@indigoai-us/hq-cli 5.311.0 → 5.311.2

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.311.2] — 2026-10-01
+- Reduce fast-path startup work by loading network compatibility only on routes that need it.
+- Make envelope `next_check_at` an unconditional keep-alive hold and remove its completed rollout flag.
+- Lead autopilot no longer asks a lead to review its own lane as a finished worker, or to relaunch a worker for a story assigned to the lead itself.
+- Lead autopilot counts a story's current `lane` together with its `lanes` history, so `lanes: []` no longer hides the assigned lane.
+- Keep the CLI company seed fixture byte-matched to the hq-core starter golden, including the session sentinel ignore rule.
+- Record lane-watcher continuations as `watcher` resumes and label their prompt source accurately; record monitor-event and system-notice message sources distinctly in lane resume history.
+
+## [5.311.1] — 2026-10-01
+- Preserve shell-compatible diagnostics when delegate pickup receives a malformed manifest.
+- Print URLs returned by `hq integrations call` without redacting their paths or query values. Other integration JSON output keeps its existing URL redaction.
+
 ## [5.311.0] — 2026-10-01
 - Add native `hq core hq-session` and `checkpoint-stop-gate` handlers on the fast route behind the default-off `core-native-session` flag, retaining bundled shell rollback companions.
 

package/dist/commands/core-delegate-w1b.js

@@ -6,7 +6,7 @@ import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
 import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
-import { isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
+import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 const FLAG = "core-native-delegate";
@@ -61,6 +61,15 @@ function jsonFile(file) {
         return undefined;
     }
 }
+function malformedJsonFile(file) {
+    try {
+        JSON.parse(fs.readFileSync(file, "utf8"));
+        return false;
+    }
+    catch (error) {
+        return error instanceof SyntaxError;
+    }
+}
 function jsonText(value) { return serializeJqJson(value, "pretty"); }
 function checksum(file) {
     return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
@@ -125,7 +134,21 @@ function parseFlags(args, allowed) {
 }
 function usage(name) { return USAGE[name] ?? ""; }
 function usageFailure(name) { err(usage(name)); return 1; }
-function runBundle(args, context) {
+function runShellFallback(name, args, context) {
+    const result = runBundledScript({
+        asset: ASSETS[name],
+        args,
+        cwd: context.cwd,
+        hqRoot: context.root ?? context.cwd,
+        captureOutput: true,
+    });
+    if (result.stdout?.length)
+        process.stdout.write(result.stdout);
+    if (result.stderr?.length)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
+function runBundle(args, context, onMalformedWhoami) {
     const root = context.root ?? context.cwd;
     if (args[0] !== "build")
         return usageFailure("bundle");
@@ -175,7 +198,9 @@ function runBundle(args, context) {
     try {
         identity = JSON.parse(who.stdout ?? "");
     }
-    catch {
+    catch (error) {
+        if (error instanceof SyntaxError)
+            return onMalformedWhoami ? onMalformedWhoami() : runShellFallback("bundle", args, context);
         identity = undefined;
     }
     const identityValue = isRecord(identity) ? identity : {};
@@ -291,6 +316,32 @@ function runBundle(args, context) {
 function runHq(args, context, stdout = "capture") {
     return subprocess("hq", args, context.cwd, { stdout });
 }
+function commandSubstitutionBytes(value) {
+    const bytes = value.stdoutBytes ?? Buffer.from(value.stdout ?? "");
+    let end = bytes.length;
+    while (end > 0 && bytes[end - 1] === 0x0a)
+        end -= 1;
+    return bytes.subarray(0, end);
+}
+function emitJqParseDiagnostic(input, args, context) {
+    if (!commandExists("jq", context.cwd))
+        return;
+    const result = subprocess("jq", args, context.cwd, { input, stdout: "ignore", stderr: "pipe" });
+    const diagnostic = result.stderrBytes ?? Buffer.from(result.stderr ?? "");
+    if (diagnostic.length)
+        err(diagnostic);
+}
+const RESOLVE_FOUND_FILTER = '.status == "found" and (.person.personUid | type == "string") and (.person.companyUid | type == "string")';
+const RESOLVE_NOT_FOUND_FILTER = '.status == "not_found"';
+const ACL_FILTER = `
+    .schemaVersion == 1 and
+    (
+      .prefix == $prefix or
+      (($prefix | endswith("/*")) and .prefix == ($prefix | sub("\\\\*$"; "")))
+    ) and
+    (.companyUid | type == "string") and ($company == "" or .companyUid == $company) and
+    (.direct | type == "array") and (.exists | type == "boolean")
+  `;
 function runGrant(args, context) {
     const parsed = parseFlags(args, ["--manifest", "--yes"]);
     if (parsed.help) {
@@ -397,7 +448,12 @@ function runGrant(args, context) {
         try {
             response = JSON.parse(resolved.stdout ?? "");
         }
-        catch {
+        catch (error) {
+            if (error instanceof SyntaxError) {
+                const input = commandSubstitutionBytes(resolved);
+                emitJqParseDiagnostic(input, ["-e", RESOLVE_FOUND_FILTER], context);
+                emitJqParseDiagnostic(input, ["-e", RESOLVE_NOT_FOUND_FILTER], context);
+            }
             response = undefined;
         }
         if (isRecord(response) && response.status === "found" && isRecord(response.person) && typeof response.person.personUid === "string" && typeof response.person.companyUid === "string") {
@@ -426,7 +482,11 @@ function runGrant(args, context) {
         try {
             value = JSON.parse(response.stdout ?? "");
         }
-        catch {
+        catch (error) {
+            if (error instanceof SyntaxError) {
+                const input = commandSubstitutionBytes(response);
+                emitJqParseDiagnostic(input, ["-e", "--arg", "prefix", prefix, "--arg", "company", expectedCompany, ACL_FILTER], context);
+            }
             value = undefined;
         }
         const rawPrefix = isRecord(value) ? value.prefix : undefined;
@@ -501,6 +561,22 @@ function runPublish(args, context) {
     if (args[0] !== "--manifest" || !args[1] || !fs.existsSync(args[1]) || !fs.statSync(args[1]).isFile())
         return fail("publish", "usage: --manifest <path>");
     const manifestPath = args[1];
+    if (malformedJsonFile(manifestPath))
+        return runShellFallback("publish", args, context);
+    let preflightManifest;
+    try {
+        preflightManifest = readJsonFile(manifestPath);
+    }
+    catch {
+        preflightManifest = undefined;
+    }
+    if (isRecord(preflightManifest) && jqRawPath(preflightManifest, "mode") === "transfer") {
+        const root = context.root ?? context.cwd;
+        const prd = path.join(root, "companies", jqRawPath(preflightManifest, "company"), "projects", jqRawPath(preflightManifest, "project.name"), "prd.json");
+        if (fs.existsSync(prd) && fs.statSync(prd).isFile() && malformedJsonFile(prd)) {
+            return runShellFallback("publish", args, context);
+        }
+    }
     const lock = `${manifestPath}.send-lock`;
     const lockHeld = args[2] === "--lock-held";
     let ownLock = false;
@@ -658,6 +734,12 @@ function runSend(args, context) {
     const manifest = jsonFile(manifestPath);
     if (!manifest)
         return fail("send", `manifest is not valid JSON: ${manifestPath}`);
+    if (send) {
+        const publishedPath = path.join(context.root ?? context.cwd, jqRawPath(manifest, "publication.manifestPath"));
+        if (fs.existsSync(publishedPath) && fs.statSync(publishedPath).isFile() && malformedJsonFile(publishedPath)) {
+            return runShellFallback("send", args, context);
+        }
+    }
     const lock = `${manifestPath}.send-lock`;
     if (send) {
         try {
@@ -819,14 +901,14 @@ function sleepNative(milliseconds) {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
 }
 function captureRun(run) {
-    let stdout = "";
-    let stderr = "";
+    const stdout = [];
+    const stderr = [];
     const stdoutWrite = process.stdout.write.bind(process.stdout);
     const stderrWrite = process.stderr.write.bind(process.stderr);
-    process.stdout.write = ((chunk) => { stdout += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"); return true; });
-    process.stderr.write = ((chunk) => { stderr += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"); return true; });
+    process.stdout.write = ((chunk) => { stdout.push(typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk)); return true; });
+    process.stderr.write = ((chunk) => { stderr.push(typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk)); return true; });
     try {
-        return { code: run(), stdout, stderr };
+        return { code: run(), stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };
     }
     finally {
         process.stdout.write = stdoutWrite;
@@ -854,16 +936,29 @@ function runVerify(args, context) {
             return fail("verify", "--dry-run requires --project");
         if (!recipient)
             return fail("verify", "--dry-run requires --to");
-        const plan = captureRun(() => runBundle(["build", "--company", company, "--project", project, "--to", recipient, "--mode", mode, "--dry-run"], context));
-        if (plan.stderr)
+        let malformedWhoamiFallbackCode;
+        const plan = captureRun(() => runBundle(["build", "--company", company, "--project", project, "--to", recipient, "--mode", mode, "--dry-run"], context, () => {
+            malformedWhoamiFallbackCode = runShellFallback("verify", args, context);
+            return malformedWhoamiFallbackCode;
+        }));
+        if (malformedWhoamiFallbackCode !== undefined) {
+            if (plan.stdout.length)
+                out(plan.stdout);
+            if (plan.stderr.length)
+                err(plan.stderr);
+            return malformedWhoamiFallbackCode;
+        }
+        if (plan.stderr.length)
             err(plan.stderr);
         if (plan.code !== 0)
             return fail("verify", "could not derive the delegation plan (see builder error above)");
         let manifest;
         try {
-            manifest = JSON.parse(plan.stdout);
+            manifest = JSON.parse(plan.stdout.toString("utf8"));
         }
-        catch {
+        catch (error) {
+            if (error instanceof SyntaxError)
+                return runShellFallback("verify", args, context);
             return fail("verify", "could not derive the delegation plan (see builder error above)");
         }
         const repoRelative = jqRawPath(manifest, "repo.path");
@@ -893,6 +988,8 @@ function runVerify(args, context) {
         return fail("verify", "--manifest is required (or --dry-run with --company/--project/--to)");
     if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile())
         return fail("verify", `manifest not found: ${manifestPath}`);
+    if (malformedJsonFile(manifestPath))
+        return runShellFallback("verify", args, context);
     const manifest = jsonFile(manifestPath);
     if (!manifest)
         return fail("verify", `jq: error: ${manifestPath}: Invalid JSON`);

package/dist/commands/core-delegate.d.ts

@@ -9,12 +9,21 @@ type CommandResult = {
     code: number;
     stdout?: string;
     stderr?: string;
+    stdoutBytes?: Buffer;
+    stderrBytes?: Buffer;
 };
+export type CommandExistsOptions = {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    existsSync?: (candidate: string) => boolean;
+};
+export declare function commandExists(name: string, cwd?: string, options?: CommandExistsOptions): boolean;
 export declare function subprocess(command: string, args: string[], cwd: string, options?: {
     input?: Buffer | string;
     stdinFd?: number;
     stderr?: "inherit" | "ignore" | "pipe";
     stdout?: "capture" | "inherit" | "ignore";
+    maxBuffer?: number;
 }): CommandResult;
 type JsonRecord = Record<string, unknown>;
 export declare function isRecord(value: unknown): value is JsonRecord;

package/dist/commands/core-delegate.js

@@ -4,6 +4,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { serializeJqJson } from "../lib/core-utils/jq-json-serializer.js";
+import { resolveWindowsExecutable } from "../lib/bot/runtime/windows.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
@@ -28,6 +29,20 @@ function writeOut(value) {
 function writeErr(value) {
     process.stderr.write(value);
 }
+function runCapturedShell(asset, args, context) {
+    const result = runBundledScript({
+        asset,
+        args,
+        cwd: context.cwd,
+        ...(context.root ? { hqRoot: context.root } : {}),
+        captureOutput: true,
+    });
+    if (result.stdout?.length)
+        process.stdout.write(result.stdout);
+    if (result.stderr?.length)
+        process.stderr.write(result.stderr);
+    return result.code;
+}
 const USAGE_TEXT = {
     resolve: "hq-delegate-resolve.sh — resolve a delegation recipient to a confirmed\nprincipal (person email / prs_ uid, or fleet-agent agt_ uid). Read-only.\n\nUsage:\n  core/scripts/hq-delegate-resolve.sh --company <slug> --to <token>\n\nOutput (stdout, JSON): {kind, principal, displayName, source}\n  kind      — \"person\" | \"agent\"\n  principal — confirmed email, prs_… or agt_… uid\n  source    — \"verbatim\" | \"people-resolve\" | \"agents-list\"\n\nExit codes:\n  0 — resolved\n  1 — usage error (missing/invalid arguments)\n  3 — ambiguous: candidate list printed to stdout as JSON\n      {status:\"ambiguous\", matches:[…]} — caller must present a picker\n  4 — not found (or found with no email): plain message on stderr\n\nTenancy: every lookup is scoped with an explicit --company. This helper\nnever enumerates or falls back across companies — single-company by\nconstruction, matching the /dm skill's resolution contract.\n\nFast path: a token containing \"@\" or starting with prs_ / agt_ passes\nthrough verbatim with NO lookup, preserving existing invocations exactly.\n",
     // Preserve the companion usage function’s historical raw source lines.
@@ -39,8 +54,20 @@ const USAGE_TEXT = {
 function usage(name) {
     return USAGE_TEXT[name];
 }
-function commandPath(name, cwd = process.cwd()) {
-    const directories = (process.env.PATH ?? "").split(path.delimiter);
+function commandPath(name, cwd = process.cwd(), options = {}) {
+    const env = options.env ?? process.env;
+    if ((options.platform ?? process.platform) === "win32") {
+        const existsSync = options.existsSync ?? ((candidate) => {
+            try {
+                return fs.statSync(candidate).isFile();
+            }
+            catch {
+                return false;
+            }
+        });
+        return resolveWindowsExecutable(name, env, existsSync, cwd) ?? undefined;
+    }
+    const directories = (env.PATH ?? "").split(path.delimiter);
     for (const directory of directories) {
         const candidate = path.resolve(cwd, directory || ".", name);
         try {
@@ -56,24 +83,30 @@ function commandPath(name, cwd = process.cwd()) {
     }
     return undefined;
 }
-function commandExists(name, cwd = process.cwd()) {
-    return commandPath(name, cwd) !== undefined;
+export function commandExists(name, cwd = process.cwd(), options = {}) {
+    return commandPath(name, cwd, options) !== undefined;
 }
 export function subprocess(command, args, cwd, options = {}) {
     const result = spawnSync(command, args, {
         cwd,
         env: process.env,
         input: options.input,
-        encoding: "utf8",
-        stdio: [options.stdinFd ?? "inherit", options.stdout === "inherit" ? "inherit" : options.stdout === "ignore" ? "ignore" : "pipe", options.stderr === "pipe" ? "pipe" : options.stderr ?? "inherit"],
+        maxBuffer: options.maxBuffer,
+        encoding: "buffer",
+        stdio: [options.input === undefined ? options.stdinFd ?? "inherit" : "pipe", options.stdout === "inherit" ? "inherit" : options.stdout === "ignore" ? "ignore" : "pipe", options.stderr === "pipe" ? "pipe" : options.stderr ?? "inherit"],
     });
     if (result.error) {
-        return { code: 127, stderr: result.error.message, stdout: "" };
+        const stderr = Buffer.from(result.error.message);
+        return { code: 127, stderr: stderr.toString("utf8"), stderrBytes: stderr, stdout: "", stdoutBytes: Buffer.alloc(0) };
     }
+    const stdoutBytes = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.alloc(0);
+    const stderrBytes = Buffer.isBuffer(result.stderr) ? result.stderr : Buffer.alloc(0);
     return {
         code: result.status ?? (result.signal ? 128 : 1),
-        stdout: typeof result.stdout === "string" ? result.stdout : "",
-        stderr: typeof result.stderr === "string" ? result.stderr : "",
+        stdout: stdoutBytes.toString("utf8"),
+        stderr: stderrBytes.toString("utf8"),
+        stdoutBytes,
+        stderrBytes,
     };
 }
 export function isRecord(value) {
@@ -82,15 +115,6 @@ export function isRecord(value) {
 export function readJsonText(text) {
     return JSON.parse(text);
 }
-function jqParseDiagnostic(text) {
-    const bareToken = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*$/.exec(text);
-    if (bareToken && !["null", "true", "false"].includes(bareToken[1] ?? "")) {
-        const line = text.split("\n").length;
-        const column = Buffer.byteLength(text.slice(text.lastIndexOf("\n") + 1));
-        return `jq: parse error: Invalid numeric literal at line ${line}, column ${column}\n`;
-    }
-    return "jq: parse error: Invalid JSON text\n";
-}
 export function readJsonFile(file) {
     return readJsonText(fs.readFileSync(file, "utf8"));
 }
@@ -373,11 +397,8 @@ function runPickup(args, context) {
         document = readJsonFile(file);
     }
     catch (error) {
-        if (error instanceof SyntaxError) {
-            const diagnostic = jqParseDiagnostic(fs.readFileSync(file, "utf8"));
-            for (let index = 0; index < 4; index += 1)
-                writeErr(diagnostic);
-        }
+        if (error instanceof SyntaxError)
+            return runCapturedShell(SCRIPT_ASSETS.pickup, args, context);
         document = {};
     }
     const status = jqRawPath(document, "status");

package/dist/commands/integrations-core.d.ts

@@ -272,6 +272,8 @@ interface QueuedOutcome {
 }
 export declare function queuedOutcome(payload: unknown): QueuedOutcome | null;
 export declare function printJson(value: unknown): void;
+/** Print the successful payload from `hq integrations call` without altering URLs. */
+export declare function printIntegrationCallResultJson(value: unknown): void;
 /**
  * Print why a connection is unusable and how to repair it, directly beneath its
  * status line.

package/dist/commands/integrations-core.js

@@ -485,6 +485,10 @@ export function queuedOutcome(payload) {
 export function printJson(value) {
     console.log(JSON.stringify(redactSensitiveUrls(value), null, 2));
 }
+/** Print the successful payload from `hq integrations call` without altering URLs. */
+export function printIntegrationCallResultJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
 /**
  * Print why a connection is unusable and how to repair it, directly beneath its
  * status line.

package/dist/commands/integrations.js

@@ -54,7 +54,7 @@ import chalk from "chalk";
 import { ensureCognitoIdToken } from "../utils/cognito-session.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
-import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printHealthNotice, printJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
+import { IntegrationsCliError, bareProvider, callGateway, fetchConnections, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, } from "./integrations-core.js";
 import { registerConnectCommands } from "./integrations-connect.js";
 import { registerImportCommands } from "./integrations-import.js";
 import { registerManageCommands } from "./integrations-manage.js";
@@ -367,7 +367,7 @@ export function registerIntegrationsCommand(program) {
         // parsing output. The gateway double-wraps the provider result as a
         // text-content string, so `isError` lands on the UNWRAPPED payload, not
         // on the raw envelope; check both levels so either shape is caught.
-        printJson(payload);
+        printIntegrationCallResultJson(payload);
         if (gatewayResultIsError(payload) || gatewayResultIsError(message.result)) {
             process.exitCode = 1;
         }

package/dist/commands/lanes-message.js

@@ -448,6 +448,11 @@ export function createLaneMessageHandlers(deps) {
                     text: promptedText,
                 });
             const deliveryText = framedMonitorEvent ?? promptedText;
+            const messageHistoryTrigger = opts.monitorEvent !== undefined
+                ? "monitor_event"
+                : opts.messageSource ?? "message";
+            const isMonitorEvent = messageHistoryTrigger === "monitor_event";
+            const isSystemNotice = messageHistoryTrigger === "system_notice";
             const dropboxMessage = {
                 at,
                 message_id: messageId,
@@ -562,9 +567,9 @@ export function createLaneMessageHandlers(deps) {
                     ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                     ...(hireGrantContext !== undefined ? { grantContext: hireGrantContext } : {}),
                     pending: {
-                        trigger: "message",
+                        trigger: messageHistoryTrigger,
                         text: deliveryText,
-                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                        ...(isMonitorEvent ? { monitor_event: true } : {}),
                         message_id: messageId,
                         compact: opts.compact !== false,
                     },
@@ -589,9 +594,9 @@ export function createLaneMessageHandlers(deps) {
                             ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                             ...(hireGrantContext !== undefined ? { grantContext: hireGrantContext } : {}),
                             pending: {
-                                trigger: "message",
+                                trigger: messageHistoryTrigger,
                                 text: deliveryText,
-                                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                ...(isMonitorEvent ? { monitor_event: true } : {}),
                                 message_id: messageId,
                                 compact: opts.compact !== false,
                             },
@@ -674,10 +679,10 @@ export function createLaneMessageHandlers(deps) {
                                             queued_at: at,
                                             pending_resume: {
                                                 session_id: sessionId,
-                                                trigger: "message",
+                                                trigger: messageHistoryTrigger,
                                                 caller: ctx.env.HQ_LANE_ID?.trim() || "user",
                                                 text: deliveryText,
-                                                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                                ...(isMonitorEvent ? { monitor_event: true } : {}),
                                                 message_id: messageId,
                                                 compact: opts.compact !== false,
                                                 at,
@@ -708,7 +713,8 @@ export function createLaneMessageHandlers(deps) {
                                         kind: "message",
                                         text: deliveryText,
                                         message_id: messageId,
-                                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                        ...(isMonitorEvent ? { monitor_event: true } : {}),
+                                        ...(isSystemNotice ? { system_notice: true } : {}),
                                     },
                                     compact: opts.compact !== false,
                                     effort: resumeEffort ?? recordedResumeEffort(lane),
@@ -868,6 +874,11 @@ export function createLaneMessageHandlers(deps) {
         try {
             await runMessage(ctx, laneId, {
                 text: formatDropboxMessages(messages),
+                messageSource: messages.some((message) => message.kind === "monitor_event")
+                    ? "monitor_event"
+                    : messages.some((message) => message.kind === "system_notice")
+                        ? "system_notice"
+                        : undefined,
                 compact: false,
                 silent: true,
                 onAccepted: () => { accepted = true; },

package/dist/commands/lanes-shared.d.ts

@@ -52,6 +52,8 @@ export interface LaneMessageOptions {
         description: string;
         sequence: number;
     };
+    /** Source kind for a message recovered from the lane dropbox. */
+    messageSource?: "monitor_event" | "system_notice";
     /** Internal recovery messages do not emit a second command response. */
     silent?: boolean;
     /** Internal recovery claim is safe to archive once this callback runs. */

package/dist/commands/lanes-watch.js

@@ -1,5 +1,5 @@
 import { accountStatus, coveredLaneIds, loadLanesConfig, MAX_WATCHED_LANES, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, monitorReminderText, runLaneWatch, } from "../lib/lanes/index.js";
-import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG } from "../lib/lanes/keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_FLAG } from "../lib/lanes/keep-alive.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { isLanesError, LanesError } from "../lib/lanes/errors.js";
@@ -50,10 +50,6 @@ export function createLaneWatchHandlers(deps) {
                 company: resolveLaneCompany(hqRoot, lane).company ?? undefined,
                 env: ctx.env,
             }),
-            keepAliveNextCheckAtEnabled: (lane) => readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, {
-                company: resolveLaneCompany(hqRoot, lane).company ?? undefined,
-                env: ctx.env,
-            }),
             readAccountStatuses: async (lanes) => {
                 if (lanes.length === 0)
                     return [];

package/dist/commands/lanes.js

@@ -61,7 +61,7 @@ import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STA
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
-import { doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
+import { doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
 import { questionBodyAbsPath, resolveQuestionCompanyWithFallback, resolveProjectQuestionCompany, } from "../lib/lanes/questions.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -5159,17 +5159,11 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
     const keepAliveState = resolveLaneKeepAlive(hqRoot, storedLane);
     const keepAliveCompany = resolveLaneCompany(hqRoot, storedLane);
     const now = ctx.now().getTime();
-    const nextCheckAtEnabled = storedLane.state === "done" && storedLane.keep_alive === true
-        ? await readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, {
-            company: keepAliveCompany.company ?? undefined,
-            env: ctx.env,
-        })
-        : false;
-    const hasPendingWork = storedLane.keep_alive_standing === true || nextCheckAtEnabled
+    const hasPendingWork = storedLane.state === "done" && storedLane.keep_alive === true
         ? hasPendingKeepAliveWork(hqRoot, storedLane)
         : false;
     const doneStateVerdict = storedLane.state === "done" && storedLane.keep_alive === true
-        ? doneKeepAliveVerdict(storedLane, { decision: storedLane.last_envelope?.decision, story_complete: storedLane.story_complete, next_check_at: storedLane.last_envelope?.next_check_at }, storedLane.keep_alive_standing === true && hasPendingWork, { nextCheckAtEnabled, hasPendingWork, nowMs: now })
+        ? doneKeepAliveVerdict(storedLane, { decision: storedLane.last_envelope?.decision, story_complete: storedLane.story_complete, next_check_at: storedLane.last_envelope?.next_check_at }, storedLane.keep_alive_standing === true && hasPendingWork, { hasPendingWork, nowMs: now })
         : null;
     let managerStatusTarget;
     let managerStatusGateError;
@@ -5191,7 +5185,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
         now: ctx.now().getTime(),
     });
     const laneIsSenior = allLanes.some((item) => item.senior.kind === "lane" && item.senior.id === laneId);
-    const requestedNextCheckMs = nextCheckAtEnabled && !hasPendingWork
+    const requestedNextCheckMs = storedLane.state === "done" && storedLane.keep_alive === true && !hasPendingWork
         ? keepAliveNextCheckAtMs(storedLane.last_envelope?.next_check_at, now, Date.parse(storedLane.last_envelope?.at ?? storedLane.updated_at))
         : undefined;
     const storedNextEligibleMs = Date.parse(storedLane.keep_alive_next_eligible_at ?? "");

package/dist/fast-scaffold.d.ts

@@ -16,6 +16,8 @@ export type FastScaffoldScript = {
     /** Path under `assets/scaffold/`, e.g. `core/scripts/foo.sh`. */
     asset: string;
     root?: "live";
+    /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
+    requiresNodeNetworkCompatibility?: boolean;
 } | {
     /** Command path, joined with spaces, e.g. `policy frontmatter`. */
     name: string;
@@ -38,6 +40,8 @@ export type FastScaffoldScript = {
     shellHqRoot?: "none" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
+    /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
+    requiresNodeNetworkCompatibility?: boolean;
 };
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];

package/dist/fast-scaffold.js

@@ -115,6 +115,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/worktree-gc.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -127,6 +128,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/clean-worktree-reconcile-handoff.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "cwd",
         shellCwd: "caller",
         shellHqRoot: "none",
@@ -139,6 +141,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/resume-thread-lock.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -151,6 +154,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/verify-story-deliverables.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -163,6 +167,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-jobs",
         asset: `core/scripts/${name === "reconcile" ? "outpost-jobs-reconcile" : `jobs-${name}`}.sh`,
+        requiresNodeNetworkCompatibility: true,
         root: name === "reconcile" ? "passthrough" : "cwd",
         shellCwd: "caller",
         shellHqRoot: name === "reconcile" ? "reconcile-default" : "none",

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import "./node-preflight.js";
-import "./node-network-compat.js";
+import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
 export declare const __test__: {

package/dist/index.js

@@ -2,7 +2,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "./node-preflight.js";
-import "./node-network-compat.js";
+import "./node-network-compat-fast.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.

package/dist/lib/bot/runtime/windows.d.ts

@@ -1,5 +1,7 @@
 import { type SpawnPlan } from "../../../utils/windows-spawn.js";
 type ExistsSync = (candidate: string) => boolean;
+/** Resolve an npm-installed provider command using Windows PATH and PATHEXT. */
+export declare function resolveWindowsExecutable(name: string, env: NodeJS.ProcessEnv, existsSync?: ExistsSync, cwd?: string): string | null;
 /** Preserve non-Windows lookup. Windows returns the first PATH/PATHEXT match. */
 export declare function resolveRuntimeBinary(name: string, env: NodeJS.ProcessEnv, platform?: NodeJS.Platform, existsSync?: ExistsSync, cwd?: string): string;
 /** Directly spawn native files; pass only batch shims through cmd.exe. */