@indigoai-us/hq-cli 5.320.0 → 5.322.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [5.322.0] — 2026-10-02
+
+- Retried idempotent vault API GETs once when API Gateway returned its generic Lambda-invoke 504 response without a function request ID.
+
+- Defer CLI-update daemon restarts until the sync runner finishes its pass, coalesce pending restart requests, and bound mesh daemon shutdown steps with clearer SIGTERM escalation diagnostics.
+
+## [5.321.0] — 2026-10-02
+
+- Project catalog cache keys include their source directory, and runtime-probe tests isolate the host CLI and scope checks to hooks.
+
+- Fixed intermittent timeouts in the concurrent journal parity test.
+- Fix repo-run-registry so an unremovable stale lock exits with a clear error instead of retrying forever.
+- Added the default-off `hq core hook-batch journal-due` command for one-process PostToolUse journal counter reads.
+
 ## [5.320.0] — 2026-10-02
 - Write session-journal titles as escaped YAML strings so free-form titles remain parseable.
 - Added a default-off hq-flags gate that lets lane list pollers skip remote owner refreshes to reduce poll latency.

package/assets/scaffold/core/scripts/repo-run-registry.sh

@@ -96,7 +96,9 @@ _try_lock() {
         mtime="$(portable_stat_mtime "$LOCK_DIR" 2>/dev/null || echo 0)"
         age=$(( $(date +%s) - mtime ))
         if [[ $age -gt 60 ]]; then
-          rm -rf "$LOCK_DIR" 2>/dev/null || true
+          if ! rm -rf "$LOCK_DIR" 2>/dev/null; then
+            _die "could not remove stale registry lock: $LOCK_DIR"
+          fi
           continue
         fi
       fi

package/dist/command-catalog.generated.d.ts

@@ -5971,6 +5971,30 @@ export declare const COMMAND_CATALOG: readonly [{
         }];
         readonly options: readonly [];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "hook-batch";
+        readonly description: "Batch PostToolUse hook helper calls";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly usage: "[options] [command]";
+        readonly arguments: readonly [];
+        readonly options: readonly [];
+        readonly subcommands: readonly [{
+            readonly name: "journal-due";
+            readonly description: "Resolve the journal path, increment the tool counter, and return its value";
+            readonly aliases: readonly [];
+            readonly hidden: false;
+            readonly usage: "[options]";
+            readonly arguments: readonly [];
+            readonly options: readonly [{
+                readonly flags: "--session <key>";
+                readonly description: "Session key used by the journal counter";
+            }, {
+                readonly flags: "--reset";
+                readonly description: "Reset the tool counter before incrementing it";
+            }];
+            readonly subcommands: readonly [];
+        }];
     }, {
         readonly name: "session-journal";
         readonly description: "Write and read session journal entries";

package/dist/command-catalog.generated.js

@@ -7681,6 +7681,36 @@ export const COMMAND_CATALOG = [
                 "options": [],
                 "subcommands": []
             },
+            {
+                "name": "hook-batch",
+                "description": "Batch PostToolUse hook helper calls",
+                "aliases": [],
+                "hidden": false,
+                "usage": "[options] [command]",
+                "arguments": [],
+                "options": [],
+                "subcommands": [
+                    {
+                        "name": "journal-due",
+                        "description": "Resolve the journal path, increment the tool counter, and return its value",
+                        "aliases": [],
+                        "hidden": false,
+                        "usage": "[options]",
+                        "arguments": [],
+                        "options": [
+                            {
+                                "flags": "--session <key>",
+                                "description": "Session key used by the journal counter"
+                            },
+                            {
+                                "flags": "--reset",
+                                "description": "Reset the tool counter before incrementing it"
+                            }
+                        ],
+                        "subcommands": []
+                    }
+                ]
+            },
             {
                 "name": "session-journal",
                 "description": "Write and read session journal entries",

package/dist/commands/core-hook-batch-command.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerCoreHookBatchCommand(core: Command): void;
+//# sourceMappingURL=core-hook-batch-command.d.ts.map

package/dist/commands/core-hook-batch-command.js

@@ -0,0 +1,27 @@
+import { resolveLiveRoot } from "../utils/hq-roots.js";
+import { describeCoreCommand } from "./core-command-catalog.js";
+import { CORE_HOOK_BATCH_HELP, runCoreHookBatchFast } from "./core-hook-batch-native.js";
+import { coreHookBatchEnabled } from "./core-hook-batch-flag.js";
+export function registerCoreHookBatchCommand(core) {
+    const group = core.command("hook-batch")
+        .description("Batch PostToolUse hook helper calls");
+    const journalDue = group.command("journal-due")
+        .description("Resolve the journal path, increment the tool counter, and return its value")
+        .requiredOption("--session <key>", "Session key used by the journal counter")
+        .option("--reset", "Reset the tool counter before incrementing it")
+        .addHelpText("after", `\n${CORE_HOOK_BATCH_HELP}`)
+        .action(async (options) => {
+        if (!await coreHookBatchEnabled()) {
+            process.stderr.write("hook-batch: journal-due requires the core-hook-batch flag\n");
+            process.exitCode = 1;
+            return;
+        }
+        const root = resolveLiveRoot({ hqRoot: core.opts().hqRoot });
+        const args = ["--session", options.session, ...(options.reset ? ["--reset"] : [])];
+        const code = runCoreHookBatchFast(args, "", process.cwd(), root);
+        if (code !== 0)
+            process.exitCode = code;
+    });
+    describeCoreCommand(journalDue, { execution: "native", root: "live" });
+}
+//# sourceMappingURL=core-hook-batch-command.js.map

package/dist/commands/core-hook-batch-flag.d.ts

@@ -0,0 +1,4 @@
+/** Default-off gate for the batched PostToolUse helper command. */
+export declare const CORE_HOOK_BATCH_FLAG = "core-hook-batch";
+export declare function coreHookBatchEnabled(): Promise<boolean>;
+//# sourceMappingURL=core-hook-batch-flag.d.ts.map

package/dist/commands/core-hook-batch-flag.js

@@ -0,0 +1,7 @@
+/** Default-off gate for the batched PostToolUse helper command. */
+export const CORE_HOOK_BATCH_FLAG = "core-hook-batch";
+export async function coreHookBatchEnabled() {
+    const { resolveProcessFlagGate } = await import("../lib/flag-registry.js");
+    return resolveProcessFlagGate(CORE_HOOK_BATCH_FLAG, { fallback: false }, () => false);
+}
+//# sourceMappingURL=core-hook-batch-flag.js.map

package/dist/commands/core-hook-batch-native.d.ts

@@ -0,0 +1,10 @@
+import { type SessionJournalOperationResult } from "./core-session-journal-native.js";
+import type { SessionHelperRuntimeOverrides } from "./core-session-helper-runtime.js";
+export declare const CORE_HOOK_BATCH_HELP = "Usage: hq core hook-batch journal-due --session <key> [--reset]\n\nRuns session-journal dir-path, tool-counter increment, and tool-counter read\ninside one process. With --reset, tool-counter reset runs before increment.\n\nOutput framing: one ASCII line per helper call, in execution order:\n  HQHB1|<step>|<exit-code>|<stdout-base64>|<stderr-base64>\nThe delimiter is |; the final newline ends each record. Base64 preserves each\nhelper stream byte-for-byte. In Bash, read each field and decode a stream with\nbase64 --decode (GNU) or base64 -D (BSD); jq is not needed. A helper's code 0\ndoes not imply empty output, and empty streams have empty base64 fields.\n";
+type BatchResult = SessionJournalOperationResult;
+/** Build the no-jq frame over the same in-process operation used by session-journal. */
+export declare function runCoreHookBatch(args: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined, dependencies?: SessionHelperRuntimeOverrides): BatchResult;
+/** Fast-route entrypoint; the encoded records are the only top-level output. */
+export declare function runCoreHookBatchFast(args: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined): number | undefined;
+export {};
+//# sourceMappingURL=core-hook-batch-native.d.ts.map

package/dist/commands/core-hook-batch-native.js

@@ -0,0 +1,85 @@
+import { runSessionJournalOperation } from "./core-session-journal-native.js";
+export const CORE_HOOK_BATCH_HELP = `Usage: hq core hook-batch journal-due --session <key> [--reset]
+
+Runs session-journal dir-path, tool-counter increment, and tool-counter read
+inside one process. With --reset, tool-counter reset runs before increment.
+
+Output framing: one ASCII line per helper call, in execution order:
+  HQHB1|<step>|<exit-code>|<stdout-base64>|<stderr-base64>
+The delimiter is |; the final newline ends each record. Base64 preserves each
+helper stream byte-for-byte. In Bash, read each field and decode a stream with
+base64 --decode (GNU) or base64 -D (BSD); jq is not needed. A helper's code 0
+does not imply empty output, and empty streams have empty base64 fields.
+`;
+function usageError() {
+    return { code: 1, stdout: Buffer.alloc(0), stderr: Buffer.from(CORE_HOOK_BATCH_HELP) };
+}
+function frame(name, result) {
+    const line = [
+        "HQHB1",
+        name,
+        String(result.code),
+        result.stdout.toString("base64"),
+        result.stderr.toString("base64"),
+    ].join("|");
+    return Buffer.from(`${line}\n`, "ascii");
+}
+function parseArgs(args) {
+    if (args.includes("--help") || args.includes("-h"))
+        return "help";
+    let session;
+    let reset = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--session") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("--"))
+                return undefined;
+            session = value;
+            index += 1;
+        }
+        else if (arg === "--reset") {
+            reset = true;
+        }
+        else {
+            return undefined;
+        }
+    }
+    if (!session)
+        return undefined;
+    return { session, reset };
+}
+function runParsedCoreHookBatch(parsed, stdin, cwd, hqRoot, dependencies) {
+    const sessionArgs = ["--session", parsed.session];
+    const steps = [
+        { name: "dir-path", args: ["dir-path"] },
+        ...(parsed.reset ? [{ name: "reset", args: ["tool-counter", "reset", ...sessionArgs] }] : []),
+        { name: "increment", args: ["tool-counter", "increment", ...sessionArgs] },
+        { name: "read", args: ["tool-counter", "read", ...sessionArgs] },
+    ];
+    const records = steps.map((step) => {
+        const result = runSessionJournalOperation(step.args, stdin, cwd, hqRoot, dependencies);
+        return frame(step.name, result);
+    });
+    return { code: 0, stdout: Buffer.concat(records), stderr: Buffer.alloc(0) };
+}
+/** Build the no-jq frame over the same in-process operation used by session-journal. */
+export function runCoreHookBatch(args, stdin, cwd, hqRoot, dependencies = {}) {
+    const parsed = parseArgs(args);
+    if (parsed === "help")
+        return { code: 0, stdout: Buffer.from(CORE_HOOK_BATCH_HELP), stderr: Buffer.alloc(0) };
+    if (!parsed)
+        return usageError();
+    return runParsedCoreHookBatch(parsed, stdin, cwd, hqRoot, dependencies);
+}
+/** Fast-route entrypoint; the encoded records are the only top-level output. */
+export function runCoreHookBatchFast(args, stdin, cwd, hqRoot) {
+    const parsed = parseArgs(args);
+    if (!parsed || parsed === "help")
+        return undefined;
+    const result = runParsedCoreHookBatch(parsed, stdin, cwd, hqRoot, {});
+    process.stdout.write(result.stdout);
+    process.stderr.write(result.stderr);
+    return result.code;
+}
+//# sourceMappingURL=core-hook-batch-native.js.map

package/dist/commands/core-repo-run-registry-native.js

@@ -131,7 +131,12 @@ export function runRepoRunRegistry(args, deps) {
                         catch { /* shell falls back to epoch zero when stat fails */ }
                         const age = Math.floor(now().getTime() / 1000) - Math.floor(mtimeMs / 1000);
                         if (age > 60) {
-                            f.rmSync(lockDir, { recursive: true, force: true });
+                            try {
+                                f.rmSync(lockDir, { recursive: true, force: true });
+                            }
+                            catch {
+                                throw new Error(`ERROR: could not remove stale registry lock: ${lockDir}`);
+                            }
                             continue;
                         }
                     }

package/dist/commands/core-session-journal-native.d.ts

@@ -1,4 +1,11 @@
 import { type SessionHelperRuntimeOverrides } from "./core-session-helper-runtime.js";
+export type SessionJournalOperationResult = {
+    code: number;
+    stdout: Buffer;
+    stderr: Buffer;
+};
+/** Execute one native helper call while retaining its two output byte streams. */
+export declare function runSessionJournalOperation(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, dependencies?: SessionHelperRuntimeOverrides): SessionJournalOperationResult;
 /** Native implementation of the fail-soft session journal helper. */
-export declare function runSessionJournalFast(args: readonly string[], _stdin: string, cwd: string, hqRoot: string | undefined, dependencies?: SessionHelperRuntimeOverrides): number;
+export declare function runSessionJournalFast(args: readonly string[], stdin: string, cwd: string, hqRoot: string | undefined, dependencies?: SessionHelperRuntimeOverrides): number;
 //# sourceMappingURL=core-session-journal-native.d.ts.map

package/dist/commands/core-session-journal-native.js

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { resolveSessionHelperRuntime } from "./core-session-helper-runtime.js";
+import { resolveBundledAsset } from "../utils/hq-roots.js";
 const USAGE = `session-journal.sh: usage:
   session-journal.sh write "<title>" [--files f1,f2,...] [--body-file PATH] [--session KEY]
   session-journal.sh list [--date YYYY-MM-DD]
@@ -94,7 +95,7 @@ function acquireJournalWriteLock(dir) {
             try {
                 fs.writeFileSync(ownerFile, `${process.pid}\n`, { flag: "wx" });
             }
-            catch (error) {
+            catch {
                 fs.rmSync(lock, { recursive: true, force: true });
                 return undefined;
             }
@@ -178,7 +179,7 @@ function options(args, valueFlags) {
     }
     return values;
 }
-function runToolCounter(root, action, sessionArg, env, now) {
+function runToolCounter(root, action, sessionArg, env, now, writers) {
     const rawKey = sessionArg || env.HQ_JOURNAL_SESSION || env.HQ_HOOK_SESSION_ID || "";
     const key = counterKey(rawKey);
     const dir = journalDir(root, now().toISOString().slice(0, 10));
@@ -188,31 +189,60 @@ function runToolCounter(root, action, sessionArg, env, now) {
     catch { /* legacy mkdir failure is ignored */ }
     const counter = path.join(dir, `.tool-count-${key}`);
     const lock = `${counter}.lock`;
+    const reportDirectoryWriteFailure = (error, line) => {
+        const code = error.code;
+        if (code !== "EISDIR")
+            return;
+        const asset = resolveBundledAsset("core/scripts/session-journal.sh");
+        writers.stderr(`${asset}: line ${line}: ${counter}: Is a directory\n`);
+    };
     if (action === "increment") {
         withCounterLock(lock, () => {
             try {
                 fs.writeFileSync(counter, `${readCounter(counter) + 1}\n`);
             }
-            catch { /* fail soft */ }
+            catch (error) {
+                reportDirectoryWriteFailure(error, 312);
+            }
         });
     }
     else if (action === "read") {
-        process.stdout.write(`${readCounter(counter)}\n`);
+        writers.stdout(`${readCounter(counter)}\n`);
     }
     else if (action === "reset") {
         withCounterLock(lock, () => {
             try {
                 fs.writeFileSync(counter, "0\n");
             }
-            catch { /* fail soft */ }
+            catch (error) {
+                reportDirectoryWriteFailure(error, 320);
+            }
         });
     }
     else {
-        warning("tool-counter: subcommand required (increment|read|reset)");
+        writers.stderr("session-journal: tool-counter: subcommand required (increment|read|reset)\n");
     }
 }
+/** Execute one native helper call while retaining its two output byte streams. */
+export function runSessionJournalOperation(args, _stdin, cwd, hqRoot, dependencies = {}) {
+    const stdout = [];
+    const stderr = [];
+    const writers = {
+        stdout: (chunk) => stdout.push(Buffer.from(chunk)),
+        stderr: (chunk) => stderr.push(Buffer.from(chunk)),
+    };
+    const code = executeSessionJournal(args, cwd, hqRoot, dependencies, writers);
+    return { code, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) };
+}
 /** Native implementation of the fail-soft session journal helper. */
-export function runSessionJournalFast(args, _stdin, cwd, hqRoot, dependencies = {}) {
+export function runSessionJournalFast(args, stdin, cwd, hqRoot, dependencies = {}) {
+    const result = runSessionJournalOperation(args, stdin, cwd, hqRoot, dependencies);
+    process.stdout.write(result.stdout);
+    process.stderr.write(result.stderr);
+    return result.code;
+}
+function executeSessionJournal(args, cwd, hqRoot, dependencies, writers) {
+    const warning = (message) => { writers.stderr(`session-journal: ${message}\n`); };
     const runtime = resolveSessionHelperRuntime(dependencies);
     const today = () => runtime.now().toISOString().slice(0, 10);
     const nowIso = () => runtime.now().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -296,8 +326,8 @@ export function runSessionJournalFast(args, _stdin, cwd, hqRoot, dependencies =
         finally {
             releaseJournalWriteLock(writeLock);
         }
-        runToolCounter(root, "reset", counterKey(session || runtime.env.HQ_JOURNAL_SESSION || runtime.env.HQ_HOOK_SESSION_ID || ""), runtime.env, runtime.now);
-        process.stdout.write(`${output}\n`);
+        runToolCounter(root, "reset", counterKey(session || runtime.env.HQ_JOURNAL_SESSION || runtime.env.HQ_HOOK_SESSION_ID || ""), runtime.env, runtime.now, writers);
+        writers.stdout(`${output}\n`);
         return 0;
     }
     if (command === "list" || command === "read" || command === "index-path" || command === "dir-path") {
@@ -306,19 +336,19 @@ export function runSessionJournalFast(args, _stdin, cwd, hqRoot, dependencies =
         const date = options(afterSequence, ["--date"]).get("--date") || today();
         const dir = journalDir(root, date);
         if (command === "dir-path") {
-            process.stdout.write(dir);
+            writers.stdout(dir);
             return 0;
         }
         if (command === "index-path") {
-            process.stdout.write(`${dir}/INDEX.md\n`);
+            writers.stdout(`${dir}/INDEX.md\n`);
             return 0;
         }
         if (command === "list") {
             const index = path.join(dir, "INDEX.md");
             if (hasFile(index))
-                process.stdout.write(fs.readFileSync(index));
+                writers.stdout(fs.readFileSync(index));
             else
-                process.stdout.write(`(no journal for ${date})\n`);
+                writers.stdout(`(no journal for ${date})\n`);
             return 0;
         }
         if (!sequence) {
@@ -339,7 +369,7 @@ export function runSessionJournalFast(args, _stdin, cwd, hqRoot, dependencies =
             }
         })();
         if (match)
-            process.stdout.write(fs.readFileSync(path.join(dir, match)));
+            writers.stdout(fs.readFileSync(path.join(dir, match)));
         else
             warning(`read: no entry ${normalized} for ${date}`);
         return 0;
@@ -347,10 +377,10 @@ export function runSessionJournalFast(args, _stdin, cwd, hqRoot, dependencies =
     if (command === "tool-counter") {
         const action = rest[0] ?? "";
         const session = options(rest.slice(1), ["--session"]).get("--session") ?? "";
-        runToolCounter(root, action, session, runtime.env, runtime.now);
+        runToolCounter(root, action, session, runtime.env, runtime.now, writers);
         return 0;
     }
-    process.stderr.write(USAGE);
+    writers.stderr(USAGE);
     return 1;
 }
 //# sourceMappingURL=core-session-journal-native.js.map

package/dist/commands/core.js

@@ -47,6 +47,7 @@ import { registerCoreRefreshVaultAccessNative } from "./core-refresh-vault-acces
 import { registerCoreWorkMeshBindTrustedNative } from "./core-work-mesh-bind-trusted-native.js";
 import { registerCoreHookHelperNativeCommands } from "./core-native-hook-helper-commands.js";
 import { registerCoreHookStateHelpers } from "./core-hook-state-helpers-native.js";
+import { registerCoreHookBatchCommand } from "./core-hook-batch-command.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -397,6 +398,7 @@ export function registerCoreCommands(program) {
     registerCoreWorkMeshBindTrustedNative(core);
     registerCoreHookHelperNativeCommands(core);
     registerCoreHookStateHelpers(core);
+    registerCoreHookBatchCommand(core);
     const sessionHelperCommands = [
         {
             name: "session-journal", asset: "core/scripts/session-journal.sh", root: "live",

package/dist/commands/daemon.js

@@ -632,7 +632,7 @@ async function runServiceSelfUpdate(d) {
         tools: TOOL_NAMES.map((name) => hostToolUpdater(name, env, d.home)),
         updateHqCloud: async () => updateManagedHqCloud(paths.root, env),
         hqCloudUnits: hqCloudUnits(detected.type, enabledServices(detected.type, readDaemonConfig(paths.configPath))),
-        requestDaemonRestart: () => writeControlRequest(paths.requestsDir, { action: "restart-daemon" }),
+        requestDaemonRestart: () => writeControlRequest(paths.requestsDir, { action: "restart-daemon", deferUntilSyncIdle: true }),
         requestRestart: (unit) => writeControlRequest(paths.requestsDir, { action: "restart", unit }),
         log: d.out,
     });

package/dist/fast-core.js

@@ -35,6 +35,11 @@ export async function runFastCore(argv) {
         const envOverride = localBooleanFlagOverride(entry.familyFlagKey, process.env);
         familyEnabled = envOverride ?? await (await import("./native-fast-route.js")).fastFlagEnabled(entry.familyFlagKey, process.env, { numericEnvironmentOverride: false });
     }
+    if (entry.kind === "native" && entry.fallbackToCommandGraph && !familyEnabled) {
+        const { runCli } = await import("./main.js");
+        await runCli();
+        return;
+    }
     const useShell = entry.kind === "native" && Boolean(entry.familyFlagKey) && !familyEnabled;
     const worktreeScopeFixEnabled = entry.name === "repo-run-registry"
         ? await (await import("./native-fast-route.js")).fastFlagEnabled(CORE_RRR_WORKTREE_SCOPE_FIX_FLAG, process.env, { numericEnvironmentOverride: false })
@@ -74,6 +79,14 @@ export async function runFastCore(argv) {
         const readsStdin = entry.readsStdinFor?.(parsed.args) ?? entry.readsStdin ?? false;
         const stdin = readsStdin ? await readStdinIfPiped(process.stdin) : "";
         const code = await handler(parsed.args, stdin, process.cwd(), hqRoot, entry.name.split(" ").at(-1) ?? entry.name, parsed.hqRootArg, worktreeScopeFixEnabled);
+        if (code === undefined) {
+            if (!entry.fallbackToCommandGraph) {
+                throw new Error(`Native fast handler ${entry.exportName} requested an unavailable command-graph fallback`);
+            }
+            const { runCli } = await import("./main.js");
+            await runCli();
+            return;
+        }
         // Let Node drain handler output before terminating. The timeout guard's
         // stderr message must survive the native route's process boundary.
         process.exitCode = code;

package/dist/fast-scaffold.d.ts

@@ -32,6 +32,8 @@ export type FastScaffoldScript = {
     familyFlagKey?: string;
     /** Shell rollback companion used while the family gate is off. */
     asset?: string;
+    /** Return to the Commander graph when this new route has no shell companion. */
+    fallbackToCommandGraph?: boolean;
     /** Root context used by the native handler. */
     root?: "live" | "cwd" | "passthrough";
     /** Cwd used for a shell rollback companion. Defaults to the caller cwd. */

package/dist/fast-scaffold.js

@@ -217,6 +217,16 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         shellHqRoot: "live",
         ...(name === "session-project" ? { readsStdin: true, readsStdinFor: (args) => args[0] === "ingest-plan" } : {}),
     })),
+    {
+        name: "hook-batch journal-due",
+        kind: "native",
+        modulePath: "./commands/core-hook-batch-native.js",
+        exportName: "runCoreHookBatchFast",
+        flagKey: "hq-core-native-fast-route",
+        familyFlagKey: "core-hook-batch",
+        root: "live",
+        fallbackToCommandGraph: true,
+    },
     ...[
         { name: "eval-trigger", modulePath: "./commands/core-eval-trigger-native.js", exportName: "runEvalTriggerFast", asset: "core/scripts/eval-trigger.sh", root: "cwd", shellCwd: "caller", shellHqRoot: "none", readsStdinFor: (args) => args[0] === "--check" },
         { name: "migrate-policy-triggers", modulePath: "./commands/core-migrate-policy-triggers-native.js", exportName: "runMigratePolicyTriggersFast", asset: "core/scripts/migrate-policy-triggers.sh", root: "live", shellCwd: "caller", shellHqRoot: "live" },

package/dist/lib/daemon/requests.d.ts

@@ -22,6 +22,7 @@ export type ControlRequest = {
 /** Restart the whole daemon, for example after the updater installed a new CLI. */
  | {
     action: "restart-daemon";
+    deferUntilSyncIdle?: boolean;
 };
 export declare function writeControlRequest(dir: string, request: ControlRequest, now?: () => number): string;
 export declare function takeControlRequests(dir: string): ControlRequest[];

package/dist/lib/daemon/requests.js

@@ -18,7 +18,7 @@ function isControlRequest(value) {
     if (v.action === "trigger" || v.action === "stop")
         return typeof v.unit === "string";
     if (v.action === "restart-daemon")
-        return true;
+        return v.deferUntilSyncIdle === undefined || typeof v.deferUntilSyncIdle === "boolean";
     if (v.action === "reconcile")
         return true;
     return false;

package/dist/lib/daemon/run.js

@@ -594,7 +594,7 @@ export async function runDaemon(opts) {
         }
     };
     // Set once the shutdown path exists below; a restart request before then is dropped.
-    let restartDaemon = () => { };
+    let restartDaemon = () => false;
     const supervisor = createSupervisor({
         machineType,
         host: opts.host,
@@ -730,12 +730,12 @@ export async function runDaemon(opts) {
         restartDaemon = () => {
             if (!restartsForParent(opts)) {
                 log("warn", "a restart was requested, but no service manager would start this daemon again; restart it yourself");
-                return;
+                return false;
             }
             if (stopping || restartPending)
-                return;
+                return true;
             restartPending = true;
-            void handoffWanted()
+            return handoffWanted()
                 .catch((err) => {
                 log("warn", `could not decide on a handoff; restarting every service: ${err.message}`);
                 return false;
@@ -745,6 +745,7 @@ export async function runDaemon(opts) {
                     handOver();
                 else
                     shutdown("restarting onto the updated CLI", RESTART_EXIT_CODE);
+                return true;
             });
         };
         process.on("SIGTERM", () => shutdown("received SIGTERM"));

package/dist/lib/daemon/succession.js

@@ -202,7 +202,7 @@ export async function stopOrphans(orphans, deps) {
         remaining = remaining.filter(same);
     }
     for (const r of remaining) {
-        deps.log("warn", `${r.id} (pid ${r.pid}) ignored SIGTERM; sending SIGKILL`);
+        deps.log("warn", `${r.id} (pid ${r.pid}) did not exit within ${graceMs / 1_000} s of SIGTERM; sending SIGKILL`);
         send(r, "SIGKILL");
     }
 }

package/dist/lib/daemon/supervisor.d.ts

@@ -26,6 +26,7 @@ import type { MachineType } from "./machine-type.js";
 import type { ControlRequest } from "./requests.js";
 import { syncPassResult } from "./sync-runner.js";
 export declare const STOP_ESCALATION_MS = 10000;
+export declare const CLI_UPDATE_SYNC_IDLE_MAX_MS: number;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
 export declare const HANDOFF_STAGGER_MS = 15000;
 /** How long a draining unit may take to finish its work before it gets SIGTERM. */
@@ -94,7 +95,7 @@ export interface SupervisorDeps {
     runInternal: (task: string) => Promise<boolean>;
     takeRequests: () => ControlRequest[];
     /** Restart the whole daemon process (a `restart-daemon` request). */
-    restartDaemon?: () => void;
+    restartDaemon?: () => void | boolean | Promise<boolean | void>;
     writeState: (state: DaemonState) => void;
     log: (level: "info" | "warn" | "error", msg: string) => void;
     now?: () => number;

package/dist/lib/daemon/supervisor.js

@@ -27,6 +27,7 @@ const BACKOFF_BASE_MS = 1_000;
 const BACKOFF_MAX_MS = 60_000;
 const HEALTHY_RUN_MS = 60_000;
 export const STOP_ESCALATION_MS = 10_000;
+export const CLI_UPDATE_SYNC_IDLE_MAX_MS = 10 * 60_000;
 const MESH_OWNER_RECHECK_MS = 15_000;
 const MESH_OWNER_LOG_INTERVAL_MS = 10 * 60_000;
 /** After a handoff, how long a replaced unit must stay up before the next one is replaced. */
@@ -61,6 +62,13 @@ export function planKey(plan, cliVersion) {
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+function lastProtocolHint(slot) {
+    if (slot.lastProtocolStatus)
+        return ` (last status: ${slot.lastProtocolStatus})`;
+    if (slot.lastProtocolLine)
+        return ` (last protocol line: ${slot.lastProtocolLine})`;
+    return "";
+}
 export function createSupervisor(deps) {
     const now = deps.now ?? Date.now;
     const setT = deps.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
@@ -81,6 +89,9 @@ export function createSupervisor(deps) {
     const live = new Set();
     let drained = null;
     let onDrained = null;
+    let deferredCliRestart = false;
+    let deferredCliRestartTimer;
+    let cliRestartInProgress = false;
     const snapshot = () => ({
         version: 1,
         pid: deps.pid,
@@ -108,6 +119,71 @@ export function createSupervisor(deps) {
             clearT(slot.heartbeatTimer);
         slot.heartbeatTimer = undefined;
     };
+    const clearDeferredCliRestart = () => {
+        deferredCliRestart = false;
+        if (deferredCliRestartTimer !== undefined)
+            clearT(deferredCliRestartTimer);
+        deferredCliRestartTimer = undefined;
+    };
+    const runDeferredCliRestart = () => {
+        if (!deferredCliRestart)
+            return;
+        clearDeferredCliRestart();
+        cliRestartInProgress = true;
+        const sync = [...slots.values()].find((slot) => slot.plan.service === "sync" && slot.child);
+        if (sync)
+            terminate(sync);
+        deps.log("info", "sync runner is between passes; restarting daemon onto the updated CLI");
+        const releaseHold = () => {
+            cliRestartInProgress = false;
+            const currentSync = [...slots.values()].find((slot) => slot.plan.service === "sync");
+            if (!currentSync)
+                return;
+            if (currentSync.child)
+                terminate(currentSync, () => activate(currentSync));
+            else
+                activate(currentSync);
+        };
+        try {
+            const result = deps.restartDaemon?.();
+            if (result === false)
+                releaseHold();
+            else if (result && typeof result === "object" && "then" in result) {
+                void Promise.resolve(result).then((accepted) => {
+                    if (accepted === false)
+                        releaseHold();
+                }).catch((err) => {
+                    deps.log("error", `CLI-update restart handoff failed: ${errorMessage(err)}`);
+                    releaseHold();
+                });
+            }
+        }
+        catch (err) {
+            deps.log("error", `CLI-update restart handoff failed: ${errorMessage(err)}`);
+            releaseHold();
+        }
+    };
+    const requestCliUpdateRestart = () => {
+        if (!deps.restartDaemon)
+            return;
+        const sync = [...slots.values()].find((slot) => slot.plan.service === "sync" && slot.child);
+        if (!sync) {
+            void deps.restartDaemon();
+            return;
+        }
+        if (sync.syncPassActive === false) {
+            deferredCliRestart = true;
+            runDeferredCliRestart();
+            return;
+        }
+        if (deferredCliRestart) {
+            deps.log("info", "coalescing CLI-update restart while waiting for sync to become idle");
+            return;
+        }
+        deferredCliRestart = true;
+        deps.log("info", "deferring CLI-update restart until sync is idle (maximum 10 minutes)");
+        deferredCliRestartTimer = setT(runDeferredCliRestart, CLI_UPDATE_SYNC_IDLE_MAX_MS);
+    };
     const setBlocked = (slot) => {
         const block = slot.plan.blocked;
         slot.state.status = block.state;
@@ -136,6 +212,12 @@ export function createSupervisor(deps) {
             then?.();
             return;
         }
+        if (slot.expectingExit) {
+            // Keep the original stop deadline and signal; only update the action
+            // that runs after exit (for example, start the changed command).
+            slot.afterExit = then;
+            return;
+        }
         slot.expectingExit = true;
         slot.afterExit = then;
         if (slot.killTimer !== undefined)
@@ -145,7 +227,7 @@ export function createSupervisor(deps) {
                 slot.killTimer = undefined;
                 if (slot.child !== child)
                     return;
-                deps.log("warn", `${slot.plan.id} ignored SIGTERM; sending SIGKILL`);
+                deps.log("warn", `${slot.plan.id} did not exit within ${STOP_ESCALATION_MS / 1_000} s of SIGTERM; sending SIGKILL${lastProtocolHint(slot)}`);
                 signalChild(slot, child, "SIGKILL");
             }, STOP_ESCALATION_MS);
         };
@@ -211,6 +293,25 @@ export function createSupervisor(deps) {
             }
             if (!event)
                 return;
+            slot.lastProtocolLine = line.length > 240 ? `${line.slice(0, 237)}...` : line;
+            if (slot.plan.service === "sync") {
+                if (event.type === "fanout-plan")
+                    slot.syncPassActive = true;
+                else if (event.type === "all-complete")
+                    slot.syncPassActive = false;
+                else if (event.type === "status" && typeof event.state === "string") {
+                    slot.lastProtocolStatus = event.state;
+                    if (event.state === "stopped" || event.state === "waiting-for-lock")
+                        slot.syncPassActive = false;
+                    else if (slot.syncPassActive === undefined && (event.state === "starting" || event.state === "running")) {
+                        // Before the first pass boundary, status heartbeats cannot prove
+                        // that startup work has not already entered a pass.
+                        slot.syncPassActive = true;
+                    }
+                }
+                if (deferredCliRestart && slot.syncPassActive === false)
+                    runDeferredCliRestart();
+            }
             const at = now();
             slot.state.lastHeartbeatAt = new Date(at).toISOString();
             const pass = syncPassResult(event, slot.state.lastHeartbeatAt);
@@ -358,6 +459,15 @@ export function createSupervisor(deps) {
     const startLong = (slot) => {
         if (stopped)
             return;
+        if (cliRestartInProgress && slot.plan.service === "sync") {
+            slot.state.status = "waiting";
+            slot.state.reason = "daemon restart pending";
+            delete slot.state.nextRunAt;
+            return;
+        }
+        delete slot.lastProtocolLine;
+        delete slot.lastProtocolStatus;
+        delete slot.syncPassActive;
         let child;
         try {
             child = deps.spawn(slot.plan);
@@ -550,7 +660,10 @@ export function createSupervisor(deps) {
                 deps.log("info", `restarting ${plan.id}: its command changed`);
                 existing.attempts = 0;
                 existing.state.restarts = 0;
-                terminate(existing, () => activate(existing));
+                if (cliRestartInProgress && plan.service === "sync")
+                    terminate(existing);
+                else
+                    terminate(existing, () => activate(existing));
             }
         }
         slots = next;
@@ -650,11 +763,19 @@ export function createSupervisor(deps) {
             return;
         }
         if (req.action === "restart-daemon") {
-            deps.log("info", "restarting the daemon (requested)");
-            if (deps.restartDaemon)
-                deps.restartDaemon();
-            else
+            if (req.deferUntilSyncIdle && deps.restartDaemon) {
+                deps.log("info", "CLI-update daemon restart requested");
+                requestCliUpdateRestart();
+            }
+            else if (deps.restartDaemon) {
+                deps.log("info", "restarting the daemon (requested)");
+                clearDeferredCliRestart();
+                void deps.restartDaemon();
+            }
+            else {
+                deps.log("info", "restarting the daemon (requested)");
                 deps.log("warn", "this daemon cannot restart itself; restart it to load the new version");
+            }
             return;
         }
         // A bot created since the last plan read is asked for before the timer
@@ -756,7 +877,11 @@ export function createSupervisor(deps) {
                 clearT(requestTimer);
             if (handoffTimer !== undefined)
                 clearT(handoffTimer);
+            clearDeferredCliRestart();
+            const childOwners = new Map();
             for (const slot of slots.values()) {
+                if (slot.child)
+                    childOwners.set(slot.child, slot);
                 clearTimer(slot);
                 clearHeartbeatTimer(slot);
                 slot.child = undefined;
@@ -784,7 +909,8 @@ export function createSupervisor(deps) {
                 }
                 const escalation = setT(() => {
                     for (const child of live) {
-                        deps.log("warn", `pid ${child.pid ?? "?"} ignored SIGTERM; sending SIGKILL`);
+                        const owner = childOwners.get(child);
+                        deps.log("warn", `${owner?.plan.id ?? `pid ${child.pid ?? "?"}`} did not exit within ${STOP_ESCALATION_MS / 1_000} s of SIGTERM; sending SIGKILL${owner ? lastProtocolHint(owner) : ""}`);
                         try {
                             child.kill("SIGKILL");
                         }
@@ -818,6 +944,7 @@ export function createSupervisor(deps) {
                 clearT(requestTimer);
             if (handoffTimer !== undefined)
                 clearT(handoffTimer);
+            clearDeferredCliRestart();
             for (const slot of slots.values()) {
                 clearTimer(slot);
                 if (slot.killTimer !== undefined)

package/dist/lib/mesh/live/daemon/run.d.ts

@@ -24,6 +24,8 @@ export declare const FLUSH_INTERVAL_MS = 10000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export declare const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 export declare const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2000;
+/** Three sequential async shutdown steps must finish within six seconds. */
+export declare const SHUTDOWN_STEP_TIMEOUT_MS = 2000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
 export declare const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**

package/dist/lib/mesh/live/daemon/run.js

@@ -45,6 +45,8 @@ export const FLUSH_INTERVAL_MS = 10_000;
 /** Keep startup recovery bounded: the next daemon start continues the backlog. */
 export const HELD_BACKFILL_STARTUP_BATCH_SIZE = 100;
 export const DEVICE_DEFAULT_MEMBERSHIP_TIMEOUT_MS = 2_000;
+/** Three sequential async shutdown steps must finish within six seconds. */
+export const SHUTDOWN_STEP_TIMEOUT_MS = 2_000;
 /** Non-zero exit reserved for CLI version drift so legacy Restart=on-failure units restart. */
 export const DAEMON_VERSION_DRIFT_EXIT_CODE = 75;
 /**
@@ -871,29 +873,48 @@ export async function runMeshDaemon(deps = {}) {
         catch {
             /* ignore */
         }
-        // Final flush, then clean MQTT DISCONNECT so the broker emits the
-        // lifecycle event; offline is published server-side only.
-        await doFlushCycle("shutdown", { force: true });
-        if (workCache) {
+        const stopStep = async (name, action) => {
+            let deadline;
+            let timedOut = false;
+            const timeout = new Promise((resolve) => {
+                deadline = timers.setTimeout(() => {
+                    timedOut = true;
+                    resolve();
+                }, SHUTDOWN_STEP_TIMEOUT_MS);
+            });
             try {
-                await workCache.stop();
+                await Promise.race([Promise.resolve().then(action), timeout]);
+                if (timedOut)
+                    log(dir, `${name} did not finish within ${SHUTDOWN_STEP_TIMEOUT_MS / 1_000} s; continuing shutdown`);
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
-                log(dir, `work cache stop error: ${msg.slice(0, 120)}`);
+                log(dir, `${name} error: ${msg.slice(0, 120)}`);
+            }
+            finally {
+                if (deadline !== undefined)
+                    timers.clearTimeout(deadline);
             }
+        };
+        // Final flush, then clean MQTT DISCONNECT so the broker emits the
+        // lifecycle event; offline is published server-side only.
+        await stopStep("shutdown flush", () => doFlushCycle("shutdown", { force: true }));
+        if (workCache) {
+            await stopStep("work cache stop", () => workCache.stop());
         }
         if (presence) {
-            try {
-                await presence.stop();
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                log(dir, `presence stop error: ${msg.slice(0, 120)}`);
-            }
+            await stopStep("presence stop", () => presence.stop());
+        }
+        try {
+            patchDaemonState(dir, { mqttState: "closed", companiesOnline: [] }, now);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(dir, `daemon shutdown state update error: ${msg.slice(0, 120)}`);
+        }
+        finally {
+            releasePidLock(dir, lockDeps);
         }
-        patchDaemonState(dir, { mqttState: "closed", companiesOnline: [] }, now);
-        releasePidLock(dir, lockDeps);
         log(dir, "daemon stopped");
     };
     const onSignal = () => {

package/dist/lib/work-context/bind-best.d.ts

@@ -41,7 +41,7 @@ export declare function discoverProjects(input: {
     env?: NodeJS.ProcessEnv;
     home?: string;
 }): CatalogProject[];
-/** discoverProjects memoized by directory mtime. A cache hit does not rescan. */
+/** discoverProjects memoized by source directory and mtime. A hit does not rescan. */
 export declare function discoverProjectsCached(input: Parameters<typeof discoverProjects>[0], nowMs?: number): CatalogProject[];
 export declare function refineProjectBinding(input: {
     hint?: string;

package/dist/lib/work-context/bind-best.js

@@ -215,14 +215,14 @@ function catalogStamp(input) {
         if (!dir)
             return "0";
         try {
-            return String(fs.statSync(dir).mtimeMs);
+            return `${dir}:${fs.statSync(dir).mtimeMs}`;
         }
         catch {
-            return "0";
+            return `${dir}:0`;
         }
     }).join("|");
 }
-/** discoverProjects memoized by directory mtime. A cache hit does not rescan. */
+/** discoverProjects memoized by source directory and mtime. A hit does not rescan. */
 export function discoverProjectsCached(input, nowMs = Date.now()) {
     const key = `${input.hqRoot ?? ""}|${input.companySlug ?? ""}|${input.companyUid ?? ""}|${input.home ?? ""}|${catalogStamp(input)}`;
     if (catalogCache && catalogCache.key === key && nowMs - catalogCache.at < CATALOG_CACHE_TTL_MS) {

package/dist/utils/vault-api.js

@@ -23,6 +23,57 @@ import { readCachedScopeUid, writeCachedScopeUid } from './secrets-cache.js';
  * whole-process watchdog.
  */
 const IDENTITY_LOOKUP_TIMEOUT_MS = 15_000;
+const LAMBDA_INVOKE_RETRY_MAX_DELAY_MS = 100;
+function isLambdaInvokeServiceError(response, bodyText) {
+    if (response.status !== 504) {
+        return false;
+    }
+    try {
+        const body = JSON.parse(bodyText);
+        return (typeof body === 'object' &&
+            body !== null &&
+            !Array.isArray(body) &&
+            Object.keys(body).length === 1 &&
+            body.message === 'Internal server error');
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchWithLambdaInvokeRetry(fetchOnce, retryEligible, signal) {
+    const first = await fetchOnce();
+    if (!retryEligible || first.status !== 504)
+        return first;
+    const bodyText = await first.text();
+    if (!isLambdaInvokeServiceError(first, bodyText)) {
+        return new Response(bodyText, {
+            status: first.status,
+            statusText: first.statusText,
+            headers: first.headers,
+        });
+    }
+    const delay = 25 + Math.floor(Math.random() * (LAMBDA_INVOKE_RETRY_MAX_DELAY_MS - 24));
+    await jitteredDelayWithAbort(delay, signal);
+    return fetchOnce();
+}
+function jitteredDelayWithAbort(ms, signal) {
+    if (signal?.aborted) {
+        return Promise.reject(signal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+    }
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal?.removeEventListener('abort', abort);
+        const timer = setTimeout(() => {
+            cleanup();
+            resolve();
+        }, ms);
+        const abort = () => {
+            clearTimeout(timer);
+            cleanup();
+            reject(signal?.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+        };
+        signal?.addEventListener('abort', abort, { once: true });
+    });
+}
 /**
  * The identity-lookup abort bound, in milliseconds. Defaults to the shipped
  * IDENTITY_LOOKUP_TIMEOUT_MS (15s). An optional HQ_IDENTITY_LOOKUP_TIMEOUT_MS
@@ -192,41 +243,40 @@ export async function vaultApiFetch(opts) {
         level: "info",
         data: { url: safeUrl, method },
     });
-    let response;
-    try {
-        response = await fetch(url.toString(), {
-            method,
-            headers: {
-                Authorization: `Bearer ${opts.token}`,
-                'Content-Type': 'application/json',
-                'x-hq-client-name': HQ_CLIENT_NAME,
-                // US-003: version alongside the client family, mirroring the desktop
-                // app's client_info.rs headers, so the server can see client-version
-                // skew on EVERY authenticated request, not only health heartbeats.
-                // Fixed build constant, never caller-supplied; attribution only.
-                'x-hq-client-version': CLI_VERSION,
-                ...opts.headers,
-            },
-            body: opts.body ? JSON.stringify(opts.body) : undefined,
-            signal: opts.signal,
-        });
-    }
-    catch (err) {
-        // A transport failure never reaches the server, so the non-2xx breadcrumb
-        // below never fires and the run's last HTTP trace is the request that
-        // silently vanished (exactly what made HQ-CLI-G's event unreadable). Leave
-        // a bounded, non-secret trail — the already-redacted safeUrl plus the
-        // recognized transport code — then RE-THROW the original error untouched,
-        // so `main.ts`'s classifier stays the single decision point.
-        const code = networkTransportErrorCode(err);
-        Sentry.addBreadcrumb({
-            category: "http",
-            message: `${method} ${path} → transport error`,
-            level: "warning",
-            data: { url: safeUrl, method, ...(code ? { code } : {}) },
-        });
-        throw err;
-    }
+    const requestInit = {
+        method,
+        headers: {
+            Authorization: `Bearer ${opts.token}`,
+            'Content-Type': 'application/json',
+            'x-hq-client-name': HQ_CLIENT_NAME,
+            // US-003: version alongside the client family, mirroring the desktop
+            // app's client_info.rs headers, so the server can see client-version
+            // skew on EVERY authenticated request, not only health heartbeats.
+            // Fixed build constant, never caller-supplied; attribution only.
+            'x-hq-client-version': CLI_VERSION,
+            ...opts.headers,
+        },
+        body: opts.body ? JSON.stringify(opts.body) : undefined,
+        signal: opts.signal,
+    };
+    const fetchWithTransportBreadcrumb = async () => {
+        try {
+            return await fetch(url.toString(), requestInit);
+        }
+        catch (err) {
+            // Keep the original transport failure and its bounded, redacted trail on
+            // both the first request and the single retry.
+            const code = networkTransportErrorCode(err);
+            Sentry.addBreadcrumb({
+                category: "http",
+                message: `${method} ${path} → transport error`,
+                level: "warning",
+                data: { url: safeUrl, method, ...(code ? { code } : {}) },
+            });
+            throw err;
+        }
+    };
+    const response = await fetchWithLambdaInvokeRetry(fetchWithTransportBreadcrumb, method.toUpperCase() === 'GET' && opts.body === undefined, opts.signal);
     if (!response.ok) {
         Sentry.addBreadcrumb({
             category: "http",
@@ -287,10 +337,10 @@ export async function vaultApiFetchPublic(opts) {
         level: 'info',
         data: { url: safeUrl, method: 'GET' },
     });
-    const response = await fetch(url.toString(), {
+    const response = await fetchWithLambdaInvokeRetry(() => fetch(url.toString(), {
         method: 'GET',
         headers: { 'Content-Type': 'application/json' },
-    });
+    }), true);
     if (!response.ok) {
         Sentry.addBreadcrumb({
             category: 'http',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.320.0",
+  "version": "5.322.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {