@indigoai-us/hq-cli 5.283.0 → 5.285.0

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [5.285.0] — 2026-09-29
+
+## [5.284.0] — 2026-09-29
+- The existing Work Mesh MQTT subscriber can signal agent inbox wakes through a private local marker without persisting MQTT message contents.
+- Add `hq agents jobs resume <uid> <jobId>` to re-enable paused agent job schedules.
+
+### Fixed
+
+- A remote `hq lanes list` read no longer dispatches owner hire summaries,
+  capacity probes, or mirror snapshots to other Outposts. Two Outposts that
+  each held a lane placed on the other ran `hq lanes list --json` on each other
+  without end, which filled both boxes with SSM commands.
+
+### Fixed
+
+- Refresh remote lane mirrors on hosts with an Outpost identity, while excluding
+  mirrors owned by that host. Resolve company attribution before checking the
+  mirror gate for refreshes and remote logs; unresolved lanes stay local.
+  Remote-read invocations skip refresh to prevent reciprocal Outpost fan-out.
+
 ## [5.283.0] — 2026-09-29
 
 ### Added

package/dist/command-catalog.generated.d.ts

@@ -4257,7 +4257,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "jobs";
-        readonly description: "List, pause, or cancel an agent's scheduled jobs";
+        readonly description: "List, pause, resume, or cancel an agent's scheduled jobs";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] [command]";
@@ -4302,6 +4302,26 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "Company slug (to resolve an agent by name/slug)";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "resume";
+            readonly description: "Resume a paused job's schedule";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <agentUid> <jobId>";
+            readonly arguments: readonly [{
+                readonly name: "agentUid";
+                readonly required: true;
+                readonly variadic: false;
+            }, {
+                readonly name: "jobId";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--company <slug>";
+                readonly description: "Company slug (to resolve an agent by name/slug)";
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "cancel";
             readonly description: "Cancel a job and delete its schedule";

package/dist/command-catalog.generated.js

@@ -5512,7 +5512,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "jobs",
-                "description": "List, pause, or cancel an agent's scheduled jobs",
+                "description": "List, pause, resume, or cancel an agent's scheduled jobs",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] [command]",
@@ -5570,6 +5570,32 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "resume",
+                        "description": "Resume a paused job's schedule",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <agentUid> <jobId>",
+                        "arguments": [
+                            {
+                                "name": "agentUid",
+                                "required": true,
+                                "variadic": false
+                            },
+                            {
+                                "name": "jobId",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--company <slug>",
+                                "description": "Company slug (to resolve an agent by name/slug)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "cancel",
                         "description": "Cancel a job and delete its schedule",

package/dist/commands/agents.d.ts

@@ -19,6 +19,7 @@
  *   hq agents revoke <uid> --yes   — revoke an external agent (--remove deletes it)
  *   hq agents jobs list <uid>      — off-box job roster (schedule + rate)
  *   hq agents jobs pause <uid> <jobId>  — flip schedule State=DISABLED
+ *   hq agents jobs resume <uid> <jobId> — flip schedule State=ENABLED
  *   hq agents jobs cancel <uid> <jobId> — delete schedule + drop the job
  *
  * Agents are company-scoped. `--company <slug>` may sit on the group
@@ -320,12 +321,20 @@ export interface PauseJobResult {
     changed: boolean;
     previousState?: string;
 }
+export interface ResumeJobResult {
+    ok: true;
+    jobId: string;
+    scheduleState: "ENABLED" | string;
+    changed: boolean;
+    previousState?: string;
+}
 export interface CancelJobResult {
     ok: true;
     jobId: string;
 }
 export declare function listAgentJobs(token: string, agentUid: string): Promise<AgentJobView[]>;
 export declare function pauseAgentJob(token: string, agentUid: string, jobId: string): Promise<PauseJobResult>;
+export declare function resumeAgentJob(token: string, agentUid: string, jobId: string): Promise<ResumeJobResult>;
 export declare function cancelAgentJob(token: string, agentUid: string, jobId: string): Promise<CancelJobResult>;
 /**
  * Map a jobs-control HTTP error to a single operator-facing line. Pure so the
@@ -336,10 +345,11 @@ export declare function cancelAgentJob(token: string, agentUid: string, jobId: s
  * the agent is cross-company) must print a clear message and exit non-zero,
  * never throw a stack trace.
  */
-export declare function formatJobsHttpError(err: AgentsHttpError, jobId?: string): string;
+export declare function formatJobsHttpError(err: AgentsHttpError, jobId?: string, action?: "resume"): string;
 /** Stable padEnd table: jobId, scheduleState, rate, lastRunOutcome, status. */
 export declare function formatJobsTable(jobs: AgentJobView[]): string;
 export declare function formatPauseResult(result: PauseJobResult): string;
+export declare function formatResumeResult(result: ResumeJobResult): string;
 /** Human-readable "hot-applied to the running box" vs "saved for next launch". */
 export declare function appliedHint(applied: boolean): string;
 /** Stable human table shared by the all-provider and provider-filtered forms. */

package/dist/commands/agents.js

@@ -19,6 +19,7 @@
  *   hq agents revoke <uid> --yes   — revoke an external agent (--remove deletes it)
  *   hq agents jobs list <uid>      — off-box job roster (schedule + rate)
  *   hq agents jobs pause <uid> <jobId>  — flip schedule State=DISABLED
+ *   hq agents jobs resume <uid> <jobId> — flip schedule State=ENABLED
  *   hq agents jobs cancel <uid> <jobId> — delete schedule + drop the job
  *
  * Agents are company-scoped. `--company <slug>` may sit on the group
@@ -790,6 +791,13 @@ export async function pauseAgentJob(token, agentUid, jobId) {
         method: "POST",
     });
 }
+export async function resumeAgentJob(token, agentUid, jobId) {
+    return agentsRequest({
+        token,
+        path: `/v1/agents/${encodeURIComponent(agentUid)}/jobs/${encodeURIComponent(jobId)}/resume`,
+        method: "POST",
+    });
+}
 export async function cancelAgentJob(token, agentUid, jobId) {
     return agentsRequest({
         token,
@@ -806,7 +814,7 @@ export async function cancelAgentJob(token, agentUid, jobId) {
  * the agent is cross-company) must print a clear message and exit non-zero,
  * never throw a stack trace.
  */
-export function formatJobsHttpError(err, jobId) {
+export function formatJobsHttpError(err, jobId, action) {
     if (err.status === 401)
         return "Not authenticated — run `hq login`.";
     // A 403 CROSS_AGENT_JOB is hq-pro's self-only jobs guard, not a role problem:
@@ -816,12 +824,17 @@ export function formatJobsHttpError(err, jobId) {
     // closed locally before the request, see crossAgentJobsRefusal).
     if (err.status === 403 && err.code === "CROSS_AGENT_JOB") {
         return ("Jobs are scoped to the calling agent's own identity — an agent may only " +
-            "list, pause, or cancel its OWN jobs (use the on-box `hq-agent-jobs` tool). " +
+            "list, pause, resume, or cancel its OWN jobs (use the on-box `hq-agent-jobs` tool). " +
             "Managing another agent's jobs needs a person session with owner/admin on " +
             "the company.");
     }
     if (err.status === 403)
         return "You need owner/admin on this company.";
+    if (action === "resume" &&
+        err.status === 404 &&
+        (err.code === "JOB_NOT_FOUND" || err.code === "SCHEDULE_NOT_FOUND")) {
+        return "job not found or its schedule was deleted; it cannot be resumed";
+    }
     if (err.status === 404 && err.code === "JOB_NOT_FOUND") {
         const id = jobId ?? extractQuotedJobId(err.message) ?? "unknown";
         return `Job '${id}' not found.`;
@@ -860,6 +873,12 @@ export function formatPauseResult(result) {
     const from = result.previousState ?? "ENABLED";
     return `Paused ${result.jobId} (${from} → ${result.scheduleState})`;
 }
+export function formatResumeResult(result) {
+    if (!result.changed)
+        return "Already active";
+    const from = result.previousState ?? "DISABLED";
+    return `Resumed ${result.jobId} (${from} → ${result.scheduleState})`;
+}
 /** Human-readable "hot-applied to the running box" vs "saved for next launch". */
 export function appliedHint(applied) {
     return applied
@@ -1119,9 +1138,9 @@ function fail(err) {
     }
     process.exit(1);
 }
-function failJobs(err, jobId) {
+function failJobs(err, jobId, action) {
     if (err instanceof AgentsHttpError) {
-        console.error(chalk.red(formatJobsHttpError(err, jobId)));
+        console.error(chalk.red(formatJobsHttpError(err, jobId, action)));
         process.exit(1);
     }
     fail(err);
@@ -1922,11 +1941,11 @@ export function registerAgentsCommand(program) {
         }
     });
     // Off-box job control (US-003). Nested group so `hq agents jobs --help`
-    // lists list|pause|cancel. Same vaultApiFetch + person JWT as the rest of
+    // lists list|pause|resume|cancel. Same vaultApiFetch + person JWT as the rest of
     // this file; keyed HQ_API_KEY rewrites /v1/agents → /v1/keys/agents.
     const jobs = agents
         .command("jobs")
-        .description("List, pause, or cancel an agent's scheduled jobs");
+        .description("List, pause, resume, or cancel an agent's scheduled jobs");
     jobs
         .command("list <agentUid>")
         .description("List an agent's scheduled jobs")
@@ -1964,6 +1983,20 @@ export function registerAgentsCommand(program) {
             failJobs(err, jobId);
         }
     });
+    jobs
+        .command("resume <agentUid> <jobId>")
+        .description("Resume a paused job's schedule")
+        .option("--company <slug>", "Company slug (to resolve an agent by name/slug)")
+        .action(async function (agentUid, jobId) {
+        const { token, targetUid } = await resolveJobsTargetOrExit(agentUid, companyOf(this));
+        try {
+            const result = await resumeAgentJob(token, targetUid, jobId);
+            console.log(chalk.green(formatResumeResult(result)));
+        }
+        catch (err) {
+            failJobs(err, jobId, "resume");
+        }
+    });
     jobs
         .command("cancel <agentUid> <jobId>")
         .description("Cancel a job and delete its schedule")

package/dist/commands/lanes.js

@@ -37,7 +37,7 @@ import { createOutpostProfileRepinContext, parseOutpostProfileRepinContext, } fr
 import { createOutpostRegistryWorkerApprovalContext, parseOutpostRegistryWorkerApprovalContext, } from "../lib/lanes/outpost-registry-worker-approval.js";
 import { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity, resolveAdmissionHost, } from "../lib/lanes/admission-host.js";
 export { OUTPOST_DIR, OUTPOST_ID_PATH, readOutpostIdentity } from "../lib/lanes/admission-host.js";
-import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, outpostRejectedEffortOption, parseOutpostPickupPayload, PICKUP_WAIT_MS, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
+import { buildOutpostCapacityCommand, buildOutpostIdentityBackfillCommand, buildOutpostLaneCommand, buildOutpostQuestionListCommand, buildOutpostPickupCommand, createOutpostsClient, dispatchErrorMessage, dispatchOutpostPickup, buildOutpostLaneListCommand, REMOTE_LANE_READ_ENV, outpostRejectedEffortOption, parseOutpostPickupPayload, PICKUP_WAIT_MS, stageOutpostPayload, } from "../lib/lanes/outpost-dispatch.js";
 import { outpostHireSummaryCacheKey, LANE_OUTPOST_SNAPSHOT_CACHE_FLAG, OUTPOST_HIRE_SUMMARY_CACHE_TTL_MS, readOutpostHireSummaryCache, readOutpostHireSummaryCacheIncludingStale, writeOutpostHireSummaryCache, } from "../lib/lanes/outpost-hire-cache.js";
 import { buildHostCapacitySnapshot, chooseHostForLane, parseHostCapacitySnapshot, } from "../lib/lanes/host-capacity.js";
 import { BALANCE_MOVABLE_STATES, selectClaudeAccount, } from "../lib/lanes/claude-balance.js";
@@ -1238,17 +1238,17 @@ async function readOutpostLaneRecords(ctx, outpostId, requestedQuery = {}, dispa
     }
     return invocationMemo.getOrCreate(outpostId, query, () => readOutpostSnapshotWithCache(ctx, outpostLaneListSnapshotKey(outpostId, query), isLaneRecordArray, () => readOutpostLaneRecordsUncached(ctx, outpostId, query, dispatchOptions)));
 }
-/** Refresh only primary-created, non-terminal Outpost mirrors in one bounded owner query per Outpost. */
+/** Refresh only this host's non-terminal Outpost mirrors in one bounded owner query per Outpost. */
 async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds) {
     const result = {
         updated: new Map(),
         unverifiedRemote: new Map(),
     };
     const host = reconcileHostFromCtx(ctx);
-    if (host.outpostId !== null || parentLaneIds?.size === 0)
+    if (ctx.env.HQ_LANES_REMOTE_READ === "1" || parentLaneIds?.size === 0)
         return result;
     let primaryIdentity;
-    const originMatchesThisPrimary = (lane) => {
+    const originMatchesThisHost = (lane) => {
         if (lane.origin_host_source !== "imds") {
             return lane.origin_host === host.hostname;
         }
@@ -1261,7 +1261,8 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds) {
     };
     const candidates = records
         .filter((lane) => lane.host.kind === "outpost" &&
-        originMatchesThisPrimary(lane) &&
+        (host.outpostId === null || lane.host.id !== host.outpostId) &&
+        originMatchesThisHost(lane) &&
         (parentLaneIds === undefined || (lane.senior.kind === "lane" &&
             lane.senior.id !== undefined &&
             parentLaneIds.has(lane.senior.id))) &&
@@ -1272,11 +1273,14 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds) {
     const enabledByCompany = new Map();
     const enabledCandidates = [];
     for (const lane of candidates) {
-        const companyKey = JSON.stringify([lane.company?.uid ?? null, lane.company?.slug ?? null]);
+        const company = resolveLaneCompany(hqRoot, lane).company;
+        if (company === null)
+            continue;
+        const companyKey = JSON.stringify([company.uid, company.slug]);
         let enabled = enabledByCompany.get(companyKey);
         if (enabled === undefined) {
             enabled = await readLanesRegistryFlag(LANE_REMOTE_MIRROR_SYNC_FLAG, {
-                company: lane.company,
+                company,
                 env: ctx.env,
             });
             enabledByCompany.set(companyKey, enabled);
@@ -1346,7 +1350,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds) {
                 : undefined;
             const before = readLane(hqRoot, mirror.lane_id);
             if (before.host.kind !== "outpost" || before.host.id !== outpostId ||
-                !originMatchesThisPrimary(before) || isTerminalLaneState(before.state)) {
+                !originMatchesThisHost(before) || isTerminalLaneState(before.state)) {
                 result.updated.set(mirror.lane_id, before);
                 continue;
             }
@@ -1365,7 +1369,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds) {
             }
             const updated = retryUpdateLane(hqRoot, mirror.lane_id, "reconcile", (current) => {
                 if (current.host.kind !== "outpost" || current.host.id !== outpostId ||
-                    !originMatchesThisPrimary(current) || isTerminalLaneState(current.state))
+                    !originMatchesThisHost(current) || isTerminalLaneState(current.state))
                     return current;
                 return {
                     ...current,
@@ -4543,9 +4547,12 @@ async function runList(ctx, opts, fastRouteFlags) {
         });
         return;
     }
-    const remoteRefresh = await refreshRemoteLaneMirrors(ctx, hqRoot, laneSource, new Set(selectedLanes
-        .filter((lane) => !isTerminalLaneState(lane.state))
-        .map((lane) => lane.lane_id)));
+    const remoteRead = ctx.env[REMOTE_LANE_READ_ENV] === "1";
+    const remoteRefresh = remoteRead
+        ? { updated: new Map(), unverifiedRemote: new Map() }
+        : await refreshRemoteLaneMirrors(ctx, hqRoot, laneSource, new Set(selectedLanes
+            .filter((lane) => !isTerminalLaneState(lane.state))
+            .map((lane) => lane.lane_id)));
     for (const [laneId, updated] of remoteRefresh.updated) {
         const index = laneSource.findIndex((lane) => lane.lane_id === laneId);
         if (index >= 0)
@@ -4563,7 +4570,8 @@ async function runList(ctx, opts, fastRouteFlags) {
     }
     const ownerEligibleLaneIds = new Set();
     for (const lane of selectedLanes) {
-        if (lane.host.kind !== "outpost" ||
+        if (remoteRead ||
+            lane.host.kind !== "outpost" ||
             isTerminalLaneState(lane.state) ||
             laneRunsHere(lane, host)) {
             continue;
@@ -4713,8 +4721,8 @@ async function runList(ctx, opts, fastRouteFlags) {
         };
     });
     const placementCompany = company ?? processLanePlacementCompany(ctx);
-    const placementEnabled = fastRouteFlags?.lanePlacementEnabled ??
-        await readLanePlacementEnabled(ctx, placementCompany);
+    const placementEnabled = !remoteRead && (fastRouteFlags?.lanePlacementEnabled ??
+        await readLanePlacementEnabled(ctx, placementCompany));
     const host_capacity = placementEnabled
         ? (await loadHostCapacitySnapshots(ctx, hqRoot, undefined, allLanes)).entries
         : undefined;
@@ -6801,14 +6809,18 @@ const CANONICAL_LOG_STREAMS = [
 async function runLogs(ctx, laneId, opts) {
     const hqRoot = ctx.hqRoot();
     const lane = readLane(hqRoot, laneId);
+    const remoteMirrorCompany = lane.host.kind === "outpost"
+        ? resolveLaneCompany(hqRoot, lane).company
+        : null;
     const tail = parseOptionalInt(opts.tail, "--tail");
     if (tail === 0) {
         throw new LanesError("invalid_integer", "--tail must be a positive integer", { flag: "--tail", value: opts.tail });
     }
     if (lane.host.kind === "outpost" &&
         !laneRunsHere(lane, reconcileHostFromCtx(ctx)) &&
+        remoteMirrorCompany !== null &&
         await readLanesRegistryFlag(LANE_REMOTE_MIRROR_SYNC_FLAG, {
-            company: lane.company,
+            company: remoteMirrorCompany,
             env: ctx.env,
         })) {
         const outpostId = lane.host.id;

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -81,6 +81,14 @@ export declare function parseOutpostPickupPayload(raw: unknown): OutpostPickupPa
 export declare function buildOutpostPickupCommand(payloadUrl: string): string;
 /** Bounded, read-only capacity query executed by the target Outpost CLI. */
 export declare function buildOutpostCapacityCommand(): string;
+/**
+ * Marks a lane list that runs on an Outpost for another host. Such a list
+ * answers from the box's own records and never dispatches to other Outposts:
+ * two boxes that each hold a lane placed on the other would otherwise run
+ * lists on each other without end. `env` keeps older CLIs working, since they
+ * ignore the variable instead of rejecting an unknown flag.
+ */
+export declare const REMOTE_LANE_READ_ENV = "HQ_LANES_REMOTE_READ";
 /** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export declare function buildOutpostLaneListCommand(input?: {
     hqBinary?: string;

package/dist/lib/lanes/outpost-dispatch.js

@@ -65,9 +65,19 @@ export function buildOutpostPickupCommand(payloadUrl) {
 export function buildOutpostCapacityCommand() {
     return withRemoteHqDir(joinCommandParts(["hq", "lanes", "capacity", "--json"]));
 }
+/**
+ * Marks a lane list that runs on an Outpost for another host. Such a list
+ * answers from the box's own records and never dispatches to other Outposts:
+ * two boxes that each hold a lane placed on the other would otherwise run
+ * lists on each other without end. `env` keeps older CLIs working, since they
+ * ignore the variable instead of rejecting an unknown flag.
+ */
+export const REMOTE_LANE_READ_ENV = "HQ_LANES_REMOTE_READ";
 /** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export function buildOutpostLaneListCommand(input = {}) {
     const args = [
+        "env",
+        `${REMOTE_LANE_READ_ENV}=1`,
         input.hqBinary?.trim() || "hq",
         "lanes",
         "list",

package/dist/lib/mesh/live/daemon/credentials.js

@@ -562,13 +562,21 @@ export function normalizePersonalRealtimeBundle(raw) {
     }
     if (!topics.dm && typeof r.topic === "string")
         topics.dm = r.topic;
+    const agentInboxTopic = typeof r.agentInboxTopic === "string" ? r.agentInboxTopic.trim() : "";
     const actorUid = (typeof r.principalUid === "string" && /^(?:prs|agt)_[A-Za-z0-9]+$/.test(r.principalUid)
         ? r.principalUid
         : undefined) ||
         actorUidFromPersonalTopic(topics.dm) ||
+        actorUidFromPersonalTopic(agentInboxTopic) ||
         "";
     if (!actorUid)
         throw new Error("contract-2 vend could not derive actorUid");
+    // hq-pro advertises the agent's own inbox topic as a top-level capability.
+    // Keep it only for the exact actor-owned topic; it reuses this personal MQTT
+    // session and never grants the subscriber a topic supplied by another actor.
+    if (actorUid.startsWith("agt_") && agentInboxTopic === `hq/${actorUid}/inbox`) {
+        topics.inbox = agentInboxTopic;
+    }
     // Only keep topics that belong to the vended principal.
     for (const [k, v] of Object.entries(topics)) {
         if (actorUidFromPersonalTopic(v) !== actorUid)

package/dist/lib/mesh/live/daemon/work-subscribe.d.ts

@@ -14,6 +14,7 @@ export interface WorkCacheMqtt {
 export interface WorkCacheSubscriber {
     stop: () => Promise<void>;
 }
+export declare const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
 export declare function startWorkCacheSubscriber(opts: {
     meshRoot: string;
     fetchCredentials?: PersonalCredentialsFetcher;

package/dist/lib/mesh/live/daemon/work-subscribe.js

@@ -2,10 +2,57 @@
  * Contract-2 subscriber for the personal work topic.
  * Owns live-cache.json writes. Presence publish stays on PresenceClient.
  */
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { createPersonalRealtimeFetcher, } from "./credentials.js";
 import { presignIotWssUrl } from "./presign.js";
 import { applyProjectViewPush, parseProjectViewPush } from "./live-cache.js";
 import { backoffDelayMs, RECONNECT_MIN_DELAY_MS } from "./presence.js";
+export const AGENT_INBOX_PUSH_STATE_BASENAME = "agent-inbox-push.json";
+const INBOX_PUSH_HEARTBEAT_MS = 5_000;
+function readInboxWakeSequence(meshRoot, onInfo) {
+    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
+    try {
+        const info = fs.lstatSync(target);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            onInfo?.("agent inbox push state read ignored (not a regular file)");
+            return 0;
+        }
+        const parsed = JSON.parse(fs.readFileSync(target, "utf8"));
+        if (Number.isSafeInteger(parsed.wakeSequence) && Number(parsed.wakeSequence) >= 0) {
+            return Number(parsed.wakeSequence);
+        }
+        onInfo?.("agent inbox push state read ignored (invalid wake sequence)");
+        return 0;
+    }
+    catch (error) {
+        if (error.code !== "ENOENT") {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            onInfo?.(`agent inbox push state read failed (${name})`);
+        }
+        return 0;
+    }
+}
+function writeInboxPushState(meshRoot, state) {
+    fs.mkdirSync(meshRoot, { recursive: true, mode: 0o700 });
+    const target = path.join(meshRoot, AGENT_INBOX_PUSH_STATE_BASENAME);
+    const temporary = `${target}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+        fs.chmodSync(temporary, 0o600);
+        fs.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (cleanupError) {
+            if (cleanupError.code !== "ENOENT")
+                throw cleanupError;
+        }
+        throw error;
+    }
+}
 export async function startWorkCacheSubscriber(opts) {
     const fetchCredentials = opts.fetchCredentials ??
         (opts.token
@@ -28,10 +75,48 @@ export async function startWorkCacheSubscriber(opts) {
     let reconnectLogged = false;
     let attempt = 0;
     let timer = null;
+    let heartbeatTimer = null;
     let generation = 0;
+    let inboxSubscribed = false;
+    // Carry the sequence forward from the last state marker so a daemon restart
+    // cannot reuse a value the watcher has already consumed.
+    let wakeSequence = readInboxWakeSequence(opts.meshRoot, opts.onInfo);
+    const clearInboxHeartbeat = () => {
+        if (heartbeatTimer !== null)
+            timers.clearTimeout(heartbeatTimer);
+        heartbeatTimer = null;
+    };
+    const persistInboxState = (connected) => {
+        try {
+            writeInboxPushState(opts.meshRoot, {
+                connected,
+                heartbeatAtMs: now().getTime(),
+                wakeSequence,
+            });
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "UnknownError";
+            opts.onInfo?.(`agent inbox push state write failed (${name})`);
+        }
+    };
+    const scheduleInboxHeartbeat = () => {
+        if (stopped || !inboxSubscribed)
+            return;
+        clearInboxHeartbeat();
+        heartbeatTimer = timers.setTimeout(() => {
+            heartbeatTimer = null;
+            if (!stopped && inboxSubscribed) {
+                persistInboxState(true);
+                scheduleInboxHeartbeat();
+            }
+        }, INBOX_PUSH_HEARTBEAT_MS);
+    };
     const connect = async () => {
         if (stopped)
             return;
+        inboxSubscribed = false;
+        clearInboxHeartbeat();
+        persistInboxState(false);
         const gen = ++generation;
         let bundle;
         try {
@@ -44,8 +129,12 @@ export async function startWorkCacheSubscriber(opts) {
         if (stopped || gen !== generation)
             return;
         const topic = bundle.topics.work;
-        if (!topic) {
-            opts.onInfo?.("work cache subscribe skipped: credentials have no work topic");
+        const inboxTopic = bundle.actorUid.startsWith("agt_") &&
+            bundle.topics.inbox === `hq/${bundle.actorUid}/inbox`
+            ? bundle.topics.inbox
+            : undefined;
+        if (!topic && !inboxTopic) {
+            opts.onInfo?.("work cache subscribe skipped: credentials have no supported topic");
             return;
         }
         const url = presignIotWssUrl(bundle.credentials, bundle.iotEndpoint, bundle.region, now());
@@ -60,12 +149,55 @@ export async function startWorkCacheSubscriber(opts) {
             if (stopped || gen !== generation)
                 return;
             reconnectLogged = false;
-            attempt = 0;
-            next.subscribe(topic, { qos: 1 }, () => undefined);
+            let pendingSubscriptions = Number(Boolean(topic)) + Number(Boolean(inboxTopic));
+            let subscriptionFailed = false;
+            const finishSubscription = (err) => {
+                if (err) {
+                    if (subscriptionFailed)
+                        return;
+                    subscriptionFailed = true;
+                    schedule(err);
+                    next.end(true);
+                    return;
+                }
+                if (subscriptionFailed)
+                    return;
+                pendingSubscriptions -= 1;
+                if (pendingSubscriptions === 0)
+                    attempt = 0;
+            };
+            if (topic) {
+                next.subscribe(topic, { qos: 1 }, (err) => finishSubscription(err));
+            }
+            if (inboxTopic) {
+                next.subscribe(inboxTopic, { qos: 1 }, (err) => {
+                    if (stopped || gen !== generation)
+                        return;
+                    if (err) {
+                        inboxSubscribed = false;
+                        clearInboxHeartbeat();
+                        persistInboxState(false);
+                        opts.onInfo?.("agent inbox push subscribe failed");
+                        finishSubscription(err);
+                        return;
+                    }
+                    inboxSubscribed = true;
+                    persistInboxState(true);
+                    scheduleInboxHeartbeat();
+                    finishSubscription();
+                });
+            }
         });
         next.on("message", (_topic, payload) => {
             if (stopped || gen !== generation)
                 return;
+            if (inboxTopic && _topic === inboxTopic && inboxSubscribed) {
+                // A topic message is a doorbell only. Never parse, persist, or log its
+                // content; the authenticated inbox GET remains the source of truth.
+                wakeSequence += 1;
+                persistInboxState(true);
+                return;
+            }
             if (_topic !== topic)
                 return;
             const push = parseProjectViewPush(payload);
@@ -79,11 +211,14 @@ export async function startWorkCacheSubscriber(opts) {
         next.on("close", () => {
             if (stopped || gen !== generation)
                 return;
+            inboxSubscribed = false;
+            clearInboxHeartbeat();
+            persistInboxState(false);
             schedule();
         });
     };
     const schedule = (err) => {
-        if (stopped)
+        if (stopped || timer !== null)
             return;
         if (!reconnectLogged) {
             reconnectLogged = true;
@@ -106,6 +241,9 @@ export async function startWorkCacheSubscriber(opts) {
             generation += 1;
             if (timer !== null)
                 timers.clearTimeout(timer);
+            clearInboxHeartbeat();
+            inboxSubscribed = false;
+            persistInboxState(false);
             const current = client;
             client = null;
             if (!current)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.283.0",
+  "version": "5.285.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {