@indigoai-us/hq-cli 5.295.0 → 5.297.0

package/dist/lib/lanes/stories.d.ts

@@ -1,4 +1,4 @@
-import type { LaneRecord, LaneStory } from "./types.js";
+import type { LaneRecord, LaneStory, LaneStoryStatus } from "./types.js";
 /** Board-facing states for the stories a lane currently carries. */
 export declare const ACTIVE_LANE_STORY_STATUSES: readonly ["in_progress", "blocked", "review"];
 export declare function storyKey(projectId: string, storyId: string): string;
@@ -14,4 +14,10 @@ export declare function storyWarning(lane: LaneRecord): string | undefined;
 export declare function withCurrentStory(lane: LaneRecord, projectId: string, storyId: string): LaneRecord;
 export declare function withLaneStories(lane: LaneRecord, stories: LaneStory[]): LaneRecord;
 export declare function storyStatusForEnvelope(status: string): "in_progress" | "review";
+/**
+ * Resolve the story status requested by a terminal envelope. Already-final
+ * carried stories are immutable through the envelope path; senior verification
+ * and explicit story commands own those transitions.
+ */
+export declare function terminalEnvelopeStoryStatus(lane: LaneRecord, decision: "done" | "blocked" | "ask", envelopeStatus?: string): LaneStoryStatus | undefined;
 //# sourceMappingURL=stories.d.ts.map

package/dist/lib/lanes/stories.js

@@ -73,4 +73,20 @@ export function storyStatusForEnvelope(status) {
         return "review";
     return "in_progress";
 }
+/**
+ * Resolve the story status requested by a terminal envelope. Already-final
+ * carried stories are immutable through the envelope path; senior verification
+ * and explicit story commands own those transitions.
+ */
+export function terminalEnvelopeStoryStatus(lane, decision, envelopeStatus = "in_progress") {
+    const primary = laneStory(lane, lane.project_id, lane.story_id);
+    if (primary && (String(primary.status) === "done" || String(primary.status) === "dropped")) {
+        return undefined;
+    }
+    if (decision === "blocked")
+        return "blocked";
+    if (decision === "done")
+        return "review";
+    return storyStatusForEnvelope(envelopeStatus);
+}
 //# sourceMappingURL=stories.js.map

package/dist/lib/lanes/types.d.ts

@@ -412,6 +412,14 @@ export interface KeepAliveResumeHistoryEntry {
     resumed_from: "done" | "interrupted" | "blocked";
     account: string | null;
 }
+/** Bounded audit entry for every lane worker start after its first start. */
+export interface LaneResumeHistoryEntry {
+    at: string;
+    /** Stable trigger class; path-specific starts may use their path name. */
+    trigger: string;
+    /** HQ lane id for an agent caller, or `user` for an explicit human CLI action. */
+    caller?: string;
+}
 export interface KrFreshnessHistoryEntry {
     event: "kr_stalled";
     turn_id: string;
@@ -659,6 +667,8 @@ export interface LaneRecord {
     provider_home_at_spawn?: string;
     /** Set at spawn when this run continued a recorded session instead of starting fresh. */
     last_resume?: LaneResumeRecord;
+    /** Last 50 lane worker starts after the initial start, including actor provenance. */
+    resume_history?: LaneResumeHistoryEntry[];
     /** Cache counters from the last exited run's result. Nothing else from the payload. */
     last_run_usage?: LaneRunUsage;
     /** Completion time paired with last_run_usage; written by the watcher. */
@@ -723,6 +733,8 @@ export interface PendingResume {
     message_id?: string;
     /** The text is already framed as untrusted monitor data, not an operator instruction. */
     monitor_event?: true;
+    /** Caller identity captured when a deferred start was requested, when known. */
+    caller?: string;
     /** False when the command passed --no-compact; the deferred spawn honours it. */
     compact?: boolean;
     at: string;

package/dist/lib/lanes/types.js

@@ -233,7 +233,7 @@ export const LANE_FIELD_WRITERS = {
     overdue: ["reconcile"], overdue_at: ["reconcile"], last_host_report_at: ["watcher", "spawn", "reconcile"], stalled: ["watcher"], stalled_at: ["watcher"], stalled_reason: ["watcher"],
     admitted_reason: ["command", "reconcile"], terminal_reason: ["command", "watcher", "spawn", "reconcile"], stop_history: ["command", "reconcile"], settings_history: ["command"], pending_settings: ["command", "spawn"], interrupted_at: ["command", "watcher", "reconcile"], terminal_details: ["command", "spawn", "watcher", "reconcile"],
     quota_reset_at: ["watcher", "reconcile"], model_quota_marker: ["watcher", "reconcile"], outpost_command_id: ["command"],
-    provider_session_id: ["watcher", "command", "spawn"], provider_session_id_absent: ["watcher", "command"], provider_home_at_spawn: ["spawn"], last_resume: ["spawn"], last_run_usage: ["watcher"], last_run_usage_at: ["watcher"], envelope_repair: ["watcher", "reconcile"], envelope_validation_errors: ["watcher"], last_progress_event_at: ["watcher"],
+    provider_session_id: ["watcher", "command", "spawn"], provider_session_id_absent: ["watcher", "command"], provider_home_at_spawn: ["spawn"], last_resume: ["spawn"], resume_history: ["spawn", "watcher"], last_run_usage: ["watcher"], last_run_usage_at: ["watcher"], envelope_repair: ["watcher", "reconcile"], envelope_validation_errors: ["watcher"], last_progress_event_at: ["watcher"],
 };
 function isPlainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);

package/dist/lib/lanes/watcher.js

@@ -36,7 +36,7 @@ import * as path from "node:path";
 import { LanesError } from "./errors.js";
 import { questionRecordRefusalCode, raiseEnvelopeQuestions, resolveQuestionCompanyWithFallback, } from "./questions.js";
 import { isTerminalLaneState, ENVELOPE_INVALID_REASON, parseLaneEnvelope, STORY_STATUSES, LANE_PROVIDERS, } from "./types.js";
-import { laneStories, storyStatusForEnvelope } from "./stories.js";
+import { laneStories, terminalEnvelopeStoryStatus } from "./stories.js";
 import { appendCappedHistory, listQuestionIds, readLane, readQuestion, retryUpdateLane, withLaneHireLocks } from "./store.js";
 import { enforceRegistryApprovalGate } from "./approval-gate.js";
 import { readWorkerRunResult } from "./delivery.js";
@@ -423,27 +423,25 @@ export function applyTerminalToLaneWithResult(hqRoot, laneId, classification, op
                 artifacts: envelope.artifacts,
                 ...(envelope.blocked_reason !== undefined ? { blocked_reason: envelope.blocked_reason } : {}),
             };
-            next.story_status = envelope.story_status;
-            next.story_complete = envelope.story_complete;
-            next.story_complete_reason = envelope.story_complete_reason;
-            const currentProject = current.project_id;
-            const currentStory = current.story_id;
-            const storyStatus = envelope.decision === "blocked"
-                ? "blocked"
-                : envelope.decision === "done"
-                    ? "review"
-                    : storyStatusForEnvelope(envelope.story_status);
-            const updatedStories = laneStories(current).map((story) => story.project_id === currentProject && story.story_id === currentStory
-                ? {
-                    ...story,
-                    status: storyStatus,
-                    updated_at: at,
-                    ...(envelope.decision === "blocked"
-                        ? { blocked_reason: envelope.blocked_reason ?? "" }
-                        : { blocked_reason: undefined }),
-                }
-                : story);
-            next.stories = updatedStories;
+            const storyStatus = terminalEnvelopeStoryStatus(current, envelope.decision, envelope.story_status);
+            if (storyStatus !== undefined) {
+                next.story_status = envelope.story_status;
+                next.story_complete = envelope.story_complete;
+                next.story_complete_reason = envelope.story_complete_reason;
+                const currentProject = current.project_id;
+                const currentStory = current.story_id;
+                const updatedStories = laneStories(current).map((story) => story.project_id === currentProject && story.story_id === currentStory
+                    ? {
+                        ...story,
+                        status: storyStatus,
+                        updated_at: at,
+                        ...(envelope.decision === "blocked"
+                            ? { blocked_reason: envelope.blocked_reason ?? "" }
+                            : { blocked_reason: undefined }),
+                    }
+                    : story);
+                next.stories = updatedStories;
+            }
         }
         return next;
     });

package/dist/lib/mesh/live/daemon/doctor.d.ts

@@ -25,6 +25,8 @@ export interface DaemonDoctorReport {
     /** Events in any local queue still marked no-company / NEEDS_COMPANY / NONE. */
     unattributedEvents: UnattributedEventCounts;
     outboxDepth: number;
+    outboxQuarantined?: number;
+    outboxLastQuarantineReason?: string;
     lastFlushAt?: string;
     lastFlushResult?: DaemonStateFile["lastFlushResult"];
     unhealthy: boolean;

package/dist/lib/mesh/live/daemon/doctor.js

@@ -9,6 +9,7 @@ import { describeCognitoTokenSource, formatCognitoSubject, loadMachineCachedToke
 import { listOutboxOperations, outboxStats, } from "../../../work-context/outbox.js";
 import { readSessionState } from "../../../work-context/state.js";
 import { workContextRoot } from "../../../work-context/paths.js";
+import { outboxQuarantineStatusEnabled } from "../../../work-context/outbox-quarantine-status-flag.js";
 import { formatDroppedPresenceCompany } from "./credentials.js";
 import { countJsonlLines, countUnattributedEvents, } from "../spool.js";
 import { workMeshDeadLetterPath, workMeshHeldPath, workMeshRoot, workMeshSpoolPath, } from "../paths.js";
@@ -258,6 +259,12 @@ export function collectDaemonDoctor(deps = {}) {
         deadLetterCount,
         unattributedEvents,
         outboxDepth: outbox.depth,
+        ...(outbox.quarantined > 0 && outboxQuarantineStatusEnabled()
+            ? {
+                outboxQuarantined: outbox.quarantined,
+                outboxLastQuarantineReason: outbox.lastQuarantineReason ?? undefined,
+            }
+            : {}),
         lastFlushAt: state?.lastFlushAt,
         lastFlushResult: state?.lastFlushResult,
         unhealthy: unhealthyReasons.length > 0,
@@ -302,6 +309,9 @@ export function formatDaemonDoctor(report) {
         // receive-only (direct) mode.
         lines.push(`spool depth: ${report.spoolDepth}`, `held: ${report.heldCount}${report.heldCount > 0 ? " (needs_company; not sent as NONE)" : ""}`, `held with no local evidence: ${report.heldWithNoLocalEvidence}`, `outbox depth: ${report.outboxDepth}`);
     }
+    if (report.outboxQuarantined !== undefined) {
+        lines.push(`outbox quarantined: ${report.outboxQuarantined} (last reason=${report.outboxLastQuarantineReason ?? "unknown"})`);
+    }
     if (report.emitMode !== "legacy" && report.heldCount > 0) {
         lines.push(`held: ${report.heldCount} (needs_company; not sent as NONE)`);
     }

package/dist/lib/work-context/outbox-quarantine-status-flag.d.ts

@@ -0,0 +1,4 @@
+export declare const OUTBOX_QUARANTINE_STATUS_FLAG = "agents.work-context-outbox-quarantine-status";
+export declare const OUTBOX_QUARANTINE_STATUS_FALLBACK = false;
+export declare function outboxQuarantineStatusEnabled(): boolean;
+//# sourceMappingURL=outbox-quarantine-status-flag.d.ts.map

package/dist/lib/work-context/outbox-quarantine-status-flag.js

@@ -0,0 +1,7 @@
+import { resolveProcessFlagGate } from "../flag-registry.js";
+export const OUTBOX_QUARANTINE_STATUS_FLAG = "agents.work-context-outbox-quarantine-status";
+export const OUTBOX_QUARANTINE_STATUS_FALLBACK = false;
+export function outboxQuarantineStatusEnabled() {
+    return resolveProcessFlagGate(OUTBOX_QUARANTINE_STATUS_FLAG, { fallback: OUTBOX_QUARANTINE_STATUS_FALLBACK }, () => OUTBOX_QUARANTINE_STATUS_FALLBACK);
+}
+//# sourceMappingURL=outbox-quarantine-status-flag.js.map

package/dist/lib/work-context/outbox.d.ts

@@ -118,6 +118,7 @@ export interface OutboxStats {
     quarantined: number;
     queued: number;
     acked: number;
+    lastQuarantineReason: string | null;
 }
 export declare function outboxStats(root: string): OutboxStats;
 export type DeliverFn = (op: OutboxOperation) => Promise<{

package/dist/lib/work-context/outbox.js

@@ -458,11 +458,17 @@ export function listOutboxOperations(root, deps = {}) {
 }
 export function outboxStats(root) {
     const ops = listOutboxOperations(root);
+    const quarantinedOps = ops.filter((o) => o.delivery === "quarantined");
+    const latestQuarantine = quarantinedOps.reduce((latest, op) => !latest || op.updatedAt > latest.updatedAt ||
+        (op.updatedAt === latest.updatedAt && op.operationId > latest.operationId)
+        ? op
+        : latest, null);
     return {
         depth: ops.filter((o) => o.delivery === "queued").length,
-        quarantined: ops.filter((o) => o.delivery === "quarantined").length,
+        quarantined: quarantinedOps.length,
         queued: ops.filter((o) => o.delivery === "queued").length,
         acked: ops.filter((o) => o.delivery === "acked").length,
+        lastQuarantineReason: latestQuarantine?.lastErrorCode ?? null,
     };
 }
 function isOutboxDue(op, nowIso) {

package/dist/run/env-graph-guard.d.ts

@@ -1,5 +1,5 @@
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export declare const VARLOCK_PINNED_VERSION = "1.0.0";
+export declare const VARLOCK_PINNED_VERSION = "1.21.1";
 /** A schema/plugin source varlock could not finish loading. */
 interface GuardDataSource {
     readonly isValid: boolean;
@@ -68,7 +68,7 @@ export declare function assertEnvGraphLoaded(graph: LoadedEnvGraph): void;
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever

package/dist/run/env-graph-guard.js

@@ -34,7 +34,7 @@
 // actionable `hq: …` line WITHOUT a Sentry capture (see isVarlockEnvError).
 import { claimRejection, releaseRejection, } from "../unhandled-rejection-boundary.js";
 /** The varlock version hq-cli is pinned to (package.json `dependencies`). */
-export const VARLOCK_PINNED_VERSION = "1.0.0";
+export const VARLOCK_PINNED_VERSION = "1.21.1";
 /**
  * A schema/entry file could not be loaded, so the env graph never finished
  * processing. Carries an actionable, file-naming message; classified by
@@ -114,7 +114,7 @@ export function assertEnvGraphLoaded(graph) {
  * rejection into a thrown EnvResolutionError instead of hanging on the promise
  * that never settles.
  *
- * varlock@1.0.0's resolveEnvValues dispatches its per-item resolver un-awaited
+ * varlock's resolveEnvValues dispatches its per-item resolver un-awaited
  * and with a dead `_reject`, so a throw inside it becomes a process-level
  * unhandled rejection AND leaves the returned promise permanently pending. We
  * race the resolve against a scoped `unhandledRejection` listener: whichever
@@ -143,6 +143,9 @@ export async function resolveEnvValuesOrThrow(graph) {
     });
     process.prependOnceListener("unhandledRejection", onRejection);
     try {
+        // Preserve current varlock's direct rejection unchanged. The race only
+        // turns a floated rejection (the 1.0.0 behavior) into a typed error rather
+        // than leaving the caller waiting on a promise that never settles.
         await Promise.race([graph.resolveEnvValues(), rejection]);
     }
     finally {

package/dist/run/hq-plugin.js

@@ -23,8 +23,9 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         errorsByName: new Map(),
         loadedSecretsByName: new Map(),
     };
-    // varlock@1.0.0's plugin-lib.js omits the Resolver export (d.ts/JS mismatch);
-    // extract it at runtime from any already-registered built-in resolver's prototype.
+    // In varlock@1.21.1, Resolver remains declared in plugin-lib's .d.mts but
+    // is not exported from its runtime module. Derive the runtime base class from
+    // a built-in resolver registered on the graph; the shape test pins this API.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     let RuntimeResolver;
     try {
@@ -39,8 +40,8 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
         RuntimeResolver = proto;
     }
     catch (e) {
-        throw new Error('varlock Resolver base class extraction failed — the varlock@1.0.0 d.ts/JS mismatch ' +
-            'may have been resolved; switch to `import { Resolver } from "varlock/plugin-lib"`. ' +
+        throw new Error('varlock Resolver base class extraction failed — varlock@1.21.1 still declares ' +
+            'Resolver in plugin-lib types without exporting it at runtime. ' +
             `Underlying: ${e instanceof Error ? e.message : String(e)}`);
     }
     // HqResolver is declared INSIDE installHqPlugin so its static def.resolve
@@ -96,7 +97,7 @@ export function installHqPlugin(graph /* EnvGraph */, opts) {
             }
         }
     }
-    // varlock@1.0.0's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
+    // Varlock's env-spec parser rejects dots in decorator names ([a-zA-Z0-9_] only),
     // so `@hq.company` is not valid syntax. We register as `@hqCompany` (camelCase) instead.
     // Schema files must use `# @hqCompany("slug")` followed by a blank line so the parser
     // treats it as a file-level root decorator rather than an item decorator for the next var.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.295.0",
+  "version": "5.297.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -58,7 +58,7 @@
     "semver": "^7.6.3",
     "simple-git": "^3.27.0",
     "smol-toml": "1.6.1",
-    "varlock": "1.0.0"
+    "varlock": "1.21.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",