@indigoai-us/hq-cli 5.310.0 → 5.311.1

package/CHANGELOG.md

@@ -2,7 +2,26 @@
 
 ## [Unreleased]
 
+## [5.311.1] — 2026-10-01
+- Preserve shell-compatible diagnostics when delegate pickup receives a malformed manifest.
+- Print URLs returned by `hq integrations call` without redacting their paths or query values. Other integration JSON output keeps its existing URL redaction.
+
+## [5.311.0] — 2026-10-01
+- Add native `hq core hq-session` and `checkpoint-stop-gate` handlers on the fast route behind the default-off `core-native-session` flag, retaining bundled shell rollback companions.
+
+- Claude lane account selection now skips accounts held for the lane's model and preserves the quota reset details when no eligible account is available.
+- Require a latency regression to recur across benchmark rounds before failing the fast-route gate.
+- Detect inline private keys when validating job definitions.
+- Deliver each Outpost its own lead autopilot registry rows from the primary reconcile pass, and report a missing or stale registry on the Outpost.
+- Add an opt-in, default-off hq-flags gate that lets the first keep-alive retry after a done turn run after a 30-second settle while preserving later backoff.
+- Add the default-off cli.personal-connector-settings flag to store imported local connector manifests in the personal vault instead of the company vault.
+
 ## [5.310.0] — 2026-10-01
+- Move directly controlled Linux CI checks to ARM runners where their tools support ARM.
+- Lead autopilot resolves a lead's company through its project when the lane record does not carry a company, and skips project paths registered to a different company.
+- Install-tree recovery errors now report bounded sibling, target, version-gate phase, and updater-liveness enums.
+
+## [5.309.1] — 2026-10-01
 - Fixed `hq agents rm` to remove external agents through revoke rather than the hosted-agent teardown path.
 
 - Wait for asynchronous integration approvals to reach a terminal queue state and report pending work accurately.
@@ -10,6 +29,7 @@
 - Add privacy-safe qmd exit diagnostics to Sentry reports.
 
 - `hq files delete` help now explains exact-key and wildcard-prefix matching.
+- Add native `hq core worker lint` and `hq core worker share` behind the default-off `core-native-worker-skills` gate.
 
 - Port `hq core dm-bind` and `hq core work-mesh-bind-trusted` to native TypeScript behind `core-native-utilities`, retaining the bundled-script fallback.
 

package/assets/scaffold/core/scripts/jobs-validate.sh

@@ -145,7 +145,7 @@ scan_string_for_secrets() {
   for entry in "${SECRET_PATTERNS[@]}"; do
     pattern="${entry%%:*}"
     name="${entry#*:}"
-    if grep -Eq "$pattern" "$tmp" 2>/dev/null; then
+    if grep -Eq -e "$pattern" "$tmp" 2>/dev/null; then
       err "$file" "$field" "inline credential-shaped value matched pattern '$name' (names only; never values)"
     fi
   done

package/dist/command-catalog.generated.d.ts

@@ -2881,7 +2881,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "import";
-        readonly description: "Import Claude Desktop connectors into company Integrations";
+        readonly description: "Import Claude Desktop connectors into HQ Integrations";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options]";
@@ -2905,7 +2905,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "install-local";
-        readonly description: "Register a company-shared local connector in this machine's Claude/Codex MCP config";
+        readonly description: "Install local connector settings in this machine's Claude/Codex MCP config";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly usage: "[options] <name>";

package/dist/command-catalog.generated.js

@@ -3692,7 +3692,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "import",
-                "description": "Import Claude Desktop connectors into company Integrations",
+                "description": "Import Claude Desktop connectors into HQ Integrations",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options]",
@@ -3723,7 +3723,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "install-local",
-                "description": "Register a company-shared local connector in this machine's Claude/Codex MCP config",
+                "description": "Install local connector settings in this machine's Claude/Codex MCP config",
                 "aliases": [],
                 "hidden": false,
                 "usage": "[options] <name>",

package/dist/commands/channels.d.ts

@@ -1,5 +1,5 @@
 import { Command } from "commander";
-import { type CallerIdentity, type ChannelMember, type ChannelSummary } from "./dm.js";
+import { type ChannelSummary } from "./dm.js";
 /**
  * Human label for a channel row. Named channels (personal/company) show their
  * name + a `hq dm <slug>` hint; unnamed group DMs are identified by their
@@ -12,13 +12,5 @@ export declare function describeChannel(c: ChannelSummary): string;
  * fetched list) so the formatting is unit-testable without network/auth.
  */
 export declare function formatChannelsList(channels: ChannelSummary[]): string;
-/**
- * Remove the caller from a channel roster before it is used for mentions.
- * Machine principals identify themselves with the JWT uid; human sessions can
- * also match the roster's email when the uid claim is absent.
- */
-export declare function excludeCallerFromChannelMembers(members: ChannelMember[], caller: CallerIdentity): ChannelMember[];
-/** Render the roster as either dm-bind's tab-separated format or JSON. */
-export declare function formatChannelMembers(members: ChannelMember[], json: boolean): string;
 export declare function registerChannelsCommand(program: Command): void;
 //# sourceMappingURL=channels.d.ts.map

package/dist/commands/channels.js

@@ -47,7 +47,7 @@ export function formatChannelsList(channels) {
  * Machine principals identify themselves with the JWT uid; human sessions can
  * also match the roster's email when the uid claim is absent.
  */
-export function excludeCallerFromChannelMembers(members, caller) {
+function excludeCallerFromChannelMembers(members, caller) {
     return members.filter((member) => {
         if (caller.personUid && member.personUid === caller.personUid)
             return false;
@@ -60,7 +60,7 @@ export function excludeCallerFromChannelMembers(members, caller) {
     });
 }
 /** Render the roster as either dm-bind's tab-separated format or JSON. */
-export function formatChannelMembers(members, json) {
+function formatChannelMembers(members, json) {
     if (json)
         return JSON.stringify(members);
     return members

package/dist/commands/company-transfer.d.ts

@@ -38,23 +38,15 @@ import { type ActiveMember } from "./members.js";
  * confirmation prompt behind an injectable seam so tests can drive it.
  */
 /** The four write transitions the server accepts. */
-export declare const TRANSFER_ACTIONS: readonly ["initiate", "accept", "decline", "cancel"];
-export type TransferAction = (typeof TRANSFER_ACTIONS)[number];
+type TransferAction = "initiate" | "accept" | "decline" | "cancel";
 /**
  * Legal `--initiator-role` values. `owner` is deliberately absent: a handover
  * where the outgoing owner keeps `owner` is not a handover. `remove` is the
  * ONLY value that takes them off the company, and it can only ever arrive from
  * an explicit flag.
  */
-export declare const INITIATOR_ROLE_VALUES: readonly ["admin", "member", "guest", "remove"];
+declare const INITIATOR_ROLE_VALUES: readonly ["admin", "member", "guest", "remove"];
 export type InitiatorRoleFlag = (typeof INITIATOR_ROLE_VALUES)[number];
-/**
- * What the SERVER falls back to when `initiatorRole` is absent. Mirrored here
- * only so the confirmation preview can tell the operator what will happen; the
- * CLI never puts this value on the wire, because sending it would defeat the
- * point of leaving the field absent.
- */
-export declare const DEFAULT_INITIATOR_ROLE = "admin";
 /** A response field's presence, kept separate from its value. */
 export interface WireRead<T = unknown> {
     present: boolean;
@@ -86,19 +78,6 @@ export interface TransferBodyParams {
     transferId?: string;
     reason?: string;
 }
-/**
- * The wire prefix that turns `POST /membership/role` into a transfer request.
- * Mirrors the server's `TRANSFER_ACTION_PREFIX` in `_ownership-transfer.ts`:
- * a body whose `action` starts with `transfer-` is a transfer; anything else
- * (including no `action` at all) is an ordinary role change.
- */
-export declare const TRANSFER_ACTION_PREFIX = "transfer-";
-/**
- * The query discriminator on `GET /membership/company/{companyUid}` that
- * selects the transfer surface instead of the member roster. Mirrors the
- * server's `TRANSFER_HISTORY_VIEW` (exact match on the server side).
- */
-export declare const TRANSFER_HISTORY_VIEW = "transfers";
 /**
  * Build the `POST /membership/role` transfer body. The CLI-side `action`
  * ("initiate" | …) is prefixed to the wire discriminator ("transfer-initiate"
@@ -127,7 +106,7 @@ export declare function describeInitiatorOutcome(role: InitiatorRoleFlag | undef
  */
 export declare function describeEffects(rawEffects: unknown): string[];
 /** Injectable yes/no confirmation seam (stubbed in tests). */
-export type ConfirmFn = (message: string) => Promise<boolean>;
+type ConfirmFn = (message: string) => Promise<boolean>;
 /**
  * The real prompt. Refuses (rather than assuming yes) when stdin is not a TTY,
  * so a transfer can never be initiated or accepted by a pipeline that simply
@@ -145,10 +124,6 @@ export declare function realConfirm(message: string): Promise<boolean>;
  * who is already an active member.
  */
 export declare function matchMemberTarget(members: ActiveMember[], target: string): ActiveMember | undefined;
-export declare function resolveTargetPersonUid(token: string, companyUid: string, target: string): Promise<{
-    personUid: string;
-    label: string;
-}>;
 export interface TransferDeps {
     confirm?: ConfirmFn;
 }
@@ -182,4 +157,5 @@ export interface RunTransferStatusParams {
 /** `hq company transfer status` — the pending nomination plus the audit trail. */
 export declare function runCompanyTransferStatus(params: RunTransferStatusParams): Promise<void>;
 export declare function registerCompanyTransferCommand(company: Command, deps?: TransferDeps): void;
+export {};
 //# sourceMappingURL=company-transfer.d.ts.map

package/dist/commands/company-transfer.js

@@ -3,57 +3,13 @@ import * as readline from "node:readline";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
 import { listActiveMembers } from "./members.js";
-/**
- * `hq company transfer` — company ownership handover (client-service-pack
- * US-010). The server adds ZERO new API routes (vault-api-hq-prod sits at the
- * 600-route quota), so the CLI half multiplexes onto two EXISTING routes:
- *
- *   - WRITES ride `POST /membership/role` with a body discriminator
- *     `action: "transfer-initiate" | "transfer-accept" | "transfer-decline" |
- *     "transfer-cancel"`. The ordinary role payload has never carried an
- *     `action` field, so the shapes cannot collide.
- *   - The READ rides `GET /membership/company/{companyUid}?view=transfers`;
- *     without that exact `view` value the route returns the member roster as
- *     before.
- *
- * TWO-PARTY BY CONSTRUCTION. `initiate` NOMINATES; it does not transfer
- * anything. Ownership moves only when the nominee runs `accept`. The four write
- * transitions (initiate / accept / decline / cancel) all multiplex through one
- * POST with an explicit `action`, matching the server's route shape.
- *
- * ABSENT-FIELD DISCIPLINE (policy `hq-absent-field-never-means-constraining-value`).
- * This flow spans two repos that deploy in EITHER order, so absence is load
- * bearing in both directions and is handled in both directions here:
- *
- *   - REQUESTS: a flag the operator did not pass is OMITTED from the body — it
- *     is never defaulted to a value on the wire. `--initiator-role` unset sends
- *     no `initiatorRole` at all, so the server applies its own reversible
- *     "keep them as admin" default; the CLI can therefore never turn silence
- *     into `remove`. Same for `--transfer-id` (absent = "the pending one").
- *   - RESPONSES: fields are read with presence and value SEPARATELY
- *     ({@link readWireField}), because an OLDER server omits fields a newer CLI
- *     knows about. An absent `effects.initiator` renders as "not reported",
- *     never as "removed" — the CLI must not narrate a destructive outcome it
- *     was never actually told about.
- *
- * Conventions mirror `company.ts` / `files.ts`: ensureCognitoToken() →
- * getEntityUid() → vaultApiFetch() → error-check → chalk output, with the
- * confirmation prompt behind an injectable seam so tests can drive it.
- */
-/** The four write transitions the server accepts. */
-export const TRANSFER_ACTIONS = [
-    "initiate",
-    "accept",
-    "decline",
-    "cancel",
-];
 /**
  * Legal `--initiator-role` values. `owner` is deliberately absent: a handover
  * where the outgoing owner keeps `owner` is not a handover. `remove` is the
  * ONLY value that takes them off the company, and it can only ever arrive from
  * an explicit flag.
  */
-export const INITIATOR_ROLE_VALUES = [
+const INITIATOR_ROLE_VALUES = [
     "admin",
     "member",
     "guest",
@@ -65,7 +21,7 @@ export const INITIATOR_ROLE_VALUES = [
  * CLI never puts this value on the wire, because sending it would defeat the
  * point of leaving the field absent.
  */
-export const DEFAULT_INITIATOR_ROLE = "admin";
+const DEFAULT_INITIATOR_ROLE = "admin";
 /**
  * Read a field off a server response reporting presence and value SEPARATELY.
  *
@@ -120,13 +76,13 @@ export function parseInitiatorRole(raw) {
  * a body whose `action` starts with `transfer-` is a transfer; anything else
  * (including no `action` at all) is an ordinary role change.
  */
-export const TRANSFER_ACTION_PREFIX = "transfer-";
+const TRANSFER_ACTION_PREFIX = "transfer-";
 /**
  * The query discriminator on `GET /membership/company/{companyUid}` that
  * selects the transfer surface instead of the member roster. Mirrors the
  * server's `TRANSFER_HISTORY_VIEW` (exact match on the server side).
  */
-export const TRANSFER_HISTORY_VIEW = "transfers";
+const TRANSFER_HISTORY_VIEW = "transfers";
 /**
  * Build the `POST /membership/role` transfer body. The CLI-side `action`
  * ("initiate" | …) is prefixed to the wire discriminator ("transfer-initiate"
@@ -289,7 +245,7 @@ export function matchMemberTarget(members, target) {
         m.personName?.toLowerCase() === needle ||
         m.personUid?.toLowerCase() === needle);
 }
-export async function resolveTargetPersonUid(token, companyUid, target) {
+async function resolveTargetPersonUid(token, companyUid, target) {
     const trimmed = target.trim();
     if (PERSON_UID_PATTERN.test(trimmed) || AGENT_UID_PATTERN.test(trimmed)) {
         return { personUid: trimmed, label: trimmed };

package/dist/commands/core-checkpoint-stop-gate-native.d.ts

@@ -0,0 +1,34 @@
+export declare const CHECKPOINT_STOP_GATE_ASSET = "core/scripts/checkpoint-stop-gate.sh";
+export type CheckpointStopGateResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+export type CheckpointStopGateDependencies = {
+    env: NodeJS.ProcessEnv;
+    now: () => Date;
+    readFile: (filePath: string, encoding: BufferEncoding) => string;
+    exists: (filePath: string) => boolean;
+    isFile: (filePath: string) => boolean;
+    isDirectory: (filePath: string) => boolean;
+    canRead: (filePath: string) => boolean;
+    canWrite: (filePath: string) => boolean;
+    mtimeSeconds: (filePath: string) => number;
+    mkdir: (directory: string) => void;
+    writeFile: (filePath: string, contents: string, mode?: number) => void;
+    appendFile: (filePath: string, contents: string) => void;
+    rename: (from: string, to: string) => void;
+    remove: (filePath: string) => void;
+    touch: (filePath: string) => void;
+    makeTempPath: () => string;
+    commandExists: (name: string, env?: NodeJS.ProcessEnv) => boolean;
+    spawnHqDetached: (args: string[], env?: NodeJS.ProcessEnv) => void;
+};
+/** In-process command body with injectable filesystem, clock, PATH, and hq process. */
+export declare function executeCheckpointStopGate(input: string, context: {
+    cwd: string;
+    hqRoot?: string;
+}, overrides?: Partial<CheckpointStopGateDependencies>): CheckpointStopGateResult;
+/** Signature consumed by the lightweight fast-core dispatcher. */
+export declare function runCheckpointStopGateFast(_argv: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined): Promise<number>;
+//# sourceMappingURL=core-checkpoint-stop-gate-native.d.ts.map