@indigoai-us/hq-cli 5.294.0 → 5.296.0

package/dist/commands/run.js

@@ -128,6 +128,11 @@ export function registerRunCommand(program) {
             let state;
             const graph = await internal.loadEnvGraph({
                 entryFilePaths: paths,
+                // hq run owns its short-lived in-memory resolution. Varlock's default
+                // cache auto-detection can write ~/.config/varlock and initialize
+                // the native local-encryption helper, neither of which belongs on
+                // this command path.
+                skipCache: true,
                 afterInit: async (g) => { state = installHqPlugin(g, pluginOpts); },
             });
             // Refuse to resolve a graph varlock never finished loading (a malformed

package/dist/fast-scaffold.d.ts

@@ -66,11 +66,6 @@ export type ParsedSecretsEnvFastRequest = {
  * the full CLI, which remains the source of truth for help and errors.
  */
 export declare function parseSecretsEnvFastRequest(argv: readonly string[]): ParsedSecretsEnvFastRequest | null;
-/**
- * The cache-first list path only handles the bare JSON request. `--fresh`,
- * filters, help, and unknown options stay with Commander and the full CLI.
- */
-export declare function isFastCachedLanesListRequest(argv: readonly string[]): boolean;
 /**
  * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
  * fast-path script. Returns null for anything else so the caller defers to the

package/dist/fast-scaffold.js

@@ -272,16 +272,6 @@ export function parseSecretsEnvFastRequest(argv) {
     }
     return hasOnly ? { options, scope } : null;
 }
-/**
- * The cache-first list path only handles the bare JSON request. `--fresh`,
- * filters, help, and unknown options stay with Commander and the full CLI.
- */
-export function isFastCachedLanesListRequest(argv) {
-    return argv.length === 5 &&
-        argv[2] === "lanes" &&
-        argv[3] === "list" &&
-        argv[4] === "--json";
-}
 /**
  * Parse `hq core [--hq-root <path>] <name> [args...]` when `<name>` is a
  * fast-path script. Returns null for anything else so the caller defers to the

package/dist/index.js

@@ -6,7 +6,7 @@ import "./node-network-compat.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.
-import { isFastCachedLanesListRequest, isFastCoreRequest, parseFastCore, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
+import { isFastCoreRequest, parseFastCore, parseSecretsEnvFastRequest, } from "./fast-scaffold.js";
 // Also dependency-light: registers a process-level rejection boundary; its only
 // heavy import (main.js) is lazy and reached only when a rejection fires.
 import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.js";
@@ -61,15 +61,6 @@ else if (parseSecretsEnvFastRequest(process.argv)) {
         });
     });
 }
-else if (isFastCachedLanesListRequest(process.argv)) {
-    void import("./fast-lanes-list-route.js").then(async ({ runFastLanesListRequest }) => {
-        const handled = await runFastLanesListRequest(process.argv);
-        if (!handled) {
-            const { runCli } = await import("./main.js");
-            await runCli();
-        }
-    });
-}
 else if (isFastCoreRequest(process.argv)) {
     // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
     // dispatches straight to the bundled-script runner, so it never pays for the

package/dist/lib/core-utils/sentry-report.d.ts

@@ -17,7 +17,6 @@
  */
 import * as Sentry from "@sentry/node";
 import type { CaptureContext, SeverityLevel } from "@sentry/node";
-import type { ClientHealthSentryEvent } from "../doctor/client-health-sentry.js";
 export declare const DEFAULT_SENTRY_REPORT_TIMEOUT_MS = 750;
 export declare const MAX_SENTRY_REPORT_TIMEOUT_MS = 5000;
 export declare const MAX_SENTRY_REPORT_PAYLOAD_BYTES = 2048;
@@ -96,17 +95,6 @@ export type SentryReportResult = {
     event?: SentryReportEvent;
     droppedMetadataKeys?: number;
 };
-export interface ClientHealthSentryScope {
-    clear(): void;
-    setLevel(level: SeverityLevel): void;
-    setFingerprint(fingerprint: string[]): void;
-    setTags(tags: Record<string, string>): void;
-    setUser(user: {
-        id: string;
-        ip_address: null;
-    }): void;
-}
-export type ClientHealthSentryScopeRunner = (callback: (scope: ClientHealthSentryScope) => void) => void;
 /**
  * Read no more than the accepted event size. Returning early keeps a malformed
  * pipe from making a watchdog retain an unbounded hook payload in memory.
@@ -129,11 +117,4 @@ export declare function parseSentryReportEvent(stdin: string): SentryReportResul
  * transport errors cannot echo event data back to a hook.
  */
 export declare function reportSentryEvent(stdin: string, options?: SentryReportOptions, dependencies?: SentryReportDependencies): Promise<SentryReportResult>;
-/** Send the client-health projection with a clean Sentry scope and no metadata payload. */
-export declare function reportClientHealthEvents(events: readonly ClientHealthSentryEvent[], options?: {
-    timeoutMs?: number;
-    scopeRunner?: ClientHealthSentryScopeRunner;
-}, dependencies?: SentryReportDependencies): Promise<{
-    code: 0 | 1;
-}>;
 //# sourceMappingURL=sentry-report.d.ts.map

package/dist/lib/core-utils/sentry-report.js

@@ -577,6 +577,14 @@ function hookTimeoutDebugContextTags(context) {
 }
 function safeSlowChild(metadata) {
     const value = metadata.slow_child;
+    const slowChildMs = metadata.slow_child_ms;
+    const hasMeasuredChild = typeof slowChildMs === "number" && Number.isFinite(slowChildMs) && slowChildMs >= 0;
+    if (metadata.hook_event === "SessionStart" &&
+        (metadata.bash_env_set === true || metadata.bash_env_set === "set") &&
+        !hasMeasuredChild &&
+        (typeof value !== "string" || value.length === 0 || value === "other")) {
+        return "entry-bash-startup";
+    }
     if (typeof value !== "string" || !SAFE_HOOK_SCRIPT.test(value))
         return "other";
     return value;
@@ -1006,65 +1014,4 @@ export async function reportSentryEvent(stdin, options = {}, dependencies = defa
     dependencies.stderr.write("Sentry report failed.\n");
     return invalidInput();
 }
-function isSafeClientHealthEvent(event) {
-    const tags = event.tags;
-    const checkClass = tags.check_class;
-    const reasonCode = tags.reason_code;
-    const classPattern = /^sync\.(?:update\.core|journal\.(?:personal|personal_vault|company)|manifest\.(?:personal|personal_vault|company))$|^other$/;
-    const reasonPattern = /^(?:none|core-version-unavailable|core-update-available|no-local-tree|never-synced|invalid-last-sync|stale-threshold|manifest-unavailable|manifest-state-unavailable|no-manifest-scopes|never-uploaded|invalid-upload-time|unresolved-company-uid)$/;
-    const versionPattern = /^(?:unknown|\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?(?:\+[A-Za-z0-9.-]+)?)$/;
-    const safeTagKeys = [
-        "check_class", "reason_code", "fix_outcome", "status", "failing_check_count",
-        "cli_version", "core_version", "sync_version", "platform", "arch",
-    ];
-    return (event.level === "warning" &&
-        classPattern.test(checkClass) &&
-        reasonPattern.test(reasonCode) &&
-        event.message === `Client health: ${checkClass} unresolved after hq doctor --fix` &&
-        event.fingerprint.length === 3 &&
-        event.fingerprint[0] === "client-health" &&
-        event.fingerprint[1] === checkClass &&
-        event.fingerprint[2] === reasonCode &&
-        (tags.fix_outcome === "not_auto_fixable" || tags.fix_outcome === "fix_failed" || tags.fix_outcome === "fix_timed_out") &&
-        (tags.status === "FAIL" || tags.status === "WARN") &&
-        /^\d{1,3}$/.test(tags.failing_check_count) &&
-        safeTagKeys.every((key) => Object.hasOwn(tags, key)) &&
-        Object.keys(tags).length === safeTagKeys.length &&
-        [tags.cli_version, tags.core_version, tags.sync_version].every((value) => versionPattern.test(value)) &&
-        /^[a-z0-9]+$/.test(tags.platform) &&
-        /^[a-z0-9]+$/.test(tags.arch) &&
-        /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(event.user.id) &&
-        event.user.ip_address === null);
-}
-/** Send the client-health projection with a clean Sentry scope and no metadata payload. */
-export async function reportClientHealthEvents(events, options = {}, dependencies = defaultDependencies) {
-    const timeoutMs = resolveTimeout(options.timeoutMs);
-    if (timeoutMs === null ||
-        events.length === 0 ||
-        events.length > 250 ||
-        events.some((event) => !isSafeClientHealthEvent(event))) {
-        dependencies.stderr.write("Invalid client health Sentry event.\n");
-        return { code: 1 };
-    }
-    const withScope = options.scopeRunner ?? ((callback) => Sentry.withScope((scope) => callback(scope)));
-    try {
-        for (const event of events) {
-            withScope((scope) => {
-                scope.clear();
-                scope.setLevel(event.level);
-                scope.setFingerprint([...event.fingerprint]);
-                scope.setTags({ sentry_event_type: "client_health", ...event.tags });
-                scope.setUser({ id: event.user.id, ip_address: null });
-                dependencies.sentry.captureMessage(event.message);
-            });
-        }
-        if (await flushWithin(dependencies.sentry, timeoutMs))
-            return { code: 0 };
-    }
-    catch {
-        // Keep the event and transport details out of hook stderr.
-    }
-    dependencies.stderr.write("Client health Sentry report failed.\n");
-    return { code: 1 };
-}
 //# sourceMappingURL=sentry-report.js.map

package/dist/lib/doctor/checks/claude-wiring.js

@@ -460,6 +460,15 @@ function requiredFromFirstCommand(first) {
         k += 1;
     if (k >= first.length)
         return { required, gatedHookId };
+    // SessionStart can use env to set BASH_ENV before Bash itself starts.
+    // Walk through that launcher and its assignments just like the shell scanner.
+    if (baseName(first[k]) === "env") {
+        k += 1;
+        while (k < first.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(first[k]))
+            k += 1;
+        if (k >= first.length || first[k].startsWith("-"))
+            return { required, gatedHookId };
+    }
     if (INTERPRETERS.has(baseName(first[k]))) {
         k += 1;
         while (k < first.length && first[k].startsWith("-")) {

package/dist/lib/lanes/flag-keys.d.ts

@@ -1,3 +1,5 @@
 /** hq-flags keys used by lane list and placement behavior. */
 export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
+/** Enables one automatic continuation after a missing-envelope repair. */
+export declare const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 //# sourceMappingURL=flag-keys.d.ts.map

package/dist/lib/lanes/flag-keys.js

@@ -1,3 +1,5 @@
 /** hq-flags keys used by lane list and placement behavior. */
 export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
+/** Enables one automatic continuation after a missing-envelope repair. */
+export const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 //# sourceMappingURL=flag-keys.js.map

package/dist/lib/lanes/manager-status-gate.d.ts

@@ -1,6 +1,4 @@
-import { readLanesRegistryFlag } from "./registry-flag.js";
 import type { LaneRecord, ManagerStatusGate } from "./types.js";
-export declare const MANAGER_STATUS_GATE_FLAG = "lanes.manager-status-gate";
 export interface ManagerStatusTarget {
     manager: boolean;
     identified_by?: "story_id" | "worker_profile" | "juniors";
@@ -11,23 +9,8 @@ export interface StatusSnapshot {
     mtime: number | null;
     updatedAt: string | null;
 }
-export interface ManagerStatusGateResolution {
-    enabled: boolean;
-    target?: ManagerStatusTarget;
-    error?: string;
-}
 /** Resolve manager identity and the single declared status file, if present. */
 export declare function resolveManagerStatusTarget(root: string, lane: LaneRecord): ManagerStatusTarget;
-export declare function resolveManagerStatusGateForLane(root: string, lane: LaneRecord, options?: {
-    env?: NodeJS.ProcessEnv;
-    readFlag?: typeof readLanesRegistryFlag;
-    onError?: (error: unknown) => void;
-}): Promise<ManagerStatusGateResolution>;
-export declare function managerStatusGateEnabledForLane(root: string, lane: LaneRecord, options?: {
-    env?: NodeJS.ProcessEnv;
-    readFlag?: typeof readLanesRegistryFlag;
-    onError?: (error: unknown) => void;
-}): Promise<boolean>;
 export declare function readStatusSnapshot(filePath: string): StatusSnapshot;
 export declare function managerStatusGateHeartbeat(root: string, lane: LaneRecord, turnId: string, turnStartedAt: string): ManagerStatusGate | undefined;
 export declare function managerStatusWasWritten(gate: ManagerStatusGate, snapshot: StatusSnapshot): boolean;

package/dist/lib/lanes/manager-status-gate.js

@@ -2,9 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { checkCompanyPath } from "./checked-company-path.js";
 import { LanesError } from "./errors.js";
-import { laneCompanyUidSource, resolveLaneCompany } from "./lane-company.js";
-import { readLanesRegistryFlag } from "./registry-flag.js";
-export const MANAGER_STATUS_GATE_FLAG = "lanes.manager-status-gate";
+import { resolveLaneCompany } from "./lane-company.js";
 function isObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -49,14 +47,6 @@ function matchesLane(rowLane, laneId) {
     const bareLaneId = laneId.split("_", 1)[0] ?? "";
     return row === laneId || row === bareLaneId;
 }
-function managerStatusGateErrorCode(err) {
-    return err instanceof LanesError ? err.error : "manager_status_gate_unavailable";
-}
-function logManagerStatusGateFailure(lane, err) {
-    const code = managerStatusGateErrorCode(err);
-    const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`hq lanes: manager status gate disabled for ${lane.lane_id}: ${code}: ${message}\n`);
-}
 /** Resolve manager identity and the single declared status file, if present. */
 export function resolveManagerStatusTarget(root, lane) {
     const directIdentity = lane.story_id === "MANAGER"
@@ -93,38 +83,6 @@ export function resolveManagerStatusTarget(root, lane) {
         statusPath,
     };
 }
-export async function resolveManagerStatusGateForLane(root, lane, options = {}) {
-    const reportError = options.onError ?? ((err) => logManagerStatusGateFailure(lane, err));
-    let enabled;
-    try {
-        const resolution = resolveLaneCompany(root, lane);
-        const company = resolution.company ?? undefined;
-        enabled = await (options.readFlag ?? readLanesRegistryFlag)(MANAGER_STATUS_GATE_FLAG, {
-            company,
-            ...(company ? {
-                companyUidSource: laneCompanyUidSource(resolution.source),
-            } : {}),
-            env: options.env,
-        });
-    }
-    catch (err) {
-        reportError(err);
-        return { enabled: false, error: managerStatusGateErrorCode(err) };
-    }
-    if (!enabled)
-        return { enabled: false };
-    try {
-        const target = resolveManagerStatusTarget(root, lane);
-        return { enabled: target.manager && target.statusPath !== undefined, target };
-    }
-    catch (err) {
-        reportError(err);
-        return { enabled: false, error: managerStatusGateErrorCode(err) };
-    }
-}
-export async function managerStatusGateEnabledForLane(root, lane, options = {}) {
-    return (await resolveManagerStatusGateForLane(root, lane, options)).enabled;
-}
 export function readStatusSnapshot(filePath) {
     let stat;
     try {
@@ -153,6 +111,7 @@ export function readStatusSnapshot(filePath) {
     return { mtime: stat.mtimeMs, updatedAt };
 }
 export function managerStatusGateHeartbeat(root, lane, turnId, turnStartedAt) {
+    resolveLaneCompany(root, lane);
     const target = resolveManagerStatusTarget(root, lane);
     if (!target.manager || target.statusPath === undefined)
         return undefined;

package/dist/lib/lanes/mesh-events.js

@@ -44,6 +44,7 @@
  */
 import { appendThreadEvent, clamp, ensureLaneMeshThread, ensureProjectThread, getProjectView, patchStoryStatus, putProjectView, requireToken, registerMeshProject, resolveMeshCompany, } from "../mesh/api.js";
 import { LanesError } from "./errors.js";
+import { terminalEnvelopeStoryStatus } from "./stories.js";
 export const LANE_MESH_EVENTS = [
     "lane_started",
     "lane_progress",
@@ -454,6 +455,8 @@ export async function emitLaneDecisionEvents(mesh, lane, envelope, opts = {}) {
     const patchStoryStatus = async (status) => {
         if (!lane.project_id?.trim() || !lane.story_id?.trim())
             return;
+        if (terminalEnvelopeStoryStatus(lane, envelope.decision) === undefined)
+            return;
         const suppressions = opts.storyStatusSuppressions;
         const key = laneStoryStatusSuppressionKey(company, lane.project_id, lane.story_id);
         if (suppressions?.has(key))

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -49,6 +49,8 @@ export interface OutpostLaneCommand {
     compact?: boolean;
     tail?: string;
     json?: boolean;
+    callerLaneId?: string;
+    callerSessionId?: string;
 }
 export declare function buildOutpostQuestionAnswerCommand(input: {
     questionId: string;

package/dist/lib/lanes/outpost-dispatch.js

@@ -190,7 +190,13 @@ export function buildOutpostLaneCommand(input) {
         args.push("--tail", input.tail);
     if (input.action === "logs" && input.json === true)
         args.push("--json");
-    return withRemoteHqDir(joinCommandParts(args));
+    const callerLaneId = input.callerLaneId?.trim();
+    const callerSessionId = input.callerSessionId?.trim();
+    const callerEnv = [
+        callerLaneId ? `HQ_LANE_ID=${callerLaneId}` : undefined,
+        callerSessionId ? `HQ_SESSION_ID=${callerSessionId}` : undefined,
+    ].filter((value) => value !== undefined);
+    return withRemoteHqDir(joinCommandParts(callerEnv.length > 0 ? ["env", ...callerEnv, ...args] : args));
 }
 /** True when a remote CLI exited after rejecting the forwarded effort flag. */
 export function outpostRejectedEffortOption(result) {

package/dist/lib/lanes/outpost-hire-cache.d.ts

@@ -1,5 +1,4 @@
 export declare const OUTPOST_HIRE_SUMMARY_CACHE_TTL_MS = 60000;
-export declare const LANE_OUTPOST_SNAPSHOT_CACHE_FLAG = "lanes.outpost-snapshot-cache";
 export interface OutpostHireSummary {
     hire_grant: number;
     hire_alive_children: number;

package/dist/lib/lanes/outpost-hire-cache.js

@@ -2,7 +2,6 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 export const OUTPOST_HIRE_SUMMARY_CACHE_TTL_MS = 60_000;
-export const LANE_OUTPOST_SNAPSHOT_CACHE_FLAG = "lanes.outpost-snapshot-cache";
 const CACHE_RELATIVE_PATH = path.join("workspace", "lanes-runs", ".cache", "outpost-hire-summaries.json");
 export function outpostHireSummaryCachePath(hqRoot) {
     return path.join(hqRoot, CACHE_RELATIVE_PATH);

package/dist/lib/lanes/outpost-snapshot-memo.d.ts

@@ -0,0 +1,6 @@
+/** Deduplicates identical remote snapshot queries within one command invocation. */
+export declare class OutpostSnapshotInvocationMemo {
+    private readonly requests;
+    getOrCreate<T>(outpostId: string, query: unknown, fetch: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=outpost-snapshot-memo.d.ts.map

package/dist/lib/lanes/outpost-snapshot-memo.js

@@ -0,0 +1,14 @@
+/** Deduplicates identical remote snapshot queries within one command invocation. */
+export class OutpostSnapshotInvocationMemo {
+    requests = new Map();
+    getOrCreate(outpostId, query, fetch) {
+        const key = JSON.stringify([outpostId, query]);
+        const existing = this.requests.get(key);
+        if (existing)
+            return existing;
+        const request = fetch();
+        this.requests.set(key, request);
+        return request;
+    }
+}
+//# sourceMappingURL=outpost-snapshot-memo.js.map

package/dist/lib/lanes/reconcile.d.ts

@@ -11,7 +11,7 @@ import { type ThrottleDeps, type CpuBusyObservation } from "./throttle.js";
 import { readLanesRegistryFlag } from "./registry-flag.js";
 import { type RunawayProcessInfo } from "./runaway-tool-guard.js";
 import { type KeepAliveBlockedReason } from "./keep-alive.js";
-import type { LaneCompanyRef, LaneRecord, LivenessState, QueuedReason, QuestionRecord, SeniorRef } from "./types.js";
+import type { LaneCompanyRef, LaneAccountSelection, LaneRecord, LivenessState, QueuedReason, QuestionRecord, SeniorRef } from "./types.js";
 import { type LaneMesh } from "./mesh-events.js";
 /** Spec §9: unanswered at the current hop for 60 minutes → one hop. */
 export declare const QUESTION_AGE_MS: number;
@@ -86,8 +86,6 @@ export interface ReconcileDeps {
     skipAdmissionWithoutCpuSample?: boolean;
     /** Flag reader seam used to assert rollout reads happen before admission locks. */
     readRegistryFlag?: typeof readLanesRegistryFlag;
-    /** Pre-read manager gate decisions, scoped to each lane for this pass. */
-    managerStatusGateByLane?: ReadonlyMap<string, boolean>;
     /** Active-company fallback for questions raised from an unscoped lane. */
     resolveQuestionActiveCompany?: () => Promise<LaneCompanyRef>;
     /** Resume queued messages after this pass wins a local dead-worker CAS. */
@@ -102,6 +100,7 @@ export interface ReconcileDeps {
     prepareKeepAliveClaudeResume?: (lane: LaneRecord) => Promise<{
         lane: LaneRecord;
         selectionFailure?: string;
+        accountSelection?: LaneAccountSelection;
     }>;
     /** Process-table snapshot seam for the opt-in runaway-search guard. */
     runawayToolProcessLister?: () => readonly RunawayProcessInfo[];