@indigoai-us/hq-cli 5.290.0 → 5.292.0

package/CHANGELOG.md

@@ -2,13 +2,54 @@
 
 ## [Unreleased]
 
-## [5.290.0] — 2026-09-29
-- A failed `hq update` restores the previous working hq-cli install when it could be backed up, instead of leaving the CLI partially updated.
+## [5.292.0] — 2026-09-30
+- Add native `hq core jobs reconcile` behind `core-native-jobs`, retaining the bundled shell rollback and scheduled-job helpers.
+- Behind the default-off `cli.staged-self-update` flag, an npm global self-update installs the new version beside the running package, checks that it answers `--version`, then swaps it in with two renames. The running `hq` stays on disk for the whole install, so services the daemon starts during an update no longer fail with "hq: command not found" or MODULE_NOT_FOUND. pnpm, Bun, Windows and linked installs keep the in-place update.
 
-## [5.288.0] — 2026-09-29
+- Disable Git auto-maintenance, auto-gc, and detached gc during CM-W2b corpus
+  creation so fixture snapshots cannot race lock files.
 
 ### Added
 
+- `hq core ontology merge-copies --listed --only <file>` (flag `checkpoint.ontology.merge-listed-pairs`, default off) merges exactly the copy -> original pairs in the file, including pairs whose names differ, such as a company listed under two names. Each pair must name two entities of one type; a copy listed twice, or listed as both a copy and an original, is skipped as `listed_conflict`. Signal and link holds apply as for other pairs.
+- `hq core ontology drop-aliases --only <file>` (flag `checkpoint.ontology.drop-aliases`, default off) removes reviewed wrong aliases, given as `{ entity, alias }` pairs, from entity files. It is a dry run unless `--apply` is given, and it writes through the multi-writer outbox so sync uploads the change.
+
+### Fixed
+
+- `hq core ontology merge-copies --rewrite-refs` no longer edits signal or source files, which sync cannot upload. A pair whose copy a signal or source still names is now held as `server_owned_refs`, and its copy is kept.
+### Added
+
+- Add `hq core delegate bundle`, `grant`, `publish`, `send`, and `verify` as
+  native TypeScript handlers behind the default-off `core-native-delegate`
+  flag, with their shell companions retained as rollback assets.
+- Match native handoff open-steps JSON nulls and invalid-JSON exit codes, and sync zero-change handoffs to the calling session's bound company after mirroring the thread.
+
+## [5.291.0] — 2026-09-29
+- Add native `hq core jobs schedule-parse` and `validate` commands behind the default-off `core-native-jobs` gate, retaining their shell rollback companions.
+
+- Offline mesh reconcile does not refresh person tokens or start interactive sign-in; valid cached tokens still validate device defaults.
+- Retry daemon state replacement briefly when Windows reports transient rename contention, while keeping the previous state file intact on failure.
+- When a lane has no Board story ID, `hq lanes` records the lane event without sending a story PATCH.
+- `hq core policy age-report` now matches the legacy script when a missing reference has no hidden sibling under a dot directory.
+- Keep bundled scaffold scripts current with staging and check their pinned source revision in CI.
+- Starter plan-limit refusals now show why and how to fix them. The CLI reads
+  hq-pro's hard-stop 402 body (and the older shapes) and prints the server
+  message, the usage, the fix options, the free-month offer when one stands,
+  and the upgrade link, including in non-interactive runs. `hq secrets set`,
+  `hq secrets generate-link`, `hq members invite` and `hq integrations connect`
+  all use this renderer and exit non-zero.
+- `hq sync push`, `hq sync push --all`, `hq sync now`, `hq sync now --all` and
+  `hq skill create` no longer print a success line when a plan limit refused a
+  file. They list the refused files the runner names, show the upgrade link and
+  exit non-zero. `hq sync push --json` adds `planLimitRefused` to its `complete`
+  event instead.
+
+## [5.290.0] — 2026-09-29
+- Ignore stale but well-formed worker-profile queue details when another valid queue reason is stored, and remove them on the lane's next write.
+
+### Added
+
+- Gate `hq sync push --personal <paths>` behind the default-off `cli.personal-targeted-push-paths` flag; explicit paths are normalized and checked against personal-vault scope and exclusions before upload.
 - `hq core ontology merge-copies --rewrite-refs` (flag `checkpoint.ontology.merge-rewrite-refs`, default off) re-points signal refs, invoice and bill links, source and knowledge links from a merged copy to its survivor and carries the copy's external ids and web domains; a pair whose files hold different values for one external id stays held (`external_id_conflict`).
 - A `--only` entry can carry `resolve_external_ids: { <provider>: { primary, namespace, object_type? } }`. With `--rewrite-refs`, a conflicting provider id then keeps `primary` in `external_ids` and moves the pair's other id to the survivor's `external_refs` (`system`, `namespace`, `objectType`, `recordId`), so no id is dropped. A `primary` that matches neither id still holds the pair.
 
@@ -20,6 +61,26 @@
 - `merge-copies --rewrite-refs` no longer holds a survivor as `merge_invalid` when it gains external ids but has no `web_domains` key (or the reverse).
 - `merge-copies` treats an annotation list item whose first key is `path:` as a link to the copy, so it no longer deletes a copy such an annotation still names.
 
+## [5.289.0] — 2026-09-29
+- A failed `hq update` restores the previous working hq-cli install when it could be backed up, instead of leaving the CLI partially updated.
+
+## [5.288.0] — 2026-09-29
+
+### Added
+
+- Add lead autopilot prompts to the lanes reconcile pass behind
+  `lanes.lead-autopilot` (off by default) and expose
+  `hq lanes autopilot run --dry-run --json`. It asks registered leads to review
+  finished, blocked, or missing workers or fill unused grant slots, starts a
+  ready worker after an
+  unanswered fill prompt ages 15 minutes, and relies on keep-alive to resume
+  completed leads with open work.
+
+### Fixed
+
+- Retry daemon state replacement briefly when Windows reports transient rename
+  contention, while keeping the previous state file intact on failure.
+
 ## [5.287.0] — 2026-09-29
 - Group hook-timeout events by script while preserving triage diagnostics.
 - Preserve safe slow-child script basenames in hook-timeout diagnostics.
@@ -29,6 +90,8 @@
   handoff scripts behind the default-off `core-native-handoff` flag. The
   original shell assets remain bundled as the rollback path.
 - Add default-off native `hq core handoff finalize`, `post`, and `open-steps` commands with the staging scripts retained as the rollback path.
+- Add a default-off `core-native-jobs` rollout gate for native `hq core jobs
+  schedule-parse` and `validate` commands.
 
 ### Fixed
 

package/assets/scaffold/core/scripts/handoff-finalize.sh

@@ -56,6 +56,8 @@ set -euo pipefail
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 HQ_ROOT="$(pwd -P)"
+HANDOFF_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$HANDOFF_SCRIPT_DIR/lib/session-id.sh"
 HAS_GIT_CHECKOUT="false"
 COMMON_GIT_DIR=""
 GIT_PROBE_OUTPUT=""
@@ -252,6 +254,22 @@ MIRROR_COMPANIES_JSON=$(printf '%s\n' "${SAFE_STAGE_PATHS[@]:-}" | jq -R -s -c '
   | unique
 ' 2>/dev/null || printf '[]')
 
+bound_session_company() {
+  local session_id metadata company
+  session_id="$(session_id_resolve "$HQ_ROOT")"
+  [[ -n "$session_id" ]] || return 0
+  metadata="$HQ_ROOT/workspace/sessions/$session_id/meta.yaml"
+  [[ -r "$metadata" ]] || return 0
+  company="$(awk '$1 == "company_slug:" { sub(/^[^:]+:[[:space:]]*/, ""); gsub(/^"|"$/, ""); print; exit }' "$metadata" 2>/dev/null || true)"
+  [[ "$company" =~ ^[a-z][a-z0-9_-]*$ ]] || return 0
+  printf '%s' "$company"
+}
+
+BOUND_SESSION_COMPANY="$(bound_session_company)"
+if [[ -n "$BOUND_SESSION_COMPANY" && -d "companies/$BOUND_SESSION_COMPANY" ]]; then
+  MIRROR_COMPANIES_JSON="$(jq -c --arg company "$BOUND_SESSION_COMPANY" '. + [$company] | unique' <<< "$MIRROR_COMPANIES_JSON")"
+fi
+
 # -------- bg git reap (if launched by caller) --------
 GIT_BG_ERRORS=""
 if [[ -f /tmp/handoff-git-bg.pid ]]; then

package/assets/scaffold/core/scripts/handoff-post.sh

@@ -18,6 +18,8 @@ set -euo pipefail
 
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
+HANDOFF_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$HANDOFF_SCRIPT_DIR/lib/session-id.sh"
 
 THREAD_PATH="${1:-}"
 LEARNINGS_FILE="${2:-}"
@@ -105,18 +107,83 @@ fi
 
 # --- 3b. Push company handoff mirrors promptly (best effort) ---
 # Session snapshots are intentionally gitignored, so a completed mirror needs
-# the sync client to make the handoff available to a second device. Trust only
-# the finalizer's lowercase company-slug metadata before constructing a path.
+# the sync client to make the handoff available to a second device. Keep
+# finalizer company metadata and add the company bound to this session when no
+# changed path identified one; never use a device-wide active-company value.
+bound_session_company() {
+  local session_id metadata company
+  session_id="$(session_id_resolve "$HQ_ROOT")"
+  [[ -n "$session_id" ]] || return 0
+  metadata="$HQ_ROOT/workspace/sessions/$session_id/meta.yaml"
+  [[ -r "$metadata" ]] || return 0
+  company="$(awk '$1 == "company_slug:" { sub(/^[^:]+:[[:space:]]*/, ""); gsub(/^"|"$/, ""); print; exit }' "$metadata" 2>/dev/null || true)"
+  [[ "$company" =~ ^[a-z][a-z0-9_-]*$ ]] || return 0
+  printf '%s' "$company"
+}
+
 if [[ -n "$THREAD_PATH" && -f "$THREAD_PATH" ]] && command -v hq >/dev/null 2>&1; then
+  if [[ "$THREAD_PATH" == /* ]]; then
+    THREAD_FILE="$THREAD_PATH"
+  else
+    THREAD_FILE="$HQ_ROOT/$THREAD_PATH"
+  fi
+  SYNC_COMPANIES_JSON="$(jq -c '
+    (.metadata.company // [])
+    | (if type == "array" then . else [.] end)
+    | map(select(type == "string" and test("^[a-z][a-z0-9_-]*$")))
+    | unique
+  ' "$THREAD_FILE" 2>/dev/null || printf '[]')"
+  BOUND_COMPANY="$(bound_session_company)"
+  if [[ -n "$BOUND_COMPANY" ]]; then
+    UPDATED_SYNC_COMPANIES_JSON="$(jq -c --arg company "$BOUND_COMPANY" '. + [$company] | unique' <<< "$SYNC_COMPANIES_JSON")"
+    if [[ "$SYNC_COMPANIES_JSON" != "$UPDATED_SYNC_COMPANIES_JSON" ]]; then
+      SYNC_COMPANIES_JSON="$UPDATED_SYNC_COMPANIES_JSON"
+      THREAD_TMP="$(mktemp "$HQ_ROOT/workspace/threads/.handoff-post-XXXXXX")"
+      if jq -c --argjson companies "$SYNC_COMPANIES_JSON" \
+        '.metadata = (.metadata // {}) | .metadata.company = $companies' \
+        "$THREAD_FILE" > "$THREAD_TMP" && mv "$THREAD_TMP" "$THREAD_FILE"; then
+        :
+      else
+        rm -f "$THREAD_TMP"
+        log "workspace-sync: skipped (could not add bound company to handoff thread)"
+        SYNC_COMPANIES_JSON='[]'
+      fi
+    else
+      SYNC_COMPANIES_JSON="$UPDATED_SYNC_COMPANIES_JSON"
+    fi
+  fi
+  THREAD_ID="$(jq -r '.thread_id // empty' "$THREAD_FILE" 2>/dev/null || true)"
+  THREAD_MIRRORABLE="false"
+  case "$THREAD_FILE" in
+    "$HQ_ROOT"/workspace/threads/T-*.json)
+      if [[ "$THREAD_ID" =~ ^T-[A-Za-z0-9._-]+$ ]]; then THREAD_MIRRORABLE="true"; fi
+      ;;
+  esac
+  if [[ "$THREAD_MIRRORABLE" == "true" && "$SYNC_COMPANIES_JSON" != '[]' ]]; then
+    MIRROR_HOOK="$HQ_ROOT/.claude/hooks/mirror-thread-to-company.sh"
+    if [[ -f "$MIRROR_HOOK" ]]; then
+      jq -n --arg file_path "$THREAD_FILE" \
+        '{tool_name:"Write",tool_input:{file_path:$file_path}}' | \
+        bash "$MIRROR_HOOK" >>"$LOG_MAIN" 2>&1 || \
+        log "workspace-sync: mirror hook failed for handoff thread"
+    else
+      log "workspace-sync: mirror hook unavailable for handoff thread"
+    fi
+  fi
   while IFS= read -r company; do
     [[ "$company" =~ ^[a-z][a-z0-9_-]*$ ]] || continue
     [[ -d "$HQ_ROOT/companies/$company/workspace" ]] || continue
+    if [[ "$THREAD_MIRRORABLE" != "true" || \
+          ! -f "$HQ_ROOT/companies/$company/workspace/sessions/$THREAD_ID.json" ]]; then
+      log "workspace-sync: skipped (thread mirror missing for $company)"
+      continue
+    fi
     if hq sync push --company "$company" "companies/$company/workspace" >>"$LOG_MAIN" 2>&1; then
       log "workspace-sync: pushed companies/$company/workspace"
     else
       log "workspace-sync: failed companies/$company/workspace"
     fi
-  done < <(jq -r '.metadata.company // empty | if type == "array" then .[] else . end' "$THREAD_PATH" 2>/dev/null || true)
+  done < <(jq -r '.[]' <<< "$SYNC_COMPANIES_JSON")
 elif [[ -n "$THREAD_PATH" && -f "$THREAD_PATH" ]]; then
   log "workspace-sync: skipped (hq CLI unavailable)"
 fi
@@ -150,9 +217,7 @@ fi
 WM_END_HOOK="$HQ_ROOT/core/hooks/SessionEnd/35-work-mesh-session-end.sh"
 if [[ -f "$WM_END_HOOK" ]]; then
   sid=""
-  if [[ -f "$HQ_ROOT/workspace/sessions/.current" ]]; then
-    sid="$(tr -d '[:space:]' <"$HQ_ROOT/workspace/sessions/.current" 2>/dev/null || true)"
-  fi
+  sid="$(session_id_resolve "$HQ_ROOT")"
   if [[ -n "$sid" ]]; then
     payload=$(printf '{"session_id":"%s"}' "$sid")
   else