@indigoai-us/hq-cli 5.286.0 → 5.287.0

package/dist/commands/cloud-provision.js

@@ -266,6 +266,21 @@ export function writeCompanyConfig(hqRoot, slug, config) {
     return true;
 }
 // ── Vault HTTP client (real impl) ────────────────────────────────────────────
+const VAULT_REQUEST_TIMEOUT_MS = 15_000;
+/** Run a complete Vault HTTP operation under a finite deadline. */
+async function withVaultRequest(url, init, readResponse) {
+    const deadline = AbortSignal.timeout(VAULT_REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, { ...init, signal: deadline });
+        return await readResponse(res);
+    }
+    catch (err) {
+        if (deadline.aborted) {
+            throw new ProvisionError(1, `Vault request timed out after ${VAULT_REQUEST_TIMEOUT_MS}ms`);
+        }
+        throw err;
+    }
+}
 /**
  * Default vault HTTP client backed by global `fetch`. Uses the `/v1/entities`
  * route surface (matches AppBar `vault_client.rs` and hq-pro handler routes).
@@ -284,52 +299,56 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
     return {
         async listMyPersonEntities() {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-type/person`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (res.status === 404)
-                return [];
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            return data.entities ?? [];
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (res.status === 404)
+                    return [];
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/by-type/person failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                return data.entities ?? [];
+            });
         },
         async findCompanyBySlug(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/by-slug/company/${encodeURIComponent(slug)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (res.status === 404)
-                return null;
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
-            }
-            return data.entity;
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (res.status === 404)
+                    return null;
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET by-slug failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault GET by-slug returned 200 with no entity body`);
+                }
+                return data.entity;
+            });
         },
         async checkSlugInMyNamespace(slug) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/check-slug/me?type=company&slug=${encodeURIComponent(slug)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            return (await res.json());
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/check-slug/me failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                return (await res.json());
+            });
         },
         async getCompanyByUid(uid) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            const res = await fetch(url, { method: "GET", headers });
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
-            }
-            return data.entity;
+            return withVaultRequest(url, { method: "GET", headers }, async (res) => {
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault GET /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault GET /entity/${uid} returned 200 with no entity body`);
+                }
+                return data.entity;
+            });
         },
         async createCompanyEntity(input) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity`;
@@ -340,54 +359,56 @@ export function createDefaultVaultClient(apiUrl, accessToken) {
             };
             if (input.ownerUid)
                 body.ownerUid = input.ownerUid;
-            const res = await fetch(url, {
+            return withVaultRequest(url, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
+            }, async (res) => {
+                if (!res.ok) {
+                    const text = await safeBody(res);
+                    // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
+                    // in their namespace (owned ∪ active-member-of). Under the
+                    // per-user-namespace model this is the new same-user-collision
+                    // signal — distinct from the legacy global EntityAlreadyExists.
+                    // The CLI normally reaches `createCompanyEntity` only after
+                    // `checkSlugInMyNamespace` reported `available: true`, so a
+                    // 409 here means a race between the pre-check and the POST.
+                    // Surface the response body verbatim so the caller can see the
+                    // `code` + `conflictingCompanyUid` and resolve / retry.
+                    throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
+                }
+                const data = (await res.json());
+                if (!data.entity) {
+                    throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
+                }
+                return data.entity;
             });
-            if (!res.ok) {
-                const text = await safeBody(res);
-                // 409 SLUG_IN_USE_FOR_PERSON: the caller already has the slug
-                // in their namespace (owned ∪ active-member-of). Under the
-                // per-user-namespace model this is the new same-user-collision
-                // signal — distinct from the legacy global EntityAlreadyExists.
-                // The CLI normally reaches `createCompanyEntity` only after
-                // `checkSlugInMyNamespace` reported `available: true`, so a
-                // 409 here means a race between the pre-check and the POST.
-                // Surface the response body verbatim so the caller can see the
-                // `code` + `conflictingCompanyUid` and resolve / retry.
-                throw new ProvisionError(1, `Vault POST /entity failed: ${res.status} ${res.statusText} — ${text}`);
-            }
-            const data = (await res.json());
-            if (!data.entity) {
-                throw new ProvisionError(1, `Vault POST /entity returned ${res.status} with no entity body`);
-            }
-            return data.entity;
         },
         async softDeleteCompany(uid) {
             const url = `${apiUrl.replace(/\/$/, "")}/entity/${encodeURIComponent(uid)}`;
-            const res = await fetch(url, { method: "DELETE", headers });
-            if (res.status === 403) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
-            }
-            if (res.status === 404) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
-            }
-            if (res.status === 400) {
-                const body = await safeBody(res);
-                throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            if (!res.ok) {
-                const body = await safeBody(res);
-                throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
-            }
-            const data = (await res.json());
-            if (data.deleted !== true || typeof data.uid !== "string") {
-                throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
-            }
-            return { deleted: true, uid: data.uid };
+            return withVaultRequest(url, { method: "DELETE", headers }, async (res) => {
+                if (res.status === 403) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Refusing to retire '${uid}': only the company owner can soft-tombstone it. ${body}`);
+                }
+                if (res.status === 404) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: not found — ${body}`);
+                }
+                if (res.status === 400) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(2, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                if (!res.ok) {
+                    const body = await safeBody(res);
+                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} failed: ${res.status} ${res.statusText} — ${body}`);
+                }
+                const data = (await res.json());
+                if (data.deleted !== true || typeof data.uid !== "string") {
+                    throw new ProvisionError(1, `Vault DELETE /entity/${uid} returned ${res.status} with no deleted confirmation`);
+                }
+                return { deleted: true, uid: data.uid };
+            });
         },
     };
 }

package/dist/commands/core-native-handoff-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
+export declare const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
+export declare function coreNativeHandoffEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-native-handoff-flag.d.ts.map

package/dist/commands/core-native-handoff-flag.js

@@ -0,0 +1,7 @@
+/** Default-off rollout gate for the native Wave 2 worktree/resume helpers. */
+export const CORE_NATIVE_HANDOFF_FLAG = "core-native-handoff";
+export async function coreNativeHandoffEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_NATIVE_HANDOFF_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-native-handoff-flag.js.map

package/dist/commands/core.js

@@ -52,6 +52,8 @@ import { qmdReindexAfterSync } from "../lib/core-utils/qmd-reindex-after-sync.js
 import { softTimeoutCommand } from "../lib/core-utils/soft-timeout.js";
 import { timeoutGuardCommand } from "../lib/core-utils/timeout-guard.js";
 import { readSentryReportStdin, reportSentryEvent } from "../lib/core-utils/sentry-report.js";
+import { CLEAN_HANDOFF_ASSET, RESUME_LOCK_ASSET, VERIFY_DELIVERABLES_ASSET, WORKTREE_GC_ASSET, runCleanWorktreeReconcileHandoff, runResumeThreadLock, runVerifyStoryDeliverables, runWorktreeGc, } from "../lib/core-utils/worktree-resume.js";
+import { coreNativeHandoffEnabled } from "./core-native-handoff-flag.js";
 import { describeCoreCommand, registeredCoreCommandListing, } from "./core-command-catalog.js";
 /**
  * These commands are now native implementations. Their retained shell assets
@@ -216,6 +218,12 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/lib/session-scope-capability.sh", root: "live", summary: "Session scope-capability lib sourced by hq-session" },
     { asset: "core/scripts/lib/session-id.sh", root: "live", summary: "Session-id resolver lib sourced by hq-session" },
     { asset: "core/scripts/lib/work-mesh-enqueue.sh", root: "live", summary: "Work Mesh Live spool enqueue lib sourced by hooks" },
+    // Wave 2 handoff/worktree commands retain their old scripts for one release,
+    // behind the shared default-off rollback flag.
+    { asset: WORKTREE_GC_ASSET, root: "live", summary: "Rollback companion for native worktree-gc" },
+    { asset: CLEAN_HANDOFF_ASSET, root: "cwd", summary: "Rollback companion for native clean-worktree-reconcile-handoff" },
+    { asset: RESUME_LOCK_ASSET, root: "live", summary: "Rollback companion for native resume-thread-lock" },
+    { asset: VERIFY_DELIVERABLES_ASSET, root: "live", summary: "Rollback companion for native verify-story-deliverables" },
     // Wave 1a delegate shells remain bundled as the default-off rollback path.
     // Their roots mirror the original scripts; pickup does not read an HQ root.
     { asset: "core/scripts/hq-delegate-resolve.sh", root: "live", summary: "Rollback shell for native delegate resolve" },
@@ -320,6 +328,43 @@ export function registerCoreCommands(program) {
     registerCoreDelegateCommand(core);
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
+    // Wave 2 handoff/worktree commands retain their byte-identical shell assets
+    // as a default-off rollback path for one release. Keep the gate helper small
+    // so sibling Wave 2 work can reuse it without editing this command table.
+    const handoffCommands = [
+        { name: "worktree-gc", asset: WORKTREE_GC_ASSET, root: "live", summary: "Safely collect old, preserved HQ worktrees", run: (args, root) => runWorktreeGc(args, root) },
+        { name: "clean-worktree-reconcile-handoff", asset: CLEAN_HANDOFF_ASSET, root: "cwd", summary: "Remove only byte-identical incoming handoff mirrors", run: (args) => runCleanWorktreeReconcileHandoff(args) },
+        { name: "resume-thread-lock", asset: RESUME_LOCK_ASSET, root: "live", summary: "Inspect or acquire a durable resumework lock", run: (args, root) => runResumeThreadLock(args, root) },
+        { name: "verify-story-deliverables", asset: VERIFY_DELIVERABLES_ASSET, root: "live", summary: "Check declared and returned story deliverables", run: (args, root) => runVerifyStoryDeliverables(args, root) },
+    ];
+    for (const entry of handoffCommands) {
+        const command = core
+            .command(entry.name)
+            .description(entry.summary)
+            .allowUnknownOption()
+            .allowExcessArguments()
+            .helpOption(false)
+            .argument("[args...]")
+            .action(async (args = [], _options, cmd) => {
+            const scope = core.opts();
+            const operands = cmd.args.length > 0 ? cmd.args : args;
+            if (!await coreNativeHandoffEnabled()) {
+                if (entry.root === "live")
+                    runEntry(entry, scope, operands);
+                else {
+                    const result = runBundledScript({ asset: entry.asset, args: operands, cwd: process.cwd() });
+                    if (result.code !== 0)
+                        process.exit(result.code);
+                }
+                return;
+            }
+            const { cwd, hqRoot } = resolveEntryRoot(entry, scope);
+            const code = await entry.run(operands, hqRoot ?? cwd);
+            if (code !== 0)
+                process.exit(code);
+        });
+        describeCoreCommand(command, { execution: "native", asset: entry.asset, root: entry.root });
+    }
     // These command names intentionally own native implementations. Their
     // similarly named scaffold assets are forwarders, so sending them through
     // runEntry would recurse back into this command forever.

package/dist/commands/lanes.js

@@ -29,6 +29,7 @@ import { registerLaneReviewCommand } from "./lanes-review.js";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
+import { startOutpostLaneSnapshotRefresh } from "../lib/lanes/outpost-snapshot-refresh.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { getOrFetchOutpostSnapshot, OUTPOST_SNAPSHOT_CACHE_TTL_MS, outpostLaneListSnapshotKey, OutpostSnapshotInvocationMemo, } from "../lib/lanes/outpost-snapshot-cache.js";
@@ -1025,34 +1026,6 @@ async function readOutpostSnapshotWithCache(ctx, key, isValue, fetch) {
         return fetch();
     return getOrFetchOutpostSnapshot({ hqRoot: ctx.hqRoot(), key, isValue, fetch });
 }
-function startOutpostLaneSnapshotRefresh(root, env) {
-    let entry;
-    try {
-        const currentEntry = process.argv[1];
-        if (!currentEntry)
-            throw new Error("process.argv[1] is empty");
-        entry = fs.realpathSync(currentEntry);
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not resolve the running CLI entry: ${dispatchErrorMessage(err)}\n`);
-        return;
-    }
-    try {
-        const child = spawn(process.execPath, [...process.execArgv, entry, "lanes", "list"], {
-            cwd: root,
-            detached: true,
-            stdio: ["ignore", "ignore", "inherit"],
-            env: { ...env, HQ_ROOT: root, HQ_NO_UPDATE_CHECK: "1", HQ_INTERNAL_LANES_REFRESH_REMOTE_SNAPSHOT: "1" },
-        });
-        child.once("error", (err) => {
-            process.stderr.write(`lanes snapshot refresh could not start: ${dispatchErrorMessage(err)}\n`);
-        });
-        child.unref();
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not start: ${dispatchErrorMessage(err)}\n`);
-    }
-}
 function isLaneRecordArray(value) {
     if (!Array.isArray(value))
         return false;

package/dist/commands/team-sync.js

@@ -16,6 +16,7 @@ import chalk from 'chalk';
 import simpleGit from 'simple-git';
 import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
+import { readCompaniesManifestMap } from '../lib/work-context/repo-remote.js';
 // ─── API helpers ────────────────────────────────────────────────────────────
 const API_BASE = 'https://example.com/api';
 async function apiGet(urlPath, token) {
@@ -137,15 +138,38 @@ function getTrackedFiles(repoDir) {
 function discoverTeamDirs(hqRoot) {
     const companiesDir = path.join(hqRoot, 'companies');
     if (!fs.existsSync(companiesDir)) {
-        return [];
+        return {
+            teams: [],
+            cloudSyncedCompanyNames: [],
+            nonCloudBackedCompanyNames: [],
+            diagnostics: [`companies directory ${companiesDir}: missing`],
+        };
+    }
+    let entries;
+    try {
+        entries = fs.readdirSync(companiesDir, { withFileTypes: true });
     }
+    catch (error) {
+        return {
+            teams: [],
+            cloudSyncedCompanyNames: [],
+            nonCloudBackedCompanyNames: [],
+            diagnostics: [
+                `companies directory ${companiesDir}: could not read (${error instanceof Error ? error.message : 'unknown error'})`,
+            ],
+        };
+    }
+    const companyDirs = entries.filter((entry) => entry.isDirectory());
     const results = [];
-    for (const entry of fs.readdirSync(companiesDir, { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
+    const missingTeamJson = [];
+    const invalidTeamJson = [];
+    const companiesManifest = readCompaniesManifestMap(hqRoot) ?? {};
+    for (const entry of companyDirs) {
         const teamJsonPath = path.join(companiesDir, entry.name, 'team.json');
-        if (!fs.existsSync(teamJsonPath))
+        if (!fs.existsSync(teamJsonPath)) {
+            missingTeamJson.push(teamJsonPath);
             continue;
+        }
         try {
             const raw = fs.readFileSync(teamJsonPath, 'utf-8');
             const meta = JSON.parse(raw);
@@ -155,12 +179,31 @@ function discoverTeamDirs(hqRoot) {
                     meta,
                 });
             }
+            else {
+                invalidTeamJson.push(teamJsonPath);
+            }
         }
         catch {
-            // Skip malformed team.json
+            invalidTeamJson.push(teamJsonPath);
         }
     }
-    return results;
+    const missingTeamJsonCompanyNames = missingTeamJson.map((file) => path.basename(path.dirname(file)));
+    const isCloudBacked = (name) => {
+        const cloudUid = companiesManifest[name]?.cloud_uid;
+        return typeof cloudUid === 'string' && cloudUid.trim().length > 0;
+    };
+    return {
+        teams: results,
+        cloudSyncedCompanyNames: missingTeamJsonCompanyNames.filter(isCloudBacked),
+        nonCloudBackedCompanyNames: missingTeamJsonCompanyNames.filter((name) => !isCloudBacked(name)),
+        diagnostics: [
+            `HQ root resolver: resolveDefaultHqRoot() returned ${hqRoot}`,
+            `companies directory ${companiesDir}: present; ${companyDirs.length} direct company directories found`,
+            `team.json discovery: ${results.length} valid, ${missingTeamJson.length} missing, ${invalidTeamJson.length} unreadable or invalid`,
+            ...missingTeamJson.map((file) => `${file}: missing`),
+            ...invalidTeamJson.map((file) => `${file}: unreadable or invalid`),
+        ],
+    };
 }
 /**
  * Sync a single team directory:
@@ -308,9 +351,27 @@ export function registerTeamSyncCommand(program) {
         try {
             const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
             // 1. Discover team directories
-            let teamDirs = discoverTeamDirs(hqRoot);
+            const discovery = discoverTeamDirs(hqRoot);
+            let teamDirs = discovery.teams;
             if (teamDirs.length === 0) {
-                console.log(chalk.yellow('No team directories found. Join a team first with: npx create-hq'));
+                console.log(chalk.yellow('No joined team directories found; no team sync ran.'));
+                if (discovery.cloudSyncedCompanyNames.length > 0) {
+                    const companyNames = discovery.cloudSyncedCompanyNames
+                        .map((name) => `"${name}"`)
+                        .join(', ');
+                    console.log(chalk.yellow(`Companies ${companyNames} are cloud-synced and do not have team.json. ` +
+                        'hq team-sync only handles git team repositories with team.json.'));
+                    console.log(chalk.dim('Use `hq sync pull --all` to sync company vault files and `hq sync status` to check their local sync state.'));
+                }
+                if (discovery.nonCloudBackedCompanyNames.length > 0) {
+                    const companyNames = discovery.nonCloudBackedCompanyNames
+                        .map((name) => `"${name}"`)
+                        .join(', ');
+                    console.log(`Companies ${companyNames} have no team.json and are not cloud-backed.`);
+                }
+                for (const diagnostic of discovery.diagnostics) {
+                    console.log(chalk.dim(`  ${diagnostic}`));
+                }
                 return;
             }
             // Filter to specific team if requested
@@ -318,7 +379,7 @@ export function registerTeamSyncCommand(program) {
                 teamDirs = teamDirs.filter((t) => t.meta.team_slug === options.team);
                 if (teamDirs.length === 0) {
                     console.log(chalk.red(`Team "${options.team}" not found. Available teams:`));
-                    for (const t of discoverTeamDirs(hqRoot)) {
+                    for (const t of discoverTeamDirs(hqRoot).teams) {
                         console.log(`  - ${t.meta.team_slug} (${t.meta.team_name})`);
                     }
                     process.exit(1);

package/dist/fast-lanes-list-route.js

@@ -1,5 +1,6 @@
 import { isFastCachedLanesListRequest } from "./fast-scaffold.js";
 import { fastFlagEnabled } from "./native-fast-route.js";
+import { registerOutpostLaneSnapshotRefreshChild } from "./lib/lanes/outpost-snapshot-refresh.js";
 import { LANE_OUTPOST_SNAPSHOT_CACHE_FLAG } from "./lib/lanes/outpost-hire-cache.js";
 import { LANE_OUTPOST_LOAD_BALANCING_FLAG } from "./lib/lanes/flag-keys.js";
 /** Returns false unless this exact list form is safely enabled in the local flag snapshot. */
@@ -14,6 +15,7 @@ export async function runFastLanesListRequest(argv, env = process.env, deps = {
         await runFastCachedLanesListFromEntrypoint();
     },
 }) {
+    registerOutpostLaneSnapshotRefreshChild(env);
     if (!isFastCachedLanesListRequest(argv))
         return false;
     if (env.HQ_INTERNAL_LANES_REFRESH_REMOTE_SNAPSHOT === "1")

package/dist/fast-lanes-list.js

@@ -1,10 +1,10 @@
-import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { compareLaneQueueOrder, laneRunsOnHost } from "./lib/lanes/admission.js";
 import { readOutpostIdentity, resolveAdmissionHost } from "./lib/lanes/admission-host.js";
 import { LaneSchemaError, isLanesError } from "./lib/lanes/errors.js";
+import { startOutpostLaneSnapshotRefresh } from "./lib/lanes/outpost-snapshot-refresh.js";
 import { OUTPOST_HIRE_SUMMARY_CACHE_TTL_MS, outpostHireSummaryCacheKey, readOutpostHireSummaryCacheIncludingStale, } from "./lib/lanes/outpost-hire-cache.js";
 import { resolveLanesHqRoot } from "./lib/lanes/hq-root.js";
 import { laneStories } from "./lib/lanes/stories.js";
@@ -82,34 +82,6 @@ function isOverdue(hqRoot, laneId, now) {
         return false;
     return now.getTime() > at;
 }
-function startOutpostLaneSnapshotRefresh(root, env) {
-    let entry;
-    try {
-        const currentEntry = process.argv[1];
-        if (!currentEntry)
-            throw new Error("process.argv[1] is empty");
-        entry = fs.realpathSync(currentEntry);
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not resolve the running CLI entry: ${errorMessage(err)}\n`);
-        return;
-    }
-    try {
-        const child = spawn(process.execPath, [...process.execArgv, entry, "lanes", "list"], {
-            cwd: root,
-            detached: true,
-            stdio: ["ignore", "ignore", "inherit"],
-            env: { ...env, HQ_ROOT: root, HQ_NO_UPDATE_CHECK: "1", HQ_INTERNAL_LANES_REFRESH_REMOTE_SNAPSHOT: "1" },
-        });
-        child.once("error", (err) => {
-            process.stderr.write(`lanes snapshot refresh could not start: ${errorMessage(err)}\n`);
-        });
-        child.unref();
-    }
-    catch (err) {
-        process.stderr.write(`lanes snapshot refresh could not start: ${errorMessage(err)}\n`);
-    }
-}
 function isOwnerLane(lane, host) {
     return lane.host.kind === "outpost" &&
         !isTerminalLaneState(lane.state) &&

package/dist/lib/core-utils/sentry-report.js

@@ -44,9 +44,6 @@ const HOOK_TIMEOUT_EXCEEDED_TYPE = "hook_timeout_exceeded";
 const HOOK_LATE_FINISH_TYPE = "hook_late_finish";
 const HOOK_TIMEOUT_WARNING_METRIC = "hq.hook_timeout_warning";
 const HOOK_TIMEOUT_EXCEEDED_METRIC = "hq.hook_timeout_exceeded";
-const HOOK_TIMEOUT_EXCEEDED_FINGERPRINT = "hook-timeout-exceeded";
-const HOOK_TIMEOUT_WARNING_FINGERPRINT = "hook-timeout";
-const HOOK_TIMEOUT_MACHINE_WIDE_FINGERPRINT = "hq-hook-slow";
 const MAX_HOOK_SEQUENCE_ENTRIES = 20;
 const MAX_HOOK_TIMEOUT_DEBUG_PHASES = 24;
 const MAX_HOOK_TIMEOUT_DEBUG_MS = 86_400_000;
@@ -580,10 +577,9 @@ function hookTimeoutDebugContextTags(context) {
 }
 function safeSlowChild(metadata) {
     const value = metadata.slow_child;
-    if (typeof value !== "string" || value.length === 0)
+    if (typeof value !== "string" || !SAFE_HOOK_SCRIPT.test(value))
         return "other";
-    const script = basenameFromPath(value);
-    return KNOWN_HOOK_SCRIPTS.has(script) ? script : "other";
+    return value;
 }
 function isMachineWideHookSlowness(metadata) {
     const spawnMs = metadata.spawn_ms;
@@ -621,6 +617,7 @@ function hookTimeoutTags(event) {
     const loadAverage = parsedLoadAverage(metadata);
     const slowChildMs = metadata.slow_child_ms;
     return {
+        hook_timeout_kind: hookTimeoutKind(event),
         hook_event: hookEvent(metadata),
         hook_script: hookScript(metadata),
         elapsed_bucket: elapsedBucket(elapsedMs),
@@ -680,37 +677,13 @@ function scrubbedSentryEnvelope(event, overrides, additionalTags = {}) {
         ...sentryEnvelope(event, overrides, additionalTags),
     }, {});
 }
-/**
- * Keep timeout faults visible at warning level while grouping them by the
- * hook event and installation-independent script basename. A genuine
- * exceeded or late-finish payload gets its own stable condition group.
- */
+/** Keep all hook-timeout conditions together by script while retaining tags for triage. */
 function hookTimeoutExceededOverrides(event) {
-    const eventName = hookEvent(event.metadata);
     if (!isHookTimeoutEvent(event))
         return undefined;
-    const kind = hookTimeoutKind(event);
-    if (isMachineWideHookSlowness(event.metadata)) {
-        return {
-            level: "warning",
-            fingerprint: [
-                HOOK_TIMEOUT_MACHINE_WIDE_FINGERPRINT,
-                "machine-wide",
-                operatingSystemName(event.metadata),
-                eventName,
-                kind,
-            ],
-        };
-    }
-    if (kind === "warning") {
-        return {
-            level: "warning",
-            fingerprint: [HOOK_TIMEOUT_WARNING_FINGERPRINT, eventName, hookScript(event.metadata)],
-        };
-    }
     return {
         level: "warning",
-        fingerprint: [HOOK_TIMEOUT_EXCEEDED_FINGERPRINT, eventName, hookScript(event.metadata)],
+        fingerprint: ["hook-timeout", hookScript(event.metadata)],
     };
 }
 /**

package/dist/lib/core-utils/worktree-resume.d.ts

@@ -0,0 +1,18 @@
+/** Native TypeScript ports of the Wave 2 worktree and resume helpers. */
+export declare const WORKTREE_GC_ASSET = "core/scripts/worktree-gc.sh";
+export declare const CLEAN_HANDOFF_ASSET = "core/scripts/clean-worktree-reconcile-handoff.sh";
+export declare const RESUME_LOCK_ASSET = "core/scripts/resume-thread-lock.sh";
+export declare const VERIFY_DELIVERABLES_ASSET = "core/scripts/verify-story-deliverables.sh";
+export type CoreIo = {
+    stdout?: (value: string) => void;
+    stderr?: (value: string) => void;
+    env?: NodeJS.ProcessEnv;
+    cwd?: string;
+    now?: () => Date;
+};
+export declare function worktreeGcPathKey(value: string): string;
+export declare function runWorktreeGc(args: readonly string[], hqRoot: string, io?: CoreIo): number;
+export declare function runCleanWorktreeReconcileHandoff(args: readonly string[], io?: CoreIo): number;
+export declare function runResumeThreadLock(args: readonly string[], hqRoot: string, io?: CoreIo): number;
+export declare function runVerifyStoryDeliverables(args: readonly string[], hqRoot: string, io?: CoreIo): Promise<number>;
+//# sourceMappingURL=worktree-resume.d.ts.map