@indigoai-us/hq-cli 5.332.0 → 5.334.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [5.334.0] — 2026-10-03
+- Keep keep-alive audit verdicts for expired stops independent of the lane's current state, and report restarts recorded after the grace window separately.
+
+## [5.333.0] — 2026-10-03
+- Limit session-start telemetry to 30 events per machine per rolling minute.
+- Start the globally registered HQ hook with BASH_ENV cleared, so an inherited shell profile no longer runs before every hook event.
+- Report non-writable npm prefixes as informational while keeping the repair guidance visible, and attribute npm `EBUSY` update exits with a bounded class.
+
 ## [5.332.0] — 2026-10-02
 - Match macOS shell behavior in native core commands for text, diagnostics, and file modes.
 - `hq mcp status` now recognizes the real Claude plugin MCP definition and Codex PATH commands, while global and `hq-anywhere` pack installs share one Codex hook per event and one `hq` MCP server.

package/dist/command-catalog.generated.d.ts

@@ -11105,7 +11105,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "keep-alive-audit";
-        readonly description: "Audit lead lane keep-alive timing";
+        readonly description: "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;

package/dist/command-catalog.generated.js

@@ -13486,7 +13486,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "keep-alive-audit",
-                "description": "Audit lead lane keep-alive timing",
+                "description": "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,

package/dist/commands/lanes-keep-alive-audit.js

@@ -2,7 +2,7 @@ import { buildKeepAliveAudit, formatKeepAliveAuditText } from "../lib/lanes/keep
 export function registerLaneKeepAliveAuditCommand(parent, deps) {
     parent
         .command("keep-alive-audit")
-        .description("Audit lead lane keep-alive timing")
+        .description("Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.")
         .option("--since <iso>", "Include stopped turns at or after this ISO date-time")
         .option("--lane <id>", "Audit one exact lane id")
         .option("--json", "Print the report as JSON")

package/dist/lib/install/claude-targets.js

@@ -52,7 +52,7 @@ export function hookCommand(hqRoot, event, target = 'master') {
     const skipInsideRoot = `if [ -d "\${CLAUDE_PROJECT_DIR:-}" ] && [ "\${CLAUDE_PROJECT_DIR}" -ef ${shellQuote(hqRoot)} ]; then exit 0; fi; `;
     if (target === 'shim')
         return `${skipInsideRoot}exec /bin/sh ${shellQuote(shimPath(hqRoot))} ${shellQuote(event)} --runtime claude`;
-    return `${skipInsideRoot}exec bash ${shellQuote(masterHookPath(hqRoot))} ${shellQuote(event)}`;
+    return `${skipInsideRoot}BASH_ENV=/dev/null exec bash ${shellQuote(masterHookPath(hqRoot))} ${shellQuote(event)}`;
 }
 /** Quote one argument for the POSIX shell used by Claude Code command hooks. */
 function shellQuote(value) {

package/dist/lib/lanes/keep-alive-audit.d.ts

@@ -19,6 +19,7 @@ interface KeepAliveAuditSummary {
     by_verdict: Record<KeepAliveAuditVerdict, number>;
     not_restarted: number;
     restarted_untimed: number;
+    late_restarts_after_window: number;
     late_over_10m: number;
     early_wake_by_others: number;
     self_wake: number;

package/dist/lib/lanes/keep-alive-audit.js

@@ -4,7 +4,6 @@ import { LEAD_LANE_KEEP_ALIVE_BASE_BACKOFF_MS } from "./keep-alive.js";
 import { LanesError } from "./errors.js";
 import { laneRunDir } from "./spawn.js";
 import { listQuestionIds, readAllLanes, tryReadQuestion } from "./store.js";
-import { HISTORY_CAP } from "./types.js";
 function readDoneClassifications(hqRoot, laneId) {
     const root = fs.realpathSync(hqRoot);
     const watcherLog = path.join(laneRunDir(root, laneId), "logs", "watcher.out");
@@ -309,17 +308,21 @@ function firstRestartAfter(lane, stop, nextEnvelopeMs) {
         // cannot establish its launch time.
         return { at: null, trigger: "keep_alive", caller: null };
     }
-    const resumeHistory = lane.resume_history ?? [];
-    const keepAliveHistory = lane.keep_alive_history ?? [];
-    if (resumeHistory.length >= HISTORY_CAP && keepAliveHistory.length >= HISTORY_CAP) {
-        // Both append-only histories can roll this resume out. The later envelope
-        // proves a turn ran, while its trigger and launch time are no longer known.
-        return { at: null, trigger: "unknown", caller: null };
-    }
-    return null;
+    const interruptedKeepAliveResume = (lane.keep_alive_history ?? []).some((entry) => {
+        const at = parseTime(entry.at);
+        return entry.resumed_from !== "done" && at !== undefined && at > stop.mtimeMs && at < nextEnvelopeMs;
+    });
+    if (interruptedKeepAliveResume)
+        return null;
+    // A later envelope proves the stop was followed by another turn even when
+    // neither capped history has a matching entry. Report the restart as
+    // untimed instead of using the lane's mutable current state as a proxy.
+    return nextEnvelopeMs === undefined ? null : { at: null, trigger: "unknown", caller: null };
 }
 function classifyVerdict(input) {
     const { dueAt, restart, lane, nowMs } = input;
+    if (restart?.trigger === "unknown" && laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
+        return "keep_alive_off";
     if (restart) {
         if (restart.at === null)
             return "restarted_untimed";
@@ -356,7 +359,7 @@ function classifyVerdict(input) {
     }
     if (laneWasKeepAliveOffAtStop(lane, input.stoppedAt))
         return "keep_alive_off";
-    if (lane.state === "done" && nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
+    if (nowMs > dueAt + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS)
         return "not_restarted";
     return "waiting";
 }
@@ -413,8 +416,12 @@ export function buildKeepAliveAudit(input) {
     rows.sort((a, b) => a.stopped_at.localeCompare(b.stopped_at) || a.lane.localeCompare(b.lane));
     const byVerdict = Object.fromEntries(VERDICTS.map((verdict) => [verdict, 0]));
     let lateOverTenMinutes = 0;
+    let lateRestartsAfterWindow = 0;
     for (const row of rows) {
         byVerdict[row.verdict] += 1;
+        if (row.restart !== null && row.restart.at !== null && Date.parse(row.restart.at) > Date.parse(row.due_at) + KEEP_ALIVE_NOT_RESTARTED_GRACE_MS) {
+            lateRestartsAfterWindow += 1;
+        }
         if (row.verdict === "late" && row.restart !== null && row.restart.at !== null && Date.parse(row.restart.at) - Date.parse(row.due_at) > LATE_KPI_THRESHOLD_MS) {
             lateOverTenMinutes += 1;
         }
@@ -427,6 +434,7 @@ export function buildKeepAliveAudit(input) {
             by_verdict: byVerdict,
             not_restarted: byVerdict.not_restarted,
             restarted_untimed: byVerdict.restarted_untimed,
+            late_restarts_after_window: lateRestartsAfterWindow,
             late_over_10m: lateOverTenMinutes,
             early_wake_by_others: byVerdict.early_wake,
             self_wake: byVerdict.self_wake,
@@ -455,7 +463,7 @@ export function formatKeepAliveAuditText(result) {
         ...values.map(tableLine),
         "",
         `Since ${result.since}; ${counts}`,
-        `not_restarted=${result.summary.not_restarted}, late_over_10m=${result.summary.late_over_10m}, early_wake_by_others=${result.summary.early_wake_by_others}, self_wake=${result.summary.self_wake}`,
+        `not_restarted=${result.summary.not_restarted}, late_restarts_after_window=${result.summary.late_restarts_after_window}, late_over_10m=${result.summary.late_over_10m}, early_wake_by_others=${result.summary.early_wake_by_others}, self_wake=${result.summary.self_wake}`,
         `Stopped and not restarted on their own: ${result.summary.stopped_and_not_restarted_on_their_own}`,
         ...result.errors.map((error) => `Error ${error.lane} (${error.error}) at ${error.path}: ${error.message}`),
     ].join("\n");

package/dist/utils/cli-telemetry.d.ts

@@ -1,6 +1,8 @@
 import { type FirstSyncStepOutcome } from "../lib/first-sync-next-step.js";
 export { CLI_FIRST_SYNC_NEXT_STEP_FLAG, FIRST_SYNC_CONFIRMATION_COPY, FIRST_SYNC_NEXT_STEP_COPY, claimFirstSyncStepMarker, firstSyncStepMarkerPaths, firstSyncStepTelemetryProperties, isHumanInteractiveCliSession, isWorkBearingSyncResult, maybeShowFirstSyncNextStep, recordFirstWorkBearingSync, shouldConfirmFirstWorkBearingSync, shouldShowFirstSyncNextStep, takeFirstSyncStepOutcomes, type FirstSyncStepOutcome, } from "../lib/first-sync-next-step.js";
 export declare const TELEMETRY_TIMEOUT_MS = 1200;
+export declare const CLI_SESSION_STARTED_BUDGET_MAX_EVENTS = 30;
+export declare const CLI_SESSION_STARTED_BUDGET_WINDOW_MS = 60000;
 /**
  * Exact stderr line printed once on the first signed-in TTY run that is not
  * `--json`. Keep this notice and its marker stable for session telemetry;

package/dist/utils/cli-telemetry.js

@@ -9,6 +9,8 @@ import { vaultApiFetch } from "./vault-api.js";
 import { firstSyncStepTelemetryProperties, isHumanInteractiveCliSession, } from "../lib/first-sync-next-step.js";
 export { CLI_FIRST_SYNC_NEXT_STEP_FLAG, FIRST_SYNC_CONFIRMATION_COPY, FIRST_SYNC_NEXT_STEP_COPY, claimFirstSyncStepMarker, firstSyncStepMarkerPaths, firstSyncStepTelemetryProperties, isHumanInteractiveCliSession, isWorkBearingSyncResult, maybeShowFirstSyncNextStep, recordFirstWorkBearingSync, shouldConfirmFirstWorkBearingSync, shouldShowFirstSyncNextStep, takeFirstSyncStepOutcomes, } from "../lib/first-sync-next-step.js";
 export const TELEMETRY_TIMEOUT_MS = 1_200;
+export const CLI_SESSION_STARTED_BUDGET_MAX_EVENTS = 30;
+export const CLI_SESSION_STARTED_BUDGET_WINDOW_MS = 60_000;
 /**
  * Exact stderr line printed once on the first signed-in TTY run that is not
  * `--json`. Keep this notice and its marker stable for session telemetry;
@@ -25,6 +27,8 @@ const DISCLOSURE_MARKER = "cli-telemetry-disclosed";
 const FIRST_SYNC_DISCLOSURE_MARKER = "cli-telemetry-disclosed-first-sync-v1";
 const INVITE_NUDGE_DISCLOSURE_MARKER = "cli-telemetry-disclosed-invite-nudge-v1";
 const FEATURE_USED_DISCLOSURE_MARKER = "cli-telemetry-disclosed-feature-used-v1";
+const SESSION_STARTED_BUDGET_FILE = "cli-session-started-budget.json";
+const SESSION_STARTED_BUDGET_LOCK_STALE_MS = 10_000;
 let cliSessionStartedPromise;
 const pendingPlanLimitInviteTeammateExposures = [];
 const pendingCliInviteNudgeEvents = [];
@@ -236,6 +240,84 @@ function hqConfigDir() {
     const home = process.env.HOME?.trim() || os.homedir();
     return path.join(home, ".hq");
 }
+/**
+ * Limit only session-start telemetry per machine. Local state is best effort:
+ * damaged or unwritable state must never suppress the event or affect a command.
+ */
+function allowCliSessionStartedBudget(now = Date.now()) {
+    const stampPath = path.join(hqConfigDir(), SESSION_STARTED_BUDGET_FILE);
+    const lockPath = `${stampPath}.lock`;
+    let lockFd;
+    try {
+        lockFd = fs.openSync(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (!isAlreadyExistsError(error)) {
+            logSessionStartedBudgetError("acquire", error);
+            return true;
+        }
+        try {
+            const lockAgeMs = Date.now() - fs.statSync(lockPath).mtimeMs;
+            if (lockAgeMs <= SESSION_STARTED_BUDGET_LOCK_STALE_MS)
+                return false;
+            fs.unlinkSync(lockPath);
+            lockFd = fs.openSync(lockPath, "wx", 0o600);
+        }
+        catch (retryError) {
+            if (isAlreadyExistsError(retryError))
+                return false;
+            logSessionStartedBudgetError("recover", retryError);
+            return true;
+        }
+    }
+    try {
+        return recordCliSessionStartedBudget(stampPath, now);
+    }
+    finally {
+        try {
+            fs.closeSync(lockFd);
+            fs.unlinkSync(lockPath);
+        }
+        catch (error) {
+            logSessionStartedBudgetError("release", error);
+        }
+    }
+}
+function recordCliSessionStartedBudget(stampPath, now) {
+    let recent = [];
+    if (fs.existsSync(stampPath)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(stampPath, "utf8"));
+            if (Array.isArray(parsed) &&
+                parsed.every((value) => typeof value === "number" && Number.isFinite(value))) {
+                recent = parsed.filter((timestamp) => timestamp <= now && now - timestamp < CLI_SESSION_STARTED_BUDGET_WINDOW_MS);
+            }
+            else {
+                console.error("hq: Invalid CLI session telemetry budget stamp; allowing telemetry.");
+            }
+        }
+        catch (error) {
+            logSessionStartedBudgetError("read", error);
+        }
+    }
+    if (recent.length >= CLI_SESSION_STARTED_BUDGET_MAX_EVENTS)
+        return false;
+    try {
+        fs.writeFileSync(stampPath, JSON.stringify([...recent, now]), { mode: 0o600 });
+    }
+    catch (error) {
+        logSessionStartedBudgetError("write", error);
+        return true;
+    }
+    return true;
+}
+function isAlreadyExistsError(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
+}
+function logSessionStartedBudgetError(operation, error) {
+    const errorClass = error instanceof Error ? error.name : "unknown";
+    console.error(`hq: Could not ${operation} CLI session telemetry budget stamp (${errorClass}); allowing telemetry.`);
+}
 export function telemetryDisclosureMarkerPath() {
     return path.join(hqConfigDir(), DISCLOSURE_MARKER);
 }
@@ -323,6 +405,8 @@ async function emitCachedCliSessionStarted(timeoutMs) {
         const token = isMachineIdentity() ? cached.idToken : cached.accessToken;
         if (!token)
             return;
+        if (!allowCliSessionStartedBudget())
+            return;
         const disclosed = maybeDiscloseCliTelemetry();
         const consentBasis = disclosed ? "disclosed" : "no-consent";
         const controller = new AbortController();

package/dist/utils/self-update.js

@@ -842,6 +842,7 @@ const SELF_UPDATE_ERROR_CLASSES = new Set([
     "MODULE_NOT_FOUND",
     "ENOENT",
     "EACCES",
+    "EBUSY",
     "EEXIST",
     "E404",
     "EAI_AGAIN",
@@ -861,6 +862,8 @@ function selfUpdateErrorReason(code, failureKind) {
         case "EACCES":
         case "EPERM":
             return "permission_denied";
+        case "EBUSY":
+            return "resource_busy";
         case "EEXIST":
             return "file_collision";
         case "E404":

package/dist/utils/update-command-supervisor.cjs

@@ -6,6 +6,7 @@ const fs = require("node:fs");
 const KNOWN_NPM_ERROR_CODES = new Set([
   "E404",
   "EACCES",
+  "EBUSY",
   "EAI_AGAIN",
   "ECONNREFUSED",
   "ECONNRESET",

package/dist/utils/version-gate.js

@@ -507,7 +507,7 @@ export function captureNonWritableNpmPrefixNotice(input) {
     if (!claimed)
         return Promise.resolve();
     Sentry.captureMessage("Self-update deferred: npm prefix is not writable", {
-        level: "warning",
+        level: "info",
         fingerprint: ["self-update", "npm-prefix-not-writable"],
         tags: {
             from_version: input.fromVersion,
@@ -754,6 +754,7 @@ const INSTALL_DETAIL_MAX_CHARS = 400;
 const KNOWN_NPM_UPDATE_ERROR_CODES = new Set([
     "E404",
     "EACCES",
+    "EBUSY",
     "EAI_AGAIN",
     "ECONNREFUSED",
     "ECONNRESET",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.332.0",
+  "version": "5.334.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {