@indigoai-us/hq-cli 5.311.1 → 5.311.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.311.3] — 2026-10-01
+- Match company file access checks against the company-anchored paths printed by `hq files browse`.
+- Record a placement resolved to the current host as local so the lane starts without dispatching back through Outpost pickup.
+
+## [5.311.2] — 2026-10-01
+- Reduce fast-path startup work by loading network compatibility only on routes that need it.
+- Make envelope `next_check_at` an unconditional keep-alive hold and remove its completed rollout flag.
+- Lead autopilot no longer asks a lead to review its own lane as a finished worker, or to relaunch a worker for a story assigned to the lead itself.
+- Lead autopilot counts a story's current `lane` together with its `lanes` history, so `lanes: []` no longer hides the assigned lane.
+- Keep the CLI company seed fixture byte-matched to the hq-core starter golden, including the session sentinel ignore rule.
+- Record lane-watcher continuations as `watcher` resumes and label their prompt source accurately; record monitor-event and system-notice message sources distinctly in lane resume history.
+
 ## [5.311.1] — 2026-10-01
 - Preserve shell-compatible diagnostics when delegate pickup receives a malformed manifest.
 - Print URLs returned by `hq integrations call` without redacting their paths or query values. Other integration JSON output keeps its existing URL redaction.

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -60,13 +60,31 @@ STATUS="$(jq -r '.status // empty' "$MANIFEST")"
 
 # File-ACL principals must be an email, grp_<id>, or @all — an agentUid is
 # NOT accepted by `hq files share`. For agent recipients, grants flow through
-# a deterministic per-agent delegation group (the /new-agent pattern):
-# grp_dlg-<uid tail>, containing exactly that agent.
+# a deterministic per-agent delegation group keyed by the full UID digest:
+# grp_dlg<first 32 SHA-256 hex characters>, containing exactly that agent.
+agent_group_id() {
+  local principal="$1" digest
+  if command -v sha256sum >/dev/null 2>&1; then
+    digest="$(printf '%s' "$principal" | sha256sum)"
+  elif command -v shasum >/dev/null 2>&1; then
+    digest="$(printf '%s' "$principal" | shasum -a 256)"
+  else
+    die "sha256 utility is required for agent delegation groups"
+  fi
+  printf 'grp_dlg%.32s' "$digest"
+}
+
 GRANT_PRINCIPAL="$PRINCIPAL"
 case "$PRINCIPAL" in
   agt_*)
     TAIL="$(printf '%s' "$PRINCIPAL" | tail -c 9 | tr '[:upper:]' '[:lower:]')"
-    GRANT_PRINCIPAL="grp_dlg-$TAIL"
+    LEGACY_GROUP="grp_dlg-$TAIL"
+    NEXT_GROUP="$(agent_group_id "$PRINCIPAL")"
+    RECORDED_GROUP="$(jq -r '.grantPrincipal // empty' "$MANIFEST")"
+    case "$RECORDED_GROUP" in
+      "$LEGACY_GROUP"|"$NEXT_GROUP") GRANT_PRINCIPAL="$RECORDED_GROUP" ;;
+      *) GRANT_PRINCIPAL="$NEXT_GROUP" ;;
+    esac
     ;;
 esac
 
@@ -133,12 +151,20 @@ done
 # --- 1b. agent recipients: ensure the delegation group exists + contains them
 
 if [ "$GRANT_PRINCIPAL" != "$PRINCIPAL" ]; then
-  # Both calls are idempotent-tolerated: an existing group / existing member
-  # is fine — the ACL read-back below is the arbiter of success.
+  # Group creation and add are idempotent-tolerated; confirm that the complete
+  # member list is exactly this agent before any file ACL is shared.
   hq groups create "$GRANT_PRINCIPAL" --name "Delegation: $DISPLAY" --company "$COMPANY" \
     || echo "hq-delegate-grant: group create reported an error (may already exist) — continuing" >&2
   hq groups add "$GRANT_PRINCIPAL" "$PRINCIPAL" --company "$COMPANY" \
     || echo "hq-delegate-grant: group add reported an error (may already be a member) — continuing" >&2
+  GROUP_MEMBERS="$(NO_COLOR=1 FORCE_COLOR=0 hq groups members "$GRANT_PRINCIPAL" --company "$COMPANY")" \
+    || die "could not verify delegation group membership"
+  MEMBER_IDS="$(printf '%s\n' "$GROUP_MEMBERS" | awk '
+    { gsub(/\033\[[0-9;]*m/, "", $0) }
+    /^PERSON_UID([[:space:]]|$)/ { collecting = 1; next }
+    collecting && NF { print $1 }
+  ')"
+  [ "$MEMBER_IDS" = "$PRINCIPAL" ] || die "delegation group membership does not exactly match recipient"
 fi
 
 # --- 2+3. exact structured read-back; never infer identity from a new row ---

package/assets/scaffold/core/scripts/hq-delegate-send.sh

@@ -93,7 +93,7 @@ if [ -f "$PRD_ABS" ] && jq -e . "$PRD_ABS" >/dev/null 2>&1; then
 fi
 
 GET_LINES="$(jq -r --arg co "$COMPANY" \
-  '.vaultPrefixes[] | "hq files get \(.prefix) --company \($co)"' "$MANIFEST")"
+  'def bashq: if test("^[A-Za-z0-9_./:@+-]+$") then . else @sh end; .vaultPrefixes[] | "hq files get \(.prefix | bashq) --company \($co | bashq)"' "$MANIFEST")"
 
 REPO_IS_NULL="$(jq -r 'if .repo == null then "yes" else "no" end' "$MANIFEST")"
 REPO_SECTION=""

package/assets/scaffold/core/scripts/hq-delegate-verify.sh

@@ -135,7 +135,7 @@ while [ "$i" -lt "$PREFIX_COUNT" ]; do
   if [ "$BROWSE_RC" -ne 0 ]; then
     echo "  FAIL  $PFX — browse errored (likely cause: the grant did not land, or the caller's session expired — re-run /hq-login and hq-delegate-grant.sh)"
     FAILED=1
-  elif [ -z "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" ]; then
+  elif [ -z "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" ] || [ "$(printf '%s' "$BROWSE_OUT" | tr -d '[:space:]')" = "Noobjectsunderthatprefix." ]; then
     echo "  FAIL  $PFX — reachable but EMPTY (likely cause: the dossier was never pushed to the vault — hq sync push companies/$COMPANY/... and re-run)"
     FAILED=1
   else
@@ -156,6 +156,31 @@ done
 # Browse each distinct parent at most once, and retry an empty result a few
 # times before trusting it. (Cache dir cleaned on exit.)
 REF_BROWSE_CACHE="$(mktemp -d)"
+listing_has_exact_key() {
+  local listing="$1" expected="$2"
+  printf '%s\n' "$listing" | awk -v expected="$expected" '
+    function exact_key(row, expected, modified, size) {
+      gsub(/\033\[[0-9;]*m/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      if (row !~ / +(shared-with-you|creator access — creator-only|role-bypass|personal-vault|private folder — children are creator-only)$/) return 0
+      sub(/ +(shared-with-you|creator access — creator-only|role-bypass|personal-vault|private folder — children are creator-only)$/, "", row)
+      modified = row
+      sub(/^.* +/, "", modified)
+      if (modified != "—" && modified !~ /^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]\.[0-9][0-9][0-9]Z$/) return 0
+      sub(/ +[^[:space:]]+$/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      size = row
+      sub(/^.* +/, "", size)
+      if (size !~ /^[0-9]+$/) return 0
+      sub(/ +[0-9]+$/, "", row)
+      sub(/[[:space:]]+$/, "", row)
+      return row == expected
+    }
+    NR > 2 && exact_key($0, expected) { found = 1 }
+    END { exit found ? 0 : 1 }
+  '
+}
+
 browse_parent() { # parent -> listing (memoized per run, retried on empty)
   local parent="$1" key out attempt
   key="$REF_BROWSE_CACHE/$(printf '%s' "$parent" | tr '/@:' '___')"
@@ -187,7 +212,7 @@ if [ "$REF_COUNT" -gt 0 ]; then
     # early match, which under `set -o pipefail` surfaces printf's SIGPIPE as a
     # non-zero pipeline and FALSE-FAILS a file that is genuinely present (it bit
     # exactly the referenced files that sort early in a large parent listing).
-    if [[ "$LISTING" == *"$BASE"* ]]; then
+    if listing_has_exact_key "$LISTING" "$kpath"; then
       echo "  pass  $REL"
     else
       echo "  FAIL  $REL — granted prefix is reachable but this referenced file is NOT in the vault (likely cause: it was never pushed — hq sync push $kpath --company $COMPANY and re-run)"

package/dist/commands/core-delegate-w1b.js

@@ -8,6 +8,7 @@ import { matchingSecretPatterns } from "../lib/core-utils/secret-patterns.js";
 import { describeCoreCommand } from "./core-command-catalog.js";
 import { commandExists, isRecord, jsonAt, jqFallback, jqRawPath, jqRawPaths, moveFile, readJsonFile, subprocess, writeJsonAtomically, } from "./core-delegate.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { ACL_SOURCE_DISPLAY_LABELS } from "../utils/files-browse-acl.js";
 import { runBundledScript } from "../utils/run-bundled-script.js";
 const FLAG = "core-native-delegate";
 const ASSETS = {
@@ -113,6 +114,42 @@ function quoteBash(value) {
         return value;
     return `'${value.replaceAll("'", `'\\''`)}'`;
 }
+function delegationGroupId(principal) {
+    return "grp_dlg" + createHash("sha256").update(principal).digest("hex").slice(0, 32);
+}
+function stripAnsiSequences(value) {
+    const escape = String.fromCharCode(27);
+    return value.replace(new RegExp(`${escape}\\[[0-?]*[ -/]*[@-~]`, "g"), "");
+}
+function groupMemberIds(output) {
+    const plainOutput = stripAnsiSequences(output);
+    const lines = plainOutput.split(/\r?\n/);
+    const header = lines.findIndex((line) => /^PERSON_UID(?:\s|$)/.test(line.trimStart()));
+    if (header < 0)
+        return null;
+    return lines.slice(header + 1).filter((line) => line.trim() !== "")
+        .map((line) => line.trim().split(/\s{2,}/, 1)[0] ?? "");
+}
+function browseContainsExactKey(listing, expected) {
+    const lines = listing.split(/\r?\n/);
+    const aclLabels = Object.values(ACL_SOURCE_DISPLAY_LABELS);
+    return lines.slice(2).some((line) => {
+        const row = stripAnsiSequences(line).trimEnd();
+        const acl = aclLabels.find((label) => row.endsWith(label));
+        if (!acl)
+            return false;
+        const beforeAcl = row.slice(0, -acl.length).trimEnd();
+        const modifiedMatch = /^(.*) +(\S+)$/.exec(beforeAcl);
+        if (!modifiedMatch)
+            return false;
+        const modified = modifiedMatch[2] ?? "";
+        if (modified !== "—" && !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(modified))
+            return false;
+        const beforeModified = (modifiedMatch[1] ?? "").trimEnd();
+        const sizeMatch = /^(.*) +(\d+)$/.exec(beforeModified);
+        return (sizeMatch?.[1] ?? "").trimEnd() === expected;
+    });
+}
 function parseFlags(args, allowed) {
     const values = {};
     for (let i = 0; i < args.length;) {
@@ -379,8 +416,12 @@ function runGrant(args, context) {
     if (!principal)
         return fail("grant", "manifest has no to.principal");
     let grantPrincipal = principal;
-    if (principal.startsWith("agt_"))
-        grantPrincipal = `grp_dlg-${principal.slice(-9).toLowerCase()}`;
+    if (principal.startsWith("agt_")) {
+        const legacyGroup = "grp_dlg-" + principal.slice(-9).toLowerCase();
+        const nextGroup = delegationGroupId(principal);
+        const recordedGroup = text(getPath(manifest, "grantPrincipal"));
+        grantPrincipal = recordedGroup === legacyGroup || recordedGroup === nextGroup ? recordedGroup : nextGroup;
+    }
     if (status !== "building" && status !== "granted")
         return fail("grant", `manifest status is '${status}' — grants run from 'building' (or re-run from 'granted'), not from there`);
     const prefixes = list(getPath(manifest, "vaultPrefixes"));
@@ -431,6 +472,13 @@ function runGrant(args, context) {
         result = runHq(["groups", "add", grantPrincipal, principal, "--company", company], context, "inherit");
         if (result.code !== 0)
             err("hq-delegate-grant: group add reported an error (may already be a member) — continuing\n");
+        const members = subprocess("hq", ["groups", "members", grantPrincipal, "--company", company], context.cwd, { env: { NO_COLOR: "1", FORCE_COLOR: "0" } });
+        if (members.code !== 0)
+            return fail("grant", "could not verify delegation group membership");
+        const memberIds = groupMemberIds(members.stdout ?? "");
+        if (memberIds === null || memberIds.length !== 1 || memberIds[0] !== principal) {
+            return fail("grant", "delegation group membership does not exactly match recipient");
+        }
     }
     let expectedType = "";
     let expectedId = "";
@@ -794,7 +842,7 @@ function runSend(args, context) {
                 .map((entry, index) => `${index + 1}. **${text(getPath(entry, "id"))}: ${text(getPath(entry, "title"))}** — ${text(getPath(entry, "description"))}`)
                 .join("\n");
         }
-        const getLines = list(getPath(manifest, "vaultPrefixes", [])).map((entry) => `hq files get ${jqRawPath(entry, "prefix")} --company ${company}`).join("\n");
+        const getLines = list(getPath(manifest, "vaultPrefixes", [])).map((entry) => "hq files get " + quoteBash(jqRawPath(entry, "prefix")) + " --company " + quoteBash(company)).join("\n");
         let repoSection = "";
         const repoValue = getPath(manifest, "repo");
         if (repoValue !== null && repoValue !== undefined) {
@@ -824,7 +872,7 @@ function runSend(args, context) {
             body += `## The goal\n\n${goal}\n\n`;
         if (stateLine)
             body += `## Where things stand\n\n${stateLine}\n\n`;
-        body += `## Pull the files (on demand — no sync)\n\nRun these from your HQ root; each materializes exactly that path:\n\n\`\`\`bash\n${getLines}\n\`\`\`\n\nStart with the project dossier: \`companies/${company}/projects/${project}/\` now contains the PRD (\`prd.json\`), a full brief (\`README.md\` / the DM's details pane), and the delegation journal.\n\n`;
+        body += `## Pull the files (on demand — no sync)\n\nRun these from your HQ root; each materializes exactly that path locally:\n\n\`\`\`bash\n${getLines}\n\`\`\`\n\nStart with the project dossier: \`companies/${company}/projects/${project}/\` now contains the PRD (\`prd.json\`), a full brief (\`README.md\` / the DM's details pane), and the delegation journal.\n\n`;
         if (repoSection)
             body += `${repoSection}\n\n`;
         if (secretsSection)
@@ -1024,7 +1072,7 @@ function runVerify(args, context) {
                 out(`  FAIL  ${prefix} — browse errored (likely cause: the grant did not land, or the caller's session expired — re-run /hq-login and hq-delegate-grant.sh)\n`);
                 failed = true;
             }
-            else if (!combined.replace(/\s/g, "")) {
+            else if (!combined.replace(/\s/g, "") || combined.replace(/\s/g, "") === "Noobjectsunderthatprefix.") {
                 out(`  FAIL  ${prefix} — reachable but EMPTY (likely cause: the dossier was never pushed to the vault — hq sync push companies/${company}/... and re-run)\n`);
                 failed = true;
             }
@@ -1059,9 +1107,8 @@ function runVerify(args, context) {
                 const relative = reference.slice(`companies/${company}/`.length);
                 const separator = relative.lastIndexOf("/");
                 const parent = `${separator < 0 ? "." : relative.slice(0, separator)}/`;
-                const base = separator < 0 ? relative : relative.slice(separator + 1);
                 const listing = browseParent(parent);
-                if (listing.includes(base))
+                if (browseContainsExactKey(listing, reference))
                     out(`  pass  ${relative}\n`);
                 else {
                     out(`  FAIL  ${relative} — granted prefix is reachable but this referenced file is NOT in the vault (likely cause: it was never pushed — hq sync push ${reference} --company ${company} and re-run)\n`);

package/dist/commands/core-delegate.d.ts

@@ -23,6 +23,7 @@ export declare function subprocess(command: string, args: string[], cwd: string,
     stdinFd?: number;
     stderr?: "inherit" | "ignore" | "pipe";
     stdout?: "capture" | "inherit" | "ignore";
+    env?: NodeJS.ProcessEnv;
     maxBuffer?: number;
 }): CommandResult;
 type JsonRecord = Record<string, unknown>;

package/dist/commands/core-delegate.js

@@ -89,7 +89,7 @@ export function commandExists(name, cwd = process.cwd(), options = {}) {
 export function subprocess(command, args, cwd, options = {}) {
     const result = spawnSync(command, args, {
         cwd,
-        env: process.env,
+        env: { ...process.env, ...options.env },
         input: options.input,
         maxBuffer: options.maxBuffer,
         encoding: "buffer",

package/dist/commands/files-browse.d.ts

@@ -36,6 +36,9 @@
 import { Command } from "commander";
 import { ListObjectsV2Command, GetObjectCommand, type ListObjectsV2CommandOutput, type GetObjectCommandOutput } from "@aws-sdk/client-s3";
 import { VaultClient, type ExplicitGrant } from "@indigoai-us/hq-cloud";
+import { type AclSource } from "../utils/files-browse-acl.js";
+export { ACL_SOURCE_DISPLAY_LABELS, displayAclSource } from "../utils/files-browse-acl.js";
+export type { AclSource } from "../utils/files-browse-acl.js";
 /** STS-vended credential set the browse/cat path consumes. */
 export interface BrowseCredentials {
     accessKeyId: string;
@@ -121,7 +124,6 @@ export type CompanyBrowseClientFactory = (input: {
  *   - `private-folder`: this is the private folder row itself. Its children
  *      are creator-only, so it never covers a child key.
  */
-export type AclSource = "shared-with-you" | "creator" | "role-bypass" | "personal-vault" | "private-folder";
 export interface BrowseRow {
     key: string;
     size: number;
@@ -505,5 +507,4 @@ export declare function resolveBrowseSession(): Promise<{
 export declare function registerFilesBrowseCommands(filesCmd: Command, deps?: {
     personalS3Factory?: S3ClientFactory;
 }): void;
-export {};
 //# sourceMappingURL=files-browse.d.ts.map

package/dist/commands/files-browse.js

@@ -42,6 +42,8 @@ import { pipeline } from "node:stream/promises";
 import { S3Client, ListObjectsV2Command, GetObjectCommand, } from "@aws-sdk/client-s3";
 import { VaultClient, } from "@indigoai-us/hq-cloud";
 import { isPrivateFolderPattern } from "./_patterns.js";
+import { displayAclSource, } from "../utils/files-browse-acl.js";
+export { ACL_SOURCE_DISPLAY_LABELS, displayAclSource } from "../utils/files-browse-acl.js";
 import { DEFAULT_HQ_ROOT, DEFAULT_COGNITO, buildVaultConfig, } from "../utils/cognito-session.js";
 import { resolveVaultCredential } from "../utils/resolve-vault-credential.js";
 import { maxLength } from "../utils/table-width.js";
@@ -142,13 +144,6 @@ export function toBrowseGrantPattern(grantPath, slug) {
     const companyRelative = toBucketRelative(grantPath, slug);
     return companyRelative === "*" ? "" : companyRelative;
 }
-function displayAclSource(source) {
-    return source === "private-folder"
-        ? "private folder — children are creator-only"
-        : source === "creator"
-            ? "creator access — creator-only"
-            : source;
-}
 /**
  * Bright-line guard for `--out`: refuse to write any byte beneath
  * `<hqRoot>/companies/`. We do NOT enumerate `companies/manifest.yaml`

package/dist/commands/lanes-message.js

@@ -448,6 +448,11 @@ export function createLaneMessageHandlers(deps) {
                     text: promptedText,
                 });
             const deliveryText = framedMonitorEvent ?? promptedText;
+            const messageHistoryTrigger = opts.monitorEvent !== undefined
+                ? "monitor_event"
+                : opts.messageSource ?? "message";
+            const isMonitorEvent = messageHistoryTrigger === "monitor_event";
+            const isSystemNotice = messageHistoryTrigger === "system_notice";
             const dropboxMessage = {
                 at,
                 message_id: messageId,
@@ -562,9 +567,9 @@ export function createLaneMessageHandlers(deps) {
                     ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                     ...(hireGrantContext !== undefined ? { grantContext: hireGrantContext } : {}),
                     pending: {
-                        trigger: "message",
+                        trigger: messageHistoryTrigger,
                         text: deliveryText,
-                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                        ...(isMonitorEvent ? { monitor_event: true } : {}),
                         message_id: messageId,
                         compact: opts.compact !== false,
                     },
@@ -589,9 +594,9 @@ export function createLaneMessageHandlers(deps) {
                             ...(resumeEffort !== undefined ? { effort: resumeEffort } : {}),
                             ...(hireGrantContext !== undefined ? { grantContext: hireGrantContext } : {}),
                             pending: {
-                                trigger: "message",
+                                trigger: messageHistoryTrigger,
                                 text: deliveryText,
-                                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                ...(isMonitorEvent ? { monitor_event: true } : {}),
                                 message_id: messageId,
                                 compact: opts.compact !== false,
                             },
@@ -674,10 +679,10 @@ export function createLaneMessageHandlers(deps) {
                                             queued_at: at,
                                             pending_resume: {
                                                 session_id: sessionId,
-                                                trigger: "message",
+                                                trigger: messageHistoryTrigger,
                                                 caller: ctx.env.HQ_LANE_ID?.trim() || "user",
                                                 text: deliveryText,
-                                                ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                                ...(isMonitorEvent ? { monitor_event: true } : {}),
                                                 message_id: messageId,
                                                 compact: opts.compact !== false,
                                                 at,
@@ -708,7 +713,8 @@ export function createLaneMessageHandlers(deps) {
                                         kind: "message",
                                         text: deliveryText,
                                         message_id: messageId,
-                                        ...(opts.monitorEvent === undefined ? {} : { monitor_event: true }),
+                                        ...(isMonitorEvent ? { monitor_event: true } : {}),
+                                        ...(isSystemNotice ? { system_notice: true } : {}),
                                     },
                                     compact: opts.compact !== false,
                                     effort: resumeEffort ?? recordedResumeEffort(lane),
@@ -868,6 +874,11 @@ export function createLaneMessageHandlers(deps) {
         try {
             await runMessage(ctx, laneId, {
                 text: formatDropboxMessages(messages),
+                messageSource: messages.some((message) => message.kind === "monitor_event")
+                    ? "monitor_event"
+                    : messages.some((message) => message.kind === "system_notice")
+                        ? "system_notice"
+                        : undefined,
                 compact: false,
                 silent: true,
                 onAccepted: () => { accepted = true; },

package/dist/commands/lanes-shared.d.ts

@@ -52,6 +52,8 @@ export interface LaneMessageOptions {
         description: string;
         sequence: number;
     };
+    /** Source kind for a message recovered from the lane dropbox. */
+    messageSource?: "monitor_event" | "system_notice";
     /** Internal recovery messages do not emit a second command response. */
     silent?: boolean;
     /** Internal recovery claim is safe to archive once this callback runs. */

package/dist/commands/lanes-watch.js

@@ -1,5 +1,5 @@
 import { accountStatus, coveredLaneIds, loadLanesConfig, MAX_WATCHED_LANES, MONITOR_ENGINES, MONITOR_MAX_TIMEOUT_MS, MONITOR_UNCOVERED_EXIT_CODE, monitorReminderText, runLaneWatch, } from "../lib/lanes/index.js";
-import { LEAD_LANE_KEEP_ALIVE_FLAG, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG } from "../lib/lanes/keep-alive.js";
+import { LEAD_LANE_KEEP_ALIVE_FLAG } from "../lib/lanes/keep-alive.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
 import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { isLanesError, LanesError } from "../lib/lanes/errors.js";
@@ -50,10 +50,6 @@ export function createLaneWatchHandlers(deps) {
                 company: resolveLaneCompany(hqRoot, lane).company ?? undefined,
                 env: ctx.env,
             }),
-            keepAliveNextCheckAtEnabled: (lane) => readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, {
-                company: resolveLaneCompany(hqRoot, lane).company ?? undefined,
-                env: ctx.env,
-            }),
             readAccountStatuses: async (lanes) => {
                 if (lanes.length === 0)
                     return [];

package/dist/commands/lanes.js

@@ -61,7 +61,7 @@ import { AccountResolutionError, compareLaneQueueOrder, LANE_PROVIDERS, LANE_STA
 import { laneStories, storyWarning, } from "../lib/lanes/stories.js";
 import { resolveLaneKeepAlive } from "../lib/lanes/profile.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
-import { doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
+import { doneKeepAliveVerdict, hasPendingKeepAliveWork, keepAliveNextCheckAtMs, keepAliveExclusion, LANE_SUPERSESSION_LINEAGE_AWARE_FLAG, loadRetiredLaneIds, } from "../lib/lanes/keep-alive.js";
 import { questionBodyAbsPath, resolveQuestionCompanyWithFallback, resolveProjectQuestionCompany, } from "../lib/lanes/questions.js";
 import { assertQuestionBodySecretSafe } from "../lib/lanes/questions.js";
 import { compactionAfterUsage, } from "../lib/lanes/compaction.js";
@@ -2962,6 +2962,7 @@ async function runCreate(ctx, opts) {
     const config = loadLanesConfig(hqRoot);
     let outpostId = opts.outpost?.trim() || undefined;
     let placementHostOverride;
+    let placementBalanceHostOverride;
     let autoPlacementChoice;
     let autoPlacementSkippedHosts = [];
     let placementMachineIdentity;
@@ -3013,12 +3014,14 @@ async function runCreate(ctx, opts) {
     if (placementToApply !== undefined) {
         const currentHost = laneHostFromCtx(ctx);
         if (placementToApply.kind === "local") {
-            placementHostOverride = currentHost;
+            placementBalanceHostOverride = currentHost;
+            placementHostOverride = { kind: "local", id: ctx.hostname() };
             outpostId = undefined;
         }
         else if (placementToApply.kind === "outpost") {
             if (currentHost.kind === "outpost" && currentHost.id === placementToApply.id) {
-                placementHostOverride = currentHost;
+                placementBalanceHostOverride = currentHost;
+                placementHostOverride = { kind: "local", id: ctx.hostname() };
                 outpostId = undefined;
             }
             else {
@@ -3275,7 +3278,7 @@ async function runCreate(ctx, opts) {
     const allowedAccounts = validatedAccounts.size > 0 ? [...validatedAccounts] : profileAccounts;
     let accountSelection;
     if (provider === "claude") {
-        const targetHost = placementHostOverride ?? (outpostId !== undefined
+        const targetHost = placementBalanceHostOverride ?? placementHostOverride ?? (outpostId !== undefined
             ? { kind: "outpost", id: outpostId }
             : laneHostFromCtx(ctx));
         balanceTargetHost = targetHost;
@@ -5159,17 +5162,11 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
     const keepAliveState = resolveLaneKeepAlive(hqRoot, storedLane);
     const keepAliveCompany = resolveLaneCompany(hqRoot, storedLane);
     const now = ctx.now().getTime();
-    const nextCheckAtEnabled = storedLane.state === "done" && storedLane.keep_alive === true
-        ? await readLanesRegistryFlag(LEAD_LANE_KEEP_ALIVE_NEXT_CHECK_FLAG, {
-            company: keepAliveCompany.company ?? undefined,
-            env: ctx.env,
-        })
-        : false;
-    const hasPendingWork = storedLane.keep_alive_standing === true || nextCheckAtEnabled
+    const hasPendingWork = storedLane.state === "done" && storedLane.keep_alive === true
         ? hasPendingKeepAliveWork(hqRoot, storedLane)
         : false;
     const doneStateVerdict = storedLane.state === "done" && storedLane.keep_alive === true
-        ? doneKeepAliveVerdict(storedLane, { decision: storedLane.last_envelope?.decision, story_complete: storedLane.story_complete, next_check_at: storedLane.last_envelope?.next_check_at }, storedLane.keep_alive_standing === true && hasPendingWork, { nextCheckAtEnabled, hasPendingWork, nowMs: now })
+        ? doneKeepAliveVerdict(storedLane, { decision: storedLane.last_envelope?.decision, story_complete: storedLane.story_complete, next_check_at: storedLane.last_envelope?.next_check_at }, storedLane.keep_alive_standing === true && hasPendingWork, { hasPendingWork, nowMs: now })
         : null;
     let managerStatusTarget;
     let managerStatusGateError;
@@ -5191,7 +5188,7 @@ async function runShow(ctx, laneId, hasPendingQuestionForLane) {
         now: ctx.now().getTime(),
     });
     const laneIsSenior = allLanes.some((item) => item.senior.kind === "lane" && item.senior.id === laneId);
-    const requestedNextCheckMs = nextCheckAtEnabled && !hasPendingWork
+    const requestedNextCheckMs = storedLane.state === "done" && storedLane.keep_alive === true && !hasPendingWork
         ? keepAliveNextCheckAtMs(storedLane.last_envelope?.next_check_at, now, Date.parse(storedLane.last_envelope?.at ?? storedLane.updated_at))
         : undefined;
     const storedNextEligibleMs = Date.parse(storedLane.keep_alive_next_eligible_at ?? "");

package/dist/fast-scaffold.d.ts

@@ -16,6 +16,8 @@ export type FastScaffoldScript = {
     /** Path under `assets/scaffold/`, e.g. `core/scripts/foo.sh`. */
     asset: string;
     root?: "live";
+    /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
+    requiresNodeNetworkCompatibility?: boolean;
 } | {
     /** Command path, joined with spaces, e.g. `policy frontmatter`. */
     name: string;
@@ -38,6 +40,8 @@ export type FastScaffoldScript = {
     shellHqRoot?: "none" | "live" | "reconcile-default";
     /** Whether this handler consumes stdin. Shell companions inherit stdin directly. */
     readsStdin?: boolean;
+    /** Whether the bundled fast-route module closure needs Node's network timeout patch. */
+    requiresNodeNetworkCompatibility?: boolean;
 };
 /** The relocated scripts that qualify for the entrypoint fast path. */
 export declare const FAST_SCAFFOLD_SCRIPTS: readonly FastScaffoldScript[];

package/dist/fast-scaffold.js

@@ -115,6 +115,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/worktree-gc.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -127,6 +128,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/clean-worktree-reconcile-handoff.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "cwd",
         shellCwd: "caller",
         shellHqRoot: "none",
@@ -139,6 +141,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/resume-thread-lock.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -151,6 +154,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-handoff",
         asset: "core/scripts/verify-story-deliverables.sh",
+        requiresNodeNetworkCompatibility: true,
         root: "live",
         shellCwd: "live",
         shellHqRoot: "live",
@@ -163,6 +167,7 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         flagKey: "hq-core-native-fast-route",
         familyFlagKey: "core-native-jobs",
         asset: `core/scripts/${name === "reconcile" ? "outpost-jobs-reconcile" : `jobs-${name}`}.sh`,
+        requiresNodeNetworkCompatibility: true,
         root: name === "reconcile" ? "passthrough" : "cwd",
         shellCwd: "caller",
         shellHqRoot: name === "reconcile" ? "reconcile-default" : "none",

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import "./node-preflight.js";
-import "./node-network-compat.js";
+import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
 export declare const __test__: {

package/dist/index.js

@@ -2,7 +2,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 import "./node-preflight.js";
-import "./node-network-compat.js";
+import "./node-network-compat-fast.js";
 import { isVersionRequest, wantsLabelledVersionReport } from "./version-request.js";
 // Dependency-light: a pure parser + table, no command graph. Safe to load on
 // every path (including --version) without reintroducing the heavy startup.

package/dist/lib/flag-registry.d.ts

@@ -7,6 +7,7 @@
  */
 import { type WorkerOptions } from "node:worker_threads";
 import { createFlagClient, type FlagClient, type FlagLookupOptions, type FlagSnapshot } from "@indigoai-us/hq-flags-client";
+type FlagRegistrySentry = Pick<typeof import("@sentry/node"), "captureException" | "withScope">;
 export { resolveProcessFlagCompanyContext } from "./process-flag-company-context.js";
 export type { ProcessFlagCompanyContext } from "./process-flag-company-context.js";
 export { FLAG_REGISTRY_ENDPOINT_ENV } from "./flag-registry-endpoint.js";
@@ -20,6 +21,7 @@ interface WorkerLike {
 export interface FlagRegistryDependencies {
     endpoint?: string;
     createWorker?: (filename: string | URL, options: WorkerOptions) => WorkerLike;
+    sentry?: FlagRegistrySentry;
     /** Test seam for exercising the no-source fail-open path. */
     workerSource?: string;
     captureWorkerFailure?: (error: Error, tags: Record<string, string>) => void;