@indigoai-us/hq-cli 5.342.11 → 5.342.13

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## [Unreleased]
 
+## [5.342.13] — 2026-10-04
+- Run independent core migration differential cases with bounded parallel child processes while preserving per-case reports and failures.
+
+- Keep resident monitor lane delivery in-process and release the supervisor package lease after its lane-message modules preload.
+- Show `hq daemon install` or `hq daemon restart --daemon` in the runtime-health row when the Unix hqd socket is unreachable, based on whether its service is installed.
+- Run shared typecheck and lint once on pull requests while retaining the Node 20 build and test coverage leg.
+- Honor blocked lead `next_check_at` values behind the existing blocked-resume flag, and report due blocked checks in the keep-alive audit.
+- Release package-use leases for agent kit, agent MCP, mesh daemon, lanes watch and wait, and monitor hook wait only after each resident import graph loads.
+- Share one Node 22 CLI build artifact across the four e2e shards to reduce repeated build work.
+- Remove the unused remote vault database helpers. No command called them.
+- Updated semver and its type definitions, and pinned esbuild to 0.28.2.
+- Combine the live Windows pipe DACL and current-user SID inspection in one PowerShell process in the integration test.
+
+## [5.342.12] — 2026-10-04
+
+- Record every lane worker resume with its launch time and trigger, and classify watcher, monitor-event, and pending-work wakes separately from keep-alive timer accuracy.
+
+- Hand off the package-use lease through a non-JSON marker after a re-executed CLI publishes its matching lease, and forward parent-only stop signals to the child.
+
 ## [5.342.11] — 2026-10-04
 - Release the CLI package-use lease before interactive login waits after resident modules preload.
 - Show the cached version update nudge after interactive commands when a newer cached release remains and its feature flag is enabled; avoid waiting for registry readiness when there is no nudge to show or repeating guidance after the updater already reported its result.

package/dist/command-catalog.generated.d.ts

@@ -11147,7 +11147,7 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly subcommands: readonly [];
     }, {
         readonly name: "keep-alive-audit";
-        readonly description: "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.";
+        readonly description: "Audit lead lane keep-alive timing. Durable worker-resume events retain launch time and trigger after bounded lane history rolls over; late_restarts_after_window counts known launches after the grace window.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;

package/dist/command-catalog.generated.js

@@ -13537,7 +13537,7 @@ export const COMMAND_CATALOG = [
             },
             {
                 "name": "keep-alive-audit",
-                "description": "Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.",
+                "description": "Audit lead lane keep-alive timing. Durable worker-resume events retain launch time and trigger after bounded lane history rolls over; late_restarts_after_window counts known launches after the grace window.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,

package/dist/commands/agent-kit.d.ts

@@ -24,6 +24,7 @@ import { type KitLogger } from "../lib/agent-kit/log.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import { type KitService } from "../lib/agent-kit/services.js";
 import { type CronRunner, type RebootCronResult, type DetachedSpawn, type KillFn } from "../lib/agent-kit/fallback.js";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 import { type ServiceHostPaths, type ServiceManagerDeps, type ServiceSetResult } from "../lib/service-manager/index.js";
 import type { HeartbeatCredsSource } from "../lib/heartbeat-identity.js";
 export declare class KitError extends Error {
@@ -83,5 +84,6 @@ export declare function runKitService(service: KitService, rt: KitRuntime): Prom
 /** `kit run all`: supervise the kit services as child processes with restart backoff. */
 export declare function runAllKitServices(rt: KitRuntime, host: ServiceHostPaths): Promise<void>;
 export declare function formatFallbackStatus(paths: AgentKitPaths, kill?: KillFn): string[] | null;
+export declare function runAgentKitWithPackageLease<T>(run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function registerAgentKitCommand(agent: Command): void;
 //# sourceMappingURL=agent-kit.d.ts.map

package/dist/commands/agent-kit.js

@@ -33,6 +33,7 @@ import { runInboxLoop } from "../lib/agent-kit/run/inbox.js";
 import { superviseKitServices } from "../lib/agent-kit/run/supervisor.js";
 import { fallbackStatus, rebootCrontabLine, ensureRebootCrontab, shouldUseFallback, startFallback, stopFallback, } from "../lib/agent-kit/fallback.js";
 import { serviceLogPath } from "../lib/agent-kit/paths.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { spawn } from "node:child_process";
 import { pendingInbox } from "../lib/agent-kit/inbox-state.js";
 import { buildWakeNotice, clearWakeConfig, currentWakeState, DEFAULT_WAKE_RETRY_MS, describeWake, fireWake, readWakeConfig, validateWakeUrl, writeWakeConfig, } from "../lib/agent-kit/wake.js";
@@ -242,6 +243,9 @@ function fail(err) {
     console.error(chalk.red(err instanceof Error ? err.message : String(err)));
     process.exit(1);
 }
+export function runAgentKitWithPackageLease(run, options) {
+    return runResidentCommandWithPackageLease("agent-kit", run, options);
+}
 export function registerAgentKitCommand(agent) {
     const kit = agent
         .command("kit")
@@ -453,28 +457,30 @@ export function registerAgentKitCommand(agent) {
         .command("run <service>")
         .description(`Run one kit service in the foreground (${KIT_SERVICES.join("|")}), or \`all\` to supervise every service in one process`)
         .action(async (service) => {
-        if (service === "all") {
+        if (service !== "all" && !isKitService(service)) {
+            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
+            process.exit(1);
+        }
+        await runAgentKitWithPackageLease(async () => {
+            if (service === "all") {
+                try {
+                    const paths = agentKitPaths(os.homedir(), process.env);
+                    const rt = buildKitRuntime("all");
+                    await runAllKitServices(rt, resolveServiceHost(paths));
+                    process.exit(0);
+                }
+                catch (err) {
+                    fail(err);
+                }
+            }
             try {
-                const paths = agentKitPaths(os.homedir(), process.env);
-                const rt = buildKitRuntime("all");
-                await runAllKitServices(rt, resolveServiceHost(paths));
-                process.exit(0);
+                const rt = buildKitRuntime(service);
+                await runKitService(service, rt);
             }
             catch (err) {
                 fail(err);
             }
-        }
-        if (!isKitService(service)) {
-            console.error(chalk.red(`Unknown kit service "${service}". Expected one of: all, ${KIT_SERVICES.join(", ")}`));
-            process.exit(1);
-        }
-        try {
-            const rt = buildKitRuntime(service);
-            await runKitService(service, rt);
-        }
-        catch (err) {
-            fail(err);
-        }
+        });
     });
 }
 //# sourceMappingURL=agent-kit.js.map

package/dist/commands/agent-mcp.d.ts

@@ -13,6 +13,7 @@ import { McpServer } from "../lib/agent-kit/mcp/jsonrpc.js";
 import { type HqRunResult, type McpToolClients } from "../lib/agent-kit/mcp/tools.js";
 import { type AgentKitPaths } from "../lib/agent-kit/paths.js";
 import type { ExternalMachineCreds } from "../lib/agent-kit/creds.js";
+import { type ResidentCommandLeaseOptions } from "../utils/resident-package-preload.js";
 export { readBounded } from "../lib/agent-kit/attachment-download.js";
 export declare const AGENT_MCP_SERVER_NAME = "hq-agent";
 export declare const AGENT_MCP_INSTRUCTIONS: string;
@@ -20,5 +21,6 @@ export declare const HQ_SUBPROCESS_TIMEOUT_MS = 120000;
 export declare function defaultRunHq(nodeBinary: string, hqBinary: string, env: NodeJS.ProcessEnv): (args: string[]) => Promise<HqRunResult>;
 export declare function defaultMcpClients(creds: ExternalMachineCreds, credsPath: string, paths?: Pick<AgentKitPaths, "inboxDir" | "attachmentsDir">): McpToolClients;
 export declare function createAgentMcpServer(clients: McpToolClients): McpServer;
+export declare function runAgentMcpWithPackageLease<T>(run: () => Promise<T>, options?: ResidentCommandLeaseOptions): Promise<T>;
 export declare function registerAgentMcpCommand(agent: Command): void;
 //# sourceMappingURL=agent-mcp.d.ts.map

package/dist/commands/agent-mcp.js

@@ -19,6 +19,7 @@ import { buildAgentMcpTools } from "../lib/agent-kit/mcp/tools.js";
 import { readKitConfig } from "../lib/agent-kit/kit-config.js";
 import { agentKitPaths } from "../lib/agent-kit/paths.js";
 import { requireExternalCreds } from "./agent-kit.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 // Re-exported for callers that imported it from here before it moved.
 export { readBounded } from "../lib/agent-kit/attachment-download.js";
 export const AGENT_MCP_SERVER_NAME = "hq-agent";
@@ -102,26 +103,31 @@ export function createAgentMcpServer(clients) {
         tools: buildAgentMcpTools(clients),
     });
 }
+export function runAgentMcpWithPackageLease(run, options) {
+    return runResidentCommandWithPackageLease("agent-mcp", run, options);
+}
 export function registerAgentMcpCommand(agent) {
     agent
         .command("mcp")
         .description("Serve HQ as a stdio MCP server for the bot framework (whoami, search, files, secrets-exec, dm, inbox, work-mesh)")
         .action(async () => {
-        const paths = agentKitPaths(os.homedir(), process.env);
-        let creds;
-        try {
-            creds = requireExternalCreds(paths);
-        }
-        catch (err) {
-            process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
-            process.exit(1);
-        }
-        process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
-        process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
-        process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
-        const server = createAgentMcpServer(defaultMcpClients(creds, paths.machineCredsPath, paths));
-        process.stderr.write(`hq agent mcp: serving as ${creds.entityUid} (${creds.companySlug})\n`);
-        await server.serve(process.stdin, process.stdout);
+        await runAgentMcpWithPackageLease(async () => {
+            const paths = agentKitPaths(os.homedir(), process.env);
+            let creds;
+            try {
+                creds = requireExternalCreds(paths);
+            }
+            catch (err) {
+                process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(1);
+            }
+            process.env.HQ_MACHINE_CREDS_FILE = paths.machineCredsPath;
+            process.env.HQ_REQUIRE_MACHINE_IDENTITY = "1";
+            process.env.HQ_VAULT_API_URL = creds.apiBaseUrl;
+            const server = createAgentMcpServer(defaultMcpClients(creds, paths.machineCredsPath, paths));
+            process.stderr.write(`hq agent mcp: serving as ${creds.entityUid} (${creds.companySlug})\n`);
+            await server.serve(process.stdin, process.stdout);
+        });
     });
 }
 //# sourceMappingURL=agent-mcp.js.map

package/dist/commands/lanes-keep-alive-audit.js

@@ -2,7 +2,7 @@ import { buildKeepAliveAudit, formatKeepAliveAuditText } from "../lib/lanes/keep
 export function registerLaneKeepAliveAuditCommand(parent, deps) {
     parent
         .command("keep-alive-audit")
-        .description("Audit lead lane keep-alive timing. A later envelope proves another turn ran and may reclassify an expired stop as restarted_untimed when no launch record remains; late_restarts_after_window counts known launches after the grace window.")
+        .description("Audit lead lane keep-alive timing. Durable worker-resume events retain launch time and trigger after bounded lane history rolls over; late_restarts_after_window counts known launches after the grace window.")
         .option("--since <iso>", "Include stopped turns at or after this ISO date-time")
         .option("--lane <id>", "Audit one exact lane id")
         .option("--json", "Print the report as JSON")

package/dist/commands/lanes-message.d.ts

@@ -1,6 +1,24 @@
-import { type Ctx, type LaneMessageHandlerDeps, type LaneMessageOptions } from "./lanes-shared.js";
+import { type Ctx, type LaneMessageHandlerDeps, type LaneMessageOptions, type LaneMessageResponse } from "./lanes-shared.js";
+export interface MonitorLaneMessagePayload {
+    text: string;
+    monitor_id: string;
+    description: string;
+    sequence: number;
+}
+export type MonitorLaneMessageResult = {
+    ok: true;
+    response: LaneMessageResponse | undefined;
+} | {
+    ok: false;
+    error: unknown;
+    errorCode: string;
+    message: string;
+};
+export declare function parseMonitorLaneMessagePayload(input: unknown): MonitorLaneMessagePayload;
+export declare function deliverMonitorLaneMessage(ctx: Ctx, laneId: string, input: unknown, runMessage: (ctx: Ctx, laneId: string, options: LaneMessageOptions) => Promise<LaneMessageResponse | undefined>): Promise<MonitorLaneMessageResult>;
 export declare function createLaneMessageHandlers(deps: LaneMessageHandlerDeps): {
-    runMessage: (ctx: Ctx, laneId: string, opts: LaneMessageOptions) => Promise<void>;
+    runMessage: (ctx: Ctx, laneId: string, opts: LaneMessageOptions) => Promise<LaneMessageResponse | undefined>;
+    deliverMonitorLaneMessage: (ctx: Ctx, laneId: string, input: unknown) => Promise<MonitorLaneMessageResult>;
     recoverQueuedMessages: (ctx: Ctx, laneId: string) => Promise<{
         action: "none" | "resumed" | "undeliverable";
         message_count: number;

package/dist/commands/lanes-message.js

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { appendCappedHistory, appendDropboxMessage, deliveryRefusalReason, dropboxInboxPath, laneAcceptsOperatorMessage, laneDeliveryMechanism, operatorMessageRefusalReason, providerSessionPortable, providerSupportsSessionResume, readLane, sessionNotPortableMessage, validateProjectStories, withLaneAdmissionLock } from "../lib/lanes/index.js";
-import { LanesError } from "../lib/lanes/errors.js";
+import { isLanesError, LanesError } from "../lib/lanes/errors.js";
+import { CompanySelectionError } from "../utils/company-selection-error.js";
 import { parseCliEffort } from "../lib/lanes/effort.js";
 import { parseOutpostHireGrantContext, sameHireGrantSenior } from "../lib/lanes/hire-grant-dispatch.js";
 import { dispatchLaneDelivery } from "../lib/lanes/delivery-core.js";
@@ -15,6 +16,60 @@ import { readLanesRegistryFlag } from "../lib/lanes/registry-flag.js";
 import { lowDiskGuardEnabledForLane } from "../lib/lanes/disk-guard.js";
 import { resolveLaneCompany } from "../lib/lanes/lane-company.js";
 import { accountMoveSummary, accountRequestKeepsCurrentLane, assertCurrentResumeAccountAvailable, callerMatchesSessionSenior, recordedResumeEffort, resetKeepAliveProgress, resolveResumeEffort } from "./lanes-shared.js";
+export function parseMonitorLaneMessagePayload(input) {
+    let payload = input;
+    if (typeof input === "string") {
+        try {
+            payload = JSON.parse(input);
+        }
+        catch (err) {
+            throw new LanesError("monitor_lane_payload_invalid", `Monitor lane delivery payload is invalid JSON: ${err instanceof Error ? err.message : String(err)}.`, {});
+        }
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+        throw new LanesError("monitor_lane_payload_invalid", "Monitor lane delivery payload must be an object.", {});
+    }
+    const value = payload;
+    if (typeof value.text !== "string" ||
+        typeof value.monitor_id !== "string" ||
+        typeof value.description !== "string" ||
+        !Number.isInteger(value.sequence) ||
+        Number(value.sequence) < 1) {
+        throw new LanesError("monitor_lane_payload_invalid", "Monitor lane delivery payload is missing text, monitor metadata, or sequence.", {});
+    }
+    return {
+        text: value.text,
+        monitor_id: value.monitor_id,
+        description: value.description,
+        sequence: Number(value.sequence),
+    };
+}
+export async function deliverMonitorLaneMessage(ctx, laneId, input, runMessage) {
+    try {
+        const payload = parseMonitorLaneMessagePayload(input);
+        const response = await runMessage(ctx, laneId, {
+            text: payload.text,
+            monitorEvent: {
+                monitor_id: payload.monitor_id,
+                description: payload.description,
+                sequence: payload.sequence,
+            },
+            silent: true,
+        });
+        return { ok: true, response };
+    }
+    catch (error) {
+        const commandError = error instanceof CompanySelectionError
+            ? new LanesError("company_selection_failed", error.message)
+            : error;
+        return {
+            ok: false,
+            error: commandError,
+            errorCode: isLanesError(commandError) ? commandError.error : "internal",
+            message: commandError instanceof Error ? commandError.message : String(commandError),
+        };
+    }
+}
 export function createLaneMessageHandlers(deps) {
     const { archiveResumeMessage, assertLaneRunsHereForAdmission, assertLaneRunsHereForOperatorMutation, assessLaneAdmission, casUpdateLane, dispatchOutpostLaneCommand, dispatchPrimaryLaneMessage, drainHookStatusFor, laneIsHostedHere, laneWithRecoveredProviderSession, loadAllLanes, mintMessageId, persistClaudeAccountSelection, prepareAccountMove, printJson, recordResumeSetup, resolveActiveQuestionCompany, resolveResumeProfile, selectAutomaticClaudeResumeAccount, validateResumeProfileModel, withResumeHireAdmission } = deps;
     function currentSuccessorOf(lane, lanes, lineageAware, companyForLane) {
@@ -843,43 +898,45 @@ export function createLaneMessageHandlers(deps) {
                         ? `The worker has made no tool call since ${next.stalled_at ?? "an unknown time"} (${next.stalled_reason ?? "stalled"}); delivery waits on its next tool call.`
                         : null,
             ].filter((message) => message !== undefined && message !== null).join(" ") || null;
+            const response = {
+                ok: true,
+                action: "message",
+                lane_id: laneId,
+                message_id: messageId,
+                accepted: true,
+                delivered: false,
+                delivery: mechanism,
+                delivered_to: { host: lane.host.id, lane_id: laneId, mechanism },
+                delivery_status: deliveryStatus,
+                ...(queuedOnQuotaHold ? {
+                    queued_reason: "account_quota_held",
+                    quota_hold: {
+                        reason: "account_quota_held",
+                        quota_reset_at: quotaHoldDeferred?.quota_reset_at ?? null,
+                        model: quotaHoldDeferred?.model ?? null,
+                    },
+                } : {}),
+                inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
+                drain_hook: drainHook,
+                warning,
+                ...(questionCancellation === null ? {} : {
+                    cancelled_questions: questionCancellation.cancelled_question_ids,
+                    question_cancellation_failures: questionCancellation.failures,
+                }),
+                resumed_session_id: resumed?.last_resume?.session_id ?? null,
+                compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
+                    ? resumed.last_compaction
+                    : null,
+                account_move: move ? accountMoveSummary(move) : null,
+                project_id: next.project_id,
+                story_id: next.story_id,
+                stories: laneStories(next),
+                story_warning: storyWarning(next) ?? null,
+                lane: next,
+            };
             if (!opts.silent)
-                printJson({
-                    ok: true,
-                    action: "message",
-                    lane_id: laneId,
-                    message_id: messageId,
-                    accepted: true,
-                    delivered: false,
-                    delivery: mechanism,
-                    delivered_to: { host: lane.host.id, lane_id: laneId, mechanism },
-                    delivery_status: deliveryStatus,
-                    ...(queuedOnQuotaHold ? {
-                        queued_reason: "account_quota_held",
-                        quota_hold: {
-                            reason: "account_quota_held",
-                            quota_reset_at: quotaHoldDeferred?.quota_reset_at ?? null,
-                            model: quotaHoldDeferred?.model ?? null,
-                        },
-                    } : {}),
-                    inbox_path: mechanism === "dropbox" ? dropboxInboxPath(hqRoot, laneId) : null,
-                    drain_hook: drainHook,
-                    warning,
-                    ...(questionCancellation === null ? {} : {
-                        cancelled_questions: questionCancellation.cancelled_question_ids,
-                        question_cancellation_failures: questionCancellation.failures,
-                    }),
-                    resumed_session_id: resumed?.last_resume?.session_id ?? null,
-                    compaction: resumed?.last_compaction && resumed.last_compaction.resume_at === resumed.last_resume?.at
-                        ? resumed.last_compaction
-                        : null,
-                    account_move: move ? accountMoveSummary(move) : null,
-                    project_id: next.project_id,
-                    story_id: next.story_id,
-                    stories: laneStories(next),
-                    story_warning: storyWarning(next) ?? null,
-                    lane: next,
-                });
+                printJson(response);
+            return response;
         }
         catch (err) {
             if (storySwitchRollback !== undefined && !storySwitchDeliveryStarted) {
@@ -994,6 +1051,10 @@ export function createLaneMessageHandlers(deps) {
             throw err;
         }
     }
-    return { runMessage, recoverQueuedMessages };
+    return {
+        runMessage,
+        deliverMonitorLaneMessage: (ctx, laneId, input) => deliverMonitorLaneMessage(ctx, laneId, input, runMessage),
+        recoverQueuedMessages,
+    };
 }
 //# sourceMappingURL=lanes-message.js.map

package/dist/commands/lanes-shared.d.ts

@@ -60,6 +60,7 @@ export interface LaneMessageOptions {
     /** Internal recovery claim is safe to archive once this callback runs. */
     onAccepted?: () => void;
 }
+export type LaneMessageResponse = Record<string, unknown>;
 export interface LaneResumeOptions {
     text?: string;
     fromFailed?: boolean;

package/dist/commands/lanes.d.ts

@@ -6,6 +6,7 @@
  * `watch` and the monitor reminder are the line-oriented text surfaces.
  */
 import { Command } from "commander";
+import type { MonitorLaneMessagePayload, MonitorLaneMessageResult } from "./lanes-message.js";
 import { type LanesMesh, type OutpostRouteIdentity, type SpawnLoginResult } from "./lanes-shared.js";
 export type { LanesMesh, SpawnLoginResult } from "./lanes-shared.js";
 export { CLAUDE_ACCOUNT_BALANCE_SIGNALS_FLAG, LANE_OUTPOST_LOAD_BALANCING_FLAG } from "./lanes-shared.js";
@@ -105,6 +106,9 @@ export interface LanesCommandDeps {
     /** Test seam for the repository-merge-hold registry flag. */
     mergeHoldEnabled?: (company: LaneCompanyRef) => boolean | Promise<boolean>;
 }
+export type MonitorLaneMessageApi = (laneId: string, payload: MonitorLaneMessagePayload) => Promise<MonitorLaneMessageResult>;
+/** Build the same lane message handlers used by `hq lanes _monitor-message`, without a CLI process boundary. */
+export declare function createMonitorLaneMessageApi(hqRoot: string, cwd: string, env?: NodeJS.ProcessEnv): MonitorLaneMessageApi;
 export declare function parseSeniorRef(raw: string): SeniorRef;
 export declare function parseQuestionBody(raw: unknown): QuestionBody | null;
 /**

package/dist/commands/lanes.js

@@ -10,7 +10,7 @@ import { randomBytes } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { Option } from "commander";
+import { Command, Option } from "commander";
 import { createLaneAccountsHandlers } from "./lanes-accounts.js";
 import { createLaneMessageHandlers } from "./lanes-message.js";
 import { createLaneMoveHandlers } from "./lanes-move.js";
@@ -34,6 +34,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { withCliFeatureUsed } from "../utils/cli-telemetry.js";
 import { resolveLanesHqRoot } from "../lib/lanes/hq-root.js";
 import { isSsmRunCommandProcess } from "../lib/lanes/ssm-command-context.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 import { readLanesFlagLocalOverride, readLanesRegistryFlag, readLanesRegistryFlagFailOff } from "../lib/lanes/registry-flag.js";
 import { LANE_HIRE_GRANT_FINISHED_LANES_FLAG, LANE_LIST_SKIP_REMOTE_REFRESH_FLAG, LANE_MESSAGE_ROUTE_OWNER_HOST_FLAG, LANE_ORPHANED_BARE_ID_DROPBOX_REPAIR_FLAG, LANE_REUSE_REFRESHES_PROFILE_FLAG, } from "../lib/lanes/flag-keys.js";
 import { CODEX_ROLLOUT_RETENTION_FLAG, configuredCodexRolloutHomes, lowDiskGuardEnabledForLane, retainCodexRollouts } from "../lib/lanes/disk-guard.js";
@@ -90,6 +91,20 @@ const REMOTE_MIRROR_REFRESH_BATCH_SIZE = 100;
 const REMOTE_LANE_NOT_FOUND_GRACE_MS = 15 * 60_000;
 /** The lane → mesh seam. Defined in lib/lanes/mesh-events.ts; the watcher shares it. */
 export { emitLaneDecisionEvents };
+const monitorLaneMessageApis = new WeakMap();
+/** Build the same lane message handlers used by `hq lanes _monitor-message`, without a CLI process boundary. */
+export function createMonitorLaneMessageApi(hqRoot, cwd, env = process.env) {
+    const program = new Command();
+    registerLanesCommand(program, {
+        hqRoot: () => hqRoot,
+        cwd: () => cwd,
+        env: { ...env, HQ_ROOT: hqRoot },
+    });
+    const api = monitorLaneMessageApis.get(program);
+    if (!api)
+        throw new Error("Monitor lane message handler was not registered");
+    return api;
+}
 function withoutProviderHome(value) {
     if (Array.isArray(value))
         return value.map(withoutProviderHome);
@@ -8390,6 +8405,7 @@ export function registerLanesCommand(parent, deps = {}) {
         withResumeHireAdmission,
     };
     const messageHandlers = createLaneMessageHandlers(messageHandlerDeps);
+    monitorLaneMessageApis.set(parent, (laneId, payload) => messageHandlers.deliverMonitorLaneMessage(ctx, laneId, payload));
     const resumeHandlers = createLaneResumeHandlers({
         onLaneWorkerStarted: deps.onLaneWorkerStarted,
         archiveResumeMessage,
@@ -8681,13 +8697,13 @@ export function registerLanesCommand(parent, deps = {}) {
         .option("--for <change-type>", "envelope | question | state", collectRepeatable, [])
         .option("--timeout <seconds>", "Positive timeout in seconds")
         .option("--json", "JSON output")
-        .action(wrapText(async (opts) => watchHandlers.runWait(ctx, opts)));
+        .action(wrapText(async (opts) => runResidentCommandWithPackageLease("lanes-watch", () => watchHandlers.runWait(ctx, opts))));
     lanes
         .command("watch")
         .description("Watch lane state and question changes until all lanes are terminal")
         .argument("<lane-id...>", "Lane ids to watch")
         .option("--interval-ms <ms>", "Polling interval, bounded to 100ms–30s", "5000")
-        .action(wrapText(async (laneIds, opts) => watchHandlers.runWatch(ctx, laneIds, opts)));
+        .action(wrapText(async (laneIds, opts) => runResidentCommandWithPackageLease("lanes-watch", () => watchHandlers.runWatch(ctx, laneIds, opts))));
     lanes
         .command("monitor-check")
         .description("Check that active Claude senior lanes have live Monitor watch tasks")
@@ -8809,33 +8825,11 @@ export function registerLanesCommand(parent, deps = {}) {
         .command("_monitor-message", { hidden: true })
         .argument("<lane-id>", "Lane id")
         .action(wrap(async (laneId) => {
-        const input = ctx.readStdin();
-        let payload;
-        try {
-            payload = JSON.parse(input);
-        }
-        catch (err) {
-            throw new LanesError("monitor_lane_payload_invalid", `Monitor lane delivery payload is invalid JSON: ${err instanceof Error ? err.message : String(err)}.`, {});
-        }
-        if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-            throw new LanesError("monitor_lane_payload_invalid", "Monitor lane delivery payload must be an object.", {});
-        }
-        const value = payload;
-        if (typeof value.text !== "string" ||
-            typeof value.monitor_id !== "string" ||
-            typeof value.description !== "string" ||
-            !Number.isInteger(value.sequence) ||
-            Number(value.sequence) < 1) {
-            throw new LanesError("monitor_lane_payload_invalid", "Monitor lane delivery payload is missing text, monitor metadata, or sequence.", {});
-        }
-        await messageHandlers.runMessage(ctx, laneId, {
-            text: value.text,
-            monitorEvent: {
-                monitor_id: value.monitor_id,
-                description: value.description,
-                sequence: Number(value.sequence),
-            },
-        });
+        const result = await messageHandlers.deliverMonitorLaneMessage(ctx, laneId, ctx.readStdin());
+        if (!result.ok)
+            throw result.error;
+        if (result.response !== undefined)
+            printJson(result.response);
     }));
     lanes
         .command("resume")

package/dist/commands/mesh.js

@@ -56,6 +56,7 @@ import { deriveRemoteOwnerSlug, deriveRepoIdentityKey, } from "../lib/work-conte
 import { promptRepoCompany, } from "../lib/work-context/repo-prompt.js";
 import { requeueQuarantinedOutbox } from "../lib/work-context/outbox.js";
 import { handOffInstallHere } from "../lib/daemon/handoff.js";
+import { runResidentCommandWithPackageLease } from "../utils/resident-package-preload.js";
 export function formatCheckLines(threads, company, projectId) {
     if (threads.length === 0) {
         return ["Work mesh: no active project threads found."];
@@ -2108,7 +2109,7 @@ export function registerMeshCommand(program) {
         .command("run")
         .description("Start the single-instance daemon (pid lock, spool watch, presence)")
         .option("--hq-root <path>", "HQ tree root (else HQ_ROOT / persisted trusted roots); the Windows task passes this explicitly")
-        .action((opts) => wrap(() => runDaemonRun(opts))());
+        .action((opts) => wrap(() => runResidentCommandWithPackageLease("mesh-daemon", () => runDaemonRun(opts)))());
     daemon
         .command("install")
         .description("Install LaunchAgent (macOS), systemd user unit (Linux), or Scheduled Task (Windows)")

package/dist/commands/monitor.d.ts

@@ -3,6 +3,7 @@ import { Command } from "commander";
 import { drainDropboxAtPath } from "../lib/lanes/dropbox.js";
 import { recordMonitorTargetActivity, type MonitorMetadata, type MonitorState, type MonitorTarget, type MonitorProcessEntry, type MonitorRuntimeIdentity } from "../lib/monitor.js";
 import type { LaneCompanyRef, LaneProvider } from "../lib/lanes/types.js";
+import { createMonitorLaneMessageApi, type MonitorLaneMessageApi } from "./lanes.js";
 export declare function findSessionOwner(target: MonitorTarget, deps?: {
     env?: NodeJS.ProcessEnv;
     parentPid?: number;
@@ -21,13 +22,25 @@ export declare function runMonitorEnabledCommand(deps?: {
 }): Promise<number>;
 export declare function armText(meta: MonitorMetadata): string;
 export declare function resolveMonitorStartTarget(hqRoot: string, discovered: MonitorTarget, explicitlyProvided: boolean, runtime?: MonitorRuntimeIdentity): MonitorTarget;
-export declare function deliverNormalEvent(hqRoot: string, meta: MonitorMetadata, state: MonitorState, rawText: string): Promise<MonitorState>;
+export declare function invokeLaneMonitorMessage(hqRoot: string, meta: MonitorMetadata, sequence: number, text: string, inProcess?: MonitorLaneMessageApi): {
+    delivered: boolean;
+    outcome: string;
+} | Promise<{
+    delivered: boolean;
+    outcome: string;
+}>;
+export declare function deliverNormalEvent(hqRoot: string, meta: MonitorMetadata, state: MonitorState, rawText: string, inProcess?: MonitorLaneMessageApi): Promise<MonitorState>;
 export interface RunSupervisorDeps {
     resolveRoot?: () => string;
     monitorEnabled?: typeof monitorEnabled;
     deliver?: typeof deliverNormalEvent;
     spawn?: typeof spawn;
+    preloadResidentModules?: () => Promise<void>;
+    releasePackageUseLease?: () => void;
+    reportPreloadFailure?: (error: unknown) => void;
+    createLaneMessageApi?: typeof createMonitorLaneMessageApi;
 }
+export declare function preloadMonitorLaneMessageApi(hqRoot: string, meta: MonitorMetadata, deps?: Pick<RunSupervisorDeps, "preloadResidentModules" | "releasePackageUseLease" | "reportPreloadFailure" | "createLaneMessageApi">): Promise<MonitorLaneMessageApi | undefined>;
 export declare function runSupervisor(id: string, deps?: RunSupervisorDeps): Promise<void>;
 interface MonitorHookResult {
     stdout: string;