@indigoai-us/hq-cli 5.294.0 → 5.296.0

package/CHANGELOG.md

@@ -2,13 +2,46 @@
 
 ## [Unreleased]
 
+## [5.296.0] — 2026-09-30
+- Upgrade varlock to 1.21.1. `hq run` skips Varlock cache setup and reports malformed env files promptly without sending them to Sentry.
+- Record bounded actor and trigger history for lane worker starts and expose it through `hq lanes show --json`. Preserve history through conflict merges and envelope repair, and record answered-question callers for immediate and queued resumes.
+- `hq lanes` no longer lets a late terminal lane envelope change a story the senior already marked done or dropped, and `hq lanes story review <lane> <story>` moves a carried story to review before senior verification (feedback_d0164732-22b0-4426-9b66-c9758ba205e3).
+
+## [5.295.0] — 2026-09-30
+- Add native `hq core job run` behind the default-off `core-native-jobs` gate, retaining its bundled shell rollback companion.
+
+- Remove the unused direct client-health Sentry route; the existing server-side reporting path remains unchanged.
+
+- Add native `hq core job probe` behind the existing default-off `core-native-jobs` gate.
+- Self-update supervisor copy and cleanup failures now log their error class.
+- Report failed and ineffective self-updates to Sentry with bounded context.
+
+- hq-cli release notes now use per-branch fragments that are folded into the next version section, reducing conflicts between parallel pull requests.
+- Claude keep-alive resume events now retain a compact account-load selection snapshot, including when the lane stays on its current account.
+- After a successful missing-envelope repair reports unfinished work, the watcher can queue one automatic continue behind the default-off `lanes.envelope-repair-continue` flag. The repair prompt now gives the required unfinished-story envelope fields.
+- Add a private machine-session token-file command for supported machine-auth handoffs.
+- Apply the 5x fast-route speedup gate only when the base p95 is at or above the 200 ms target; retain the p95 latency and base/PR regression gates.
+- The changelog fragment check runs only on pull requests again, so pushes to main no longer fail it.
+- Refresh terminal Outpost lane mirrors before applying `hq lanes list` state filters, so a lane whose owner is still running is listed as running.
+- Remove the unused Outpost snapshot cache flag and its cache-first lane-list path.
+- The mesh daemon logs spool watcher failures and continues flushing on its polling interval instead of exiting on an unhandled watcher error.
+- Make the manager status gate always active and remove its rollout flag lookup.
+- Compare fast-route latency with a PR-build full-graph baseline so the 5x gate remains valid after the base build gains fast routing.
+
 ## [5.294.0] — 2026-09-30
+- Record automatic keep-alive resumes in each lane's durable, bounded history and expose it in `hq lanes show --json` and `hq lanes list --json`.
+
+### Fixed
 
+- Outpost `hq lanes message` now reaches primary-hosted lanes through the
+  primary owner command, which checks sender rights and includes the
+  destination in JSON output.
 - Split the lane story command handlers into a dedicated module without changing behavior.
 - On a box, `sudo hq daemon migrate --apply` now finds the login user's own systemd user units (hq-mesh-daemon, hq-lanes-reconcile and the rest) and stops them through that user's systemd manager. `sudo hq daemon uninstall --restore-legacy` restarts them the same way. Before, root looked only in its own home and could not reach the login user's manager.
 
 ## [5.293.0] — 2026-09-30
 - [HQ-CLI-HOOK-TIMEOUT-KIND] Group hook timeout events by normalized kind (`warning` or `exceeded`) across scripts; keep script and platform tags for triage. Existing per-script issues will stop receiving new events, and the lead handles their status.
+- [HQ-CLI-2C] Label unmeasured SessionStart delay as entry Bash startup when BASH_ENV is set; doctor follows the env-prefixed hook command.
 - `hq lanes move` now reports an already-on-target no-op without dispatching or changing the queued lane.
 - Keep bundled scheduled-job reconciliation units on the live scaffold runner, and preserve caller spelling in job-validation paths.
 - On Linux, `hq daemon run` sets XDG_RUNTIME_DIR for its services when the system unit left it unset, so `systemctl --user` from jobs-reconcile no longer fails with "Failed to connect to bus: No medium found".

package/dist/command-catalog.generated.d.ts

@@ -860,6 +860,18 @@ export declare const COMMAND_CATALOG: readonly [{
     readonly arguments: readonly [];
     readonly options: readonly [];
     readonly subcommands: readonly [{
+        readonly name: "machine-session";
+        readonly description: "Write the existing machine identity session to a private file";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options]";
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--output <path>";
+            readonly description: "path for the private machine session JSON";
+        }];
+        readonly subcommands: readonly [];
+    }, {
         readonly name: "login";
         readonly description: "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally";
         readonly aliases: readonly [];
@@ -5606,6 +5618,41 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly options: readonly [];
             readonly subcommands: readonly [];
         }];
+    }, {
+        readonly name: "job";
+        readonly description: "Run or inspect one scheduled job";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "probe";
+            readonly description: "Check scheduled-job requirements and report readiness";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }, {
+            readonly name: "run";
+            readonly description: "Run a scheduled job";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[args...]";
+            readonly arguments: readonly [{
+                readonly name: "args";
+                readonly required: false;
+                readonly variadic: true;
+            }];
+            readonly options: readonly [];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "jobs";
         readonly description: "Scheduled jobs helpers";
@@ -6130,15 +6177,6 @@ export declare const COMMAND_CATALOG: readonly [{
     }, {
         readonly flags: "--client-health-report";
         readonly description: "Resolve the opt-in hq-flags gate used by the client-health report hook.";
-    }, {
-        readonly flags: "--client-health-sentry";
-        readonly description: "Send the opt-in client-health Sentry report from a doctor JSON document.";
-    }, {
-        readonly flags: "--json-input <file>";
-        readonly description: "Doctor JSON input for the client-health report.";
-    }, {
-        readonly flags: "--client-health-fix-outcome <outcome>";
-        readonly description: "Safe fix outcome label for the client-health report.";
     }, {
         readonly flags: "--yes";
         readonly description: "Skip the interactive --fix confirmation (non-interactive use).";
@@ -8379,6 +8417,29 @@ export declare const COMMAND_CATALOG: readonly [{
                 readonly description: "JSON on stdout (always)";
             }];
             readonly subcommands: readonly [];
+        }, {
+            readonly name: "review";
+            readonly description: "Move a carried story to review";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options] <lane-id> <story-id>";
+            readonly arguments: readonly [{
+                readonly name: "lane-id";
+                readonly required: true;
+                readonly variadic: false;
+            }, {
+                readonly name: "story-id";
+                readonly required: true;
+                readonly variadic: false;
+            }];
+            readonly options: readonly [{
+                readonly flags: "--project <slug>";
+                readonly description: "Project id; defaults to the lane's current project";
+            }, {
+                readonly flags: "--json";
+                readonly description: "JSON on stdout (always)";
+            }];
+            readonly subcommands: readonly [];
         }, {
             readonly name: "block";
             readonly description: "Mark one carried story blocked";

package/dist/command-catalog.generated.js

@@ -1097,6 +1097,21 @@ export const COMMAND_CATALOG = [
         "arguments": [],
         "options": [],
         "subcommands": [
+            {
+                "name": "machine-session",
+                "description": "Write the existing machine identity session to a private file",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options]",
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--output <path>",
+                        "description": "path for the private machine session JSON"
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "login",
                 "description": "Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally",
@@ -7229,6 +7244,49 @@ export const COMMAND_CATALOG = [
                     }
                 ]
             },
+            {
+                "name": "job",
+                "description": "Run or inspect one scheduled job",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "probe",
+                        "description": "Check scheduled-job requirements and report readiness",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[args...]",
+                        "arguments": [
+                            {
+                                "name": "args",
+                                "required": false,
+                                "variadic": true
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    },
+                    {
+                        "name": "run",
+                        "description": "Run a scheduled job",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[args...]",
+                        "arguments": [
+                            {
+                                "name": "args",
+                                "required": false,
+                                "variadic": true
+                            }
+                        ],
+                        "options": [],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "jobs",
                 "description": "Scheduled jobs helpers",
@@ -7883,18 +7941,6 @@ export const COMMAND_CATALOG = [
                 "flags": "--client-health-report",
                 "description": "Resolve the opt-in hq-flags gate used by the client-health report hook."
             },
-            {
-                "flags": "--client-health-sentry",
-                "description": "Send the opt-in client-health Sentry report from a doctor JSON document."
-            },
-            {
-                "flags": "--json-input <file>",
-                "description": "Doctor JSON input for the client-health report."
-            },
-            {
-                "flags": "--client-health-fix-outcome <outcome>",
-                "description": "Safe fix outcome label for the client-health report."
-            },
             {
                 "flags": "--yes",
                 "description": "Skip the interactive --fix confirmation (non-interactive use)."
@@ -10806,6 +10852,36 @@ export const COMMAND_CATALOG = [
                         ],
                         "subcommands": []
                     },
+                    {
+                        "name": "review",
+                        "description": "Move a carried story to review",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options] <lane-id> <story-id>",
+                        "arguments": [
+                            {
+                                "name": "lane-id",
+                                "required": true,
+                                "variadic": false
+                            },
+                            {
+                                "name": "story-id",
+                                "required": true,
+                                "variadic": false
+                            }
+                        ],
+                        "options": [
+                            {
+                                "flags": "--project <slug>",
+                                "description": "Project id; defaults to the lane's current project"
+                            },
+                            {
+                                "flags": "--json",
+                                "description": "JSON on stdout (always)"
+                            }
+                        ],
+                        "subcommands": []
+                    },
                     {
                         "name": "block",
                         "description": "Mark one carried story blocked",

package/dist/commands/auth.d.ts

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account

package/dist/commands/auth.js

@@ -6,6 +6,7 @@
  *   hq auth logout    — clear the cached HQ session
  *   hq auth refresh   — ensure a valid cached Cognito session (non-interactive)
  *   hq auth status    — show whether a valid session is cached + expiry
+ *   hq auth machine-session --output <path> — write machine tokens to a private file
  *
  * Sign-up is owned by the onboarding web app at
  * https://onboarding.hq.computer. `hq auth login` signs an existing account
@@ -13,9 +14,12 @@
  * session is kept valid by `hq auth refresh` / `hq-auth-refresh` and consumed
  * by the deploy + sync skills.
  */
+import * as fs from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, } from "../utils/cognito-session.js";
+import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
 import { resolveLoginProviderSelection, } from "../utils/login-provider.js";
 import { getLastLoginProviderStatePath, loadLastLoginProvider, storeLastLoginProvider, } from "../lib/auth-login-provider-state.js";
 import { callbackPortBusyGuidance, DEFAULT_CALLBACK_PORT, isCallbackPortBusy, } from "../utils/callback-port-busy.js";
@@ -128,6 +132,77 @@ export function registerAuthCommands(program) {
     const authCmd = program
         .command("auth")
         .description("Manage the local HQ Cognito session");
+    authCmd
+        .command("machine-session")
+        .description("Write the existing machine identity session to a private file")
+        .requiredOption("--output <path>", "path for the private machine session JSON")
+        .action(async (options) => {
+        const requestedPath = path.resolve(options.output);
+        let handle;
+        try {
+            if (!loadMachineCreds()) {
+                throw new Error("Machine credentials are unavailable.");
+            }
+            const outputDirectory = await realpath(path.dirname(requestedPath));
+            const outputPath = path.join(outputDirectory, path.basename(requestedPath));
+            const protectedPaths = await Promise.all([personTokenCacheFile(), machineTokenCacheFile()].map(async (protectedPath) => {
+                const resolved = path.resolve(protectedPath);
+                try {
+                    return path.join(await realpath(path.dirname(resolved)), path.basename(resolved));
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return resolved;
+                    throw error;
+                }
+            }));
+            if (protectedPaths.includes(outputPath)) {
+                throw new Error("Refusing to overwrite a cached Cognito session.");
+            }
+            const tokens = await ensureMachineSessionTokens();
+            const contents = JSON.stringify({
+                accessToken: tokens.accessToken,
+                idToken: tokens.idToken,
+                expiresAt: tokens.expiresAt,
+            }) + "\n";
+            try {
+                handle = await open(outputPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+                    (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                handle = await open(outputPath, fs.constants.O_WRONLY | (fs.constants.O_NOFOLLOW ?? 0));
+                const metadata = await handle.stat();
+                if (!metadata.isFile() ||
+                    metadata.uid !== process.getuid?.() ||
+                    (metadata.mode & 0o077) !== 0) {
+                    throw new Error("Existing output file is not a private file owned by this user.");
+                }
+                await handle.truncate(0);
+            }
+            await handle.writeFile(contents, { encoding: "utf8" });
+            await handle.close();
+            handle = undefined;
+        }
+        catch (error) {
+            if (handle)
+                await handle.close().catch(() => undefined);
+            const code = error && typeof error === "object" && "code" in error &&
+                typeof error.code === "string" && /^[A-Z0-9_]+$/.test(error.code)
+                ? error.code
+                : undefined;
+            console.error(code === "EACCES" || code === "ELOOP" || code === "EEXIST"
+                ? "Could not write machine session file (unsafe or inaccessible path)."
+                : error instanceof Error && error.message === "Machine credentials are unavailable."
+                    ? "Machine credentials are unavailable."
+                    : error instanceof Error && (error.message === "Existing output file is not a private file owned by this user." ||
+                        error.message === "Refusing to overwrite a cached Cognito session.")
+                        ? error.message
+                        : "Could not obtain or write machine session.");
+            process.exitCode = 1;
+        }
+    });
     authCmd
         .command("login")
         .description("Sign in to HQ — opens the Cognito Hosted UI and caches tokens locally")

package/dist/commands/core-job-native.d.ts

@@ -0,0 +1,7 @@
+/** Native `hq core job <name>` command group. */
+import type { Command } from "commander";
+export declare function registerCoreJobNativeCommand(core: Command): void;
+export declare function registerCoreJobCommand(core: Command): void;
+/** Keep eager `core` registration complete while the jobs fast route loads only its own module. */
+export declare function registerCoreJobsNativeCommand(core: Command): void;
+//# sourceMappingURL=core-job-native.d.ts.map

package/dist/commands/core-job-native.js

@@ -0,0 +1,20 @@
+import { registerCoreJobProbeCommand } from "./core-job-probe-native.js";
+import { registerCoreJobRunCommand } from "./core-job-run-native.js";
+import { registerCoreJobsNativeCommand as registerPluralJobsCommand } from "./core-jobs-native.js";
+const JOB_GROUP_DESCRIPTION = "Run or inspect one scheduled job";
+export function registerCoreJobNativeCommand(core) {
+    const job = core.command("job").description(JOB_GROUP_DESCRIPTION);
+    registerCoreJobProbeCommand(job);
+}
+export function registerCoreJobCommand(core) {
+    const job = core.command("job").description(JOB_GROUP_DESCRIPTION);
+    registerCoreJobRunCommand(job);
+}
+/** Keep eager `core` registration complete while the jobs fast route loads only its own module. */
+export function registerCoreJobsNativeCommand(core) {
+    const job = core.command("job").description(JOB_GROUP_DESCRIPTION);
+    registerCoreJobProbeCommand(job);
+    registerCoreJobRunCommand(job);
+    registerPluralJobsCommand(core);
+}
+//# sourceMappingURL=core-job-native.js.map

package/dist/commands/core-job-probe-native.d.ts

@@ -0,0 +1,45 @@
+import type { Command } from "commander";
+export declare const JOB_PROBE_ASSET = "core/scripts/hq-job-probe.sh";
+export declare const JOB_PROBE_USAGE: string;
+export type Checks = {
+    runtime: string;
+    auth: string;
+    secrets: {
+        status: string;
+        missing: string[];
+    };
+    cwd: string;
+    company: {
+        status: string;
+        slug?: string;
+    };
+};
+export type ProbeResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type ProbeDeps = {
+    root: string;
+    home: string;
+    env: Record<string, string | undefined>;
+    now: () => Date;
+    sleep: (seconds: number) => Promise<void>;
+    statSize: (file: string) => number | undefined;
+    isFile: (file: string) => boolean;
+    isDirectory: (file: string) => boolean;
+    realpath: (file: string) => string | undefined;
+    readText: (file: string) => string;
+    writeState: (file: string, body: string) => void;
+    writeStderr: (line: string) => void;
+    listSecrets: (company?: string) => Promise<{
+        code: number;
+        stdout: string;
+    }>;
+    commandExists: (name: string) => boolean;
+    fetcher: (url: string, init: RequestInit) => Promise<Response>;
+};
+export declare function defaultProbeDeps(root: string, env?: Record<string, string | undefined>): ProbeDeps;
+export declare function runJobProbe(argv: string[], injected?: ProbeDeps): Promise<ProbeResult>;
+export declare function registerCoreJobProbeCommand(job: Command): void;
+//# sourceMappingURL=core-job-probe-native.d.ts.map