@indigoai-us/hq-cli 5.318.1-beta.0 → 5.320.0

package/dist/commands/lanes.js

@@ -26,6 +26,7 @@ import { registerLaneKpisCommand } from "./lanes-kpis.js";
 import { registerLaneKeepAliveAuditCommand } from "./lanes-keep-alive-audit.js";
 import { registerLaneAutopilotReportCommand } from "./lanes-autopilot.js";
 import { registerLaneChecksCommand } from "./lanes-checks.js";
+import { registerLaneDropboxRepairCommand } from "./lanes-dropbox-repair.js";
 import { registerLaneReportCommands } from "./lanes-report.js";
 import { registerLaneRepoMergeHoldCommand } from "./lanes-hold.js";
 import { registerLaneReviewCommand } from "./lanes-review.js";
@@ -34,7 +35,7 @@ import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
-import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG } from "../lib/lanes/flag-keys.js";
+import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, } from "../lib/lanes/flag-keys.js";
 import { CODEX_ROLLOUT_RETENTION_FLAG, configuredCodexRolloutHomes, lowDiskGuardEnabledForLane, retainCodexRollouts } from "../lib/lanes/disk-guard.js";
 import { isControllerAliasOutpostId } from "../lib/lanes/admission-host.js";
 import { runLeadAutopilotPass } from "../lib/lanes/autopilot.js";
@@ -1336,6 +1337,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
         updated: new Map(),
         unverifiedRemote: new Map(),
         missingOnOwner: new Map(),
+        skippedRemoteRefresh: new Set(),
     };
     const now = ctx.now();
     const nowMs = now.getTime();
@@ -1377,6 +1379,7 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
     if (candidates.length === 0)
         return result;
     const enabledByCompany = new Map();
+    const skipRefreshByCompany = new Map();
     const enabledCandidates = [];
     for (const lane of candidates) {
         const company = resolveLaneCompany(hqRoot, lane).company;
@@ -1391,8 +1394,20 @@ async function refreshRemoteLaneMirrors(ctx, hqRoot, records, parentLaneIds, opt
             });
             enabledByCompany.set(companyKey, enabled);
         }
-        if (enabled)
-            enabledCandidates.push(lane);
+        if (!enabled)
+            continue;
+        if (options.skipRemoteRefreshForCompany) {
+            let skipRefresh = skipRefreshByCompany.get(companyKey);
+            if (skipRefresh === undefined) {
+                skipRefresh = await options.skipRemoteRefreshForCompany(company);
+                skipRefreshByCompany.set(companyKey, skipRefresh);
+            }
+            if (skipRefresh) {
+                result.skippedRemoteRefresh.add(lane.lane_id);
+                continue;
+            }
+        }
+        enabledCandidates.push(lane);
     }
     if (enabledCandidates.length === 0)
         return result;
@@ -4949,7 +4964,12 @@ async function runList(ctx, opts) {
     }
     const remoteRead = ctx.env[REMOTE_LANE_READ_ENV] === "1";
     const remoteRefresh = remoteRead
-        ? { updated: new Map(), unverifiedRemote: new Map(), missingOnOwner: new Map() }
+        ? {
+            updated: new Map(),
+            unverifiedRemote: new Map(),
+            missingOnOwner: new Map(),
+            skippedRemoteRefresh: new Set(),
+        }
         : await refreshRemoteLaneMirrors(ctx, hqRoot, laneSource, new Set(laneSource
             .filter((lane) => matchesLaneFilters(lane, false))
             .map((lane) => lane.lane_id)), {
@@ -4957,6 +4977,7 @@ async function runList(ctx, opts) {
             laneIds: new Set(laneSource
                 .filter((lane) => matchesLaneFilters(lane, false))
                 .map((lane) => lane.lane_id)),
+            skipRemoteRefreshForCompany: (company) => readLanesRegistryFlagFailOff(LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, { company, env: ctx.env }),
         });
     for (const [laneId, updated] of remoteRefresh.updated) {
         const index = laneSource.findIndex((lane) => lane.lane_id === laneId);
@@ -4994,6 +5015,7 @@ async function runList(ctx, opts) {
     const ownerEligibleLaneIds = new Set();
     for (const lane of selectedLanes) {
         if (remoteRead ||
+            remoteRefresh.skippedRemoteRefresh.has(lane.lane_id) ||
             lane.host.kind !== "outpost" ||
             isTerminalLaneState(lane.state) ||
             laneRunsHere(lane, host)) {
@@ -5033,6 +5055,7 @@ async function runList(ctx, opts) {
     const livenessBySession = new Map();
     let livenessDeps;
     const lanes = selectedLanes.map((lane) => {
+        const overdue = Boolean(lane.overdue) || isOverdue(hqRoot, lane.lane_id, now);
         const remoteQueued = lane.state === "queued" &&
             lane.host.kind === "outpost" &&
             !laneRunsHere(lane, host);
@@ -5051,7 +5074,7 @@ async function runList(ctx, opts) {
                     queued_details: lane.queued_reason === "low_disk" ? lane.queued_details : undefined,
                 }
                 : {}),
-            overdue: Boolean(lane.overdue) || isOverdue(hqRoot, lane.lane_id, now),
+            overdue,
             stalled: Boolean(lane.stalled),
             // Listing is observational. Reconcile owns durable liveness transitions.
             senior_lost: lane.state === "running" && lane.senior.kind === "session" && lane.senior.id
@@ -7872,6 +7895,7 @@ async function runReconcile(ctx, opts, recoverQueuedMessages) {
             updated: new Map(),
             unverifiedRemote: new Map(),
             missingOnOwner: new Map(),
+            skippedRemoteRefresh: new Set(),
         }
         : await refreshRemoteLaneMirrors(ctx, hqRoot, loadAllLanes(hqRoot));
     const remoteLost = [];
@@ -8322,6 +8346,21 @@ export function registerLanesCommand(parent, deps = {}) {
             deps: ctx.livenessDeps,
         }),
     }, wrap);
+    registerLaneDropboxRepairCommand(lanes, {
+        hqRoot: ctx.hqRoot,
+        now: ctx.now,
+        resolveCompany: ctx.resolveCompany,
+        repairEnabled: async (lane) => {
+            const resolution = resolveLaneCompany(ctx.hqRoot(), lane);
+            const company = resolution.company ?? undefined;
+            return readLanesRegistryFlagFailOff(LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, {
+                company,
+                ...(company ? { companyUidSource: laneCompanyUidSource(resolution.source) } : {}),
+                env: ctx.env,
+            }, readLanesRegistryFlag);
+        },
+        wrap,
+    });
     registerLaneReportCommands(lanes, {
         hqRoot: ctx.hqRoot,
         resolveCompany: ctx.resolveCompany,

package/dist/fast-core.js

@@ -9,6 +9,7 @@
 import { resolveLiveRoot } from "./utils/hq-roots.js";
 import { runBundledScript } from "./utils/run-bundled-script.js";
 import { parseFastCore } from "./fast-scaffold.js";
+import { CORE_RRR_WORKTREE_SCOPE_FIX_FLAG } from "./commands/core-rrr-worktree-scope-fix-flag.js";
 export async function readStdinIfPiped(stream) {
     if (stream.isTTY)
         return "";
@@ -35,6 +36,9 @@ export async function runFastCore(argv) {
         familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
     }
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
+    const worktreeScopeFixEnabled = entry.name === "repo-run-registry"
+        ? await (await import("./native-fast-route.js")).fastFlagEnabled(CORE_RRR_WORKTREE_SCOPE_FIX_FLAG, process.env, { numericEnvironmentOverride: false })
+        : undefined;
     const shouldInjectRoot = useShell
         ? entry.shellHqRoot === "live" || (entry.shellHqRoot === "reconcile-default" &&
             !parsed.args.includes("--hq-root") && !parsed.args.includes("--help") && !parsed.args.includes("-h"))
@@ -69,7 +73,7 @@ export async function runFastCore(argv) {
         }
         const readsStdin = entry.readsStdinFor?.(parsed.args) ?? entry.readsStdin ?? false;
         const stdin = readsStdin ? await readStdinIfPiped(process.stdin) : "";
-        const code = await handler(parsed.args, stdin, process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg);
+        const code = await handler(parsed.args, stdin, process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg, worktreeScopeFixEnabled);
         // Let Node drain handler output before terminating. The timeout guard's
         // stderr message must survive the native route's process boundary.
         process.exitCode = code;
@@ -90,6 +94,7 @@ export async function runFastCore(argv) {
         ...(entry.name === "migrate-policy-triggers"
             ? { CLAUDE_PROJECT_DIR: process.env.CLAUDE_PROJECT_DIR || process.cwd() }
             : {}),
+        ...(entry.name === "repo-run-registry" ? { HQ_FLAG_CORE_RRR_WORKTREE_SCOPE_FIX: String(worktreeScopeFixEnabled) } : {}),
     };
     const { code } = runBundledScript({
         asset,

package/dist/index.d.ts

@@ -3,8 +3,17 @@ import "./node-preflight.js";
 import "./node-network-compat-fast.js";
 import { isVersionRequest } from "./version-request.js";
 import { isFastCoreRequest } from "./fast-scaffold.js";
+type PackageUseLeaseLoader = () => Promise<void>;
+declare function isNpmPackageEntry(entryUrl: string): boolean;
+declare function dispatchWithPackageUseLease(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
+declare function runCliEntry(entryUrl: string, dispatch: () => void, loadLease?: PackageUseLeaseLoader): void | Promise<void>;
 export declare const __test__: {
     isVersionRequest: typeof isVersionRequest;
     isFastCoreRequest: typeof isFastCoreRequest;
+    dispatchWithPackageUseLease: typeof dispatchWithPackageUseLease;
+    runCliEntry: typeof runCliEntry;
+    isNpmPackageEntry: typeof isNpmPackageEntry;
+    acquirePackageUseLease: (prefix: string, version: string, stateDirectory?: string) => Promise<import("./utils/package-use-lease.js").PackageUseLease>;
 };
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -17,77 +17,149 @@ import { installProcessRejectionBoundary } from "./unhandled-rejection-boundary.
 // command never run (HQ-CLI-W). Sets process.exitCode only, never process.exit,
 // so runCli's finally still finalizes release health and flushes Sentry.
 installProcessRejectionBoundary();
-if (isVersionRequest(process.argv)) {
-    // Bare `--version` is the CLI semver only (the contract field updaters
-    // compare). `hq version` and `--json` print the labelled HQ/CLI report.
-    // Lazy so this path still skips the command graph.
-    if (wantsLabelledVersionReport(process.argv)) {
-        void import("./lib/flag-registry.js").then(({ kickFlagRegistryReadiness }) => {
-            kickFlagRegistryReadiness();
-            return import("./utils/version-report.js").then(({ runVersionCommand }) => runVersionCommand(process.argv));
+function dispatchCliEntry() {
+    if (isVersionRequest(process.argv)) {
+        // Bare `--version` is the CLI semver only (the contract field updaters
+        // compare). `hq version` and `--json` print the labelled HQ/CLI report.
+        // Lazy so this path still skips the command graph.
+        if (wantsLabelledVersionReport(process.argv)) {
+            void import("./lib/flag-registry.js").then(({ kickFlagRegistryReadiness }) => {
+                kickFlagRegistryReadiness();
+                return import("./utils/version-report.js").then(({ runVersionCommand }) => runVersionCommand(process.argv));
+            });
+        }
+        else {
+            // Keep the benchmarked updater fast route limited to the installed semver.
+            // Registry checks and flag resolution belong to the regular command path.
+            void import("./cli-version.js").then(({ CLI_VERSION }) => {
+                process.stdout.write(`${CLI_VERSION}\n`);
+            });
+        }
+    }
+    else if (parseFastCore(process.argv)?.entry.kind === "native" &&
+        (process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "true" ||
+            process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "1")) {
+        // An explicit enabled override has already decided the global gate. Skip the
+        // snapshot reader import on hot native plumbing paths; runFastCore still
+        // checks the command-family flag before choosing native or shell rollback.
+        void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv));
+    }
+    else if (parseFastCore(process.argv)?.entry.kind === "native") {
+        // Native routes are default-off. Resolve the company-scoped persisted flag
+        // without loading the command graph; a miss or stale snapshot takes the
+        // existing full-graph route.
+        void import("./native-fast-route.js").then(async ({ nativeFastRouteEnabled }) => {
+            if (await nativeFastRouteEnabled(process.argv)) {
+                const { runFastCore } = await import("./fast-core.js");
+                await runFastCore(process.argv);
+            }
+            else {
+                const { runCli } = await import("./main.js");
+                await runCli();
+            }
         });
     }
-    else {
-        // Keep the benchmarked updater fast route limited to the installed semver.
-        // Registry checks and flag resolution belong to the regular command path.
-        void import("./cli-version.js").then(({ CLI_VERSION }) => {
-            process.stdout.write(`${CLI_VERSION}\n`);
+    else if (parseSecretsEnvFastRequest(process.argv)) {
+        const request = parseSecretsEnvFastRequest(process.argv);
+        void import("./secrets-env-fast-route.js").then(async (route) => {
+            await route.dispatchSecretsEnvFastRequest(request, {
+                isEnabled: () => route.secretsEnvFastRouteEnabled(request),
+                runFast: async () => {
+                    const { runSecretsEnvFastPath } = await import("./secrets-env-fast-path.js");
+                    return runSecretsEnvFastPath(request);
+                },
+                runCurrent: async () => {
+                    const { runCli } = await import("./main.js");
+                    await runCli();
+                },
+            });
         });
     }
+    else if (isFastCoreRequest(process.argv)) {
+        // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
+        // dispatches straight to the bundled-script runner, so it never pays for the
+        // ~60-module command graph main.ts imports. See src/fast-scaffold.ts.
+        void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv));
+    }
+    else {
+        // Keep the command lifecycle detached from module evaluation, as it was
+        // before the fast --version split. Some best-effort teardown work uses
+        // unref'd handles; top-level-awaiting runCli() makes Node turn an otherwise
+        // successful command into exit 13 when that teardown promise remains pending.
+        // A floated rejection here no longer exits 0 silently: the boundary installed
+        // above turns it into a non-zero exit (HQ-CLI-W).
+        void import("./main.js").then(({ runCli }) => runCli());
+    }
 }
-else if (parseFastCore(process.argv)?.entry.kind === "native" &&
-    (process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "true" ||
-        process.env.HQ_FLAG_HQ_CORE_NATIVE_FAST_ROUTE === "1")) {
-    // An explicit enabled override has already decided the global gate. Skip the
-    // snapshot reader import on hot native plumbing paths; runFastCore still
-    // checks the command-family flag before choosing native or shell rollback.
-    void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv));
+function isNpmPackageEntry(entryUrl) {
+    return /\/node_modules\/@indigoai-us\/hq-cli\/dist\/index\.js$/i.test(entryUrl);
 }
-else if (parseFastCore(process.argv)?.entry.kind === "native") {
-    // Native routes are default-off. Resolve the company-scoped persisted flag
-    // without loading the command graph; a miss or stale snapshot takes the
-    // existing full-graph route.
-    void import("./native-fast-route.js").then(async ({ nativeFastRouteEnabled }) => {
-        if (await nativeFastRouteEnabled(process.argv)) {
-            const { runFastCore } = await import("./fast-core.js");
-            await runFastCore(process.argv);
-        }
-        else {
-            const { runCli } = await import("./main.js");
-            await runCli();
-        }
-    });
+function isPackageUseUpdatePendingError(error) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        error.name === "PackageUseUpdatePendingError");
 }
-else if (parseSecretsEnvFastRequest(process.argv)) {
-    const request = parseSecretsEnvFastRequest(process.argv);
-    void import("./secrets-env-fast-route.js").then(async (route) => {
-        await route.dispatchSecretsEnvFastRequest(request, {
-            isEnabled: () => route.secretsEnvFastRouteEnabled(request),
-            runFast: async () => {
-                const { runSecretsEnvFastPath } = await import("./secrets-env-fast-path.js");
-                return runSecretsEnvFastPath(request);
-            },
-            runCurrent: async () => {
-                const { runCli } = await import("./main.js");
-                await runCli();
-            },
-        });
-    });
+function packageUseErrorClass(error) {
+    if (!error || typeof error !== "object")
+        return "unknown";
+    const value = error;
+    if (typeof value.code === "string")
+        return value.code;
+    if (value.cause && typeof value.cause === "object") {
+        const cause = value.cause;
+        if (typeof cause.code === "string")
+            return cause.code;
+        if (typeof cause.name === "string")
+            return cause.name;
+    }
+    return typeof value.name === "string" ? value.name : "unknown";
 }
-else if (isFastCoreRequest(process.argv)) {
-    // Hot relocated plumbing (`hq core hq-session`, `hq core checkpoint-stop-gate`)
-    // dispatches straight to the bundled-script runner, so it never pays for the
-    // ~60-module command graph main.ts imports. See src/fast-scaffold.ts.
-    void import("./fast-core.js").then(({ runFastCore }) => runFastCore(process.argv));
+function dispatchWithPackageUseLease(entryUrl, dispatch, loadLease = async () => {
+    const { acquireCurrentPackageUseLease } = await import("./utils/package-use-lease.js");
+    acquireCurrentPackageUseLease();
+}) {
+    if (!isNpmPackageEntry(entryUrl)) {
+        dispatch();
+        return;
+    }
+    return loadLease().then(dispatch, (error) => {
+        if (isPackageUseUpdatePendingError(error))
+            throw error;
+        process.stderr.write(`hq-cli package-use lease unavailable (${packageUseErrorClass(error)}); continuing without lease\n`);
+        dispatch();
+    });
 }
-else {
-    // Keep the command lifecycle detached from module evaluation, as it was
-    // before the fast --version split. Some best-effort teardown work uses
-    // unref'd handles; top-level-awaiting runCli() makes Node turn an otherwise
-    // successful command into exit 13 when that teardown promise remains pending.
-    // A floated rejection here no longer exits 0 silently: the boundary installed
-    // above turns it into a non-zero exit (HQ-CLI-W).
-    void import("./main.js").then(({ runCli }) => runCli());
+function runCliEntry(entryUrl, dispatch, loadLease) {
+    const handlePendingUpdate = (error) => {
+        if (!isPackageUseUpdatePendingError(error))
+            throw error;
+        const message = error instanceof Error
+            ? error.message
+            : "The HQ CLI package is being updated";
+        process.stderr.write(`hq-cli: ${message}\n`);
+        process.exitCode = 1;
+    };
+    try {
+        const result = dispatchWithPackageUseLease(entryUrl, dispatch, loadLease);
+        return result?.catch(handlePendingUpdate);
+    }
+    catch (error) {
+        handlePendingUpdate(error);
+    }
 }
-export const __test__ = { isVersionRequest, isFastCoreRequest };
+// Local builds and benchmark fixtures are not installed in an npm prefix.
+// Keep their fast route free of package-use filesystem work; npm installs still
+// publish a lease before dispatch.
+void runCliEntry(import.meta.url, dispatchCliEntry);
+export const __test__ = {
+    isVersionRequest,
+    isFastCoreRequest,
+    dispatchWithPackageUseLease,
+    runCliEntry,
+    isNpmPackageEntry,
+    acquirePackageUseLease: async (prefix, version, stateDirectory) => {
+        const lease = await import("./utils/package-use-lease.js");
+        return lease.acquirePackageUseLease(prefix, version, stateDirectory);
+    },
+};
 //# sourceMappingURL=index.js.map

package/dist/lib/daemon/run.d.ts

@@ -12,6 +12,8 @@ import { type HostApp } from "./supervisor.js";
 export declare const LOG_ROTATE_BYTES: number;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export declare const RESTART_EXIT_CODE = 75;
+/** Route an updater request through the daemon's existing graceful handoff. */
+export declare function handoffForPackageUpdateRequest(requested: boolean, restartDaemon: () => void): void;
 export interface RunDaemonOptions {
     foreground?: boolean;
     /** Started by the OS unit, which relaunches the daemon whenever it exits. */

package/dist/lib/daemon/run.js

@@ -12,6 +12,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { loadCachedTokens } from "@indigoai-us/hq-cloud";
 import { CLI_VERSION } from "../../cli-version.js";
+import { currentPackageUseUpdateRequested } from "../../utils/package-use-lease.js";
 import { isLocalDependencyInstall, resolveRunningInstall } from "../../utils/version-gate.js";
 import { agentKitPaths } from "../agent-kit/paths.js";
 import { readBotConfig } from "../bot/config.js";
@@ -39,6 +40,11 @@ import { userToolDirs } from "./tools.js";
 export const LOG_ROTATE_BYTES = 5 * 1024 * 1024;
 /** Exit code for "restart me": non-zero so every service manager relaunches (Windows tasks only restart on failure). */
 export const RESTART_EXIT_CODE = 75;
+/** Route an updater request through the daemon's existing graceful handoff. */
+export function handoffForPackageUpdateRequest(requested, restartDaemon) {
+    if (requested)
+        restartDaemon();
+}
 const LEGACY_PROBE_TTL_MS = 60_000;
 /** A flag read that has not answered by then counts as off. */
 const HANDOFF_FLAG_TIMEOUT_MS = 10_000;
@@ -603,7 +609,10 @@ export async function runDaemon(opts) {
                 log("info", `rotated ${n} log file(s)`);
             return true;
         },
-        takeRequests: () => takeControlRequests(paths.requestsDir),
+        takeRequests: () => {
+            handoffForPackageUpdateRequest(currentPackageUseUpdateRequested(), restartDaemon);
+            return takeControlRequests(paths.requestsDir);
+        },
         restartDaemon: () => restartDaemon(),
         writeState: (state) => writeJsonAtomic(paths.statePath, state),
         log,

package/dist/lib/lanes/autopilot.js

@@ -6,7 +6,7 @@ import { isControllerAliasOutpostId } from "./admission-host.js";
 import { LEAD_REGISTRY_REL, validateOutpostLeadRegistry } from "./autopilot-registry.js";
 import { appendDropboxMessage } from "./dropbox.js";
 import { LanesError } from "./errors.js";
-import { LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG, LANE_AUTOPILOT_NUDGE_DEDUPE_FLAG, LEAD_AUTOPILOT_KPI_STALENESS_BATCH_FLAG, LEAD_AUTOPILOT_KPI_STALENESS_FLAG, LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG, LEAD_AUTOPILOT_PER_LEAD_ERRORS_FLAG as PER_LEAD_ERRORS_FLAG, } from "./flag-keys.js";
+import { LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG, LANE_AUTOPILOT_NUDGE_DEDUPE_FLAG, LEAD_AUTOPILOT_KPI_STALENESS_BATCH_FLAG, LEAD_AUTOPILOT_KPI_STALENESS_FLAG, LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG, LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, LEAD_AUTOPILOT_PER_LEAD_ERRORS_FLAG as PER_LEAD_ERRORS_FLAG, } from "./flag-keys.js";
 import { resolveLaneCompany } from "./lane-company.js";
 import { readLanesRegistryFlag } from "./registry-flag.js";
 import { readAllLanes } from "./store.js";
@@ -786,9 +786,16 @@ async function runLeadAutopilotPassUnlocked(input) {
             result.skipped.push({ lead_lane: lead.lane_id, reason: "lead_company_unresolved" });
             continue;
         }
+        // A lead created on an Outpost records a local host, while its registry row names the Outpost.
+        const outpostNativeLead = !registeredLocalHost &&
+            input.outpostId === registered.host &&
+            lead.host.kind === "local" &&
+            lead.host.id === input.hostname &&
+            await (input.readFlag ?? readLanesRegistryFlag)(LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG, { company }).catch(() => false);
         const hostMatchesRegistry = registeredLocalHost
             ? lead.host.kind === "local"
-            : lead.host.kind === "outpost" && lead.host.id === registered.host && input.outpostId === registered.host;
+            : outpostNativeLead ||
+                (lead.host.kind === "outpost" && lead.host.id === registered.host && input.outpostId === registered.host);
         if (!hostMatchesRegistry ||
             !laneRunsOnHost(lead, { hostname: input.hostname, outpostId: effectiveOutpostId })) {
             result.skipped.push({ lead_lane: lead.lane_id, reason: "lead_host_mismatch" });

package/dist/lib/lanes/flag-keys.d.ts

@@ -4,6 +4,9 @@ export declare const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-bala
 export declare const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 /** Count only children with live work against their senior's hire grant. */
 export declare const LANE_HIRE_GRANT_FINISHED_LANES_FLAG = "lanes.hire-grant-count-live-only";
+/** Skips owner refreshes during ordinary lane list polling when explicitly enabled. */
+export declare const LANE_LIST_SKIP_REMOTE_REFRESH_FLAG = "lanes.list-skip-remote-refresh";
+export declare const LANE_LIST_SKIP_REMOTE_REFRESH_DEFAULT_ENABLED = false;
 /** Enables missed-deadline lead nudges and second-miss operator escalation. */
 export declare const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-missed-deadline-escalation";
 export declare const LANE_AUTOPILOT_NUDGE_DEDUPE_FLAG = "lanes.autopilot-nudge-dedupe";
@@ -22,4 +25,10 @@ export declare const LEAD_AUTOPILOT_KPI_STALENESS_BATCH_DEFAULT_ENABLED = false;
 /** Enables staleness notices for a registered lead's dashboard headline. */
 export declare const LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG = "lanes.autopilot-headline-staleness";
 export declare const LEAD_AUTOPILOT_HEADLINE_STALENESS_DEFAULT_ENABLED = false;
+/** Lets an Outpost's autopilot wake leads created on that Outpost, which record a local host. */
+export declare const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG = "lanes.autopilot-outpost-native-leads";
+export declare const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_DEFAULT_ENABLED = false;
+/** Allows applying an operator-reviewed repair of messages stranded in bare-ULID dropboxes. */
+export declare const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG = "lanes.orphaned-bare-id-dropbox-repair";
+export declare const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_DEFAULT_ENABLED = false;
 //# sourceMappingURL=flag-keys.d.ts.map

package/dist/lib/lanes/flag-keys.js

@@ -4,6 +4,9 @@ export const LANE_OUTPOST_LOAD_BALANCING_FLAG = "lanes.outpost-load-balancing";
 export const LANE_ENVELOPE_REPAIR_CONTINUE_FLAG = "lanes.envelope-repair-continue";
 /** Count only children with live work against their senior's hire grant. */
 export const LANE_HIRE_GRANT_FINISHED_LANES_FLAG = "lanes.hire-grant-count-live-only";
+/** Skips owner refreshes during ordinary lane list polling when explicitly enabled. */
+export const LANE_LIST_SKIP_REMOTE_REFRESH_FLAG = "lanes.list-skip-remote-refresh";
+export const LANE_LIST_SKIP_REMOTE_REFRESH_DEFAULT_ENABLED = false;
 /** Enables missed-deadline lead nudges and second-miss operator escalation. */
 export const LANE_AUTOPILOT_MISSED_DEADLINE_ESCALATION_FLAG = "lanes.autopilot-missed-deadline-escalation";
 export const LANE_AUTOPILOT_NUDGE_DEDUPE_FLAG = "lanes.autopilot-nudge-dedupe";
@@ -22,4 +25,10 @@ export const LEAD_AUTOPILOT_KPI_STALENESS_BATCH_DEFAULT_ENABLED = false;
 /** Enables staleness notices for a registered lead's dashboard headline. */
 export const LEAD_AUTOPILOT_HEADLINE_STALENESS_FLAG = "lanes.autopilot-headline-staleness";
 export const LEAD_AUTOPILOT_HEADLINE_STALENESS_DEFAULT_ENABLED = false;
+/** Lets an Outpost's autopilot wake leads created on that Outpost, which record a local host. */
+export const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_FLAG = "lanes.autopilot-outpost-native-leads";
+export const LEAD_AUTOPILOT_OUTPOST_NATIVE_LEADS_DEFAULT_ENABLED = false;
+/** Allows applying an operator-reviewed repair of messages stranded in bare-ULID dropboxes. */
+export const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG = "lanes.orphaned-bare-id-dropbox-repair";
+export const LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_DEFAULT_ENABLED = false;
 //# sourceMappingURL=flag-keys.js.map

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -1,4 +1,4 @@
-type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "self_wake" | "early_by_keep_alive" | "not_restarted" | "waiting";
+type KeepAliveAuditVerdict = "on_time" | "late" | "early_wake" | "message_wake" | "self_wake" | "early_by_keep_alive" | "not_restarted" | "keep_alive_off" | "waiting";
 interface KeepAliveAuditRestart {
     at: string;
     trigger: string;

package/dist/lib/lanes/keep-alive-audit.js

@@ -3,7 +3,7 @@ import * as path from "node:path";
 import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS } from "./keep-alive.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
-import { readAllLanes } from "./store.js";
+import { listQuestionIds, readAllLanes, tryReadQuestion } from "./store.js";
 function readDoneClassifications(hqRoot, laneId) {
     const root = fs.realpathSync(hqRoot);
     const watcherLog = path.join(laneRunDir(root, laneId), "logs", "watcher.out");
@@ -56,6 +56,7 @@ const VERDICTS = [
     "message_wake",
     "self_wake",
     "early_by_keep_alive",
+    "keep_alive_off",
     "not_restarted",
     "waiting",
 ];
@@ -219,9 +220,66 @@ function hasDeliveredDropboxEvidence(hqRoot, laneId, stoppedAt, restartAt) {
         const realFile = fs.realpathSync(file);
         if (!withinRoot(root, realFile))
             return false;
-        return stat.mtimeMs >= stoppedAt && stat.mtimeMs <= restartAt + 2 * 60_000;
+        if (stat.mtimeMs >= stoppedAt && stat.mtimeMs <= restartAt + 2 * 60_000)
+            return true;
+        if (!name.endsWith(".inbox.jsonl") && !name.endsWith(".resume.jsonl"))
+            return false;
+        const text = fs.readFileSync(realFile, "utf8");
+        for (const line of text.split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            let value;
+            try {
+                value = JSON.parse(line);
+            }
+            catch (err) {
+                throw new LanesError("keep_alive_audit_event_invalid", `Cannot parse delivered lane message ${realFile}: ${err instanceof Error ? err.message : String(err)}`, { lane_id: laneId, path: realFile });
+            }
+            if (isRecord(value)) {
+                const at = parseTime(value.at);
+                if (at !== undefined && at >= stoppedAt && at <= restartAt + 2 * 60_000)
+                    return true;
+            }
+        }
+        return false;
     });
 }
+function hasMessageResumeEvidence(lane, stoppedAt, restartAt) {
+    return (lane.resume_history ?? []).some((entry) => (entry.trigger === "message" || entry.trigger === "answered_questions") &&
+        (parseTime(entry.at) ?? Number.NaN) >= stoppedAt &&
+        (parseTime(entry.at) ?? Number.NaN) <= restartAt + 2 * 60_000);
+}
+function hasAnsweredQuestionEvidence(hqRoot, laneId, stoppedAt, restartAt) {
+    for (const questionId of listQuestionIds(hqRoot)) {
+        let question;
+        try {
+            question = tryReadQuestion(hqRoot, questionId);
+        }
+        catch {
+            // One unreadable question file must not fail the whole audit.
+            continue;
+        }
+        if (!question || question.lane_id !== laneId || question.origin?.id !== laneId)
+            continue;
+        const timestamps = [
+            question.delivered_at,
+            question.answer?.answered_at,
+            ...(question.answer_history ?? []).map((answer) => answer.answered_at),
+        ];
+        if (timestamps.some((timestamp) => {
+            const at = parseTime(timestamp);
+            return at !== undefined && at >= stoppedAt && at <= restartAt + 2 * 60_000;
+        }))
+            return true;
+    }
+    return false;
+}
+function laneWasKeepAliveOffAtStop(lane, stoppedAt) {
+    if (lane.keep_alive === true)
+        return false;
+    const optedInAt = parseTime(lane.keep_alive_opted_in_at);
+    return optedInAt === undefined || optedInAt > stoppedAt;
+}
 function firstRestartAfter(lane, stop, nextEnvelopeMs) {
     const restart = (lane.resume_history ?? [])
         .map((entry) => ({ entry, at: parseTime(entry.at) }))
@@ -241,13 +299,18 @@ function classifyVerdict(input) {
         const restartAt = Date.parse(restart.at);
         if (restart.caller === lane.lane_id)
             return "self_wake";
+        if (restart.trigger === "message" || restart.trigger === "answered_questions")
+            return "message_wake";
         if (restart.trigger === "keep_alive") {
             const event = input.resumeEvents
-                .filter((candidate) => candidate.at > input.stoppedAt && Math.abs(candidate.at - restartAt) <= 2 * 60_000)
+                .filter((candidate) => candidate.at > input.stoppedAt && candidate.at <= restartAt + 2 * 60_000)
                 .sort((left, right) => Math.abs(left.at - restartAt) - Math.abs(right.at - restartAt))[0];
             if (event?.reason === "pending_work")
                 return "message_wake";
-            if (event?.reason === undefined && hasDeliveredDropboxEvidence(input.hqRoot, lane.lane_id, input.stoppedAt, restartAt)) {
+            if (event?.reason === undefined &&
+                (hasDeliveredDropboxEvidence(input.hqRoot, lane.lane_id, input.stoppedAt, restartAt) ||
+                    hasMessageResumeEvidence(lane, input.stoppedAt, restartAt) ||
+                    hasAnsweredQuestionEvidence(input.hqRoot, lane.lane_id, input.stoppedAt, restartAt))) {
                 return "message_wake";
             }
             const nextCheckAt = parseTime(input.nextCheckAt);
@@ -264,6 +327,8 @@ function classifyVerdict(input) {
             return "early_wake";
         return "late";
     }
+    if (laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
+        return "keep_alive_off";
     if (lane.state === "done" && nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
         return "not_restarted";
     return "waiting";