generation)
                 return;
+            inboxSubscribed = false;
+            clearInboxHeartbeat();
+            persistInboxState(false);
             schedule();
         });
     };
     const schedule = (err) => {
-        if (stopped)
+        if (stopped || timer !== null)
             return;
         if (!reconnectLogged) {
             reconnectLogged = true;
@@ -106,6 +241,9 @@ export async function startWorkCacheSubscriber(opts) {
             generation += 1;
             if (timer !== null)
                 timers.clearTimeout(timer);
+            clearInboxHeartbeat();
+            inboxSubscribed = false;
+            persistInboxState(false);
             const current = client;
             client = null;
             if (!current)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.283.0",
+  "version": "5.284.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {