@indigoai-us/hq-cli 5.307.0 → 5.309.0

package/dist/lib/doctor/checks/codex-wiring.d.ts

@@ -41,10 +41,6 @@
  */
 import { type AllowedDivergenceLoad } from "../allowed-divergence.js";
 import type { CheckContext, CheckResult } from "../types.js";
-/** Basename of the single-adapter script the current architecture routes to. */
-export declare const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
-/** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export declare const CODEX_DISPATCH_LIB_RELPATH: string;
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.

package/dist/lib/doctor/checks/codex-wiring.js

@@ -44,9 +44,9 @@ import * as path from "node:path";
 import { parse as parseToml } from "smol-toml";
 import { ALLOWED_DIVERGENCE_RELPATH, loadAllowedDivergence, } from "../allowed-divergence.js";
 /** Basename of the single-adapter script the current architecture routes to. */
-export const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
+const CODEX_ADAPTER_BASENAME = "hq-codex-hook-adapter.sh";
 /** Library the adapter sources to dispatch `.claude/settings.json` live. */
-export const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
+const CODEX_DISPATCH_LIB_RELPATH = path.join("core", "scripts", "lib", "hook-adapter-core.sh");
 /**
  * Lifecycle events the shipped `.codex/config.toml` routes through the adapter.
  * A missing event means the Claude hooks for that event never run under Codex.

package/dist/lib/doctor/checks/runtime-health.d.ts

@@ -28,16 +28,6 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 /** The id of the AI-runtime-health family. */
 export declare const RUNTIMES_FAMILY_ID = "runtimes";
-/** Common id prefix for every result this family emits. */
-export declare const RUNTIMES_PREFIX = "runtimes";
-/**
- * The deterministic one-line probe prompt. Health is proven by a round-trip
- * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
- * that answers with anything at all still passes.
- */
-export declare const PROBE_PROMPT = "Reply with exactly: OK";
-/** How long each live probe may run before it is killed and marked UNKNOWN. */
-export declare const DEFAULT_PROBE_TIMEOUT_MS = 120000;
 /** One AI runtime the doctor knows how to find and probe. */
 export interface RuntimeSpec {
     /** Stable key used in check ids, e.g. `runtimes.codex.binary`. */
@@ -94,11 +84,4 @@ export interface RuntimeHealthDeps {
 export declare function checkRuntimeHealth(context: CheckContext, deps?: RuntimeHealthDeps): Promise<CheckResult[]>;
 /** The registered family object. */
 export declare const runtimeHealthFamily: CheckFamily;
-/**
- * Resolve an executable name against PATH with a pure filesystem scan — no
- * process is spawned, keeping the doctor's default run a function of on-disk
- * shape. First PATH entry containing an executable regular file wins, which is
- * exactly the copy a shell would run.
- */
-export declare function resolveOnPath(binary: string): string | null;
 //# sourceMappingURL=runtime-health.d.ts.map

package/dist/lib/doctor/checks/runtime-health.js

@@ -33,15 +33,15 @@ import { planCommandSpawn } from "../../../utils/windows-spawn.js";
 /** The id of the AI-runtime-health family. */
 export const RUNTIMES_FAMILY_ID = "runtimes";
 /** Common id prefix for every result this family emits. */
-export const RUNTIMES_PREFIX = "runtimes";
+const RUNTIMES_PREFIX = "runtimes";
 /**
  * The deterministic one-line probe prompt. Health is proven by a round-trip
  * (exit 0 plus non-empty output), not by exact-matching the reply, so a model
  * that answers with anything at all still passes.
  */
-export const PROBE_PROMPT = "Reply with exactly: OK";
+const PROBE_PROMPT = "Reply with exactly: OK";
 /** How long each live probe may run before it is killed and marked UNKNOWN. */
-export const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
+const DEFAULT_PROBE_TIMEOUT_MS = 120_000;
 /**
  * The three runtimes HQ wires hooks for. Codex runs its probe under its own
  * read-only sandbox and outside-a-repo mode so the probe can never write; the
@@ -243,7 +243,7 @@ export const runtimeHealthFamily = {
  * shape. First PATH entry containing an executable regular file wins, which is
  * exactly the copy a shell would run.
  */
-export function resolveOnPath(binary) {
+function resolveOnPath(binary) {
     const pathVar = process.env.PATH ?? "";
     for (const dir of pathVar.split(path.delimiter)) {
         if (!dir)

package/dist/lib/doctor/checks/scaffold-cli-floor.d.ts

@@ -1,6 +1,5 @@
 import type { CheckContext, CheckFamily, CheckResult } from "../types.js";
 export declare const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
-export declare const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
 export declare const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
 export declare const scaffoldCliFloorFamily: CheckFamily;
 export declare function checkScaffoldCliFloor(context: CheckContext): CheckResult[];

package/dist/lib/doctor/checks/scaffold-cli-floor.js

@@ -4,7 +4,7 @@ import * as yaml from "js-yaml";
 import { CLI_VERSION } from "../../../cli-version.js";
 import { compareScaffoldCliFloor } from "../../scaffold-cli-floor.js";
 export const SCAFFOLD_CLI_FLOOR_FAMILY_ID = "scaffold-cli-floor";
-export const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
+const SCAFFOLD_CLI_FLOOR_FAMILY_TITLE = "Scaffold CLI compatibility";
 export const SCAFFOLD_CLI_FLOOR_CHECK_ID = "scaffold-cli-floor.requires-hq-cli";
 export const scaffoldCliFloorFamily = {
     id: SCAFFOLD_CLI_FLOOR_FAMILY_ID,

package/dist/lib/doctor/compat.d.ts

@@ -31,22 +31,6 @@ import type { DoctorJsonDocument } from "./json-output.js";
 export declare const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export declare const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
-/** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
-export declare const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
-/** The runtime-probe result id: whether hooks actually fired (the ledger). */
-export declare const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
-/**
- * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
- * load* scope — the subset of the hooks family the wrapper is allowed to fail
- * on. Deliberately narrow: it covers a missing/invalid settings file, an
- * unquoted `$CLAUDE_PROJECT_DIR` that word-splits on a spaced root, and a hook
- * command that runs a script which is not on disk — and nothing else. The many
- * richer doctor findings (executable bits, orphaned scripts, three-profile
- * membership, Codex/Grok parity, fixture coverage) are intentionally OUT of
- * scope, so the wrapper stays byte-for-byte compatible with callers that only
- * ever cared whether the hook configuration could load.
- */
-export declare const CHECK_HQ_HOOKS_SETTINGS_SCOPE: readonly string[];
 /**
  * Whether hook dispatch was observed this session. Mirrors the wrapper's
  * `HQ runtime enforcement: …` line. `NOT CHECKED` is the default when

package/dist/lib/doctor/compat.js

@@ -31,9 +31,9 @@ export const CHECK_HQ_HOOKS_PASS_EXIT = 0;
 /** Exit code check-hq-hooks.sh returns on a health failure. Preserved. */
 export const CHECK_HQ_HOOKS_FAIL_EXIT = 2;
 /** Exit code check-hq-hooks.sh returns on a usage error. Preserved. */
-export const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
+const CHECK_HQ_HOOKS_USAGE_EXIT = 64;
 /** The runtime-probe result id: whether hooks actually fired (the ledger). */
-export const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
+const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
 /**
  * The `hq doctor` check ids that correspond to check-hq-hooks.sh's *settings
  * load* scope — the subset of the hooks family the wrapper is allowed to fail
@@ -45,7 +45,7 @@ export const RUNTIME_ENFORCEMENT_CHECK_ID = "hooks.runtime.enforcement";
  * scope, so the wrapper stays byte-for-byte compatible with callers that only
  * ever cared whether the hook configuration could load.
  */
-export const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
+const CHECK_HQ_HOOKS_SETTINGS_SCOPE = [
     "hooks.settings-present",
     "hooks.settings-required-command-hooks",
     "hooks.settings-valid-json",

package/dist/lib/doctor/platform.d.ts

@@ -126,24 +126,8 @@ export declare function claudeCodeFlagEvidence(env: NodeJS.ProcessEnv): Platform
  * `com.googlecode.iterm2`), so this fires only under a real desktop host.
  */
 export declare function bundleIdEvidence(env: NodeJS.ProcessEnv): PlatformEvidence | null;
-/**
- * Codex runtime environment variables, kept in parity with the canonical shell
- * detector `core/scripts/lib/detect-codex.sh`. Presence of any is a strong Codex
- * signal. One evidence entry is produced per variable found so a single Codex
- * signal can be tested in isolation.
- */
-export declare const CODEX_ENV_VARS: readonly ["CODEX_SANDBOX", "CODEX_SESSION_ID", "CODEX_EXECUTION_ID", "CODEX_AGENT_ID", "CODEX_THREAD_ID", "CODEX_SHELL", "CODEX_CI", "CODEX_INTERNAL_ORIGINATOR_OVERRIDE", "OPENAI_CODEX"];
 /** Every Codex environment signal present in `env`, one entry per variable. */
 export declare function codexEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
-/**
- * Grok runtime environment variables. Restricted to variables the Grok host
- * exports into the session (a session id, its workspace root) — HQ's own Grok
- * *launcher* variables (`GROK_BIN`, `GROK_CONFIG`, `XAI_API_KEY`, …) are
- * excluded on purpose: those can be set inside a Claude or Codex session that is
- * merely preparing to launch Grok, and treating them as "we are running under
- * Grok" would be a false positive.
- */
-export declare const GROK_ENV_VARS: readonly ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
@@ -157,10 +141,6 @@ export declare function grokEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidenc
  * on its environment signals instead, and this function does not guess it.
  */
 export declare function ancestryEvidence(ancestors: AncestorProcess[]): PlatformEvidence[];
-/** The one command this module ever launches to read process ancestry. */
-export declare const PS_COMMAND = "ps";
-/** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
-export declare const PS_ARGS: readonly ["-Ao", "pid=,ppid=,comm="];
 /**
  * Low-level process-table provider: runs a command and returns its stdout, or
  * `null` on failure. This is the single seam through which any process is
@@ -186,12 +166,6 @@ export interface ReadAncestryOptions {
  * environment signals rather than throwing.
  */
 export declare function readProcessAncestry(options?: ReadAncestryOptions): AncestorProcess[];
-/**
- * Collect the environment signals, in a stable order: entrypoint, the Claude
- * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
- * separately (and lazily) by {@link detectPlatform}.
- */
-export declare function collectEnvEvidence(env: NodeJS.ProcessEnv): PlatformEvidence[];
 /**
  * Collect every signal from an environment and an explicit ancestor chain, in a
  * stable order: environment signals first, then process ancestry. Exposed for

package/dist/lib/doctor/platform.js

@@ -150,7 +150,7 @@ function looksLikeClaudeDesktopBundle(id) {
  * signal. One evidence entry is produced per variable found so a single Codex
  * signal can be tested in isolation.
  */
-export const CODEX_ENV_VARS = [
+const CODEX_ENV_VARS = [
     "CODEX_SANDBOX",
     "CODEX_SESSION_ID",
     "CODEX_EXECUTION_ID",
@@ -185,7 +185,7 @@ export function codexEnvEvidence(env) {
  * merely preparing to launch Grok, and treating them as "we are running under
  * Grok" would be a false positive.
  */
-export const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
+const GROK_ENV_VARS = ["GROK_SESSION_ID", "GROK_WORKSPACE_ROOT"];
 /** Every Grok environment signal present in `env`, one entry per variable. */
 export function grokEnvEvidence(env) {
     const found = [];
@@ -249,9 +249,9 @@ const DEFAULT_MAX_HOPS = 20;
 /** Wall-clock bound for the single `ps` snapshot, keeping startup fast. */
 const PS_TIMEOUT_MS = 250;
 /** The one command this module ever launches to read process ancestry. */
-export const PS_COMMAND = "ps";
+const PS_COMMAND = "ps";
 /** `ps` arguments: every process as `pid ppid comm`, header-suppressed. */
-export const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
+const PS_ARGS = ["-Ao", "pid=,ppid=,comm="];
 /**
  * Read this process's ancestor chain (nearest parent first) by taking one `ps`
  * snapshot of the process table and walking parent pointers upward. A single
@@ -330,7 +330,7 @@ function defaultPsSpawner(command, args) {
  * flag, bundle id, Codex vars, then Grok vars. Process ancestry is collected
  * separately (and lazily) by {@link detectPlatform}.
  */
-export function collectEnvEvidence(env) {
+function collectEnvEvidence(env) {
     const evidence = [];
     const entrypoint = entrypointEvidence(env);
     if (entrypoint)

package/dist/lib/lanes/autopilot.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { laneRunsOnHost } from "./admission.js";
 import { appendDropboxMessage } from "./dropbox.js";
 import { LanesError } from "./errors.js";
 import { readLanesRegistryFlag } from "./registry-flag.js";
@@ -406,7 +407,7 @@ function recordOperatorEscalation(hqRoot, record) {
 async function runLeadAutopilotPassUnlocked(input) {
     const { hqRoot, host, now } = input;
     const result = { ok: true, host, evaluated: 0, sent: [], started: [], escalated: [], skipped: [] };
-    const leads = parseRegistry(hqRoot).filter((lead) => lead.host === host || (host === "local" && lead.host === input.hostname));
+    const leads = parseRegistry(hqRoot);
     const lanes = readAllLanes(hqRoot);
     const byId = new Map(lanes.map((lane) => [lane.lane_id, lane]));
     const stateFile = path.join(hqRoot, "workspace", "lane-briefs", "autopilot-state.json");
@@ -422,131 +423,150 @@ async function runLeadAutopilotPassUnlocked(input) {
             continue;
         }
         const registeredLocalHost = registered.host === "local" || registered.host === input.hostname;
-        if ((registeredLocalHost && (lead.host.kind !== "local" || lead.host.id !== input.hostname)) ||
-            (!registeredLocalHost && (lead.host.kind !== "outpost" || lead.host.id !== registered.host || input.outpostId !== registered.host))) {
+        const hostMatchesRegistry = registeredLocalHost
+            ? lead.host.kind === "local"
+            : lead.host.kind === "outpost" && lead.host.id === registered.host && input.outpostId === registered.host;
+        if (!hostMatchesRegistry ||
+            !laneRunsOnHost(lead, { hostname: input.hostname, outpostId: input.outpostId })) {
             result.skipped.push({ lead_lane: lead.lane_id, reason: "lead_host_mismatch" });
             continue;
         }
-        const enabled = await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_FLAG, { company: lead.company });
-        if (!enabled) {
-            result.skipped.push({ lead_lane: lead.lane_id, reason: "flag_off" });
-            continue;
-        }
-        const status = readStatus(hqRoot, registered.status, lead.company.slug);
-        const statusUpdatedAt = typeof status.updated_at === "string" && Number.isFinite(Date.parse(status.updated_at))
-            ? new Date(Date.parse(status.updated_at)).toISOString()
-            : undefined;
-        result.evaluated += 1;
-        const stories = projectStories(hqRoot, registered.prd, lead.company.slug, lead.project_id);
-        const children = lanes.filter((lane) => lane.senior.kind === "lane" && lane.senior.id === lead.lane_id);
-        const planned = planLeadAutopilotWakes({
-            lead,
-            children,
-            stories,
-            now,
-            managerStatus: status,
-            keepAliveResumed: input.keepAliveResumedLeads?.has(lead.lane_id) === true,
-        });
         let stateChanged = false;
-        const activeKeys = new Set(planned.map((wake) => `${lead.lane_id}:${wake.condition}`));
-        for (const key of Object.keys(state.sent)) {
-            if (key.startsWith(`${lead.lane_id}:`) && !activeKeys.has(key)) {
-                delete state.sent[key];
-                stateChanged = true;
+        try {
+            const enabled = await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_FLAG, { company: lead.company });
+            if (!enabled) {
+                result.skipped.push({ lead_lane: lead.lane_id, reason: "flag_off" });
+                continue;
             }
-        }
-        for (const wake of planned) {
-            const key = `${lead.lane_id}:${wake.condition}`;
-            const prior = state.sent[key];
-            if (prior?.fingerprint === wake.fingerprint) {
-                if (input.dryRun)
-                    continue;
-                let current = prior;
-                const lastWakeAt = Date.parse(prior.last_wake_at ?? prior.at);
-                if (!Number.isFinite(lastWakeAt)) {
-                    throw new LanesError("lead_autopilot_state_invalid", `Invalid wake time for ${lead.lane_id}`, { lead_lane: lead.lane_id, story_id: wake.story_id });
-                }
-                if (statusUpdatedAt === undefined || prior.status_updated_at === undefined) {
-                    throw new LanesError("lead_autopilot_status_activity_unverifiable", `Cannot verify whether lead ${lead.lane_id} acted after its autopilot wake`, { lead_lane: lead.lane_id, story_id: wake.story_id });
-                }
-                if (!prior.acted && Date.parse(statusUpdatedAt) > Date.parse(prior.status_updated_at)) {
-                    current = { ...prior, acted: true };
-                    state.sent[key] = current;
+            const status = readStatus(hqRoot, registered.status, lead.company.slug);
+            const statusUpdatedAt = typeof status.updated_at === "string" && Number.isFinite(Date.parse(status.updated_at))
+                ? new Date(Date.parse(status.updated_at)).toISOString()
+                : undefined;
+            const stories = projectStories(hqRoot, registered.prd, lead.company.slug, lead.project_id);
+            const children = lanes.filter((lane) => lane.senior.kind === "lane" && lane.senior.id === lead.lane_id);
+            const planned = planLeadAutopilotWakes({
+                lead,
+                children,
+                stories,
+                now,
+                managerStatus: status,
+                keepAliveResumed: input.keepAliveResumedLeads?.has(lead.lane_id) === true,
+            });
+            const activeKeys = new Set(planned.map((wake) => `${lead.lane_id}:${wake.condition}`));
+            for (const key of Object.keys(state.sent)) {
+                if (key.startsWith(`${lead.lane_id}:`) && !activeKeys.has(key)) {
+                    delete state.sent[key];
                     stateChanged = true;
                 }
-                if (wake.condition === "fill_grant" && input.startWorker && !current.acted && !current.auto_started) {
-                    const firstWakeAt = Date.parse(current.at);
-                    if (!Number.isFinite(firstWakeAt)) {
-                        throw new LanesError("lead_autopilot_state_invalid", `Invalid fill-grant wake time for ${lead.lane_id}`, { lead_lane: lead.lane_id, story_id: wake.story_id });
+            }
+            for (const wake of planned) {
+                const key = `${lead.lane_id}:${wake.condition}`;
+                const prior = state.sent[key];
+                if (prior?.fingerprint === wake.fingerprint) {
+                    if (input.dryRun)
+                        continue;
+                    let current = prior;
+                    const lastWakeAt = Date.parse(prior.last_wake_at ?? prior.at);
+                    if (!Number.isFinite(lastWakeAt)) {
+                        throw new LanesError("lead_autopilot_state_invalid", `Invalid wake time for ${lead.lane_id}`, { lead_lane: lead.lane_id, story_id: wake.story_id });
+                    }
+                    if (statusUpdatedAt === undefined || prior.status_updated_at === undefined) {
+                        throw new LanesError("lead_autopilot_status_activity_unverifiable", `Cannot verify whether lead ${lead.lane_id} acted after its autopilot wake`, { lead_lane: lead.lane_id, story_id: wake.story_id });
+                    }
+                    if (!prior.acted && Date.parse(statusUpdatedAt) > Date.parse(prior.status_updated_at)) {
+                        current = { ...prior, acted: true };
+                        state.sent[key] = current;
+                        stateChanged = true;
                     }
-                    if (now.getTime() - firstWakeAt >= LEAD_AUTOPILOT_FILL_DELAY_MS) {
-                        const story = stories.find((candidate) => candidate.id === wake.story_id && candidate.status === "todo");
-                        if (!story?.briefPath) {
-                            throw new LanesError("lead_autopilot_story_brief_missing", `Cannot auto-start story ${wake.story_id}: its project record has no valid brief path`, { lead_lane: lead.lane_id, story_id: wake.story_id, project_id: lead.project_id });
+                    if (wake.condition === "fill_grant" && input.startWorker && !current.acted && !current.auto_started) {
+                        const firstWakeAt = Date.parse(current.at);
+                        if (!Number.isFinite(firstWakeAt)) {
+                            throw new LanesError("lead_autopilot_state_invalid", `Invalid fill-grant wake time for ${lead.lane_id}`, { lead_lane: lead.lane_id, story_id: wake.story_id });
                         }
-                        if (lead.state !== "running" && lead.state !== "queued") {
-                            current = { ...current, acted: true };
+                        if (now.getTime() - firstWakeAt >= LEAD_AUTOPILOT_FILL_DELAY_MS) {
+                            const story = stories.find((candidate) => candidate.id === wake.story_id && candidate.status === "todo");
+                            if (!story?.briefPath) {
+                                throw new LanesError("lead_autopilot_story_brief_missing", `Cannot auto-start story ${wake.story_id}: its project record has no valid brief path`, { lead_lane: lead.lane_id, story_id: wake.story_id, project_id: lead.project_id });
+                            }
+                            if (lead.state !== "running" && lead.state !== "queued") {
+                                current = { ...current, acted: true };
+                                state.sent[key] = current;
+                                stateChanged = true;
+                                result.skipped.push({ lead_lane: lead.lane_id, reason: "auto_start_lead_not_active" });
+                            }
+                            else {
+                                const started = await input.startWorker({ lead, story });
+                                current = { ...current, auto_started: true, worker_lane: started.lane_id };
+                                state.sent[key] = current;
+                                stateChanged = true;
+                                result.started.push({ lead_lane: lead.lane_id, story_id: story.id, worker_lane: started.lane_id });
+                            }
+                        }
+                    }
+                    if (!current.acted && !current.auto_started && current.escalated_at === undefined && now.getTime() - lastWakeAt >= LEAD_AUTOPILOT_FILL_DELAY_MS) {
+                        const wakeCount = current.wake_count ?? 1;
+                        if (wakeCount < 2) {
+                            appendDropboxMessage(hqRoot, lead.lane_id, {
+                                at: now.toISOString(),
+                                message_id: `lead-autopilot:${wake.fingerprint}:wake-2`,
+                                kind: "system_notice",
+                                text: wake.prompt,
+                            });
+                            current = { ...current, wake_count: 2, last_wake_at: now.toISOString() };
                             state.sent[key] = current;
                             stateChanged = true;
-                            result.skipped.push({ lead_lane: lead.lane_id, reason: "auto_start_lead_not_active" });
+                            result.sent.push(wake);
                         }
                         else {
-                            const started = await input.startWorker({ lead, story });
-                            current = { ...current, auto_started: true, worker_lane: started.lane_id };
+                            const escalation = { team: registered.team, lead_lane: lead.lane_id, condition: wake.condition, story_id: wake.story_id, at: now.toISOString(), fingerprint: wake.fingerprint };
+                            recordOperatorEscalation(hqRoot, escalation);
+                            current = { ...current, escalated_at: now.toISOString() };
                             state.sent[key] = current;
                             stateChanged = true;
-                            result.started.push({ lead_lane: lead.lane_id, story_id: story.id, worker_lane: started.lane_id });
+                            result.escalated.push(escalation);
                         }
                     }
+                    continue;
                 }
-                if (!current.acted && !current.auto_started && current.escalated_at === undefined && now.getTime() - lastWakeAt >= LEAD_AUTOPILOT_FILL_DELAY_MS) {
-                    const wakeCount = current.wake_count ?? 1;
-                    if (wakeCount < 2) {
-                        appendDropboxMessage(hqRoot, lead.lane_id, {
-                            at: now.toISOString(),
-                            message_id: `lead-autopilot:${wake.fingerprint}:wake-2`,
-                            kind: "system_notice",
-                            text: wake.prompt,
-                        });
-                        current = { ...current, wake_count: 2, last_wake_at: now.toISOString() };
-                        state.sent[key] = current;
-                        stateChanged = true;
-                        result.sent.push(wake);
-                    }
-                    else {
-                        const escalation = { team: registered.team, lead_lane: lead.lane_id, condition: wake.condition, story_id: wake.story_id, at: now.toISOString(), fingerprint: wake.fingerprint };
-                        recordOperatorEscalation(hqRoot, escalation);
-                        current = { ...current, escalated_at: now.toISOString() };
-                        state.sent[key] = current;
-                        stateChanged = true;
-                        result.escalated.push(escalation);
-                    }
+                if (!input.dryRun) {
+                    appendDropboxMessage(hqRoot, lead.lane_id, {
+                        at: now.toISOString(),
+                        message_id: `lead-autopilot:${wake.fingerprint}`,
+                        kind: "system_notice",
+                        text: wake.prompt,
+                    });
+                    state.sent[key] = {
+                        fingerprint: wake.fingerprint,
+                        at: now.toISOString(),
+                        ...(statusUpdatedAt ? { status_updated_at: statusUpdatedAt } : {}),
+                        wake_count: 1,
+                        last_wake_at: now.toISOString(),
+                    };
+                    stateChanged = true;
                 }
-                continue;
+                result.sent.push(wake);
             }
-            if (!input.dryRun) {
-                appendDropboxMessage(hqRoot, lead.lane_id, {
-                    at: now.toISOString(),
-                    message_id: `lead-autopilot:${wake.fingerprint}`,
-                    kind: "system_notice",
-                    text: wake.prompt,
-                });
-                state.sent[key] = {
-                    fingerprint: wake.fingerprint,
-                    at: now.toISOString(),
-                    ...(statusUpdatedAt ? { status_updated_at: statusUpdatedAt } : {}),
-                    wake_count: 1,
-                    last_wake_at: now.toISOString(),
-                };
-                stateChanged = true;
-            }
-            result.sent.push(wake);
+            if (!input.dryRun && stateChanged)
+                writeState(stateFile, state);
+            result.evaluated += 1;
+        }
+        catch (error) {
+            if (!input.dryRun && stateChanged)
+                writeState(stateFile, state);
+            if (!(error instanceof LanesError) || LEAD_AUTOPILOT_PASS_FATAL_ERRORS.has(error.error))
+                throw error;
+            result.skipped.push({ lead_lane: lead.lane_id, reason: error.error });
         }
-        if (!input.dryRun && stateChanged)
-            writeState(stateFile, state);
     }
     return result;
 }
+// Tenant-boundary and path-safety failures stop the whole pass; other per-lead
+// data errors skip only that lead.
+const LEAD_AUTOPILOT_PASS_FATAL_ERRORS = new Set([
+    "lead_autopilot_tenant_mismatch",
+    "lead_autopilot_status_path_invalid",
+    "lead_autopilot_escalation_record_invalid",
+]);
 const LEAD_AUTOPILOT_STALE_LOCK_MAX_AGE_MS = 60 * 60_000;
 function processStartIdentity(pid) {
     try {

package/dist/lib/onboarding/errors.d.ts

@@ -4,7 +4,7 @@
  * Each failure class maps to a distinct step in the onboarding flow,
  * making it easy for the installer to show targeted recovery hints.
  */
-export declare class OnboardingError extends Error {
+declare class OnboardingError extends Error {
     readonly step: string;
     readonly cause?: Error | undefined;
     constructor(message: string, step: string, cause?: Error | undefined);
@@ -30,4 +30,5 @@ export declare class InviteAcceptError extends OnboardingError {
 export declare class StsVerifyError extends OnboardingError {
     constructor(message: string, cause?: Error);
 }
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/onboarding/errors.js

@@ -4,7 +4,7 @@
  * Each failure class maps to a distinct step in the onboarding flow,
  * making it easy for the installer to show targeted recovery hints.
  */
-export class OnboardingError extends Error {
+class OnboardingError extends Error {
     step;
     cause;
     constructor(message, step, cause) {

package/dist/lib/onboarding/index.d.ts

@@ -7,11 +7,7 @@
  * invite/accept into create-company and join-company flows with
  * checkpoint/resume.
  */
-export { createCompanyFlow, joinCompanyFlow, resumeOnboarding, onboardingContract, } from "./orchestrator.js";
-export { readCheckpoint, writeCheckpoint, deleteCheckpoint, getCheckpointPath, isStepComplete, } from "./checkpoint.js";
-export { OnboardingError, PersonCreationError, CompanyCreationError, ProvisioningError, MembershipBootstrapError, FirstSyncError, InviteAcceptError, StsVerifyError, } from "./errors.js";
-export type { OnboardingInput, CreateCompanyInput, JoinCompanyInput, OnboardingConfig, OnboardingResult, OnboardingProgress, OnboardingStep, StepStatus, ProgressCallback, OnboardingCheckpoint, DesktopInstallerContract, HqConfig, } from "./types.js";
+export { readCheckpoint } from "./checkpoint.js";
+export type { OnboardingCheckpoint } from "./types.js";
 export { runOnboardCli } from "./cli/onboard.js";
-export type { OnboardCliOptions, OnboardCliResult } from "./cli/onboard.js";
-export { formatProgress, formatSummary, formatError, validateSlug, validateEmail } from "./cli/prompts.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/onboarding/index.js

@@ -7,10 +7,7 @@
  * invite/accept into create-company and join-company flows with
  * checkpoint/resume.
  */
-export { createCompanyFlow, joinCompanyFlow, resumeOnboarding, onboardingContract, } from "./orchestrator.js";
-export { readCheckpoint, writeCheckpoint, deleteCheckpoint, getCheckpointPath, isStepComplete, } from "./checkpoint.js";
-export { OnboardingError, PersonCreationError, CompanyCreationError, ProvisioningError, MembershipBootstrapError, FirstSyncError, InviteAcceptError, StsVerifyError, } from "./errors.js";
-// CLI
+// The CLI command and identity guard are the only consumers of this barrel.
+export { readCheckpoint } from "./checkpoint.js";
 export { runOnboardCli } from "./cli/onboard.js";
-export { formatProgress, formatSummary, formatError, validateSlug, validateEmail } from "./cli/prompts.js";
 //# sourceMappingURL=index.js.map

package/dist/lib/search-index/embed-lock.d.ts

@@ -11,13 +11,6 @@ export type EmbedLockProcessEvents = Pick<NodeJS.Process, 'once'> & {
     removeListener?: NodeJS.Process['removeListener'];
 };
 export type EmbedLockRunResult = 'ran' | 'skipped' | 'busy' | 'unavailable';
-/**
- * Serializes QMD writes started through HQ-managed hq-cli paths. A bare `qmd
- * update` / `qmd embed` (or another tool that does not call this module) cannot
- * participate, because qmd is a third-party package and does not know about
- * HQ's lock protocol.
- */
-export declare const EMBED_LOCK_NAME = "qmd-reindex-bg.lock";
 export declare function defaultEmbedLockDependencies(env?: NodeJS.ProcessEnv): EmbedLockDependencies;
 export declare function lockRoot(home: string): string;
 export declare function lockPath(home: string): string;

package/dist/lib/search-index/embed-lock.js

@@ -6,7 +6,7 @@ import * as path from 'node:path';
  * participate, because qmd is a third-party package and does not know about
  * HQ's lock protocol.
  */
-export const EMBED_LOCK_NAME = 'qmd-reindex-bg.lock';
+const EMBED_LOCK_NAME = 'qmd-reindex-bg.lock';
 export function defaultEmbedLockDependencies(env = process.env) {
     return {
         env,

package/dist/lib/search-index/load-gate.d.ts

@@ -22,10 +22,6 @@ export type LoadGateDependencies = {
     freemem: () => number;
     totalmem: () => number;
 };
-type CpuCounters = {
-    total: number;
-    idle: number;
-};
 export type EmbedLoadDecision = {
     action: 'embed';
     forced: false;
@@ -44,11 +40,8 @@ export declare class LoadGateConfigurationError extends Error {
     constructor(value: string);
 }
 export declare function defaultLoadGateDependencies(env?: NodeJS.ProcessEnv): LoadGateDependencies;
-export declare function parseProcStatAggregate(contents: string): CpuCounters | undefined;
-export declare function cpuBusyPercent(before: CpuCounters, after: CpuCounters): number | undefined;
 /** Sample aggregate CPU busy time over 200 ms, falling back only without /proc/stat. */
 export declare function measureCpuPercent(dependencies: LoadGateDependencies): number;
-export declare function memAvailableFraction(contents: string): number | undefined;
 /** Prefer Linux MemAvailable, because MemFree alone treats reclaimable cache as used memory. */
 export declare function measureMemoryPercent(dependencies: LoadGateDependencies): number;
 export declare function parseLoadThreshold(env: NodeJS.ProcessEnv): number | undefined;
@@ -61,5 +54,4 @@ export declare function loadGateStatePath(home: string): string;
 export declare function checkEmbedLoad(home: string, dependencies: LoadGateDependencies): EmbedLoadDecision;
 /** Reset the starvation counter only after qmd embed has actually returned successfully. */
 export declare function recordSuccessfulEmbed(home: string, dependencies: LoadGateDependencies): void;
-export {};
 //# sourceMappingURL=load-gate.d.ts.map