@indigoai-us/hq-cli 5.309.0 → 5.310.0

package/dist/commands/core-native-utilities.d.ts

@@ -5,6 +5,7 @@ export type UtilityOutput = {
     code: number;
     stdout: string;
     stderr: string;
+    stderrBytes?: Uint8Array;
 };
 export type UtilityContext = {
     root: string;
@@ -18,7 +19,7 @@ export type NativeUtilityDefinition = {
     root: CoreCommandRoot;
     summary: string;
     resolveRoot: (cwd: string, hqRoot?: string) => string;
-    run: (args: string[], context: UtilityContext) => UtilityOutput;
+    run: (args: string[], context: UtilityContext) => UtilityOutput | Promise<UtilityOutput>;
 };
 /** Register one raw-argv command and retain the original shell as rollback. */
 export declare function registerNativeUtility(core: Command, definition: NativeUtilityDefinition): void;

package/dist/commands/core-native-utilities.js

@@ -31,10 +31,12 @@ export function registerNativeUtility(core, definition) {
                 process.exitCode = result.code;
             return;
         }
-        const result = definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
+        const result = await definition.run(operands, { root, cwd, env: process.env, now: () => new Date() });
         if (result.stdout)
             process.stdout.write(result.stdout);
-        if (result.stderr)
+        if (result.stderrBytes)
+            process.stderr.write(result.stderrBytes);
+        else if (result.stderr)
             process.stderr.write(result.stderr);
         if (result.code !== 0)
             process.exitCode = result.code;

package/dist/commands/core-ontology.d.ts

@@ -9,11 +9,7 @@
  */
 import { Command } from "commander";
 import { type FlagReader } from "../lib/checkpoint-ontology/plan.js";
-import { type AliasDrop } from "../lib/checkpoint-ontology/drop-aliases.js";
-import { type DeleteVaultKey, type ListedPair, type MergeCopiesReport } from "../lib/checkpoint-ontology/merge-copies.js";
-export declare const ONTOLOGY_PAYLOAD_FILE = "payload.json";
-/** The hq-flags read, scoped to the payload company. */
-export declare const registryFlagReader: FlagReader;
+import { type DeleteVaultKey, type MergeCopiesReport } from "../lib/checkpoint-ontology/merge-copies.js";
 export interface OntologyCommandDeps {
     readFlag?: FlagReader;
     now?: () => Date;
@@ -41,8 +37,6 @@ export interface MergeCopiesCommandOptions {
     json?: boolean;
 }
 export declare function mergeCopiesSummary(report: MergeCopiesReport): string;
-/** Reads a `--only` file: a JSON array of `{ copy, original }` company-relative paths. */
-export declare function readListedPairs(file: string): ListedPair[];
 /**
  * `hq core ontology merge-copies`: merge `<slug> <n>.md` copies into their
  * original (`--apply`), then delete merged copies from the vault
@@ -58,8 +52,6 @@ export declare function readListedPairs(file: string): ListedPair[];
  * which a person reviewed, instead of the pairs a finder produces.
  */
 export declare function runOntologyMergeCopies(hqRoot: string, slug: string | undefined, options: MergeCopiesCommandOptions, deps?: OntologyCommandDeps): Promise<string>;
-/** Reads a `drop-aliases --only` file: a JSON array of `{ entity, alias }`. */
-export declare function readAliasDrops(file: string): AliasDrop[];
 /**
  * `hq core ontology drop-aliases`: remove the reviewed `{ entity, alias }`
  * pairs in `--only` from entity files (`--apply`); without it only reports.

package/dist/commands/core-ontology.js

@@ -22,7 +22,7 @@ import { MERGE_COPIES_FLAG, MERGE_LISTED_PAIRS_FLAG, MERGE_REWRITE_REFS_FLAG, ME
 import { callDeleteEndpoint } from "./files.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { registerCoreOntologyNativeCommands } from "./core-ontology-native.js";
-export const ONTOLOGY_PAYLOAD_FILE = "payload.json";
+const ONTOLOGY_PAYLOAD_FILE = "payload.json";
 class OntologyUsageError extends Error {
 }
 function readPayload(runDir) {
@@ -49,7 +49,7 @@ function requireRunDir(runDir) {
     return resolved;
 }
 /** The hq-flags read, scoped to the payload company. */
-export const registryFlagReader = (flagKey, company) => readLanesRegistryFlag(flagKey, {
+const registryFlagReader = (flagKey, company) => readLanesRegistryFlag(flagKey, {
     company: company.cloudUid ? { slug: company.slug, uid: company.cloudUid } : null,
 });
 function companyBriefSuffix(brief) {
@@ -160,7 +160,7 @@ export function mergeCopiesSummary(report) {
     return lines.join("\n");
 }
 /** Reads a `--only` file: a JSON array of `{ copy, original }` company-relative paths. */
-export function readListedPairs(file) {
+function readListedPairs(file) {
     let parsed;
     try {
         parsed = JSON.parse(fs.readFileSync(file, "utf8"));
@@ -270,7 +270,7 @@ export async function runOntologyMergeCopies(hqRoot, slug, options, deps = {}) {
     return options.json ? JSON.stringify(report, null, 2) : mergeCopiesSummary(report);
 }
 /** Reads a `drop-aliases --only` file: a JSON array of `{ entity, alias }`. */
-export function readAliasDrops(file) {
+function readAliasDrops(file) {
     let parsed;
     try {
         parsed = JSON.parse(fs.readFileSync(file, "utf8"));

package/dist/commands/core-policy.d.ts

@@ -1,8 +1,5 @@
 import type { Command } from 'commander';
 import { type FrontmatterResult } from './core-policy-frontmatter.js';
-export declare const POLICY_AGE_REPORT_ASSET = "core/scripts/policy-age-report.sh";
-export declare const POLICY_RETIRE_ASSET = "core/scripts/policy-retire.sh";
-export declare const POLICY_FRONTMATTER_ASSET = "core/scripts/read-policy-frontmatter.sh";
 export type CorePolicyResult = {
     code: number;
     stdout: Buffer;

package/dist/commands/core-policy.js

@@ -8,9 +8,9 @@ import { resolveLiveRoot, resolveBundledAsset } from '../utils/hq-roots.js';
 import { runBundledScript } from '../utils/run-bundled-script.js';
 import { describeCoreCommand } from './core-command-catalog.js';
 import { runPolicyFrontmatter as runPolicyFrontmatterImpl } from './core-policy-frontmatter.js';
-export const POLICY_AGE_REPORT_ASSET = 'core/scripts/policy-age-report.sh';
-export const POLICY_RETIRE_ASSET = 'core/scripts/policy-retire.sh';
-export const POLICY_FRONTMATTER_ASSET = 'core/scripts/read-policy-frontmatter.sh';
+const POLICY_AGE_REPORT_ASSET = 'core/scripts/policy-age-report.sh';
+const POLICY_RETIRE_ASSET = 'core/scripts/policy-retire.sh';
+const POLICY_FRONTMATTER_ASSET = 'core/scripts/read-policy-frontmatter.sh';
 const AGE_HELP = [
     '# hq-core: public',
     '# policy-age-report.sh — measure policy usage and flag retirement candidates',

package/dist/commands/core-work-mesh-bind-trusted-native.d.ts

@@ -0,0 +1,32 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import type { Command } from "commander";
+import { type UtilityOutput } from "./core-native-utilities.js";
+export declare const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export declare const WORK_MESH_BIND_TRUSTED_HELP = "hq-core: public\nUS-011 \u2014 write session meta + reconcile with observation.trustedContext.\nNo --trusted CLI flag in hq-cli; trusted bind is the observation field.\nset -euo pipefail\n\nROOT=\"${HQ_ROOT:-${CLAUDE_PROJECT_DIR:-}}\"\nif [ -z \"$ROOT\" ]; then\n";
+export type WorkMeshBindDeps = {
+    root: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    fs: typeof fs;
+    runHq: (args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    runHqSession: (root: string, args: string[], env: NodeJS.ProcessEnv) => {
+        code: number;
+        stdout: string;
+        stderr: string;
+    };
+    spawnHq: (args: string[], env: NodeJS.ProcessEnv) => void;
+    pid: number;
+    tmpDir: string;
+    ulid: (now: Date) => string;
+};
+export declare const createWorkMeshBindDeps: (root: string, cwd: string, env: NodeJS.ProcessEnv, now: () => Date) => WorkMeshBindDeps;
+export declare function resolveWorkMeshBindSessionId(root: string, env: NodeJS.ProcessEnv, fileSystem?: typeof fs): string;
+export declare function runWorkMeshBindTrusted(args: string[], deps: WorkMeshBindDeps): UtilityOutput;
+export declare function registerCoreWorkMeshBindTrustedNative(core: Command): void;
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.d.ts.map

package/dist/commands/core-work-mesh-bind-trusted-native.js

@@ -0,0 +1,190 @@
+/** Native implementation of core/scripts/work-mesh-live-bind-trusted.sh. */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { generateUlid } from "../lib/mesh/live/ulid.js";
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { registerNativeUtility } from "./core-native-utilities.js";
+export const WORK_MESH_BIND_TRUSTED_ASSET = "core/scripts/work-mesh-live-bind-trusted.sh";
+export const WORK_MESH_BIND_TRUSTED_HELP = `hq-core: public
+US-011 — write session meta + reconcile with observation.trustedContext.
+No --trusted CLI flag in hq-cli; trusted bind is the observation field.
+set -euo pipefail
+
+ROOT="\${HQ_ROOT:-\${CLAUDE_PROJECT_DIR:-}}"
+if [ -z "$ROOT" ]; then
+`;
+export const createWorkMeshBindDeps = (root, cwd, env, now) => ({
+    root, cwd, env, now, fs, pid: process.pid, tmpDir: env.TMPDIR || "/tmp", ulid: (date) => generateUlid(date.getTime()),
+    runHq: (args, childEnv) => {
+        const result = spawnSync("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    runHqSession: (scriptRoot, args, childEnv) => {
+        const result = spawnSync("bash", [path.join(scriptRoot, "core/scripts/hq-session.sh"), ...args], { cwd, env: childEnv, encoding: "utf8" });
+        return { code: result.status ?? 127, stdout: result.stdout ?? "", stderr: result.stderr ?? (result.error ? `${result.error.message}\n` : "") };
+    },
+    spawnHq: (args, childEnv) => {
+        const child = spawn("hq", args, { cwd, env: { ...childEnv, HQ_ROOT: root }, detached: true, stdio: "ignore" });
+        child.unref();
+    },
+});
+export function resolveWorkMeshBindSessionId(root, env, fileSystem = fs) {
+    for (const key of ["HQ_SESSION_ID", "CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID", "CODEX_SESSION_ID", "CODEX_THREAD_ID"]) {
+        const value = (env[key] ?? "").replace(/\s/g, "");
+        if (value)
+            return value;
+    }
+    try {
+        const value = fileSystem.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+        return value;
+    }
+    catch {
+        return "";
+    }
+}
+function hasExecutable(deps, command) {
+    for (const directory of (deps.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        try {
+            const stat = deps.fs.statSync(path.join(directory, command));
+            if (stat.isFile() && (stat.mode & 0o111) !== 0)
+                return true;
+        }
+        catch { /* PATH entry is absent */ }
+    }
+    return false;
+}
+function workMeshJsonQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")}"`;
+}
+function workMeshObservationJson(observation) {
+    const identity = observation.identity;
+    const trusted = observation.trustedContext;
+    let json = `{"contractVersion":1,"clientOperationId":${workMeshJsonQuote(String(observation.clientOperationId))},"identity":{"sessionId":${workMeshJsonQuote(identity.sessionId)},"harness":${workMeshJsonQuote(identity.harness)},"adapterVersion":${workMeshJsonQuote(identity.adapterVersion)}},"cwd":${workMeshJsonQuote(String(observation.cwd))},"hqRoot":${workMeshJsonQuote(String(observation.hqRoot))}`;
+    if (trusted) {
+        json += ',"trustedContext":{';
+        let first = true;
+        for (const [key, value] of Object.entries(trusted)) {
+            if (!first)
+                json += ",";
+            first = false;
+            json += `${workMeshJsonQuote(key)}:${workMeshJsonQuote(value)}`;
+        }
+        json += "}";
+    }
+    return `${json}}`;
+}
+export function runWorkMeshBindTrusted(args, deps) {
+    let root = deps.env.HQ_ROOT || deps.env.CLAUDE_PROJECT_DIR || deps.root;
+    let company = "", project = "", task = "", sid = "", noReconcile = false;
+    const output = [];
+    for (let i = 0; i < args.length;) {
+        const arg = args[i];
+        if (["--company", "--company-slug", "--project", "--task", "--session", "--session-id", "--root"].includes(arg)) {
+            const value = args[i + 1] ?? "";
+            if (arg === "--company" || arg === "--company-slug")
+                company = value;
+            else if (arg === "--project")
+                project = value;
+            else if (arg === "--task")
+                task = value;
+            else if (arg === "--session" || arg === "--session-id")
+                sid = value;
+            else
+                root = value;
+            i += 2;
+        }
+        else if (arg === "--no-reconcile") {
+            noReconcile = true;
+            i += 1;
+        }
+        else if (arg === "-h" || arg === "--help")
+            return { code: 0, stdout: WORK_MESH_BIND_TRUSTED_HELP.replace(/^# ?/gm, ""), stderr: "" };
+        else
+            i += 1;
+    }
+    if (!sid) {
+        sid = resolveWorkMeshBindSessionId(root, deps.env, deps.fs);
+        if (!sid) {
+            try {
+                sid = deps.fs.readFileSync(path.join(root, "workspace/sessions/.current"), "utf8").replace(/\s/g, "");
+            }
+            catch {
+                sid = "";
+            }
+        }
+    }
+    const childEnv = { ...deps.env, HQ_ROOT: root };
+    const pin = sid ? ["--session-id", sid] : [];
+    let stderr = "";
+    for (const [key, value] of [["company_slug", company], ["project", project], ["task", task]]) {
+        if (!value)
+            continue;
+        const result = deps.runHqSession(root, [...pin, "set", key, value], deps.env);
+        output.push(result.stdout);
+        stderr += result.stderr;
+        if (result.code !== 0)
+            return { code: result.code, stdout: output.join(""), stderr };
+    }
+    if (noReconcile || !sid)
+        return { code: 0, stdout: output.join(""), stderr };
+    let harness = deps.env.HQ_HARNESS || deps.env.HQ_WORK_MESH_HARNESS || "claude-code";
+    if (["claude", "Claude", "ClaudeCode"].includes(harness))
+        harness = "claude-code";
+    else if (harness === "Codex")
+        harness = "codex";
+    else if (harness === "Grok")
+        harness = "grok";
+    const adapter = deps.env.HQ_ADAPTER_CONTRACT_VERSION || "1.0.0";
+    const clientOperationId = deps.ulid(deps.now());
+    const observation = {
+        contractVersion: 1,
+        clientOperationId,
+        identity: { sessionId: sid, harness, adapterVersion: adapter },
+        cwd: deps.env.PWD ?? "",
+        hqRoot: root,
+    };
+    if (company || project || task) {
+        const trusted = {};
+        if (company)
+            trusted.companySlug = company;
+        if (project)
+            trusted.project = project;
+        if (task)
+            trusted.task = task;
+        observation.trustedContext = trusted;
+    }
+    const directory = path.join(deps.tmpDir, "hq-work-mesh-obs");
+    try {
+        deps.fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        deps.fs.chmodSync(directory, 0o700);
+    }
+    catch { /* legacy mkdir/chmod are best effort */ }
+    const observationFile = path.join(directory, `${sid}.bind.${deps.pid}.json`);
+    try {
+        deps.fs.writeFileSync(observationFile, `${workMeshObservationJson(observation)}\n`);
+    }
+    catch { /* legacy printf redirection failure is non-fatal */ }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_LOG) {
+        try {
+            deps.fs.appendFileSync(deps.env.HQ_WORK_MESH_RECONCILE_LOG, `reconcile-trusted ${observationFile}\n`);
+        }
+        catch { /* legacy log write is best effort */ }
+    }
+    if (deps.env.HQ_WORK_MESH_RECONCILE_STUB === "1")
+        return { code: 0, stdout: output.join(""), stderr };
+    if (hasExecutable(deps, "hq") && deps.fs.existsSync(observationFile)) {
+        deps.spawnHq(["mesh", "context", "reconcile", "--observation-file", observationFile, "--machine"], childEnv);
+    }
+    return { code: 0, stdout: output.join(""), stderr };
+}
+export function registerCoreWorkMeshBindTrustedNative(core) {
+    registerNativeUtility(core, {
+        name: "work-mesh-bind-trusted", asset: WORK_MESH_BIND_TRUSTED_ASSET, root: "live", summary: "Bind trusted session context and reconcile it with Work Mesh",
+        resolveRoot: (_cwd, hqRoot) => resolveLiveRoot({ hqRoot }),
+        run: (args, context) => runWorkMeshBindTrusted(args, createWorkMeshBindDeps(context.root, context.cwd, context.env, context.now)),
+    });
+}
+//# sourceMappingURL=core-work-mesh-bind-trusted-native.js.map

package/dist/commands/core.js

@@ -40,9 +40,11 @@ import { registerCoreJobsNativeCommand } from "./core-job-native.js";
 import { registerCoreResolveCompanyNativeCommand } from "./core-resolve-company-command.js";
 import { registerCoreCheckpointGateSettingCommand } from "./core-checkpoint-gate-setting.js";
 import { registerCoreAuditLogNative } from "./core-audit-log-native.js";
+import { registerCoreDmBindNative } from "./core-dm-bind-native.js";
 import { registerCoreGitPackExtensionCheckNative } from "./core-git-pack-extension-check-native.js";
 import { registerCorePinNative } from "./core-pin-native.js";
 import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-access-native.js";
+import { registerCoreWorkMeshBindTrustedNative } from "./core-work-mesh-bind-trusted-native.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -227,6 +229,8 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/hq-job-run.sh", root: "live", summary: "Scheduled jobs runner used by generated systemd units" },
     { asset: "core/scripts/hq-job-notify.sh", root: "live", summary: "Scheduled jobs failure notification helper" },
     { asset: "core/scripts/hq-job-remediate.sh", root: "live", summary: "Scheduled jobs bounded remediation helper" },
+    { asset: "core/scripts/hq-dm-bind.sh", root: "live", summary: "Rollback shell for native dm-bind" },
+    { asset: "core/scripts/work-mesh-live-bind-trusted.sh", root: "live", summary: "Rollback shell for native work-mesh-bind-trusted" },
     // Shared shell libs sourced by the two relocated scripts (and hooks). Never
     // dispatched on their own (so no `hq core` command), but they MUST ship in the
     // tarball, or the bundled hq-session / checkpoint-stop-gate die at `source`
@@ -372,6 +376,8 @@ export function registerCoreCommands(program) {
     registerCoreGitPackExtensionCheckNative(core);
     registerCorePinNative(core);
     registerCoreRefreshVaultAccessNative(core);
+    registerCoreDmBindNative(core);
+    registerCoreWorkMeshBindTrustedNative(core);
     // Wave 2 handoff/worktree commands retain their byte-identical shell assets
     // as a default-off rollback path for one release. Keep the gate helper small
     // so sibling Wave 2 work can reuse it without editing this command table.

package/dist/commands/files.js

@@ -511,7 +511,7 @@ export function registerFilesCommand(program) {
     });
     files
         .command("delete <prefix>")
-        .description("Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.")
+        .description("Delete vault objects by exact key or bounded prefix. A trailing slash expands recursively; use * for an explicit wildcard prefix. Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.")
         .option("--dry-run", "List what WOULD be deleted without deleting anything")
         .option("--personal", "Target your own personal vault instead of a company vault (mutually exclusive with --company)")
         .option("-y, --yes", "Skip the confirmation prompt (for scripts)")

package/dist/commands/index-cmd.js

@@ -38,7 +38,7 @@ export function syncSearchIndex(hqRoot, embed, dependencies = defaults) {
         catch {
             /* capping is an optimisation; indexing is the job */
         }
-        dependencies.runQmd(['update'], { cwd: hqRoot });
+        dependencies.runQmd(['update'], { cwd: hqRoot, entryPath: 'index-sync' });
     };
     const writeStderr = dependencies.writeStderr ?? ((text) => process.stderr.write(text));
     const singleFlightEnabled = (dependencies.singleFlightEnabled ?? qmdReindexSingleFlightEnabled)();

package/dist/commands/integrations-api.d.ts

@@ -288,13 +288,18 @@ export interface PendingApproval {
     requestedByName?: string | null;
     createdAt: string;
     expiresAt: string;
+    /** Queue state is present on history rows; older servers may omit it. */
+    status?: string;
+    /** Owner-facing outcome projected by hq-pro for decided rows. */
+    outcome?: string;
 }
 /**
- * Live open-approval list, read from hq-pro's confirm-queue state (not the
- * audit feed). Unlike the audit-derived reconstruction this replaces, a call
- * that was approved/rejected/expired no longer appears here.
+ * Read open approvals from hq-pro's confirm-queue state (not the audit feed).
+ * Pass `includeHistory` to include recently decided rows alongside open ones.
  */
-export declare function fetchPendingApprovals(token: string, companyUid: string): Promise<PendingApproval[]>;
+export declare function fetchPendingApprovals(token: string, companyUid: string, options?: {
+    includeHistory?: boolean;
+}): Promise<PendingApproval[]>;
 export declare function getConnectionAccess(token: string, companyUid: string, connectionId: string): Promise<ConnectionAccess>;
 export declare function mutateConnectionAccess(token: string, companyUid: string, action: "grant" | "revoke", input: {
     connectionId: string;

package/dist/commands/integrations-api.js

@@ -148,20 +148,23 @@ export async function setReadSafe(token, companyUid, connectionId, toolName, rea
         await raiseForResponse(res, "Failed to update the tool's read-safe setting");
 }
 /**
- * Live open-approval list, read from hq-pro's confirm-queue state (not the
- * audit feed). Unlike the audit-derived reconstruction this replaces, a call
- * that was approved/rejected/expired no longer appears here.
+ * Read open approvals from hq-pro's confirm-queue state (not the audit feed).
+ * Pass `includeHistory` to include recently decided rows alongside open ones.
  */
-export async function fetchPendingApprovals(token, companyUid) {
+export async function fetchPendingApprovals(token, companyUid, options = {}) {
     const res = await vaultApiFetch({
         token,
         path: "/v1/integrations/factory/pending",
-        query: { companyUid },
+        query: {
+            companyUid,
+            ...(options.includeHistory ? { include: "history" } : {}),
+        },
     });
     if (!res.ok)
         await raiseForResponse(res, "Failed to list pending approvals");
     const body = (await res.json());
-    return body.pending ?? [];
+    const pending = body.pending ?? [];
+    return options.includeHistory ? [...pending, ...(body.history ?? [])] : pending;
 }
 export async function getConnectionAccess(token, companyUid, connectionId) {
     const res = await vaultApiFetch({

package/dist/commands/integrations-manage.js

@@ -562,6 +562,7 @@ export function registerManageCommands(integrations) {
         .description("Calls that were queued for an owner's approval")
         .option("--company <slug>", "Company slug, e.g. indigo")
         .option("--json", "Machine-readable output")
+        .option("--history", "Include recently decided calls")
         .action(async (opts) => {
         const token = await ensureCognitoIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
@@ -570,7 +571,9 @@ export function registerManageCommands(integrations) {
         // could only show that a call was once queued.
         let pending;
         try {
-            pending = await fetchPendingApprovals(token, companyUid);
+            pending = await fetchPendingApprovals(token, companyUid, {
+                includeHistory: opts.history,
+            });
         }
         catch (err) {
             // This CLI can ship ahead of the hq-pro deploy that adds the pending
@@ -586,14 +589,19 @@ export function registerManageCommands(integrations) {
             return;
         }
         if (pending.length === 0) {
-            console.log("Nothing is waiting for approval.");
+            console.log(opts.history ? "No recent approval history." : "Nothing is waiting for approval.");
             return;
         }
         for (const row of pending) {
             const who = row.requestedByName ?? row.requestedBy;
             const label = row.requestedTool ?? row.toolName;
             console.log(`${chalk.bold(label)}  ${chalk.dim(`${who} · ${row.createdAt}`)}`);
-            console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}`));
+            if (opts.history) {
+                console.log(chalk.dim(`  ${row.queueId} · ${row.status ?? row.outcome ?? "status unavailable"}`));
+            }
+            else {
+                console.log(chalk.dim(`  hq integrations approve ${row.queueId}${row.provider ? ` --provider ${bareProvider(row.provider)}` : ""}`));
+            }
         }
     });
     integrations

package/dist/commands/integrations.d.ts

@@ -22,6 +22,7 @@
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
  *   hq integrations pending                  Calls awaiting approval.
+ *   hq integrations pending --history        Recently decided calls, including status.
  *   hq integrations approve|reject <queueId> Decide a queued call.
  *
  * Govern and remove:
@@ -49,7 +50,14 @@
  * `integrations-manage.ts`.
  */
 import { Command } from "commander";
+import { type PendingApproval } from "./integrations-api.js";
 export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 export type { AdminConnection } from "./integrations-core.js";
+/** Wait for a decided queue item without resending the approve request. */
+export declare function waitForApprovalTerminal(token: string, companyUid: string, queueId: string, options?: {
+    timeoutMs?: number;
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+}): Promise<PendingApproval | null>;
 export declare function registerIntegrationsCommand(program: Command): void;
 //# sourceMappingURL=integrations.d.ts.map

package/dist/commands/integrations.js

@@ -22,6 +22,7 @@
  *   hq integrations tools --provider <p>     What the connected app can do.
  *   hq integrations call <tool> --provider <p> --args '<json>'
  *   hq integrations pending                  Calls awaiting approval.
+ *   hq integrations pending --history        Recently decided calls, including status.
  *   hq integrations approve|reject <queueId> Decide a queued call.
  *
  * Govern and remove:
@@ -57,6 +58,7 @@ import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isCl
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
+import { fetchPendingApprovals } from "./integrations-api.js";
 export { IntegrationsCliError, callGateway, fetchConnections, queuedOutcome, selectConnection, toolPrefixForProvider, unwrapGatewayResult, } from "./integrations-core.js";
 /**
  * Gateway metadata is additive and may be absent when talking to an older
@@ -160,6 +162,55 @@ function reportRevokedConnection(connection, opts) {
     }
     return true;
 }
+const APPROVAL_POLL_TIMEOUT_MS = 5 * 60_000;
+const APPROVAL_POLL_INITIAL_DELAY_MS = 1_000;
+const APPROVAL_POLL_MAX_DELAY_MS = 15_000;
+const APPROVAL_TERMINAL_STATUSES = new Set([
+    "completed",
+    "resumed",
+    "failed",
+    "write_unknown",
+    "rejected",
+    "expired",
+]);
+const APPROVAL_TERMINAL_OUTCOMES = new Set([
+    "ran",
+    "failed",
+    "unknown",
+    "turned_down",
+    "timed_out",
+]);
+function isTerminalApproval(row) {
+    return APPROVAL_TERMINAL_STATUSES.has(row.status ?? "") ||
+        APPROVAL_TERMINAL_OUTCOMES.has(row.outcome ?? "");
+}
+/** Wait for a decided queue item without resending the approve request. */
+export async function waitForApprovalTerminal(token, companyUid, queueId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? APPROVAL_POLL_TIMEOUT_MS;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const deadline = now() + timeoutMs;
+    let delayMs = APPROVAL_POLL_INITIAL_DELAY_MS;
+    while (now() < deadline) {
+        const rows = await fetchPendingApprovals(token, companyUid, { includeHistory: true });
+        const row = rows.find((candidate) => candidate.queueId === queueId);
+        if (row && isTerminalApproval(row))
+            return row;
+        const remainingMs = deadline - now();
+        if (remainingMs <= 0)
+            break;
+        await sleep(Math.min(delayMs, remainingMs));
+        delayMs = Math.min(delayMs * 2, APPROVAL_POLL_MAX_DELAY_MS);
+    }
+    return null;
+}
+function isPendingApprovalResponse(status) {
+    return ["pending", "approved", "approved_pending_run", "in_progress"].includes(status ?? "");
+}
+function approvalOutcomeFailed(row) {
+    return ["failed", "write_unknown"].includes(row.status ?? "") ||
+        ["failed", "unknown"].includes(row.outcome ?? "");
+}
 export function registerIntegrationsCommand(program) {
     const integrations = program
         .command("integrations")
@@ -347,6 +398,38 @@ export function registerIntegrationsCommand(program) {
                 raiseIfUpstreamUnavailable(res);
                 throw new IntegrationsCliError(body.error ?? `${decision} failed (HTTP ${res.status})`, { expected: isClientError(res.status) });
             }
+            const pendingApprove = decision === "approve" &&
+                (res.status === 202 || isPendingApprovalResponse(body.status));
+            if (pendingApprove) {
+                const terminal = await waitForApprovalTerminal(token, companyUid, queueId);
+                const historyCommand = `hq integrations pending --history${opts.company ? ` --company ${opts.company}` : ""}`;
+                if (!terminal) {
+                    if (opts.json) {
+                        printJson({ ...body, status: "pending", pollTimedOut: true, checkCommand: historyCommand });
+                    }
+                    else {
+                        console.log(chalk.yellow(`Approval is still running after 5 minutes. Check queue ${queueId} later with: ${historyCommand}`));
+                    }
+                    return;
+                }
+                if (opts.json)
+                    printJson(terminal);
+                else if (approvalOutcomeFailed(terminal)) {
+                    const unknown = terminal.status === "write_unknown" || terminal.outcome === "unknown";
+                    console.log(chalk.red(unknown
+                        ? `The provider outcome is unknown for ${queueId}. Check the provider before taking any action; ${historyCommand} shows the latest queue state.`
+                        : `The approved call failed (${terminal.status ?? terminal.outcome}). See ${historyCommand} for its status.`));
+                }
+                else if (terminal.status === "resumed" || terminal.status === "completed" || terminal.outcome === "ran") {
+                    console.log(chalk.green("Approved — the call completed."));
+                }
+                else {
+                    console.log(chalk.yellow(`Approval ended with status ${terminal.status ?? terminal.outcome ?? "unknown"}.`));
+                }
+                if (approvalOutcomeFailed(terminal))
+                    process.exitCode = 1;
+                return;
+            }
             if (opts.json) {
                 printJson(body);
                 return;

package/dist/commands/lanes-checks.d.ts

@@ -19,7 +19,6 @@ export interface ProjectMapping {
     excludePrefix?: string;
 }
 export declare function mappingIncludesStory(mapping: ProjectMapping, storyId: string): boolean;
-export declare function ambiguousProjectMappings(mappings: readonly ProjectMapping[]): Map<string, string[]>;
 export interface ProjectReadResult {
     stories: Array<Record<string, unknown>>;
     mtime: number;
@@ -35,7 +34,6 @@ export declare function readProject(root: string, company: string, prdPath: stri
 export declare function loadCompanyQuestionRecords(root: string, company: LaneCompanyRef, projectId?: string): QuestionRecord[];
 export declare function readTeamInputs(root: string, company: LaneCompanyRef, projects: readonly ProjectMapping[], lanes: readonly LaneRecord[]): TrackerCheckTeam[];
 export declare function pathForTrackerRecord(projectDirectory: string, kind: TrackerKind, id: string): string;
-export declare function listTrackerRecords(projectDirectory: string, kind: TrackerKind): TrackerRecord[];
 export interface TolerantTrackerReadIssue {
     path: string;
     field: string;