@indigoai-us/hq-cli 5.303.0 → 5.304.0

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## [Unreleased]
 
+## [5.304.0] — 2026-10-01
+- `hq lanes show` skips owner refresh only when a failed Outpost dispatch explicitly recorded `pickup_persisted: false` and no owner heartbeat; it reports `remote_refresh: "skipped_undispatched"` in that case.
+
 ## [5.303.0] — 2026-10-01
 - Fixed bundled shell scripts failing on Windows when Git Bash is installed but `bash` is not on `PATH`.
 - The bundled token usage script now reads Claude sessions from `CLAUDE_CONFIG_DIR/projects` and the standard Claude project directories, including nested session folders (subagent transcripts are skipped), when no project directory is given.

package/dist/commands/lanes.d.ts

@@ -132,6 +132,8 @@ export declare function parseMaxRuntimeSeconds(raw: unknown, workerId: string):
 export declare const PICKUP_TERMINAL_REASONS: readonly ["account_not_logged_in", "unknown_account", "account_disabled", "model_unsupported"];
 export declare const DISPATCH_TERMINAL_REASON: "outpost_dispatch_failed";
 export type PickupTerminalReason = (typeof PICKUP_TERMINAL_REASONS)[number];
+/** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
+export declare function isUndispatchedOutpostMirror(lane: LaneRecord): boolean;
 /**
  * The CAS updater a pickup failure applies. A lane that is already terminal
  * for any reason (a cancel that landed after the caller's last read, an

package/dist/commands/lanes.js

@@ -1284,9 +1284,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
         ((parentLaneIds === undefined || (lane.senior.kind === "lane" &&
             lane.senior.id !== undefined &&
             parentLaneIds.has(lane.senior.id))) || options.laneIds?.has(lane.lane_id) === true) &&
-        !(isTerminalLaneState(lane.state) &&
-            lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
-            lane.last_host_report_at === undefined) &&
+        !isUndispatchedOutpostMirror(lane) &&
         (options.includeTerminalMirrors === true || !isTerminalLaneState(lane.state)))
         .sort((a, b) => {
         const terminalOrder = Number(isTerminalLaneState(a.state)) - Number(isTerminalLaneState(b.state));
@@ -2524,6 +2522,14 @@ export const PICKUP_TERMINAL_REASONS = [
     "model_unsupported",
 ];
 export const DISPATCH_TERMINAL_REASON = "outpost_dispatch_failed";
+/** Only explicit non-persistence evidence can prove a failed dispatch has no owner snapshot. */
+export function isUndispatchedOutpostMirror(lane) {
+    return lane.host.kind === "outpost" &&
+        isTerminalLaneState(lane.state) &&
+        lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
+        lane.terminal_details?.pickup_persisted === false &&
+        lane.last_host_report_at == null;
+}
 function parsePickupTerminalReason(value) {
     if (PICKUP_TERMINAL_REASONS.includes(value)) {
         return value;
@@ -3647,6 +3653,9 @@ async function dispatchCreatedOutpostLane(ctx, input) {
                 command_id: dispatched.commandId,
                 exit_code: dispatched.exitCode,
                 status: dispatched.status,
+                ...(remote?.pickup_persisted === false || ownerError.details.pickup_persisted === false
+                    ? { pickup_persisted: false }
+                    : {}),
                 owner_error: ownerError,
             });
             await emitLaneTerminalStateSoft(ctx, failed);
@@ -5038,13 +5047,17 @@ async function runOutpostIdentityBackfillTarget(ctx, opts) {
 }
 async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
     if (lane.host.kind !== "outpost" || laneRunsHere(lane, reconcileHostFromCtx(ctx))) {
-        return lane;
+        return { lane };
+    }
+    if (isUndispatchedOutpostMirror(lane)) {
+        return { lane, remoteRefresh: "skipped_undispatched" };
     }
     const outpostId = lane.host.id;
     const descendantIds = localLanes
         .filter((candidate) => candidate.lane_id !== lane.lane_id &&
         candidate.host.kind === "outpost" && candidate.host.id === outpostId &&
         walkHitsLane(ctx.hqRoot(), candidate.senior, lane.lane_id, ctx))
+        .filter((candidate) => !isUndispatchedOutpostMirror(candidate))
         .map((candidate) => candidate.lane_id);
     const refresh = async (laneId) => {
         try {
@@ -5061,13 +5074,14 @@ async function refreshOutpostLaneCopiesForShow(ctx, lane, localLanes) {
     };
     const refreshed = await mapWithConcurrency([lane.lane_id, ...descendantIds], OUTPOST_HIRE_SUMMARY_CONCURRENCY, refresh);
     const refreshedLane = refreshed[0] ?? null;
-    return refreshedLane ?? lane;
+    return { lane: refreshedLane ?? lane };
 }
 async function runShow(ctx, laneId, hasPendingQuestionForLane) {
     const hqRoot = ctx.hqRoot();
     const initialLane = readLane(hqRoot, laneId);
     const initialLanes = loadAllLanes(hqRoot);
-    const storedLane = await refreshOutpostLaneCopiesForShow(ctx, initialLane, initialLanes);
+    const showRefresh = await refreshOutpostLaneCopiesForShow(ctx, initialLane, initialLanes);
+    const storedLane = showRefresh.lane;
     const allLanes = loadAllLanes(hqRoot);
     const hire = await laneHirePresentation(ctx, storedLane, allLanes);
     const remoteQueued = storedLane.state === "queued" &&
@@ -5152,6 +5166,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
         stalled_reason: lane.stalled_reason ?? null,
         ask_delivery_failed: askDeliveryFailed,
         delivery,
+        ...(showRefresh.remoteRefresh === undefined ? {} : { remote_refresh: showRefresh.remoteRefresh }),
         provider_session_id: lane.provider_session_id ?? null,
         provider_session_id_absent: lane.provider_session_id_absent ?? null,
         envelope_repair_mode: lane.envelope_repair?.mode ?? null,

package/dist/lib/doctor/deep/executor.d.ts

@@ -55,7 +55,7 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 10000;
  */
 export declare const SANDBOX_COPY_RELPATHS: readonly string[];
 /** One gate execution's inputs. */
-export interface GateRunInput {
+interface GateRunInput {
     /** Absolute path to the sandboxed `hook-gate.sh`. */
     gatePath: string;
     /** Absolute path to the sandboxed hook script the gate delegates to. */
@@ -72,7 +72,7 @@ export interface GateRunInput {
     timeoutMs: number;
 }
 /** One gate execution's observed outcome. */
-export interface GateRunResult {
+interface GateRunResult {
     /** True when the execution exceeded {@link GateRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Gate exit code, or null when it did not exit normally (timeout/signal). */
@@ -81,14 +81,7 @@ export interface GateRunResult {
     stderr: string;
 }
 /** Executes one gate invocation. Injectable so the aggregation is unit-testable. */
-export type GateRunner = (input: GateRunInput) => GateRunResult;
-/**
- * The real runner: spawn `bash hook-gate.sh <id> <script>` with the payload on
- * stdin, `HQ_HOOK_PROFILE` set, and a hard timeout. A timeout is detected by the
- * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
- * a hook cannot ignore the bound.
- */
-export declare const defaultGateRunner: GateRunner;
+type GateRunner = (input: GateRunInput) => GateRunResult;
 /** Options for {@link runDeepGuardTests}. All are injectable for testing. */
 export interface DeepTestOptions {
     /** Per-case time bound. Default: {@link DEFAULT_PER_CASE_TIMEOUT_MS}. */
@@ -109,4 +102,5 @@ export declare function cleanupAllDeepSandboxes(): void;
  * an empty list — creating no sandbox — when there is nothing to run.
  */
 export declare function runDeepGuardTests(context: CheckContext, options?: DeepTestOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=executor.d.ts.map

package/dist/lib/doctor/deep/executor.js

@@ -74,7 +74,7 @@ export const SANDBOX_COPY_RELPATHS = [
  * `ETIMEDOUT` error code spawnSync reports; the process is killed with SIGKILL so
  * a hook cannot ignore the bound.
  */
-export const defaultGateRunner = (input) => {
+const defaultGateRunner = (input) => {
     const result = spawnSync("bash", [input.gatePath, input.hookId, input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,

package/dist/lib/doctor/deep/parity.d.ts

@@ -46,14 +46,6 @@ import { type PlatformId } from "../payload-shapes.js";
 export declare const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export declare const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
-/** Default per-case, per-platform time bound. */
-export declare const DEFAULT_PARITY_TIMEOUT_MS = 10000;
-/** The gate profile the replay runs each hook under. Strict is the broadest
- * allowlist, so profile gating never suppresses the hook whose LOGIC is being
- * compared across platforms — profile-specific behaviour is US-008's concern. */
-export declare const PARITY_GATE_PROFILE = "strict";
-/** The session id stamped onto every replay payload. */
-export declare const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 /** One platform replay's inputs. */
 export interface PlatformRunInput {
     /** Which platform's adapter path to exercise. */
@@ -85,27 +77,7 @@ export interface PlatformRunOutput {
 /** Executes one platform replay. Injectable so the comparison is unit-testable. */
 export type PlatformRunner = (input: PlatformRunInput) => PlatformRunOutput;
 /** The real runner set, keyed by platform. */
-export type PlatformRunners = Record<PlatformId, PlatformRunner>;
-/** The real Claude runner: the canonical script through the Claude gate. */
-export declare const defaultClaudeRunner: PlatformRunner;
-/** The real Codex runner: the duplicated mirror through the Codex gate. */
-export declare const defaultCodexRunner: PlatformRunner;
-/**
- * The real Grok runner. Grok shares the canonical `.claude/hooks/` scripts with
- * Claude — it has no mirror of its own — and its adapter's whole job is to read
- * the camelCase payload, map the tool alias back to canonical, build the Claude
- * JSON, and pipe it to the same `hook-gate.sh`. We reproduce that routing here
- * (via {@link toGrokPayload} + {@link grokToSnakePayload}) rather than spawn the
- * adapter directly, for two reasons: the live adapter runs a whole tool
- * *sequence* where the replay needs one isolated hook, and its user-global
- * bridge cannot be simulated from a project-local run (US-005 keeps bridge
- * presence a wiring check). The Grok block protocol still applies — the gate's
- * non-zero exit is what the adapter would translate into a stdout `deny`
- * ({@link interpretGrokBlock} in verdictFor recognises both).
- */
-export declare const defaultGrokRunner: PlatformRunner;
-/** The default real runner set wired to each platform's real adapter path. */
-export declare const defaultPlatformRunners: PlatformRunners;
+type PlatformRunners = Record<PlatformId, PlatformRunner>;
 /** Options for {@link runParityReplay}. All injectable for testing. */
 export interface ParityOptions {
     /** Per-case, per-platform time bound. Default: {@link DEFAULT_PARITY_TIMEOUT_MS}. */
@@ -126,4 +98,5 @@ export declare function cleanupAllParitySandboxes(): void;
  * empty list — creating no sandbox — when there is nothing to replay.
  */
 export declare function runParityReplay(context: CheckContext, options?: ParityOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=parity.d.ts.map

package/dist/lib/doctor/deep/parity.js

@@ -52,13 +52,13 @@ export const PARITY_FAMILY_ID = "deep-parity";
 /** Human title of the parity family. */
 export const PARITY_FAMILY_TITLE = "Cross-platform parity replay";
 /** Default per-case, per-platform time bound. */
-export const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
+const DEFAULT_PARITY_TIMEOUT_MS = 10_000;
 /** The gate profile the replay runs each hook under. Strict is the broadest
  * allowlist, so profile gating never suppresses the hook whose LOGIC is being
  * compared across platforms — profile-specific behaviour is US-008's concern. */
-export const PARITY_GATE_PROFILE = "strict";
+const PARITY_GATE_PROFILE = "strict";
 /** The session id stamped onto every replay payload. */
-export const PARITY_SESSION_ID = "hq-doctor-parity-replay";
+const PARITY_SESSION_ID = "hq-doctor-parity-replay";
 function spawnWithStdin(command, args, stdin, input) {
     const result = spawnSync(command, args, {
         input: stdin,
@@ -96,12 +96,12 @@ function runThroughGate(input, platformDir, payload) {
     return { ...spawned };
 }
 /** The real Claude runner: the canonical script through the Claude gate. */
-export const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
+const defaultClaudeRunner = (input) => runThroughGate(input, ".claude", JSON.stringify(toClaudePayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
 /** The real Codex runner: the duplicated mirror through the Codex gate. */
-export const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
+const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSON.stringify(toCodexPayload(input.testCase, {
     cwd: input.sandbox,
     sessionId: PARITY_SESSION_ID,
 })));
@@ -118,7 +118,7 @@ export const defaultCodexRunner = (input) => runThroughGate(input, ".codex", JSO
  * non-zero exit is what the adapter would translate into a stdout `deny`
  * ({@link interpretGrokBlock} in verdictFor recognises both).
  */
-export const defaultGrokRunner = (input) => {
+const defaultGrokRunner = (input) => {
     const grokPayload = toGrokPayload(input.testCase, {
         cwd: input.sandbox,
         sessionId: PARITY_SESSION_ID,
@@ -127,7 +127,7 @@ export const defaultGrokRunner = (input) => {
     return runThroughGate(input, ".claude", JSON.stringify(snake));
 };
 /** The default real runner set wired to each platform's real adapter path. */
-export const defaultPlatformRunners = {
+const defaultPlatformRunners = {
     claude: defaultClaudeRunner,
     codex: defaultCodexRunner,
     grok: defaultGrokRunner,

package/dist/lib/doctor/deep/sandbox.d.ts

@@ -46,21 +46,10 @@ export declare const DEFAULT_PER_CASE_TIMEOUT_MS = 15000;
  * come under sandboxed execution.
  */
 export type Precondition = "git-repo" | "session-metadata" | "company-scaffold";
-/** Every precondition the default seeder knows how to provide. */
-export declare const KNOWN_PRECONDITIONS: readonly Precondition[];
-/**
- * Tree entries copied from the live tree into every sandbox — the same curated
- * set US-008 uses: the hook scripts and gate, the settings a hook may read, the
- * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
- * skipped so a partial tree still sandboxes cleanly.
- */
-export declare const SANDBOX_SEED_RELPATHS: readonly string[];
 /** Remove every side-effect sandbox still on disk. Safe to call repeatedly. */
 export declare function cleanupAllSandboxes(): void;
 /** The sandbox roots this process is still tracking (for tests). */
 export declare function trackedSandboxRoots(): string[];
-/** Remove one sandbox and stop tracking it. Idempotent. */
-export declare function destroySandbox(root: string): void;
 /** The outcome of seeding one sandbox. */
 export interface SeedResult {
     /** Absolute, realpath'd sandbox root under the OS temp dir. */
@@ -91,7 +80,7 @@ export interface SeedOptions {
  */
 export declare function seedSandbox(hqRoot: string, opts?: SeedOptions): SeedResult;
 /** One hook execution's inputs. */
-export interface HookRunInput {
+interface HookRunInput {
     /** Absolute path to the sandboxed hook script. */
     hookScriptPath: string;
     /** The JSON payload piped to the hook's stdin. */
@@ -104,7 +93,7 @@ export interface HookRunInput {
     timeoutMs: number;
 }
 /** One hook execution's observed result (exit code is diagnostic only). */
-export interface HookRunResult {
+interface HookRunResult {
     /** True when the execution exceeded {@link HookRunInput.timeoutMs}. */
     timedOut: boolean;
     /** Exit code, or null when it did not exit normally (timeout/signal). */
@@ -113,17 +102,9 @@ export interface HookRunResult {
     stderr: string;
 }
 /** Runs one hook. Injectable so the tier's aggregation is unit-testable. */
-export type HookRunner = (input: HookRunInput) => HookRunResult;
-/**
- * The real runner: fire the hook script directly with the payload on stdin, its
- * cwd and session env pointed at the sandbox, and a hard timeout. Unlike a pure
- * guard (US-008), a side-effecting hook is run directly rather than through the
- * gate — its exit code is irrelevant here; what matters is the effect it leaves
- * on the sandbox, which effects.ts reads afterwards.
- */
-export declare const defaultHookRunner: HookRunner;
+type HookRunner = (input: HookRunInput) => HookRunResult;
 /** One parsed side-effecting fixture case (its own shape, not the US-007 schema). */
-export interface SideEffectCase {
+interface SideEffectCase {
     name: string;
     event: string;
     tool: string;
@@ -136,13 +117,13 @@ export interface SideEffectCase {
     expectedFailure?: ExpectedFailure;
 }
 /** A validated side-effecting fixture. */
-export interface SideEffectFixture {
+interface SideEffectFixture {
     hookId: string;
     relpath: string;
     cases: SideEffectCase[];
 }
 /** A side-effecting fixture that could not be parsed. */
-export interface SideEffectFixtureError {
+interface SideEffectFixtureError {
     hookId: string | null;
     relpath: string;
     message: string;
@@ -187,4 +168,5 @@ export interface SideEffectTestOptions {
  * Returns an empty list when there is nothing side-effecting to run.
  */
 export declare function runSideEffectTests(context: CheckContext, options?: SideEffectTestOptions): Promise<CheckResult[]>;
+export {};
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/lib/doctor/deep/sandbox.js

@@ -46,7 +46,7 @@ import { captureEffectBaseline, describeEffect, defaultGitProbe, evaluateEffects
 /** Default per-case time bound. No latency target, but no case may hang. */
 export const DEFAULT_PER_CASE_TIMEOUT_MS = 15_000;
 /** Every precondition the default seeder knows how to provide. */
-export const KNOWN_PRECONDITIONS = [
+const KNOWN_PRECONDITIONS = [
     "git-repo",
     "session-metadata",
     "company-scaffold",
@@ -57,7 +57,7 @@ export const KNOWN_PRECONDITIONS = [
  * Codex/Grok mirrors, and `core/` (helpers hooks source). Missing entries are
  * skipped so a partial tree still sandboxes cleanly.
  */
-export const SANDBOX_SEED_RELPATHS = [
+const SANDBOX_SEED_RELPATHS = [
     ".claude/hooks",
     ".claude/settings.json",
     ".claude/settings.local.json",
@@ -100,7 +100,7 @@ function removeTree(root) {
     }
 }
 /** Remove one sandbox and stop tracking it. Idempotent. */
-export function destroySandbox(root) {
+function destroySandbox(root) {
     removeTree(root);
     trackedSandboxes.delete(root);
 }
@@ -198,7 +198,7 @@ function git(root, args) {
  * gate — its exit code is irrelevant here; what matters is the effect it leaves
  * on the sandbox, which effects.ts reads afterwards.
  */
-export const defaultHookRunner = (input) => {
+const defaultHookRunner = (input) => {
     const result = spawnSync("bash", [input.hookScriptPath], {
         input: input.payload,
         cwd: input.cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.303.0",
+  "version": "5.304.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {