@indigoai-us/hq-cli 5.306.0 → 5.307.0

package/dist/commands/core-pin-native.js

@@ -0,0 +1,236 @@
+/** Native per-session pin implementation matching core/scripts/hq-pin.sh. */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { bundledShellUnboundValue, registerNativeUtility, utilityError } from "./core-native-utilities.js";
+export const PIN_ASSET = "core/scripts/hq-pin.sh";
+export const PIN_HELP = `# hq-pin.sh — anchor the current session to one goal (the "pin").
+#
+# A pin is the message, goal, or target the session keeps working toward
+# across loops, wakeups, compactions, and hand-offs. It is stored per session
+# and re-read at every checkpoint so the session cannot drift.
+#
+# Usage:
+#   core/scripts/hq-pin.sh set  "<goal>" [--done "<criterion>"]... [--owner <name>] [--channel <dm-channel>]
+#   core/scripts/hq-pin.sh show                # print the pin (goal, done criteria, owner, channel, set-at)
+#   core/scripts/hq-pin.sh check               # print a one-line reminder for loop ticks; exit 3 if no pin
+#   core/scripts/hq-pin.sh note "<progress>"   # append a dated progress line under the pin
+#   core/scripts/hq-pin.sh clear               # remove the pin (the goal is met or withdrawn)
+#
+# Storage: workspace/sessions/<sid>/pin.md plus \`pin: <goal>\` in the session's
+`;
+const SESSION_ENV_KEYS = ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID", "GROK_SESSION_ID"];
+const stamp = (date) => date.toISOString().replace(/\.\d{3}Z$/, "Z");
+function normalizeId(value) { return value.replace(/[\t\n\v\f\r ]/g, ""); }
+function validId(value) { return value !== "" && value !== "." && value !== ".." && /^[A-Za-z0-9._-]+$/.test(value); }
+export function resolvePinSessionId(root, env) {
+    for (const key of SESSION_ENV_KEYS) {
+        const value = normalizeId(env[key] ?? "");
+        if (validId(value))
+            return value;
+    }
+    try {
+        const value = normalizeId(fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8"));
+        return validId(value) ? value : "";
+    }
+    catch {
+        return "";
+    }
+}
+function pinPath(deps, sid) { return path.join(deps.root, "workspace/sessions", sid, "pin.md"); }
+function fail(message) { return utilityError(`hq-pin: ${message}`, 2); }
+function sessionMetaPath(deps, sid) { return path.join(deps.root, "workspace/sessions", sid, "meta.yaml"); }
+function writeSessionPin(deps, sid, goal) {
+    const meta = sessionMetaPath(deps, sid);
+    fs.mkdirSync(path.dirname(meta), { recursive: true });
+    let contents;
+    try {
+        contents = fs.readFileSync(meta, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        contents = `session_id: ${sid}\nstarted_at: "${stamp(deps.now())}"\nsenior: user\n`;
+    }
+    const lines = contents ? contents.replace(/\n$/, "").split("\n") : [];
+    let found = false;
+    const next = lines.map((line) => {
+        if (line.trimStart().split(/[\t ]/)[0] === "pin:") {
+            found = true;
+            return `pin: ${goal}`;
+        }
+        return line;
+    });
+    if (!found)
+        next.push(`pin: ${goal}`);
+    const text = `${next.join("\n")}\n`;
+    const temp = path.join(path.dirname(meta), `.meta.yaml.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
+    fs.writeFileSync(temp, text, { mode: 0o600 });
+    fs.renameSync(temp, meta);
+}
+function createPinDirectory(deps) {
+    const sid = resolvePinSessionId(deps.root, deps.env);
+    if (!sid)
+        return { error: fail("no current session (hq-session.sh current is empty)") };
+    const file = pinPath(deps, sid);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    return { sid, file };
+}
+function setPin(args, deps) {
+    const goal = args[0] ?? "";
+    if (!goal)
+        return fail("set needs the goal text");
+    let owner = "";
+    let channel = "";
+    const done = [];
+    for (let i = 1; i < args.length;) {
+        const arg = args[i];
+        if (arg === "--done") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 36);
+            done.push(args[i + 1]);
+            i += 2;
+        }
+        else if (arg === "--owner") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 37);
+            owner = args[i + 1];
+            i += 2;
+        }
+        else if (arg === "--channel") {
+            if (i + 1 >= args.length)
+                return bundledShellUnboundValue(PIN_ASSET, 38);
+            channel = args[i + 1];
+            i += 2;
+        }
+        else
+            return fail(`set: unknown arg ${arg}`);
+    }
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    const lines = ["# Pin", "", `Goal: ${goal}`, "", `Set: ${stamp(deps.now())}`];
+    if (owner)
+        lines.push(`Owner: ${owner}`);
+    if (channel)
+        lines.push(`Channel: ${channel}`);
+    if (done.length > 0)
+        lines.push("", "## Done when", ...done.map((criterion) => `- [ ] ${criterion}`));
+    lines.push("", "## Progress");
+    fs.writeFileSync(current.file, `${lines.join("\n")}\n`, { encoding: "utf8", mode: 0o666 });
+    writeSessionPin(deps, current.sid, goal);
+    return { code: 0, stdout: `pinned session ${current.sid}: ${goal}\n`, stderr: "" };
+}
+function showPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return { code: 3, stdout: `no pin for session ${current.sid}\n`, stderr: "" };
+    return { code: 0, stdout: fs.readFileSync(current.file, "utf8"), stderr: "" };
+}
+function checkPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return { code: 3, stdout: "no pin\n", stderr: "" };
+    const text = fs.readFileSync(current.file, "utf8");
+    const goal = text.split(/\r?\n/).find((line) => line.startsWith("Goal: "))?.slice(6) ?? "";
+    const open = (text.match(/^- \[ \]/gm) ?? []).length;
+    const closed = (text.match(/^- \[x\]/gm) ?? []).length;
+    return { code: 0, stdout: `PIN: ${goal} (done criteria: ${closed} met, ${open} open)\n`, stderr: "" };
+}
+function notePin(args, deps) {
+    const text = args[0] ?? "";
+    if (!text)
+        return fail("note needs text");
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return fail("no pin to note against");
+    const time = deps.now().toISOString().slice(11, 16);
+    fs.appendFileSync(current.file, `- ${time}Z ${text}\n`);
+    return { code: 0, stdout: "noted\n", stderr: "" };
+}
+function donePin(args, deps) {
+    const needle = args[0] ?? "";
+    if (!needle)
+        return fail("done needs a criterion substring");
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    if (!fs.existsSync(current.file))
+        return fail("no pin");
+    const text = fs.readFileSync(current.file, "utf8");
+    const lines = text.split("\n");
+    // Bash read ignores a final line without a newline. The shell script then
+    // echoes every line it did read, adding a newline to each one.
+    lines.pop();
+    let hit = false;
+    const next = lines.map((line) => {
+        if (line.startsWith("- [ ] ") && line.includes(needle)) {
+            hit = true;
+            // Preserve the bundled shell's parameter-expansion result: it keeps the
+            // matched source line after adding the checked marker.
+            return `- [x] ${line}`;
+        }
+        return line;
+    });
+    const output = next.length > 0 ? `${next.join("\n")}\n` : "";
+    const tempDir = fs.mkdtempSync(path.join(deps.tmpDir ?? os.tmpdir(), "hq-pin-"));
+    const tempFile = path.join(tempDir, "pin");
+    try {
+        fs.writeFileSync(tempFile, output, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        try {
+            fs.renameSync(tempFile, current.file);
+        }
+        catch (error) {
+            if (error.code !== "EXDEV")
+                throw error;
+            fs.copyFileSync(tempFile, current.file);
+            fs.chmodSync(current.file, 0o600);
+            fs.unlinkSync(tempFile);
+        }
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+    return hit
+        ? { code: 0, stdout: `marked done: ${needle}\n`, stderr: "" }
+        : fail(`no open criterion matches: ${needle}`);
+}
+function clearPin(deps) {
+    const current = createPinDirectory(deps);
+    if (current.error)
+        return current.error;
+    fs.rmSync(current.file, { force: true });
+    writeSessionPin(deps, current.sid, "");
+    return { code: 0, stdout: "pin cleared\n", stderr: "" };
+}
+export function runPin(args, deps) {
+    const [command = "", ...rest] = args;
+    if (command === "set")
+        return setPin(rest, deps);
+    if (command === "show")
+        return showPin(deps);
+    if (command === "check")
+        return checkPin(deps);
+    if (command === "note")
+        return notePin(rest, deps);
+    if (command === "done")
+        return donePin(rest, deps);
+    if (command === "clear")
+        return clearPin(deps);
+    return { code: 2, stdout: PIN_HELP, stderr: "" };
+}
+export function registerCorePinNative(core) {
+    registerNativeUtility(core, {
+        name: "pin", asset: PIN_ASSET, root: "live", summary: "Pin the current session to one goal",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runPin(args, context),
+    });
+}
+//# sourceMappingURL=core-pin-native.js.map

package/dist/commands/core-refresh-vault-access-native.d.ts

@@ -0,0 +1,20 @@
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export declare const REFRESH_VAULT_ACCESS_HELP: string;
+export type HqResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    missing?: boolean;
+};
+export type RefreshVaultAccessDependencies = {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    hqAvailable: boolean;
+    runHq?: (args: string[], cwd: string) => HqResult;
+};
+export declare function runRefreshVaultAccess(args: string[], deps: RefreshVaultAccessDependencies): UtilityOutput;
+export declare function registerCoreRefreshVaultAccessNative(core: Command): void;
+//# sourceMappingURL=core-refresh-vault-access-native.d.ts.map

package/dist/commands/core-refresh-vault-access-native.js

@@ -0,0 +1,229 @@
+/** Native local manifest refresh for core/scripts/refresh-vault-access.sh. */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const REFRESH_VAULT_ACCESS_ASSET = "core/scripts/refresh-vault-access.sh";
+export const REFRESH_VAULT_ACCESS_HELP = `# hq-core: public
+# refresh-vault-access.sh — build/refresh the local vault-access manifest that
+# enforce-vault-write-access.sh (PreToolUse hook) reads.
+#
+# Output: <hqRoot>/.hq/vault-access.json
+#
+#   {
+#     "version": 1,
+#     "generatedAt": "2026-01-01T00:00:00Z",
+#     "companies": {
+#       "<slug>": {
+#         "role": "owner|admin|member|guest|unknown",
+#         "grants": [ { "path": "reports/*", "permission": "read|write" } ]
+#       }
+#     }
+#   }
+#
+# Sources (best-effort, all via the hq CLI):
+#   - grants: \`hq files shared-with-me\` (explicit per-prefix grants)
+#   - role:   \`hq members --company <slug> list\` matched against the caller's
+#             email (from \`hq whoami\`, override with HQ_VAULT_ACCESS_EMAIL)
+#
+# Fail-open by design: anything this script cannot determine is recorded as
+# role "unknown" (the hook does not enforce unknown roles), and a company it
+# cannot query at all is left out of the manifest entirely (the hook allows
+# companies absent from the manifest). The server-side STS/ACL layer remains
+# the authoritative security boundary — this manifest only powers the local
+# early-warning block for read-only shares.
+#
+# Usage:
+#   bash core/scripts/refresh-vault-access.sh [--company <slug>]... [--root <hqRoot>]
+#
+`.replace(/^# ?/gm, "");
+function defaultHq(args, cwd, env) {
+    const result = spawnSync("hq", args, { cwd, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    if (result.error)
+        return { code: 127, stdout: "", stderr: result.error.message, missing: result.error.code === "ENOENT" };
+    return { code: result.status ?? 128, stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? "") };
+}
+function executableOnPath(name, value) {
+    if (!value)
+        return false;
+    for (const directory of value.split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return true;
+        }
+        catch { /* keep checking the PATH */ }
+    }
+    return false;
+}
+function isHqRoot(root) {
+    const candidate = root.endsWith(path.sep) ? root.slice(0, -1) : root;
+    if (!candidate)
+        return false;
+    try {
+        return fs.statSync(path.join(candidate, "core")).isDirectory() && fs.statSync(path.join(candidate, ".claude")).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function parseOptions(args) {
+    let root = "";
+    const slugs = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (arg === "--root") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--root requires a value" };
+            root = args[i + 1];
+            i += 2;
+        }
+        else if (arg === "--company") {
+            if (i + 1 >= args.length)
+                return { root, slugs, help: false, error: "--company requires a value" };
+            slugs.push(args[i + 1]);
+            i += 2;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { root, slugs, help: true };
+        else
+            return { root, slugs, help: false, error: `unknown argument: ${arg}` };
+    }
+    return { root, slugs, help: false };
+}
+function resolveRoot(parsedRoot, deps) {
+    if (parsedRoot)
+        return parsedRoot;
+    if (isHqRoot(deps.env.CLAUDE_PROJECT_DIR ?? ""))
+        return deps.env.CLAUDE_PROJECT_DIR;
+    let current = path.resolve(deps.cwd);
+    while (current !== path.parse(current).root) {
+        if (isHqRoot(current))
+            return current;
+        current = path.dirname(current);
+    }
+    return "";
+}
+// eslint-disable-next-line no-control-regex -- strip ANSI SGR sequences printed by hq.
+function cleanAnsi(value) { return value.replace(/\u001b\[[0-9;]*m/g, ""); }
+function log(message) { return `refresh-vault-access: ${message}\n`; }
+function getEmail(output) {
+    const matches = cleanAnsi(output).match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g) ?? [];
+    return matches.find((email) => !email.includes("@outposts.")) ?? "";
+}
+function parseGrantTable(output) {
+    const grants = new Map();
+    for (let line of cleanAnsi(output).split(/\r?\n/)) {
+        line = line.replace(" (private folder)", "");
+        if (/^COMPANY\s/.test(line) || /^─/.test(line) || /^\s*$/.test(line) || /^Nothing is explicitly shared/.test(line))
+            continue;
+        const fields = line.trim().split(/\s+/);
+        if (fields.length < 3)
+            continue;
+        const permission = ["read", "write", "admin"].includes(fields[2]) ? fields[2]
+            : fields.length >= 4 && ["read", "write", "admin"].includes(fields[3]) ? fields[3] : "";
+        if (!permission)
+            continue;
+        const rows = grants.get(fields[0]) ?? [];
+        rows.push({ path: fields[1], permission });
+        grants.set(fields[0], rows);
+    }
+    return grants;
+}
+function roleFromTable(output, email) {
+    if (!email)
+        return "unknown";
+    for (const line of cleanAnsi(output).split(/\r?\n/)) {
+        const [candidate, role] = line.trim().split(/\s+/);
+        if (candidate === email && ["owner", "admin", "member", "guest"].includes(role ?? ""))
+            return role;
+        if (candidate === email)
+            return "unknown";
+    }
+    return "unknown";
+}
+function resolveEmail(deps, runHq) {
+    const override = deps.env.HQ_VAULT_ACCESS_EMAIL ?? "";
+    if (override)
+        return { email: override, stderr: "" };
+    const result = runHq(["whoami"], deps.cwd);
+    const email = getEmail(result.stdout);
+    return { email, stderr: email ? "" : log("could not determine caller email — roles will be 'unknown' (hook will not enforce)") };
+}
+export function runRefreshVaultAccess(args, deps) {
+    const parsed = parseOptions(args);
+    if (parsed.help)
+        return { code: 0, stdout: REFRESH_VAULT_ACCESS_HELP, stderr: "" };
+    if (parsed.error)
+        return { code: 1, stdout: "", stderr: log(parsed.error) };
+    const root = resolveRoot(parsed.root, deps);
+    if (!isHqRoot(root))
+        return { code: 1, stdout: "", stderr: log("could not resolve the HQ root (pass --root <hqRoot>)") };
+    if (!deps.hqAvailable)
+        return { code: 0, stdout: "", stderr: log("hq CLI not found — nothing refreshed (the write-access hook stays fail-open without a manifest)") };
+    const runHq = deps.runHq ?? ((hqArgs, cwd) => defaultHq(hqArgs, cwd, deps.env));
+    const identity = resolveEmail(deps, runHq);
+    let stderr = identity.stderr;
+    const explicit = parsed.slugs;
+    const allGrants = new Map();
+    if (explicit.length > 0) {
+        for (const slug of explicit) {
+            const result = runHq(["files", "shared-with-me", "--company", slug], deps.cwd);
+            if (result.code !== 0) {
+                stderr += log(`skipping ${slug} — shared-with-me query failed`);
+                continue;
+            }
+            const rows = parseGrantTable(result.stdout);
+            for (const [company, grants] of rows)
+                allGrants.set(company, [...(allGrants.get(company) ?? []), ...grants]);
+        }
+    }
+    else {
+        const result = runHq(["files", "shared-with-me"], deps.cwd);
+        if (result.code !== 0)
+            return { code: 0, stdout: "", stderr: `${stderr}${log("shared-with-me roll-up failed — nothing refreshed")}` };
+        for (const [company, grants] of parseGrantTable(result.stdout))
+            allGrants.set(company, grants);
+    }
+    const companies = new Set(allGrants.keys());
+    for (const slug of explicit)
+        companies.add(slug);
+    const sortedSlugs = [...companies].sort();
+    if (sortedSlugs.length === 0)
+        stderr += log("no explicit grants found — writing an empty manifest (hook stays fail-open everywhere)");
+    const companyData = {};
+    for (const slug of sortedSlugs) {
+        let role = "unknown";
+        if (identity.email) {
+            const result = runHq(["members", "--company", slug, "list"], deps.cwd);
+            role = result.code === 0 ? roleFromTable(result.stdout, identity.email) : "unknown";
+        }
+        const grants = (allGrants.get(slug) ?? []).map((grant) => ({ path: grant.path, permission: grant.permission }));
+        companyData[slug] = { role, grants };
+    }
+    const manifest = { version: 1, generatedAt: deps.now().toISOString().replace(/\.\d{3}Z$/, "Z"), companies: companyData };
+    const directory = path.join(root, ".hq");
+    fs.mkdirSync(directory, { recursive: true });
+    const target = path.join(directory, "vault-access.json");
+    const temp = `${target}.${process.pid}.${Math.random().toString(16).slice(2)}`;
+    fs.writeFileSync(temp, serializeJqJson(manifest, "pretty"), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    fs.chmodSync(temp, 0o600);
+    fs.renameSync(temp, target);
+    stderr += log(`wrote .hq/vault-access.json (${sortedSlugs.length} companies, identity: ${identity.email || "unknown"})`);
+    return { code: 0, stdout: "", stderr };
+}
+export function registerCoreRefreshVaultAccessNative(core) {
+    registerNativeUtility(core, {
+        name: "refresh-vault-access", asset: REFRESH_VAULT_ACCESS_ASSET, root: "cwd", summary: "Refresh the local vault access manifest",
+        resolveRoot: (cwd) => cwd,
+        run: (args, context) => runRefreshVaultAccess(args, {
+            cwd: context.cwd, env: context.env, now: context.now,
+            hqAvailable: executableOnPath("hq", context.env.PATH),
+            runHq: (args, cwd) => defaultHq(args, cwd, context.env),
+        }),
+    });
+}
+//# sourceMappingURL=core-refresh-vault-access-native.js.map

package/dist/commands/core.js

@@ -38,6 +38,10 @@ import { registerCoreKnowledgePrefsCommand } from "./core-knowledge-prefs.js";
 import { registerCorePolicyCommand } from "./core-policy.js";
 import { registerCoreJobsNativeCommand } from "./core-job-native.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
+import { registerCoreAuditLogNative } from "./core-audit-log-native.js";
+import { registerCoreGitPackExtensionCheckNative } from "./core-git-pack-extension-check-native.js";
+import { registerCorePinNative } from "./core-pin-native.js";
+import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -271,6 +275,13 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
+    // Wave 5 native utility rollback companions, sourced verbatim from staging
+    // because these assets were not present in the hq-cli bundle at launch.
+    { asset: "core/scripts/audit-log.sh", root: "live", summary: "Rollback shell for native audit-log" },
+    { asset: "core/scripts/git-pack-extension-check.sh", root: "cwd", summary: "Rollback shell for native git-pack-extension-check" },
+    { asset: "core/scripts/hq-pin.sh", root: "live", summary: "Rollback shell for native pin" },
+    { asset: "core/scripts/refresh-vault-access.sh", root: "cwd", summary: "Rollback shell for native refresh-vault-access" },
+    { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by the audit-log rollback shell" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
         root,
@@ -354,6 +365,10 @@ export function registerCoreCommands(program) {
     registerCoreKnowledgePrefsCommand(core);
     registerCorePolicyCommand(core);
     registerCoreJobsNativeCommand(core);
+    registerCoreAuditLogNative(core);
+    registerCoreGitPackExtensionCheckNative(core);
+    registerCorePinNative(core);
+    registerCoreRefreshVaultAccessNative(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/dist/commands/dm.js

@@ -407,7 +407,12 @@ async function runConnectionAction(action, identifier) {
         const token = await ensureCognitoToken();
         // Resolve the pairKey from the caller's pending requests when possible so
         // accept/decline/block work against a friendly email or personUid.
-        const requests = await fetchRequests(token).catch(() => []);
+        const requests = await fetchRequests(token).catch((err) => {
+            console.error("hq dm: pending connection request lookup failed", {
+                errorName: err instanceof Error ? err.name : typeof err,
+            });
+            return [];
+        });
         const matched = matchRequest(requests, identifier);
         const body = buildConnectionActionBody(identifier, matched);
         const res = await vaultApiFetch({

package/dist/commands/lanes.js

@@ -184,8 +184,12 @@ async function defaultDispatchOutpostExec(input) {
         throw new LanesError("outpost_dispatch_failed", `Outpost exec failed: ${dispatchErrorMessage(err)}`, { outpost_id: input.outpostId, message: dispatchErrorMessage(err) });
     }
 }
+// Pickup payloads are small; 30 seconds leaves room for normal network variance.
+const OUTPOST_PICKUP_PAYLOAD_TIMEOUT_MS = 30_000;
 async function defaultFetchText(url) {
-    const res = await fetch(url);
+    const res = await fetch(url, {
+        signal: AbortSignal.timeout(OUTPOST_PICKUP_PAYLOAD_TIMEOUT_MS),
+    });
     if (!res.ok) {
         throw new LanesError("outpost_payload_invalid", `Failed to download pickup payload: HTTP ${res.status}`, { status: res.status });
     }
@@ -1006,6 +1010,8 @@ const OUTPOST_HIRE_SUMMARY_TIMEOUT_SECONDS = 20;
 const OUTPOST_HIRE_SUMMARY_WAIT_MS = 15_000;
 const OUTPOST_SINGLE_LANE_WAIT_ENV = "HQ_LANES_OUTPOST_SINGLE_LANE_WAIT_MS";
 const OUTPOST_SINGLE_LANE_WAIT_MAX_MS = 600_000;
+const LEGACY_PICKUP_SETTLEMENT_MARGIN_MS = 60_000;
+const LEGACY_PICKUP_SETTLEMENT_MIN_AGE_MS = OUTPOST_SINGLE_LANE_WAIT_MAX_MS + LEGACY_PICKUP_SETTLEMENT_MARGIN_MS;
 function outpostSingleLaneWaitMs(env) {
     const raw = env[OUTPOST_SINGLE_LANE_WAIT_ENV]?.trim() || String(PICKUP_WAIT_MS);
     const value = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
@@ -1363,6 +1369,25 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
                 !ownerIsHostedByOutpost ||
                 (owner.company?.uid ?? null) !== (mirror.company?.uid ?? null) ||
                 (owner.company?.slug ?? null) !== (mirror.company?.slug ?? null)) {
+                if (matches.length === 0 && isLegacyFailedDispatchWithoutPickupEvidence(mirror, nowMs)) {
+                    const settled = retryUpdateLane(hqRoot, mirror.lane_id, "reconcile", (current) => {
+                        if (!isLegacyFailedDispatchWithoutPickupEvidence(current, nowMs) ||
+                            current.host.id !== outpostId) {
+                            return current;
+                        }
+                        return {
+                            ...current,
+                            terminal_details: {
+                                ...(current.terminal_details ?? {}),
+                                pickup_persisted: false,
+                            },
+                        };
+                    });
+                    if (isUndispatchedOutpostMirror(settled)) {
+                        result.updated.set(mirror.lane_id, settled);
+                        continue;
+                    }
+                }
                 if (matches.length === 0)
                     result.missingOnOwner.set(mirror.lane_id, mirror);
                 const detail = matches.length === 0
@@ -2530,6 +2555,23 @@ export function isUndispatchedOutpostMirror(lane) {
         lane.terminal_details?.pickup_persisted === false &&
         lane.last_host_report_at == null;
 }
+function isLegacyFailedDispatchWithoutPickupEvidence(lane, nowMs) {
+    const terminalDetails = lane.terminal_details;
+    const updatedAtMs = Date.parse(lane.updated_at);
+    const completedFailure = (terminalDetails?.status === "Failed" ||
+        terminalDetails?.status === "Cancelled" ||
+        terminalDetails?.status === "TimedOut") &&
+        typeof terminalDetails.exit_code === "number" &&
+        Number.isSafeInteger(terminalDetails.exit_code);
+    return lane.host.kind === "outpost" &&
+        isTerminalLaneState(lane.state) &&
+        lane.terminal_reason === DISPATCH_TERMINAL_REASON &&
+        lane.last_host_report_at == null &&
+        lane.terminal_details?.pickup_persisted === undefined &&
+        completedFailure &&
+        Number.isFinite(updatedAtMs) &&
+        nowMs - updatedAtMs > LEGACY_PICKUP_SETTLEMENT_MIN_AGE_MS;
+}
 function parsePickupTerminalReason(value) {
     if (PICKUP_TERMINAL_REASONS.includes(value)) {
         return value;

package/dist/lib/agent-kit/fallback.d.ts

@@ -9,10 +9,7 @@
  */
 import type { ServiceHostPaths, ServiceSetResult } from "../service-manager/index.js";
 import type { AgentKitPaths } from "./paths.js";
-export declare const KIT_PID_NAME = "kit.pid";
-export declare const KIT_FALLBACK_LOG_NAME = "kit.log";
 export declare function kitPidPath(paths: Pick<AgentKitPaths, "agentDir">): string;
-export declare function kitFallbackLogPath(paths: Pick<AgentKitPaths, "logsDir">): string;
 /** True when an activation error means the service manager itself is unusable. */
 export declare function isServiceManagerUnavailable(error: string | undefined): boolean;
 /**
@@ -46,10 +43,6 @@ export interface DetachedSpawn {
         unref(): void;
     };
 }
-export declare function fallbackCommand(host: ServiceHostPaths): {
-    cmd: string;
-    args: string[];
-};
 /** crontab line that restarts the fallback supervisor after a reboot. */
 export declare function rebootCrontabLine(paths: Pick<AgentKitPaths, "agentDir" | "logsDir">, host: ServiceHostPaths): string;
 export declare function startFallback(paths: AgentKitPaths, host: ServiceHostPaths, deps?: {

package/dist/lib/agent-kit/fallback.js

@@ -12,12 +12,12 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { kitServiceEnv } from "./services.js";
 import { writePrivateFile } from "./private-file.js";
-export const KIT_PID_NAME = "kit.pid";
-export const KIT_FALLBACK_LOG_NAME = "kit.log";
+const KIT_PID_NAME = "kit.pid";
+const KIT_FALLBACK_LOG_NAME = "kit.log";
 export function kitPidPath(paths) {
     return path.join(paths.agentDir, KIT_PID_NAME);
 }
-export function kitFallbackLogPath(paths) {
+function kitFallbackLogPath(paths) {
     return path.join(paths.logsDir, KIT_FALLBACK_LOG_NAME);
 }
 const UNAVAILABLE_PATTERNS = [
@@ -93,7 +93,7 @@ export function stopFallback(paths, kill = defaultKill) {
     fs.rmSync(kitPidPath(paths), { force: true });
     return { pid, killed };
 }
-export function fallbackCommand(host) {
+function fallbackCommand(host) {
     return { cmd: host.nodeBinary, args: [host.hqBinary, "agent", "kit", "run", "all"] };
 }
 /** crontab line that restarts the fallback supervisor after a reboot. */

package/dist/lib/agent-kit/inbox-state.d.ts

@@ -9,8 +9,6 @@
  * always drain exactly what it has not handled yet and never reply twice.
  */
 import type { AgentKitPaths } from "./paths.js";
-export declare const DONE_IDS_NAME = "done-ids.json";
-export declare const MAX_DONE_IDS = 5000;
 export interface MirroredInboxEntry {
     id: string;
     mirroredAt?: string;