@indigoai-us/hq-cli 5.301.0 → 5.303.0

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## [Unreleased]
 
+## [5.303.0] — 2026-10-01
+- Fixed bundled shell scripts failing on Windows when Git Bash is installed but `bash` is not on `PATH`.
+- The bundled token usage script now reads Claude sessions from `CLAUDE_CONFIG_DIR/projects` and the standard Claude project directories, including nested session folders (subagent transcripts are skipped), when no project directory is given.
+
+## [5.302.0] — 2026-10-01
+
+- Generate company project indexes while preserving hand-written content unless `--accept` is used.
+
+- Follow all hq-deploy app-list pages when resolving apps for comments and report publishing.
+- Let a senior message or resume an `awaiting_input` lane when its pending question is gone or cannot be reached from the senior's host. Pending questions remain answer-first, including across registered Outpost routes.
+- A senior can resume or send a fallback message to an `awaiting_input` lane when its pending questions are addressed to another audience. Once the resume is accepted, those questions are cancelled on their owner; unreachable owners are reported while the lane continues.
+- When a blocker escalation targets a session without a registered monitor inbox, record the reason and deliver it through the lane's existing inbox instead of retrying the failed escalation every watcher pass.
+- `hq integrations disconnect` can now remove company integrations that were created outside the app catalog.
+- Lead envelopes can set `next_check_at` to defer automatic keep-alive resumes
+  until a scheduled check, with pending work continuing to resume immediately.
+- Reconcile records deduplicated keep-alive skip reasons in each lane's watcher event log.
+- Add a company-scoped reconcile gate that closes local interrupted worker lanes after 24 hours when all carried project stories are done or dropped and no pending work remains.
+- Skip refreshing failed-dispatch lane mirrors that never reached their Outpost owner.
+- Keep lane keep-alive, retry-context, and monitor history readers moving past torn JSONL records.
+- Refresh primary mirror heartbeats from fresh running Outpost reports before dead-host reconciliation.
+- Report answerable awaiting-input questions as the `hq lanes show` delivery path, and retry blocker-freshness fallback messages after a failed append.
+- Let `hq integrations connect` send an API key in a custom HTTP header.
+- Bound `hq rescue` GitHub release and tag lookups to 30 seconds with a clear timeout error.
+- hq-cli now logs live-board refresh failures and recovery while continuing to retry.
+- On Windows, background jobs started by `/handoff` and search indexing no longer open console windows.
+
 ## [5.301.0] — 2026-10-01
 - `hq meetings transcript` and `hq meetings notes` stop a stalled document download after two minutes and say so, instead of waiting forever.
 

package/assets/scaffold/core/scripts/rebuild-projects-index.sh

@@ -11,12 +11,11 @@ set -euo pipefail
 HQ_ROOT="${HQ_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
 cd "$HQ_ROOT"
 
+COMPANIES_DIR="companies"
 PROJECTS_DIR="personal/projects"
 OUT="${PROJECTS_DIR}/INDEX.md"
 DATE=$(date -u +%Y-%m-%d)
 
-[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
-
 sanitize_cell() {
   printf '%s' "$1" | tr '\n' ' ' | sed -e 's/|/\\|/g' -e 's/  */ /g' -e 's/^ *//' -e 's/ *$//'
 }
@@ -29,17 +28,23 @@ trunc() {
 project_status() {
   local project="$1"
   local prd="$2"
+  local fallback="${3:-—}"
+  local expected_prd="${4:-}"
   local state="workspace/orchestrator/${project}/state.json"
   if [[ -f "$state" ]]; then
-    local raw
-    raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
-    case "$raw" in
-      completed|complete) echo "complete" ;;
-      in_progress|active|started) echo "active" ;;
-      archived) echo "archived" ;;
-      *) echo "$raw" ;;
-    esac
-    return
+    local state_prd
+    state_prd=$(jq -r '.prd_path // ""' "$state" 2>/dev/null || echo "")
+    if [[ -z "$expected_prd" || "$state_prd" == "$expected_prd" ]]; then
+      local raw
+      raw=$(jq -r '.status // "active"' "$state" 2>/dev/null || echo "active")
+      case "$raw" in
+        completed|complete) echo "complete" ;;
+        in_progress|active|started) echo "active" ;;
+        archived) echo "archived" ;;
+        *) echo "$raw" ;;
+      esac
+      return
+    fi
   fi
   if [[ -f "$prd" ]]; then
     local total passes
@@ -50,9 +55,91 @@ project_status() {
       return
     fi
   fi
-  echo "—"
+  echo "$fallback"
+}
+
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
 }
 
+stamp_generated() {
+  local input="$1" output="$2" normalized hash
+  normalized=$(mktemp)
+  sed 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$input" > "$normalized"
+  hash=$(sha256_file "$normalized")
+  rm -f "$normalized"
+  awk -v h="$hash" '{print} /^> Auto-generated. Updated: / {print "<!-- hq-generated-sha256: " h " -->"}' "$input" > "$output"
+}
+
+company_title() {
+  printf '%s\n' "$1" | awk -F'-' '{ for (i=1; i<=NF; i++) { $i = toupper(substr($i,1,1)) substr($i,2) } print }' OFS=' '
+}
+
+write_company_projects_index() {
+  local company="$1" company_root project_dir output tmp name prd description status
+  company_root="${COMPANIES_DIR}/${company}"
+  project_dir="${company_root}/projects"
+  output="${project_dir}/INDEX.md"
+  tmp=$(mktemp)
+  {
+    printf '# %s Projects\n\n' "$(company_title "$company")"
+    printf '> Auto-generated. Updated: %s\n\n' "$DATE"
+    echo '| Project | Status | Description |'
+    echo '|---------|--------|-------------|'
+    while IFS= read -r project; do
+      name=$(basename "$project")
+      [[ "$name" == _* ]] && continue
+      [[ "$name" == .* ]] && continue
+      prd="${project}/prd.json"
+      description=""
+      if [[ -f "$prd" ]]; then description=$(jq -r '.description // ""' "$prd" 2>/dev/null || echo ""); fi
+      status=$(project_status "$name" "$prd" "active" "$prd")
+      description=$(sanitize_cell "$description")
+      description=$(trunc "$description" 110)
+      [[ -z "$description" ]] && description="—"
+      printf '| `%s` | %s | %s |\n' "$name" "$status" "$description"
+    done < <(find "$project_dir" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+  } > "$tmp"
+  local existing=0 stored actual normalized
+  [[ -e "$output" ]] && existing=1
+  if [[ "$existing" == 1 ]]; then
+    if grep -q '<!-- hq:keep -->' "$output" || ! grep -q '^> Auto-generated. Updated: ' "$output"; then
+      echo "rebuild-projects-index: refused to overwrite ${output} (hand-written or kept)" >&2
+      rm -f "$tmp"
+      return 0
+    fi
+    stored=$(sed -n 's/^<!-- hq-generated-sha256: \([a-f0-9]*\) -->$/\1/p' "$output" | head -n 1)
+    if [[ -n "$stored" ]]; then
+      normalized=$(mktemp)
+      sed -e '/^<!-- hq-generated-sha256: [a-f0-9]* -->$/d' -e 's/^> Auto-generated. Updated: [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/> Auto-generated. Updated: <date>/' "$output" > "$normalized"
+      actual=$(sha256_file "$normalized")
+      rm -f "$normalized"
+      if [[ "$stored" != "$actual" ]]; then
+        echo "rebuild-projects-index: refused to overwrite ${output} (generated content was edited)" >&2
+        rm -f "$tmp"
+        return 0
+      fi
+    fi
+  fi
+  stamp_generated "$tmp" "$output"
+  rm -f "$tmp"
+  echo "rebuild-projects-index: wrote ${output}" >&2
+}
+
+while IFS= read -r dir; do
+  co=$(basename "$dir")
+  [[ "$co" == _* ]] && continue
+  [[ "$co" == .* ]] && continue
+  project_dir="${COMPANIES_DIR}/${co}/projects"
+  [[ -d "$project_dir" ]] && write_company_projects_index "$co"
+done < <(find "$COMPANIES_DIR" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort)
+
+[[ -d "$PROJECTS_DIR" ]] || { echo "rebuild-projects-index: ${PROJECTS_DIR}/ missing, skipping" >&2; exit 0; }
+
 {
   echo "# Projects"
   echo ""

package/assets/scaffold/core/scripts/token-usage-report.sh

@@ -12,7 +12,8 @@
 
 set -euo pipefail
 
-PROJECT_DIR="${CLAUDE_PROJECTS_DIR:-$HOME/.claude/projects/-Users-{your-name}-Documents-HQ}"
+PROJECT_DIR=""
+PROJECT_DIR_SET=0
 LAST_DAYS=7
 SINCE=""
 JSON_MODE=0
@@ -31,6 +32,7 @@ while [ $# -gt 0 ]; do
         exit 1
       fi
       PROJECT_DIR="$2"
+      PROJECT_DIR_SET=1
       shift 2
       ;;
     --compare-windows) shift ;;   # flag, presence triggers compare mode via --before/--after
@@ -47,14 +49,47 @@ done
 
 command -v node >/dev/null 2>&1 || { echo "token-usage-report: node is required" >&2; exit 1; }
 
+# Resolve roots in the same precedence order as the native command. Explicit
+# project directories and environment overrides select one exact activity root;
+# otherwise include standard, desktop-saved, and discovered Claude roots.
+PROJECT_DIRS=("")
+add_project_dir() {
+  local candidate="$1" existing
+  [ -d "$candidate" ] || return 0
+  for existing in "${PROJECT_DIRS[@]}"; do [ "$existing" = "$candidate" ] && return 0; done
+  PROJECT_DIRS+=("$candidate")
+}
+trim_env_path() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+if [ "$PROJECT_DIR_SET" -eq 1 ]; then
+  if [ ! -d "$PROJECT_DIR" ]; then echo "Project dir not found: $PROJECT_DIR" >&2; exit 1; fi
+  add_project_dir "$PROJECT_DIR"
+elif [ -n "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")" ]; then
+  add_project_dir "$(trim_env_path "${CLAUDE_PROJECTS_DIR:-}")"
+elif [ -n "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")" ]; then
+  add_project_dir "$(trim_env_path "${CLAUDE_CONFIG_DIR:-}")/projects"
+else
+  add_project_dir "$HOME/.claude/projects"
+  SAVED_PROJECT_DIR="$(node -e 'try { const value = require(process.argv[1]).claudeProjectsDir; if (typeof value === "string" && value.trim()) process.stdout.write(value.trim()); } catch {}' "$HOME/.hq/menubar.json")"
+  [ -z "$SAVED_PROJECT_DIR" ] || add_project_dir "$SAVED_PROJECT_DIR"
+  for candidate in "$HOME"/.claude-*; do
+    [ -d "$candidate/projects" ] && add_project_dir "$candidate/projects"
+  done
+fi
+if [ "${#PROJECT_DIRS[@]}" -le 1 ]; then echo "Claude activity folders not found" >&2; exit 1; fi
+
 # --- Compare-windows mode (US-011) ---
 # Format: --before YYYY-MM-DD:YYYY-MM-DD --after YYYY-MM-DD:YYYY-MM-DD
 if [ -n "$COMPARE_BEFORE" ] && [ -n "$COMPARE_AFTER" ]; then
-  node - "$PROJECT_DIR" "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" <<'JS'
+  node - "$COMPARE_BEFORE" "$COMPARE_AFTER" "$MIN_HOURS" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [proj, before, after, minHoursS, jsonModeS] = process.argv.slice(2);
+const [before, after, minHoursS, jsonModeS, ...projectDirs] = process.argv.slice(2);
 const minHours = parseFloat(minHoursS);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -63,13 +98,24 @@ const [bStart, bEnd] = parseRange(before);
 const [aStart, aEnd] = parseRange(after);
 
 const fmt = (n) => n.toLocaleString("en-US");
-const listJsonl = () => {
-  try { return fs.readdirSync(proj).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { return []; }
+const listJsonl = (projectDir) => {
+  const found = [];
+  const visit = (current, relative) => {
+    let entries;
+    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return; }
+    for (const entry of entries) {
+      const nextRelative = path.join(relative, entry.name);
+      if (entry.isDirectory() && entry.name !== "subagents") visit(path.join(current, entry.name), nextRelative);
+      else if (entry.isFile() && entry.name.endsWith(".jsonl")) found.push(nextRelative);
+    }
+  };
+  visit(projectDir, "");
+  return found.sort();
 };
 
 function collect(windowStart, windowEnd) {
   const rows = [];
-  for (const name of listJsonl()) {
+  for (const proj of projectDirs) for (const name of listJsonl(proj)) {
     const f = path.join(proj, name);
     let cr = 0, firstTs = null, lastTs = null;
     const sid = name.replace(/\.jsonl$/, "");
@@ -130,16 +176,11 @@ JS
   exit 0
 fi
 
-if [ ! -d "$PROJECT_DIR" ]; then
-  echo "Project dir not found: $PROJECT_DIR" >&2
-  exit 1
-fi
-
-node - "$PROJECT_DIR" "$LAST_DAYS" "$SINCE" "$JSON_MODE" <<'JS'
+node - "$LAST_DAYS" "$SINCE" "$JSON_MODE" "${PROJECT_DIRS[@]:1}" <<'JS'
 const fs = require("fs");
 const path = require("path");
 
-const [projectDir, lastDaysS, sinceS, jsonModeS] = process.argv.slice(2);
+const [lastDaysS, sinceS, jsonModeS, ...projectDirs] = process.argv.slice(2);
 const lastDays = parseInt(lastDaysS, 10);
 const jsonMode = parseInt(jsonModeS, 10) === 1;
 
@@ -156,11 +197,20 @@ const fmt = (n) => n.toLocaleString("en-US");
 const dayTotals = {};
 const sessionTotals = {};
 
-let names;
-try { names = fs.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).sort(); } catch (e) { names = []; }
-
-// Parent sessions only (top-level *.jsonl)
-for (const name of names) {
+// Parent sessions only; listJsonl skips each session's subagents/ tree.
+for (const projectDir of projectDirs) {
+  const listJsonl = (current, relative = "") => {
+    let entries;
+    try { entries = fs.readdirSync(current, { withFileTypes: true }); } catch (e) { return []; }
+    return entries.flatMap((entry) => {
+      const nextRelative = path.join(relative, entry.name);
+      if (entry.isDirectory() && entry.name !== "subagents") return listJsonl(path.join(current, entry.name), nextRelative);
+      if (entry.isFile() && entry.name.endsWith(".jsonl")) return [nextRelative];
+      return [];
+    }).sort();
+  };
+  const names = listJsonl(projectDir);
+  for (const name of names) {
   const f = path.join(projectDir, name);
   let mtime;
   try { mtime = fs.statSync(f).mtime; } catch (e) { continue; }
@@ -170,6 +220,7 @@ for (const name of names) {
   let firstTs = null, lastTs = null, firstUser = "";
   let subCount = 0;
   const sid = name.replace(/\.jsonl$/, "");
+  const sessionId = path.basename(path.dirname(projectDir)) + "/" + sid;
   let content;
   try { content = fs.readFileSync(f, "utf8"); } catch (e) { continue; }
   for (const line of content.split(/\r?\n/)) {
@@ -196,15 +247,16 @@ for (const name of names) {
   if (!day) day = mt;
   if (day < cutoff) continue;
   if (!dayTotals[day]) dayTotals[day] = { sessions: new Set(), inp: 0, out: 0, cc: 0, cr: 0 };
-  dayTotals[day].sessions.add(sid);
+  dayTotals[day].sessions.add(sessionId);
   dayTotals[day].inp += inp;
   dayTotals[day].out += out;
   dayTotals[day].cc += cc;
   dayTotals[day].cr += cr;
-  sessionTotals[sid] = {
+  sessionTotals[sessionId] = {
     day: day, inp: inp, out: out, cc: cc, cr: cr,
     eff: Math.trunc(eff), subagents: subCount, first_user: firstUser.split("\n").join(" "),
   };
+  }
 }
 
 const sortedDays = Object.keys(dayTotals).sort();

package/dist/command-catalog.generated.d.ts

@@ -3122,6 +3122,9 @@ export declare const COMMAND_CATALOG: readonly [{
         }, {
             readonly flags: "--token-stdin";
             readonly description: "Read the API key from stdin";
+        }, {
+            readonly flags: "--auth-header <name>";
+            readonly description: "Send the API key in this HTTP header (implies --auth key)";
         }, {
             readonly flags: "--auth <mode>";
             readonly description: "Force the auth mode: none, key, or oauth (default: detect)";
@@ -8608,7 +8611,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "resume";
-        readonly description: "Resume an interrupted, done or blocked lane on its recorded provider session; recover failed lanes with the senior-only --from-failed option";
+        readonly description: "Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with the senior-only --from-failed option";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <lane-id>";

package/dist/command-catalog.generated.js

@@ -4013,6 +4013,10 @@ export const COMMAND_CATALOG = [
                         "flags": "--token-stdin",
                         "description": "Read the API key from stdin"
                     },
+                    {
+                        "flags": "--auth-header <name>",
+                        "description": "Send the API key in this HTTP header (implies --auth key)"
+                    },
                     {
                         "flags": "--auth <mode>",
                         "description": "Force the auth mode: none, key, or oauth (default: detect)"
@@ -11100,7 +11104,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "resume",
-                "description": "Resume an interrupted, done or blocked lane on its recorded provider session; recover failed lanes with the senior-only --from-failed option",
+                "description": "Resume an interrupted, done or blocked lane, or an awaiting_input lane with no answerable question; recover failed lanes with the senior-only --from-failed option",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <lane-id>",

package/dist/commands/bot.js

@@ -228,6 +228,7 @@ export function spawnDetachedRun(name, dir) {
     const fd = fs.openSync(botLogPath(dir), "a");
     const child = spawn(process.execPath, [entry, "bot", "run", name], {
         detached: true,
+        windowsHide: true,
         stdio: ["ignore", fd, fd],
         env: { ...process.env, HQ_NO_UPDATE_CHECK: "1" },
     });

package/dist/commands/core-checkpoint.js

@@ -1049,6 +1049,7 @@ function startSibling(liveRoot, input, threadPath, backend) {
     try {
         child = spawn(backend, args, {
             detached: true,
+            windowsHide: true,
             cwd: liveRoot,
             stdio: ["ignore", logFd, logFd],
             env: siblingEnv(process.env, backend),

package/dist/commands/core-handoff-fast.js

@@ -60,6 +60,7 @@ async function launchHandoffPost(args, root) {
                     HQ_NATIVE_HANDOFF_POST_CHILD: "1",
                 },
                 detached: true,
+                windowsHide: true,
                 stdio: "ignore",
             });
             child.once("error", (error) => {

package/dist/commands/core-handoff.js

@@ -802,6 +802,7 @@ function spawnBashDetached(script, args, cwd, root, logFile) {
             cwd,
             env: { ...process.env, HQ_ROOT: root },
             detached: true,
+            windowsHide: true,
             stdio: ["ignore", fd, fd],
         });
         child.once("error", (error) => appendLog(logFile, `${error.message}\n`));
@@ -841,6 +842,7 @@ async function launchHandoffPost(args, root) {
                 cwd: root,
                 env: { ...process.env, HQ_NATIVE_HANDOFF_POST_CHILD: "1" },
                 detached: true,
+                windowsHide: true,
                 stdio: "ignore",
             });
             child.once("error", (error) => resolve({ code: 127, stdout: "", stderr: `${error.message}\n` }));

package/dist/commands/deploy-comments.js

@@ -1,4 +1,5 @@
 import { deployApiRequest } from "../lib/deploy-api.js";
+import { listDeployApps } from "../lib/deploy-apps.js";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken } from "../utils/cognito-session.js";
 import { readActiveCompanySlug } from "./skill.js";
 class DeployCommentsError extends Error {
@@ -50,8 +51,10 @@ async function deployJson(token, route, orgHeaders) {
     }
 }
 async function resolveAppId(token, appNameOrId, orgHeaders) {
-    const result = await deployJson(token, "/api/apps", orgHeaders);
-    const apps = Array.isArray(result.apps) ? result.apps : [];
+    const apps = await listDeployApps((cursor) => {
+        const route = cursor ? `/api/apps?cursor=${encodeURIComponent(cursor)}` : "/api/apps";
+        return deployJson(token, route, orgHeaders);
+    });
     const byId = apps.find((app) => app && typeof app.id === "string" && app.id === appNameOrId);
     const matches = byId
         ? [byId]

package/dist/commands/integrations-connect.d.ts

@@ -30,6 +30,7 @@ interface ConnectOptions {
     displayName?: string;
     token?: string;
     tokenStdin?: boolean;
+    authHeader?: string;
     auth?: string;
     browser?: boolean;
     timeout?: string;
@@ -48,6 +49,8 @@ interface ConnectOptions {
  * than fall through to a default.
  */
 export declare function assertAuthMode(value: string | undefined): void;
+/** RFC 7230 token characters accepted for an HTTP field name. */
+export declare function assertAuthHeader(value: string | undefined): void;
 /** Single-quote a value for a copy-pasteable shell command. */
 export declare function shellQuote(value: string): string;
 /** Everything the connect verbs need to name one app to hq-pro. */

package/dist/commands/integrations-connect.js

@@ -185,6 +185,12 @@ export function assertAuthMode(value) {
         throw new IntegrationsCliError("--auth must be none, key, or oauth.", { expected: true });
     }
 }
+/** RFC 7230 token characters accepted for an HTTP field name. */
+export function assertAuthHeader(value) {
+    if (value !== undefined && !/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(value)) {
+        throw new IntegrationsCliError("--auth-header must be a non-empty HTTP header name using RFC 7230 token characters.", { expected: true });
+    }
+}
 /** Single-quote a value for a copy-pasteable shell command. */
 export function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -904,7 +910,9 @@ function reportInstall(result, opts, expectedRevivedConnectionId) {
  */
 async function connectApp(token, companyUid, app, opts, expectedRevivedConnectionId) {
     const target = await resolveTarget(token, companyUid, app, opts, expectedRevivedConnectionId !== undefined);
-    const authMode = opts.auth ?? target.authClass;
+    const authMode = opts.authHeader
+        ? "key"
+        : opts.auth ?? target.authClass;
     assertUserClientApplicable(opts, target, authMode);
     assertScopesApplicable(opts, target, authMode);
     if (authMode === "oauth") {
@@ -922,7 +930,13 @@ async function connectApp(token, companyUid, app, opts, expectedRevivedConnectio
         const result = await installIntegration(token, companyUid, {
             ...target.ref,
             ...(bearerToken
-                ? { authMode: "bearer", bearerToken }
+                ? {
+                    authMode: "bearer",
+                    bearerToken,
+                    ...(opts.authHeader
+                        ? { authScheme: { placement: "header", header: opts.authHeader } }
+                        : {}),
+                }
                 : authMode === "none"
                     ? { authMode: "none" }
                     : {}),
@@ -1173,6 +1187,7 @@ export function registerConnectCommands(integrations) {
         .option("--display-name <name>", "Display name for a custom --mcp-url")
         .option("--token <key>", "API key (prefer --token-stdin: --token lands in shell history)")
         .option("--token-stdin", "Read the API key from stdin")
+        .option("--auth-header <name>", "Send the API key in this HTTP header (implies --auth key)")
         .option("--auth <mode>", "Force the auth mode: none, key, or oauth (default: detect)")
         .option("--client-id <id>", "Client id of an OAuth app you registered with the provider yourself")
         .option("--client-secret-stdin", "Read that app's client secret from stdin")
@@ -1183,6 +1198,10 @@ export function registerConnectCommands(integrations) {
         .option("--json", "Machine-readable output")
         .action(async (app, opts) => {
         assertAuthMode(opts.auth);
+        assertAuthHeader(opts.authHeader);
+        if (opts.authHeader && opts.auth !== undefined && opts.auth !== "key") {
+            throw new IntegrationsCliError("--auth-header can only be used with --auth key.", { expected: true });
+        }
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         if (await refuseIfAlreadyConnected(token, companyUid, app, opts))

package/dist/commands/lanes-message.js

@@ -247,6 +247,7 @@ export function createLaneMessageHandlers(deps) {
         }
         let lane = resolution.lane;
         if (resolution.remoteOnly || (lane.host.kind === "outpost" && !laneIsHostedHere(ctx, lane))) {
+            const fallbackAt = lane.state === "awaiting_input" ? ctx.now().toISOString() : undefined;
             const callerLaneId = ctx.env.HQ_LANE_ID?.trim();
             const supersededMessageCallerId = callerLaneId === undefined || resolution.remoteOnly
                 ? undefined
@@ -262,9 +263,14 @@ export function createLaneMessageHandlers(deps) {
                 ...opts,
                 ...(supersededMessageCallerId === undefined ? {} : { supersededMessageCallerId }),
                 ...(supersededMessageSessionId === undefined ? {} : { supersededMessageSessionId }),
-            }, resolution.remoteOnly
-                ? { syncPrimary: false, expectedOwnerHost: resolution.ownerHost }
-                : undefined);
+            }, {
+                ...(resolution.remoteOnly
+                    ? { syncPrimary: false, expectedOwnerHost: resolution.ownerHost }
+                    : {}),
+                ...(fallbackAt === undefined ? {} : {
+                    afterFallbackResume: () => deps.cancelFallbackQuestionsForLane(ctx, lane, "message", fallbackAt),
+                }),
+            });
             return;
         }
         assertLaneRunsHereForOperatorMutation(ctx, lane, "message");
@@ -350,6 +356,19 @@ export function createLaneMessageHandlers(deps) {
             if (opts.account !== undefined && !keepCurrentAccount && !providerSessionPortable(lane.provider)) {
                 throw new LanesError("provider_session_not_portable", sessionNotPortableMessage(lane.provider), { lane_id: laneId, provider: lane.provider });
             }
+            const pendingAnswerableQuestion = lane.state === "awaiting_input"
+                ? await deps.hasPendingQuestionForLane(ctx, lane)
+                : false;
+            if (pendingAnswerableQuestion) {
+                const message = deliveryRefusalReason(lane);
+                throw new LanesError("lane_not_accepting_messages", message, {
+                    lane_id: laneId,
+                    state: lane.state,
+                    provider: lane.provider,
+                    message,
+                });
+            }
+            const awaitingInputFallback = lane.state === "awaiting_input" && !pendingAnswerableQuestion;
             // One decision point for how a follow-up reaches this lane (delivery.ts).
             // `none` refuses before anything is written: no inbox append, no spawn.
             const mechanism = laneDeliveryMechanism(lane);
@@ -536,9 +555,13 @@ export function createLaneMessageHandlers(deps) {
                     ...(keepCurrentAccount && opts.model !== undefined ? { cliModel: opts.model } : {}),
                 });
             }
+            let questionCancellation = null;
             if (move?.queued) {
                 // Parked at the target's cap: reconcile resumes the session there.
                 markAccepted();
+                questionCancellation = awaitingInputFallback
+                    ? await deps.cancelFallbackQuestionsForLane(ctx, lane, "message", at)
+                    : null;
             }
             else {
                 const dispatched = await dispatchLaneDelivery(lane, {
@@ -637,6 +660,9 @@ export function createLaneMessageHandlers(deps) {
                 if (dispatched.mechanism === "resume")
                     resumed = dispatched.value;
                 markAccepted();
+                questionCancellation = awaitingInputFallback
+                    ? await deps.cancelFallbackQuestionsForLane(ctx, lane, "message", at)
+                    : null;
             }
             // Every accepted message moves the compaction reference forward.
             const next = casUpdateLane(hqRoot, laneId, (current) => ({
@@ -679,6 +705,10 @@ export function createLaneMessageHandlers(deps) {
                     inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
                     drain_hook: drainHook,
                     warning,
+                    ...(questionCancellation === null ? {} : {
+                        cancelled_questions: questionCancellation.cancelled_question_ids,
+                        question_cancellation_failures: questionCancellation.failures,
+                    }),
                     resumed_session_id: resumed?.last_resume?.session_id ?? null,
                     compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
                         ? resumed.last_compaction

package/dist/commands/lanes-questions.d.ts

@@ -1,7 +1,9 @@
-import { type QuestionBody, type QuestionRecord } from "../lib/lanes/index.js";
-import type { Ctx, LaneQuestionsHandlerDeps } from "./lanes-shared.js";
+import { type QuestionBody, type LaneRecord, type QuestionRecord } from "../lib/lanes/index.js";
+import type { Ctx, FallbackQuestionCancellationResult, LaneQuestionsHandlerDeps } from "./lanes-shared.js";
 export declare function resolveAnswerChoice(choice: string, options: string[], freeform: boolean): string;
 export declare function createLaneQuestionsHandlers(deps: LaneQuestionsHandlerDeps): {
+    hasPendingQuestionForLane: (ctx: Ctx, lane: LaneRecord) => Promise<boolean>;
+    cancelFallbackQuestionsForLane: (ctx: Ctx, lane: LaneRecord, trigger: "message" | "resume", at: string) => Promise<FallbackQuestionCancellationResult>;
     runQuestionsList: (ctx: Ctx, opts: {
         allHosts?: boolean;
         for?: string;