@indigoai-us/hq-cli 5.293.0 → 5.295.0

package/CHANGELOG.md

@@ -2,9 +2,40 @@
 
 ## [Unreleased]
 
+## [5.295.0] — 2026-09-30
+- Remove the unused direct client-health Sentry route; the existing server-side reporting path remains unchanged.
+
+- Self-update supervisor copy and cleanup failures now log their error class.
+- Report failed and ineffective self-updates to Sentry with bounded context.
+
+- hq-cli release notes now use per-branch fragments that are folded into the next version section, reducing conflicts between parallel pull requests.
+- Claude keep-alive resume events now retain a compact account-load selection snapshot, including when the lane stays on its current account.
+- After a successful missing-envelope repair reports unfinished work, the watcher can queue one automatic continue behind the default-off `lanes.envelope-repair-continue` flag. The repair prompt now gives the required unfinished-story envelope fields.
+- Add a private machine-session token-file command for supported machine-auth handoffs.
+- Apply the 5x fast-route speedup gate only when the base p95 is at or above the 200 ms target; retain the p95 latency and base/PR regression gates.
+- The changelog fragment check runs only on pull requests again, so pushes to main no longer fail it.
+- Refresh terminal Outpost lane mirrors before applying `hq lanes list` state filters, so a lane whose owner is still running is listed as running.
+- Remove the unused Outpost snapshot cache flag and its cache-first lane-list path.
+- The mesh daemon logs spool watcher failures and continues flushing on its polling interval instead of exiting on an unhandled watcher error.
+- Make the manager status gate always active and remove its rollout flag lookup.
+- Compare fast-route latency with a PR-build full-graph baseline so the 5x gate remains valid after the base build gains fast routing.
+
+## [5.294.0] — 2026-09-30
+- Record automatic keep-alive resumes in each lane's durable, bounded history and expose it in `hq lanes show --json` and `hq lanes list --json`.
+
+### Fixed
+
+- Outpost `hq lanes message` now reaches primary-hosted lanes through the
+  primary owner command, which checks sender rights and includes the
+  destination in JSON output.
+- Split the lane story command handlers into a dedicated module without changing behavior.
+- On a box, `sudo hq daemon migrate --apply` now finds the login user's own systemd user units (hq-mesh-daemon, hq-lanes-reconcile and the rest) and stops them through that user's systemd manager. `sudo hq daemon uninstall --restore-legacy` restarts them the same way. Before, root looked only in its own home and could not reach the login user's manager.
+
 ## [5.293.0] — 2026-09-30
 - [HQ-CLI-HOOK-TIMEOUT-KIND] Group hook timeout events by normalized kind (`warning` or `exceeded`) across scripts; keep script and platform tags for triage. Existing per-script issues will stop receiving new events, and the lead handles their status.
+- [HQ-CLI-2C] Label unmeasured SessionStart delay as entry Bash startup when BASH_ENV is set; doctor follows the env-prefixed hook command.
 - `hq lanes move` now reports an already-on-target no-op without dispatching or changing the queued lane.
+- Keep bundled scheduled-job reconciliation units on the live scaffold runner, and preserve caller spelling in job-validation paths.
 - On Linux, `hq daemon run` sets XDG_RUNTIME_DIR for its services when the system unit left it unset, so `systemctl --user` from jobs-reconcile no longer fails with "Failed to connect to bus: No medium found".
 
 - With the default-off lanes.keep-alive-resume-blocked gate enabled, reconcile
@@ -18,13 +49,21 @@
 - Preserve empty directory paths and modes in recorded corpus cases. The recorder rejects tree entries the case format cannot replay, and CI checks committed snapshots after a clean Git archive extraction.
 - Cross-Outpost resume and hire-grant dispatch verify the senior from the
   senior's owning Outpost before signing the caller's grant context.
+- Run the no-Hermes source guard with the required Changelog gate in one runner job.
 
 ### Added
 
+- Add the read-only `hq lanes autopilot report` metrics command for operator nudges, review latency, idle capacity with ready work, and nudge defects.
+
 - Add `hq lanes ask --priority P0|P1|P2` and show question urgency in the queue; warn when omitted during the compatibility release.
+- Route ported native hq core commands through the fast-startup gate while preserving each family's bundled shell fallback.
 
 ### Fixed
 
+- Skip malformed remote lane mirrors with a lane and field warning while
+  keeping local lane validation strict. Refresh mirror queue reason and details
+  from one owner snapshot.
+- Primary-side Outpost question show and answer skip the current Outpost during owner lookup. Remote answers require the lane senior; when the owner is reachable, an unrelated unavailable Outpost is returned as `lookup_errors` without blocking the answer.
 - CI-only: keep the same-binary Node control case measured without applying performance regression thresholds.
 - Fix npm global self-updates, which have failed with MODULE_NOT_FOUND since 5.290.0. The update moved the hq-cli package aside and then started its installer through a supervisor script inside that package. It now runs the installer through a copy of the supervisor outside the package.
 

package/assets/scaffold/core/scripts/outpost-jobs-reconcile.sh

@@ -39,7 +39,6 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 VALIDATE="$SCRIPT_DIR/jobs-validate.sh"
-RUNNER="$SCRIPT_DIR/hq-job-run.sh"
 PROBE="$SCRIPT_DIR/hq-job-probe.sh"
 
 DRY_RUN=0
@@ -99,6 +98,11 @@ while [ $# -gt 0 ]; do
   esac
 done
 
+# The shell script is also bundled inside hq-cli. Its own SCRIPT_DIR then
+# points into the npm package, while job units must always target the live
+# scaffold forwarder so they survive CLI upgrades and Node switches.
+RUNNER="$HQ_ROOT/core/scripts/hq-job-run.sh"
+
 command -v yq >/dev/null 2>&1 || die "yq is required (mikefarah/yq)"
 command -v jq >/dev/null 2>&1 || die "jq is required"
 [ -x "$VALIDATE" ] || [ -f "$VALIDATE" ] || die "missing jobs-validate.sh"

package/dist/command-catalog.generated.d.ts

@@ -860,6 +860,18 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly arguments: readonly [];
     readonly options: readonly [];
     readonly subcommands: readonly [{
+        readonly name: "machine-session";
+        readonly description: "Write the existing machine identity session to a private file";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--output <path>";
+            readonly description: "path for the private machine session JSON";
+        }];
+        readonly subcommands: readonly [];
+    }, {
         readonly name: "login";
         readonly description: "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally";
         readonly aliases: readonly [];
@@ -6130,15 +6142,6 @@ export declare const COMMAND_CATALOG: readonly [{
     }, {
         readonly flags: "--client-health-report";
         readonly description: "Resolve the opt-in hq-flags gate used by the client-health report hook.";
-    }, {
-        readonly flags: "--client-health-sentry";
-        readonly description: "Send the opt-in client-health Sentry report from a doctor JSON document.";
-    }, {
-        readonly flags: "--json-input <file>";
-        readonly description: "Doctor JSON input for the client-health report.";
-    }, {
-        readonly flags: "--client-health-fix-outcome <outcome>";
-        readonly description: "Safe fix outcome label for the client-health report.";
     }, {
         readonly flags: "--yes";
         readonly description: "Skip the interactive --fix confirmation (non-interactive use).";
@@ -7769,6 +7772,48 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "Print the KR freshness report as JSON";
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "autopilot";
+        readonly description: "Run lead autopilot checks and report follow-through metrics";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "report";
+            readonly description: "Report operator nudges, review latency, and idle slots with ready work";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--since <iso>";
+                readonly description: "Include activity since this ISO timestamp";
+            }, {
+                readonly flags: "--days <n>";
+                readonly description: "Include the most recent number of days";
+            }, {
+                readonly flags: "--json";
+                readonly description: "Print JSON";
+            }];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "run";
+            readonly description: "Run one lead autopilot check pass";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--dry-run";
+                readonly description: "Report proposed wakes without writing them";
+            }, {
+                readonly flags: "--json";
+                readonly description: "Emit JSON on stdout (default)";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "create";
         readonly description: "Register a lane, run admission, and return immediately";
@@ -8992,30 +9037,6 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly description: "JSON on stdout (always)";
         }];
         readonly subcommands: readonly [];
-    }, {
-        readonly name: "autopilot";
-        readonly description: "Check registered team leads and wake them for ready work";
-        readonly aliases: readonly [];
-        readonly hidden: false;
-        readonly usage: "[options] [command]";
-        readonly arguments: readonly [];
-        readonly options: readonly [];
-        readonly subcommands: readonly [{
-            readonly name: "run";
-            readonly description: "Run one lead autopilot check pass";
-            readonly aliases: readonly [];
-            readonly hidden: false;
-            readonly usage: "[options]";
-            readonly arguments: readonly [];
-            readonly options: readonly [{
-                readonly flags: "--dry-run";
-                readonly description: "Report proposed wakes without writing them";
-            }, {
-                readonly flags: "--json";
-                readonly description: "Emit JSON on stdout (default)";
-            }];
-            readonly subcommands: readonly [];
-        }];
     }, {
         readonly name: "reconcile";
         readonly description: "Run one machine-owned reconcile pass and exit";

package/dist/command-catalog.generated.js

@@ -1097,6 +1097,21 @@ export const COMMAND_CATALOG = [
         "arguments": [],
         "options": [],
         "subcommands": [
+            {
+                "name": "machine-session",
+                "description": "Write the existing machine identity session to a private file",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--output <path>",
+                        "description": "path for the private machine session JSON"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "login",
                 "description": "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally",
@@ -7883,18 +7898,6 @@ export const COMMAND_CATALOG = [
                 "flags": "--client-health-report",
                 "description": "Resolve the opt-in hq-flags gate used by the client-health report hook."
             },
-            {
-                "flags": "--client-health-sentry",
-                "description": "Send the opt-in client-health Sentry report from a doctor JSON document."
-            },
-            {
-                "flags": "--json-input <file>",
-                "description": "Doctor JSON input for the client-health report."
-            },
-            {
-                "flags": "--client-health-fix-outcome <outcome>",
-                "description": "Safe fix outcome label for the client-health report."
-            },
             {
                 "flags": "--yes",
                 "description": "Skip the interactive --fix confirmation (non-interactive use)."
@@ -10013,6 +10016,59 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "autopilot",
+                "description": "Run lead autopilot checks and report follow-through metrics",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "report",
+                        "description": "Report operator nudges, review latency, and idle slots with ready work",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--since <iso>",
+                                "description": "Include activity since this ISO timestamp"
+                            },
+                            {
+                                "flags": "--days <n>",
+                                "description": "Include the most recent number of days"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Print JSON"
+                            }
+                        ],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "run",
+                        "description": "Run one lead autopilot check pass",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--dry-run",
+                                "description": "Report proposed wakes without writing them"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "Emit JSON on stdout (default)"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "create",
                 "description": "Register a lane, run admission, and return immediately",
@@ -11608,36 +11664,6 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
-            {
-                "name": "autopilot",
-                "description": "Check registered team leads and wake them for ready work",
-                "aliases": [],
-                "hidden": false,
-                "usage": "[options] [command]",
-                "arguments": [],
-                "options": [],
-                "subcommands": [
-                    {
-                        "name": "run",
-                        "description": "Run one lead autopilot check pass",
-                        "aliases": [],
-                        "hidden": false,
-                        "usage": "[options]",
-                        "arguments": [],
-                        "options": [
-                            {
-                                "flags": "--dry-run",
-                                "description": "Report proposed wakes without writing them"
-                            },
-                            {
-                                "flags": "--json",
-                                "description": "Emit JSON on stdout (default)"
-                            }
-                        ],
-                        "subcommands": []
-                    }
-                ]
-            },
             {
                 "name": "reconcile",
                 "description": "Run one machine-owned reconcile pass and exit",

package/dist/commands/auth.d.ts

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account

package/dist/commands/auth.js

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account
@@ -13,9 +14,12 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import * as fs from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
+import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
 import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
 import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
@@ -128,6 +132,77 @@ export function registerAuthCommands(program) {
     const authCmd = program
         .command("auth")
         .description("Manage the local HQ Cognito session");
+    authCmd
+        .command("machine-session")
+        .description("Write the existing machine identity session to a private file")
+        .requiredOption("--output <path>", "path for the private machine session JSON")
+        .action(async (options) => {
+        const requestedPath = path.resolve(options.output);
+        let handle;
+        try {
+            if (!loadMachineCreds()) {
+                throw new Error("Machine credentials are unavailable.");
+            }
+            const outputDirectory = await realpath(path.dirname(requestedPath));
+            const outputPath = path.join(outputDirectory, path.basename(requestedPath));
+            const protectedPaths = await Promise.all([personTokenCacheFile(), machineTokenCacheFile()].map(async (protectedPath) => {
+                const resolved = path.resolve(protectedPath);
+                try {
+                    return path.join(await realpath(path.dirname(resolved)), path.basename(resolved));
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return resolved;
+                    throw error;
+                }
+            }));
+            if (protectedPaths.includes(outputPath)) {
+                throw new Error("Refusing to overwrite a cached Cognito session.");
+            }
+            const tokens = await ensureMachineSessionTokens();
+            const contents = JSON.stringify({
+                accessToken: tokens.accessToken,
+                idToken: tokens.idToken,
+                expiresAt: tokens.expiresAt,
+            }) + "\n";
+            try {
+                handle = await open(outputPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+                    (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                handle = await open(outputPath, fs.constants.O_WRONLY | (fs.constants.O_NOFOLLOW ?? 0));
+                const metadata = await handle.stat();
+                if (!metadata.isFile() ||
+                    metadata.uid !== process.getuid?.() ||
+                    (metadata.mode & 0o077) !== 0) {
+                    throw new Error("Existing output file is not a private file owned by this user.");
+                }
+                await handle.truncate(0);
+            }
+            await handle.writeFile(contents, { encoding: "utf8" });
+            await handle.close();
+            handle = undefined;
+        }
+        catch (error) {
+            if (handle)
+                await handle.close().catch(() => undefined);
+            const code = error && typeof error === "object" && "code" in error &&
+                typeof error.code === "string" && /^[A-Z0-9_]+$/.test(error.code)
+                ? error.code
+                : undefined;
+            console.error(code === "EACCES" || code === "ELOOP" || code === "EEXIST"
+                ? "Could not write machine session file (unsafe or inaccessible path)."
+                : error instanceof Error && error.message === "Machine credentials are unavailable."
+                    ? "Machine credentials are unavailable."
+                    : error instanceof Error && (error.message === "Existing output file is not a private file owned by this user." ||
+                        error.message === "Refusing to overwrite a cached Cognito session.")
+                        ? error.message
+                        : "Could not obtain or write machine session.");
+            process.exitCode = 1;
+        }
+    });
     authCmd
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")

package/dist/commands/core-command-catalog.js

@@ -46,8 +46,9 @@ export function fastScaffoldListingMismatches(listing, fastScripts) {
         else if (fast.kind === "shell" && listed.asset !== fast.asset) {
             mismatches.push(`${fast.name} lists ${listed.asset ?? "no asset"}, fast path uses ${fast.asset ?? "no asset"}`);
         }
-        else if (fast.kind === "native" && (listed.execution !== "native" || listed.asset)) {
-            mismatches.push(`${fast.name} is native in the fast path but not in the command catalog`);
+        else if (fast.kind === "native" && (listed.execution !== "native" ||
+            (fast.asset === undefined ? listed.asset !== undefined : listed.asset !== fast.asset))) {
+            mismatches.push(`${fast.name} has fast-route metadata that differs from the native command catalog`);
         }
     }
     return mismatches;

package/dist/commands/core-delegate-w1b.d.ts

@@ -3,6 +3,8 @@ import { Command } from "commander";
 import { type DelegateContext } from "./core-delegate.js";
 type W1bName = "bundle" | "grant" | "publish" | "send" | "verify";
 export declare function runNativeDelegateW1b(name: W1bName, args: string[], context: DelegateContext): number;
+/** Fast-entry adapter; the shared family flag is resolved before this module loads. */
+export declare function runDelegateW1bFast(args: readonly string[], _stdin: string, _cwd: string, hqRoot: string | undefined, commandName: string): number;
 export declare function registerCoreDelegateW1b(delegate: Command, core: Command): void;
 export {};
 //# sourceMappingURL=core-delegate-w1b.d.ts.map

package/dist/commands/core-delegate-w1b.js

@@ -5,7 +5,6 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
@@ -1004,6 +1003,32 @@ export function runNativeDelegateW1b(name, args, context) {
         case "verify": return runVerify(args, context);
     }
 }
+/** Fast-entry adapter; the shared family flag is resolved before this module loads. */
+export function runDelegateW1bFast(args, _stdin, _cwd, hqRoot, commandName) {
+    const root = hqRoot ?? resolveLiveRoot();
+    const context = { cwd: root, root };
+    const saved = new Map();
+    for (const key of ["HQ_ROOT", "CLAUDE_PROJECT_DIR", "PWD"])
+        saved.set(key, process.env[key]);
+    process.env.HQ_ROOT = root;
+    process.env.CLAUDE_PROJECT_DIR = root;
+    process.env.PWD = root;
+    let code;
+    try {
+        code = runNativeDelegateW1b(commandName, [...args], context);
+    }
+    finally {
+        for (const [key, value] of saved) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+    if (code !== 0)
+        process.exitCode = code;
+    return code;
+}
 export function registerCoreDelegateW1b(delegate, core) {
     for (const name of ["bundle", "grant", "publish", "send", "verify"]) {
         const command = delegate.command(name)
@@ -1012,10 +1037,11 @@ export function registerCoreDelegateW1b(delegate, core) {
             .allowExcessArguments()
             .helpOption(false)
             .argument("[args...]", "arguments accepted for shell ABI compatibility")
-            .action((args = []) => {
+            .action(async (args = []) => {
             const options = core.opts();
             const root = resolveLiveRoot({ hqRoot: options.hqRoot });
             const context = { cwd: root, root };
+            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
             if (!resolveProcessFlagGate(FLAG, { fallback: false }, () => false)) {
                 const result = runBundledScript({ asset: ASSETS[name], args, cwd: root, hqRoot: root });
                 if (result.code !== 0)

package/dist/commands/core-delegate.d.ts

@@ -28,7 +28,9 @@ export declare function jqRawPaths(value: unknown, dottedPaths: string[], fallba
 export declare function requireRecord(value: unknown, property: string): JsonRecord;
 export declare function moveFile(source: string, target: string): void;
 export declare function writeJsonAtomically(target: string, value: unknown, siblingTemp?: boolean): void;
+/** Fast-entry adapter; family gating and shell fallback happen before import. */
+export declare function runDelegateFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): number;
 /** Register the Wave 1a delegate commands and preserve the shell rollback path. */
-export declare function registerCoreDelegateCommand(core: Command): void;
+export declare function registerCoreDelegateCommand(core: Command, registerWave1b?: (delegate: Command, core: Command) => void): void;
 export {};
 //# sourceMappingURL=core-delegate.d.ts.map

package/dist/commands/core-delegate.js

@@ -4,11 +4,9 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
-import { resolveProcessFlagGate } from "../lib/flag-registry.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
-import { registerCoreDelegateW1b } from "./core-delegate-w1b.js";
 export const CORE_NATIVE_DELEGATE_FLAG = "core-native-delegate";
 const SCRIPT_ASSETS = {
     resolve: "core/scripts/hq-delegate-resolve.sh",
@@ -936,8 +934,39 @@ function runNative(name, args, context) {
         case "transfer": return runTransfer(args, context);
     }
 }
+/** Fast-entry adapter; family gating and shell fallback happen before import. */
+export function runDelegateFast(args, _stdin, cwd, hqRoot, commandName) {
+    const name = commandName;
+    const context = name === "pickup"
+        ? { cwd }
+        : (() => { const root = hqRoot ?? resolveLiveRoot(); return { cwd: root, root }; })();
+    const savedEnvironment = new Map();
+    if (context.root) {
+        for (const key of ["HQ_ROOT", "CLAUDE_PROJECT_DIR", "PWD"]) {
+            savedEnvironment.set(key, process.env[key]);
+        }
+        process.env.HQ_ROOT = context.root;
+        process.env.CLAUDE_PROJECT_DIR = context.root;
+        process.env.PWD = context.cwd;
+    }
+    let code;
+    try {
+        code = runNative(name, [...args], context);
+    }
+    finally {
+        for (const [key, value] of savedEnvironment) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+    }
+    if (code !== 0)
+        process.exitCode = code;
+    return code;
+}
 /** Register the Wave 1a delegate commands and preserve the shell rollback path. */
-export function registerCoreDelegateCommand(core) {
+export function registerCoreDelegateCommand(core, registerWave1b) {
     const delegate = core.command("delegate").description("Delegation handover helpers");
     for (const name of ["resolve", "pickup", "repo", "secrets", "transfer"]) {
         const rootMode = name === "pickup" ? "cwd" : "live";
@@ -947,11 +976,12 @@ export function registerCoreDelegateCommand(core) {
             .allowExcessArguments()
             .helpOption(false)
             .argument("[args...]", "arguments accepted for shell ABI compatibility")
-            .action((args = []) => {
+            .action(async (args = []) => {
             const scope = core.opts();
             const context = rootMode === "cwd"
                 ? { cwd: process.cwd() }
                 : (() => { const root = resolveLiveRoot({ hqRoot: scope.hqRoot }); return { cwd: root, root }; })();
+            const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
             if (!resolveProcessFlagGate(CORE_NATIVE_DELEGATE_FLAG, { fallback: false }, () => false)) {
                 const result = runBundledScript({ asset: SCRIPT_ASSETS[name], args, cwd: context.cwd, hqRoot: context.root });
                 if (result.code !== 0)
@@ -984,6 +1014,6 @@ export function registerCoreDelegateCommand(core) {
         });
         describeCoreCommand(command, { execution: "native", asset: SCRIPT_ASSETS[name], root: rootMode });
     }
-    registerCoreDelegateW1b(delegate, core);
+    registerWave1b?.(delegate, core);
 }
 //# sourceMappingURL=core-delegate.js.map

package/dist/commands/core-handoff-fast.d.ts

@@ -0,0 +1,18 @@
+/** Lightweight entry adapters for the fast handoff routes. */
+type RunResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * `handoff finalize --help` is historically an unknown-argument error. Keep
+ * that fast error path out of the large handoff implementation module.
+ */
+export declare function handoffFinalizeHelpResult(args: readonly string[], root: string, tmpRoot?: string): RunResult | undefined;
+/**
+ * Keep cheap help/launch paths in this small module. Commands that do the
+ * actual handoff work load the existing implementation only when invoked.
+ */
+export declare function runHandoffFastEntry(args: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined, commandName: string): Promise<number>;
+export {};
+//# sourceMappingURL=core-handoff-fast.d.ts.map